I’m connecting to an Amazon Web Service (AWS) EC2 instance in a virtual private server’s private subnet via a NAT instance and getting the following error:
Permission denied (publickey)
This is happened after I have connected to the NAT and am trying to SSH to the private subnet EC2 instance.
Procedure:
Define host in
~/.ssh/config
with the following :Host my_aws_nat Hostname xx.xx.xx.xx User ec2-user IdentityFile /location/of/my/aws/key_pair.pem ForwardAgent yes
SSH to NAT instance via
ssh my_aws_nat
(which is successful)SSH to instance in private subnet
ssh [email protected]
- which is when I get the error
I’m able to ping my private instance from my NAT with ping 10.0.X.X
. So I’m fairly sure it’s not security groups issue. It looks like it’s an agent forwarding issue.
Currently the instance I’m connecting to uses the same key pair as the NAT instance (in learning mode).
The other way I’ve tried is to connect to the NAT with:
ssh -A [email protected] -i key_pair.pem
Which again, connects correctly to the NAT but gives the same error when connecting to the private instance.
Do I have to use ssh-agent
on Mac OS X?
Or shouldn’t specifying ForwardAgent yes
in /.ssh/config
do the same thing ?