8

I am playing around with Amazons EC2 new free tier plan and noticed the default ubuntu install comes with a user ubuntu that is preconfigured to work with your key you are provided from AWS. One thing I would like to do is add a new user and remove the default "ubuntu" user. From my experience with other VPS (VMWare and Rackspace cloud) you only have root on your fresh install (tho that is with Red Hat and not Ubuntu).

Should I have any problems removed the default ubuntu user?

Or should I just not touch the user "ubuntu" and create a new user for my to login and do my work.

2
  • You should consider first searching for questions on pem auth/pub-priv ssh key auth, and if you don't find a satisfactory answer, then splitting them out into their own question and removing them from this one.
    – VxJasonxV
    Nov 4, 2010 at 7:32
  • Yeah I thought as I typed it last night i was asking too many questions. I removed the pem question now only on the "ubuntu" user
    – Zuhaib
    Nov 4, 2010 at 17:44

2 Answers 2

4

Of course you can remove the ubuntu user, just make sure that the new user you created is able to sudo, etc..

All in all it doesn't really matter what your users are called. Services like cloudwatch also don't log into your instance to gain vitals. The instance is a virtual environment, what Amazon exposes is available to them from the host system.

Also, I don't see this user as a security hole -- by contrast, it was added to the Ubuntu AMIs because every other AMI allows you to login with root. That's more of a security issue. ;-)

Further more, the account is protected with a private key so I don't see an issue here unless your private key is compromised. In which case you should generate a new pair on the AWS console.

If you really want another login, you could try to rename it: usermod -l NEWNAME ubuntu

4
  • Till, That is a good point if I view Ubuntu as root. Then again the first thing I do on a box is not allow root to SSH. I guess I was a little confused about how the control panel communicated with the Instance but its started to get clear. I think I will just nuke it and use my current SSH Keys with it.
    – Zuhaib
    Nov 7, 2010 at 5:59
  • Of course it's a security hole. Unless maybe you are a one man operation. If you have many people logging in using the same username, how do you audit what they are doing. If you only have experience playing with toy deployments then fine, but a real commercial site needs to be able to log who logs in. Mar 7, 2013 at 22:09
  • @BillR That's a different concern though? I'd never share the same user account among different people. But that's something you will have to setup and no one is keeping you from it. We use chef to achieve the same.
    – Till
    Mar 9, 2013 at 2:23
  • So you don't see that the ubuntu user being able to sudo without a secondary password as a security problem?
    – Sammaye
    Jan 8, 2016 at 13:07
0

Go ahead and create yourself a new user. Just make sure to put that user in the "admin" group and test logging in as that user before you blow away the 'ubuntu' user.

I haven't found any reason to keep the ubuntu user, and it strikes me as a potential security hole.

It's possible that you're cutting yourself off from other AWS tools like Cloud Watch or something else that expects the AWS sitekey to allow you to login to the box, but I don't use those services.

3
  • Security hole -- hardly? And cloudwatch logs into an instance?
    – Till
    Nov 5, 2010 at 11:12
  • Sure, ssh keys make it fairly secure. However anyone with access to my AWS login could pull those down. By changing the default login from a well known user account to something unique to my deployment, I can single out attack traffic much easier. Also managing my private keys myself instead of using a third party's keys takes away that potential for abuse.
    – Joel K
    Nov 5, 2010 at 17:14
  • Someone with access to your AWS login can't pull down your private ssh key -- it's a one-time deal, and after you've created and downloaded it it's no longer available in your AWS account.
    – Mike Scott
    Jan 20, 2014 at 18:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .