Permission denied (publickey) when SSH Access to Amazon EC2 instance

Question

I want to use my Amazon ec2 instance but faced the following error:

Permission denied (publickey).

I have created my key pair and downloaded .pem file.

Given:

chmod  600 pem file.

Then, this command

ssh -i /home/kashif/serverkey.pem  ubuntu@ec2-54-227-242-179.compute-1.amazonaws.com

But have this error:

Permission denied (publickey)

Also, how can I connect with filezilla to upload/download files?

regarding your 2nd question, connect with filezilla to upload/download files, check this out for step by step instructions - http://y2u.be/e9BDvg42-JI — Yasitha Waduge, Nov 01 '13 at 03:55
are you sure you did not use "sudo chmod 600 pem file" this would cause this error and mean that you would need to use sudo before ssh — felbus, Jun 11 '14 at 10:13
You actually want read-access only on your instance key: `chmod 400 private.pem` — Brent Faust, Jul 28 '14 at 20:23
If your username is `ec2-user`, make sure you're not using `ec2_user` :) — grisaitis, Sep 21 '15 at 17:55
Make sure the **user** as which you're trying to connect has the key listed in *his/her* `$HOME/.ssh/authorized_keys` file. — ILMostro_7, Apr 25 '16 at 11:32
What does your **sshd_config** look like? You may have needed to add `PermitRootLogin without-password PasswordAuthentication yes` to it. — IgorGanapolsky, Aug 15 '16 at 14:25
I have mistakenly deleted .ssh/authorized_keys files how can I log in again? — Kishan Mehta, Feb 05 '18 at 05:36
If AWS EC2 instance is set properly, there will be no restrictions inside ubuntu directory, read/write to home director will have Permission restrictions. — vijeth.ag, Mar 31 '18 at 06:09
Also for some Debian OS the username is `admin`. At least for 6.5 and 7.0 versions. — Developer, Jul 28 '14 at 05:46

Thibault D. · Accepted Answer · 2015-05-27T06:30:37.900

589

This error message means you failed to authenticate.

These are common reasons that can cause that:

Trying to connect with the wrong key. Are you sure this instance is using this keypair?
Trying to connect with the wrong username. ubuntu is the username for the ubuntu based AWS distribution, but on some others it's ec2-user (or admin on some Debians, according to Bogdan Kulbida's answer)(can also be root, fedora, see below)
Trying to connect the wrong host. Is that the right host you are trying to log in to?

Note that 1. will also happen if you have messed up the /home/<username>/.ssh/authorized_keys file on your EC2 instance.

About 2., the information about which username you should use is often lacking from the AMI Image description. But you can find some in AWS EC2 documentation, bullet point 4. : http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.html

Use the ssh command to connect to the instance. You'll specify the private key (.pem) file and user_name@public_dns_name. For Amazon Linux, the user name is ec2-user. For RHEL5, the user name is either root or ec2-user. For Ubuntu, the user name is ubuntu. For Fedora, the user name is either fedora or ec2-user. For SUSE Linux, the user name is root. Otherwise, if ec2-user and root don't work, check with your AMI provider.

Finally, be aware that there are many other reasons why authentication would fail. SSH is usually pretty explicit about what went wrong if you care to add the -v option to your SSH command and read the output, as explained in many other answers to this question.

edited May 27 '15 at 06:30

answered Aug 31 '13 at 21:11

Thibault D.

9,683
3
20
55

I have deleted one previous key. Now i create another. But in istance description he is displaying that this instance is using "wer'hare" key. While i have delete this key. And create "new-keys". How instance can use new key. – Kashiftufail Sep 01 '13 at 12:29
1

While i have reading if you have lost key that you generate on instance creation. Then you can create another to access your instance. – Kashiftufail Sep 01 '13 at 12:29
Well, you should never delete a key in use because the only way for you to access the machine is with this key, so you cannot add a new key in the authorizedkeys file without the old one. – Thibault D. Sep 01 '13 at 18:31
2

I don't think the interface offers you to add a key to a running instance so you will have to start a new one if you have lost the key to your running instance. – Thibault D. Sep 01 '13 at 18:32
81

#2 fixed my issue, thanks! – rckehoe Nov 04 '13 at 18:06
4

This answer solved it for me. The default username for this instance was "ubuntu", not ec2-user as it said in the AWS manual. Try using 'ec2-user@_your_EC2_IP.amazonaws.com – emf Jan 02 '14 at 07:50
1

+1 ec2-user solved it – jmoz Feb 28 '14 at 12:57
7

Regarding #1, wrong key, adding -v (verbose) to the ssh command line showed me which keys it was trying and that led me to realize it wasn't trying the key I had generated because I had named it something other than id_rsa or id_dsa. – KC Baltz May 20 '14 at 18:32
`chmod` can also cause this. I accidentally changed permissions to `root` on my `ec2-user` folder. Lol. – Adam McArthur Oct 23 '14 at 10:09
Thanks for suggesting an edit for this, but I think a user not having access to his home directory rare enough and maybe not the main reason why one gets the "permission denied (public key)" error. – Thibault D. Oct 23 '14 at 11:38
ec2-user worked for me, but how do we find out the username of instance? – Raj Pawan Gumdal Feb 23 '15 at 12:11
2

@Raj I think that information is lacking in the Image description. You can otherwise find it in AWS documentation: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.html at bullet point 4. "[...] You'll specify the private key (.pem) file and user_name@public_dns_name. For Amazon Linux, the user name is ec2-user. For RHEL5, the user name is either root or ec2-user. For Ubuntu, the user name is ubuntu. For Fedora, the user name is either fedora or ec2-user. For SUSE Linux, the user name is root. Otherwise, if ec2-user and root don't work, check with your AMI provider." – Thibault D. Feb 23 '15 at 13:26
I accidentally deleted /home//.ssh/authorized_keys is there any way to fix this? i need at least download all the files to make a backup... – Fernando Santiago Mar 17 '15 at 16:49
There's no way you can connect to your instance, that's security. But you can take an image of your instance and start a new one with the "same" EBS and a new key. – Thibault D. Mar 18 '15 at 07:08
3

"ubuntu is the username for the ubuntu based AWS distribution," This is what got me. Was used to ec2-user, just assumed that was always the username. – Nate Reed Nov 30 '15 at 15:47
Can you please help me out with the following question posted by me http://stackoverflow.com/questions/39806657 – Shivam Oct 03 '16 at 12:56
1

Just wanted to second (or third, or fourth...) the fact I did not know `ec2-user` was *not* the default username on the Ubuntu EC2 servers. – Craig Otis Dec 02 '16 at 00:57
Three years later they still haven't made this clear enough... But since then I discovered Azure's documentation and I still think AWS is much better documented. – Thibault D. Dec 02 '16 at 09:25
#2 fixed mine, AWS should really have this properly documented in their instance page. Thanks – A. K. Mar 19 '17 at 11:08
You also need make sure that the authorized_keys file has the correct permission, i.e 644. That's what fixed this issue for me – king May 17 '17 at 10:11
`/home//.ssh/authorized_keys` file solved my problem. Just copy and paste your (own laptop's) SSH key to server, in this file. – ozanmuyes Jun 07 '17 at 22:08
For me it was a `.pem` file with the correct name but somehow didn't work. After re-downloading the key file and replacing it in `~/.ssh` it worked – nickang Sep 14 '17 at 05:10

Matteo Ceserani · Answer 2 · 2014-03-12T15:23:56.510

In this case the problem arises from lost Key Pair. About this:

There's no way to change Key Pair on an instance. You have to create a new instance that uses a new Key Pair.
You can work around the problem if your instance is used by an application on Elastic Beanstalk.

You can follow these steps:

Access to AWS Management Console
Open Elastic Beanstalk Tab
Select your application from All Applications Tab
From left side menù select Configuration
Click on the Instances Gear
In Server Form check the EC2 Key Pair input and select your new Key Pair. You may have to refresh the list in order to see a new Key Pair you're just created.
Save
Elastic Beanstalk will create for you new instances associated with the new key pair.

In general, remember you have to allow your EC2 instance to accept inbound SSH traffic.

To do this, you have to create a specific rule for the Security Group of your EC2 instance. You can follow these steps.

Access to AWS Management Console
Open EC2 Tab
From Instances list select the instance you are interested in
In the Description Tab chek the name of the Security Group your instance is using.
Again in Description Tab click on View rules and check if your Security Group has a rule for inbound ssh traffic on port 22
If not, in Network & Security menù select Security Group
Select the Security Group used by your instance and the click Inbound Tab
On the left of Inbound Tab you can compose a rule for SSH inbound traffic:
- Create a new rule: SSH
- Source: IP address or subnetwork from which you want access to instance
- Note: If you want grant unlimited access to your instance you can specify 0.0.0.0/0, although Amazon not recommend this practice
Click Add Rule and then Apply Your Changes
Check if you're now able to connect to your instance via SSH.

Hope this can help someone as helped me.

The second part of your answer is wrong. You cannot get "Permission denied (publickey)." if you haven't correctly set the firewall settings (Security Groups). "Permission denied (publickey)." is an error message from SSH and is a proof that your Security Groups configuration is right. Instead, you would get "ssh: connect to host x.x.x.x port 22: Connection refused" — Thibault D., Feb 24 '14 at 09:40
Long story short: The error message tells that this issue has nothing to do with your Security Groups configuration. — Thibault D., Feb 24 '14 at 09:41
You're right. The second part treats another kind of problem. I fixed the post. — Matteo Ceserani, Mar 12 '14 at 15:22
If you lost the key I think a possible way to solve it would be to take a snapshot of the instance and then start a new one with a new key. In that case Amazon appends the new public key in .ssh/authorized_keys so make sure to remove the old one afterwards. (and be careful not to remove the new one or you're back to your first issue) — Thibault D., Nov 14 '14 at 06:58

score 43 · Answer 3 · answered Dec 23 '13 at 01:49

43

This is how I solved the problem

ssh -i <key> ec2-user@<ec2 ip>

answered Dec 23 '13 at 01:49

Deepti Kohli

1,729
1
13
6

1

It seemed the key for me here was the DNS address of the host vs IP. ec2-user@ worked for me. – Zack Aug 28 '14 at 03:00
1

Solution as well. – Tpojka Sep 19 '16 at 13:30

Wellington Lorindo · Answer 4 · 2015-10-02T12:53:45.127

26

I solved the problem just putting sudo before

sudo ssh -i mykey.pem myec2.amazonaws.com

But the proper solution is to change the ownership first, and then connect as a normal user as Janus Troelsen said below. In my case it would be:

chown wellington:wellington key.pem

edited Oct 02 '15 at 12:53

answered Nov 24 '13 at 14:05

Wellington Lorindo

2,177
15
21

Worked for me (had to update some packages after though)! – user1429980 Feb 03 '14 at 05:34
4

the proper solution is to change the ownership first, and then connect as a normal user. use `sudo chown wellington:wellington key.pem`. – Janus Troelsen Mar 12 '14 at 12:36
it is working, in your case because you are trying to login that VM at Amazon which support **root** user – Taimoor Changaiz Sep 30 '15 at 15:23
I had done whoami then sudo chown user_name_given_by_whoami xxxx.pem – Chirag Purohit Mar 28 '18 at 06:51

score 23 · Answer 5 · answered Jun 30 '14 at 13:43

23

Try using

sudo ssh -i mykey.pem ubuntu@<ec2_ip_public_dns>

OR

sudo ssh -i mykey.pem ec2-user@<ec2_ip_public_dns>

answered Jun 30 '14 at 13:43

Abhishek Gupta

3,621
20
25

score 22 · Answer 6 · answered Jul 02 '15 at 12:17

22

Another possible cause of this error:

When user's home directory is group writeable, the user cannot login.

(Reproduced on Ubuntu instance.)

answered Jul 02 '15 at 12:17

Stepan

876
8
9

1

+1 Wish I had read this 4 hours ago!!! Solved my issue where rsync -a was overwriting the permission of my ec2-user folder. – Michael Hobbs Nov 25 '15 at 19:33
After I mv my home directory, I couldn't login. – Robert Moon Jan 12 '16 at 13:41
So how do you login on a machine that's thus affected, and you cannot login to it at all? – PKHunter Feb 09 '16 at 10:14
Fix permissions on /home directory works for me too, thanks! @AlexPetralia, your link is broken =/ but has a post in aws forum talking about this: https://forums.aws.amazon.com/message.jspa?messageID=334402 – Liko Mar 30 '16 at 22:01
Can someone like Alex Petralia or @Michael Hobbs repost (or restate) the solution to this? – Jakub Langr Apr 06 '16 at 13:37
@JakubLangr chmod 755 on the users home directory – Michael Hobbs Apr 20 '16 at 22:49
Can you please help me out with the following question posted by me stackoverflow.com/questions/39806657 – Shivam Oct 03 '16 at 12:59

score 7 · Answer 7 · answered Mar 10 '14 at 20:51

7

for the ubuntu 12.04 lts micro instance i had to set the user name as option

ssh -i pemfile.pem -l ubuntu dns

answered Mar 10 '14 at 20:51

dc10

1,944
5
26
43

this worked for me, i'm surprised it is not part of the aws documentation to actually discuss users that may be required. – Ben May 08 '14 at 00:55

score 7 · Answer 8 · edited Mar 11 '17 at 11:03

7

You need to do the following steps:

Open your ssh client or terminal if you are using Linux.
Locate your private key file and change your directory.
cd <path to your .pem file>
Execute below commands:
chmod 400 <filename>.pem
ssh -i <filename>.pem ubuntu@<ipaddress.com>

If ubuntu user is not working then try with ec2-user.

edited Mar 11 '17 at 11:03

M. K. Hunter

1,622
3
19
27

answered Mar 11 '17 at 02:11

Rabinarayan Panigrahi

149
2
7

Ben Paz · Answer 9 · 2015-06-19T16:33:58.633

I struggled with the same permission denied error apparently due to

key_parse_private2: missing begin marker

In my situation the cause was the ssh config file of the current user (~/.ssh/config).

Using the following:

ssh -i ~/myKey.pem ec2-user@<IP address> -v 'exit'

The initial output showed:

debug1: Reading configuration data /home/ec2-user/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug1: Hostname has changed; re-reading configuration
debug1: Reading configuration data /home/ec2-user/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config

... many debug lines cut here ...

debug1: Next authentication method: publickey
debug1: Trying private key: /home/ec2-user/somekey.pem
debug1: key_parse_private2: missing begin marker
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.

The third line above is where the problem actual was identified; however, I looked for at the debug message four lines from the bottom (above) and was misled. There isn't a problem with the key but I tested it and compared other configurations.

My user ssh config file reset the host via an unintended global setting as shown below. The first Host line should not have been a comment.

$ cat config
StrictHostKeyChecking=no
#Host myAlias
        user ec2-user
        Hostname bitbucket.org
#        IdentityFile ~/.ssh/somekey
#        IdentitiesOnly yes

Host my2ndAlias
        user myOtherUser
        Hostname bitbucket.org
        IdentityFile ~/.ssh/my2ndKey
        IdentitiesOnly yes

I hope someone else finds this helpful.

score 4 · Answer 10 · answered Mar 31 '16 at 08:42

4

I forgot to add the username (ubuntu) when connecting my Ubuntu instance. So I tried this:

ssh -i /path/my-key-pair.pem my-ec2-instance.amazonaws.com

and the correct way was

ssh -i /path/my-key-pair.pem ubuntu@my-ec2-instance.amazonaws.com

answered Mar 31 '16 at 08:42

JohnP

956
2
13
26

Legit beginner error. If you forget to add the username, then it will use the username of user you are logged in with in your local computer. – Thibault D. Apr 05 '16 at 13:45

score 3 · Answer 11 · answered Jan 14 '14 at 15:42

This has happened to me multiple times. I have used Amazon Linux AMI 2013.09.2 and Ubuntu Server 12.04.3 LTS which are both on the free tier.

Every time I have launched an instance I have permission denied show up. I haven't verified this but my theory is that the server is not completely set up before I try to ssh into it. After a few tries with permission denied, I wait a few minutes and then I am able to connect. If you are having this problem I suggest waiting five minutes and trying again.

score 2 · Answer 12 · answered Mar 17 '14 at 01:51

Here is a possible frustrating scenarios that produces this error:

If you are lunching a new instance from an AMI you created of another instance (say instance xyz), then the new instance will only accept the same key that instance A used. This is totally understandable but it gets confusing because during the step by step process of creating the new instance, you are asked to select or create a key (at the very last step) which will not work.

Regardless of the key you create or select, only the key you were using for instance XYZ will will be accepted by the new instance.

It usually appends the new public key to the authorized_keys file, hence making both usable. It's been a while since I tested though, but that's what I would expect to happen. — Thibault D., Sep 20 '15 at 11:16

score 2 · Answer 13 · answered Apr 22 '15 at 14:06

2

I struggled with this for a while too until I found the following:

eb ssh

When you use that from the project directory, bingo-bango no muss no fuss, you're in

answered Apr 22 '15 at 14:06

JedA

109
1
4

score 2 · Answer 14 · answered Aug 18 '15 at 20:59

2

In my own case, i did the following:

chmod 400 <key.pem>

ssh -i <key.pem> ec2-user@ec2_public_dns (for debian)

I was initially using root@ part and i got this prompt:

Please login as the user "ec2-user" rather than the user "root".

answered Aug 18 '15 at 20:59

AJNinja

131
15

score 2 · Answer 15 · edited May 23 '17 at 12:34

2

I'm in Windows with WinSCP. It works great on both File Explorer and PuTTY SSH Shell to access my Amazon EC2-VPC Linux. There is nothing to do with chmod pem file as it uses myfile.ppk converted by PuTTYgen from the pem file.

edited May 23 '17 at 12:34

Community

1
1

answered Jul 17 '16 at 00:38

Chetabahana

7,806
2
50
70

score 2 · Answer 16 · answered Nov 11 '17 at 21:33

2

same thing happened to me, but all that was happening is that the private key got lost from the keychain on my local machine.

ssh-add -K

re-added the key, then the ssh command to connect returned to work.

answered Nov 11 '17 at 21:33

eiTan LaVi

2,359
20
14

It happens every single time after restart and i need to re-run above command any workaround for this. – silentsudo Jan 04 '18 at 11:40
1

haven't verified this myself, but the verified answer here might help: https://apple.stackexchange.com/questions/254468/macos-sierra-doesn-t-seem-to-remember-ssh-keys-between-reboots – eiTan LaVi Jan 16 '18 at 13:52

score 1 · Answer 17 · edited May 11 '15 at 14:08

1

This issue can be solved by login into Ubuntu box using below command:

ssh -i ec2key.pem ubuntu@ec2-public-IP

edited May 11 '15 at 14:08

Arslan Ali

16,294
7
51
65

answered Dec 03 '14 at 09:28

Prajith

19
1

1

Please Give some details. – Syeda Zunaira Dec 03 '14 at 09:32

score 1 · Answer 18 · answered Nov 01 '15 at 23:18

I've twice had keys and ssh command line correct (I know because I'm duplicating a working Ubuntu 14.04 instance), but just not been able to ssh into a new instance, even after waiting 5 minutes as suggested by Wade Anderson above.

I had to destroy and re-create the machine. This has happened on two separate occasions. Since I can't get in initially, I can't see what's wrong.

So, if you have this problem, try that.

score 1 · Answer 19 · answered Oct 01 '16 at 14:19

you must check these few things:

Make sure your IP address is correct
Make sure you are using the correct Key
Make sure you are using the correct username, you can try: 3.1. admin 3.2. ec2-user 3.3. ubuntu

I had the same problem, and it solved after I changed username to ubuntu. In AWS documentation was mentioned to user ec2-user but somehow does not work for me.

score 1 · Answer 20 · answered Oct 26 '16 at 09:16

My private key was set to permission 400 and was resulting in Permission denied setting it to '644' helped me .

key_load_private_type: Permission denied is the specific error I was getting

Solution: Sudo chmod 644 <key.pem>

Note: set to 644 is must, it was not working with 400

score 1 · Answer 21 · answered Apr 06 '17 at 02:52

1

When you try doing

ssh -i <.pem path> root@ec2-public-dns

You get a message advising you to use the ec2-user.

Please login as the user "ec2-user" rather than the user "root".

So use

ssh -i <.pem path> ec2-user@ec2-public-dns

answered Apr 06 '17 at 02:52

Jerome Anthony

7,203
2
36
26

score 1 · Answer 22 · answered May 03 '17 at 11:24

I had same problem and its very strange. If you believe you are doing all good than follow this: Some times there is confusion about user for the EC2 instance!! Some times you get ec2-user, ubuntu, centos etc. So check your username for the machie!!

Login with root user ssh -i yourkey.pem (400 permission) root@<ip> It will throw error and will give you the available username. then login with that user.

score 1 · Answer 23 · answered Jun 08 '17 at 14:35

It's a basic thing, but always confirm which user you are trying to do the login. Im my case was just a distraction. I was trying using a root user:

ssh -i ~/keys/<key_name> root@111.111.111.111

But was another user:

ssh -i ~/keys/<key_name> dedeco@111.111.111.111

Azriel · Answer 24 · 2017-12-26T21:52:29.753

i had same error but different situation. to me it happened out of the blue after a lot of time i could ssh successfully to my remote computer out there. after a lot of searching the solution to my problem were file permissions. it is strange of course because i didn't change any permissions in my computer or the remote one belonging to the ssh's files/directories. so from the good archlinux wiki here it is:

For the local machine do this:

$ chmod 700 ~/
$ chmod 700 ~/.ssh
$ chmod 600 ~/.ssh/id_ecdsa

For the remote machine do that:

$ chmod 700 ~/
$ chmod 700 ~/.ssh
$ chmod 600 ~/.ssh/authorized_keys

after that my ssh started to working again without the permission denied (publickey) thing.

score 0 · Answer 25 · answered Jan 27 '18 at 21:41

Another Possible Issue: Wrong login ID

Check 'Usage Instructions'

All good suggestions above, but what I ran into was that I selected a pre-made instance. After the instance has started , look at the usage instructions. I incorrectly used login id of the private key when in the instructions I was supposed to use 'bitnami' (e.g. bitnami@domain -i key.pem)

score 0 · Answer 26 · answered Apr 05 '18 at 08:48

I had similar error

debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: xxxx.pem
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).

My problem was that the instance did not start properly due to error on the run-on-start-up script from Step 3: Configure instance detail under Advanced details:

What I thought I entered:

#include  https://xxxx/bootstrap.sh 

What actually entered breaks the instance setup

#include

https://xxxx/bootstrap.sh

So the public key on instance side was not created

score 0 · Answer 27 · answered Apr 25 '18 at 00:38

0

It's case sensitive.

Wrong : SSH EC2-user@XXX.XX.XX.XX -i MyEC2KeyPair.pem

Correct : SSH ec2-user@XXX.XX.XX.XX -i MyEC2KeyPair.pem

answered Apr 25 '18 at 00:38

Tanmay

315
1
5
12

score -1 · Answer 28 · answered Aug 09 '17 at 20:12

I was able to SSH from one machine, but not from another. Turns out I was using the wrong private key.

The way I figured this out was by getting the public key from my private key, like this:

ssh-keygen -y -f ./myprivatekey.pem

What came out didn't match what was in ~/.ssh/authorized_keys on the EC2 instance.

score -1 · Answer 29 · answered Apr 02 '18 at 20:21

-1

All of the top ranked answers above are accurate and should work for most cases. In the event that they don't as was in my case, I simply got rid of my ~/.ssh/known_hosts file on the machine I was trying to ssh from and that solved the problem for me. I was able to connect afterwards.

answered Apr 02 '18 at 20:21

pbegle

438
6
12

While deleting `known_hosts` can solve a problem when connecting to server that has changed its host key (while it's a bad approach anyway), I'm pretty sure it cannot solve *"Permission denied (publickey)"* error. – Martin Prikryl Apr 03 '18 at 06:02

Permission denied (publickey) when SSH Access to Amazon EC2 instance

29 Answers29

Linked