0

I have two instances running on my aws. I have the same keypair for both of them. I was using both instances for long time. but today I am getting an error on one instance while trying to login through terminal if I run this command.

ssh -i mypem.pem ec2-user@52.xx.xxx.xxx
Permission denied (publickey).

But If I try to login to other instance with the same pem file. It works and I can successfully login to it.

I have tried all the solutions which presented here

Permission denied (publickey) when SSH Access to Amazon EC2 instance

Trying to SSH into an Amazon Ec2 instance - permission error

But nothing works for me

If I do this 

ssh -i mypem.pem ec2-user@52.xx.xxx.xxx -vvv

The result is this

    OpenSSH_7.4p1, LibreSSL 2.5.0
debug1: Reading configuration data /etc/ssh/ssh_config
debug2: resolving "52.xx.xxx.xxx" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 52.xx.xxx.xxx [52.xx.xxx.xxx] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file mypem.pem type -1
debug1: key_load_public: No such file or directory
debug1: identity file mypem.pem-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 52.xx.xxx.xxx:22 as 'ec2-user'
debug3: hostkeys_foreach: reading file "/Users/myusername/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/myusername/.ssh/known_hosts:6
debug3: load_hostkeys: loaded 1 keys from 52.xx.xxx.xxx
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: mykeyhere
debug3: hostkeys_foreach: reading file "/Users/myusername/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/myusername/.ssh/known_hosts:6
debug3: load_hostkeys: loaded 1 keys from 52.70.181.239
debug1: Host '52.xx.xxx.xxx' is known and matches the ECDSA host key.
debug1: Found key in /Users/irfansheikh/.ssh/known_hosts:6
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: mypem.pem (0x7f9053c03750), agent
debug2: key: mypem.pem (0x0), explicit
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: bringthings.pem
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug1: Trying private key: mypem.pem
debug3: sign_and_send_pubkey: RSA 
SHA256:keyhere**********
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).

What I have tried

chmod 400 mypem.pem

I have also tried this 

sudo ssh -i mypem.pem ec2-xxx-xxx-xxx-xxx.us-west 2.compute.amazonaws.com

Got this

Please login as the user "ec2-user" rather than the user "root"

then I did this

sudo ssh -i mypem.pem ec2-xxx-xxx-xxx-xxx.us-west-2.compute.amazonaws.com -l ec2-user

I got 

Permission denied (publickey)

If I try to login to other instance with the same key. I can successfully login. Please help what actually went wrong here

Security Group on my instance is this

enter image description here

user1hjgjhgjhggjhg
  • 1,027
  • 3
  • 12
  • 27
  • Are they both AWS Linux instances? If not, the username will be different (for Ubuntu instances, for example, it's "ubuntu" and not "ec2-user"). – kdgregory Apr 21 '18 at 12:29
  • And have you _ever_ been able to log into the second instance? If yes, is it possible that you did something that changed `.ssh/authorized_keys`? – kdgregory Apr 21 '18 at 12:29
  • The other instance has the username ubuntu but this instance has ec2-user.. and yes i can successfully login to other instance – user1hjgjhgjhggjhg Apr 21 '18 at 12:38
  • everything was working fine till night. when I wake up it stopped working. so no I didn't do anything – user1hjgjhgjhggjhg Apr 21 '18 at 12:38

4 Answers4

1

The issue is because of using different public keys and for solving this issue :-

Just create a public key with your private key that is mypem.pem file like below:-

ssh-keygen -y -f mypem.pem

It will create and display a public key for the private key You just want to copy this key into your aws instance like below :-

If you are running an ubuntu instance open the authorized_keys file and paste the generated public key into that file (delete the existing content):-

vi ~/.ssh/authorized_keys

Then try to connect with below command :-

ssh -i mypem.pem ec2-user@52.xx.xxx.xxx

or

ssh -i mypem.pem ubuntu@52.xx.xxx.xxx

Muhammed Fasil
  • 5,710
  • 1
  • 12
  • 23
0

Troubleshooting connection to ec2: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.html

You can try also a triple verbose option -vvv

I used to have same errors from time to time,usually i was using ec2-user instead of ubuntu or wrong key

Vladyslav Didenko
  • 579
  • 8
  • 15
0

You can try -vvv option as suggested already and try to see if you get more information about the reason why the SSH is failing.

If it still is unclear, the only option is to detach the volume from the current instance and attaching it to an another EC2 instance, mounting the volume and checking the following log files for any error messages :-

/var/log/messages
/var/log/secure

You can use the following links for reference on how to detach and attach the volume to another EC2 instance :-

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-detaching-volume.html 
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-attaching-volume.html

While detaching and attaching, keep a note of the device names of the volumes like /dev/xvda or /dev/sda1. It's quite annoying if you miss out the first time and then again you have to repeat the whole detach and attach process.

There can be several reasons for the error here. For example, if somehow the permissions for the /home/ec2-user/.ssh folder or any files present on it were incorrectly set during the last time before server was shut down, the command won't be able to read the files and hence fail. Generally, the errors logged in the log files are helpful and able to provide the cause of in the inaccessibility.

One thing that I would like to point out is that there are two key pair names that you are tyring to use : amazonec2.pem and mypem.pem. When using mypem.pem, you mentioned the username : ec2-user along with the IP address in SSH command. However, when you used amazonec2.pem, it was missing from the command!

Please note that if the username is not present, the command would actually fail giving the same Permission denied (publickey). error. I tried to SSH into my EC2 instance without mentioning the username and it failed.

Hope this helps.

Crazy Psychild
  • 552
  • 5
  • 15
  • sorry "amazonec2.pem and mypem.pem" these were just a typo error. I am using the same mypem.pem on everywhere – user1hjgjhgjhggjhg Apr 21 '18 at 09:00
  • Then, you have to analyze the log files, what does the `-vvv` output of ssh say, you can update the output here so that everyone can see and help if they have a hint! – Crazy Psychild Apr 21 '18 at 09:16
0

In my case, I typed in the incorrect passphrase multiple times. After which I kept getting Permission denied continuously. I rebooted my AWS instance and tried the same credentials which worked.

alif
  • 645
  • 9
  • 10