Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am playing around with Amazons EC2 new free tier plan and noticed the default ubuntu install comes with a user ubuntu that is preconfigured to work with your key you are provided from AWS. One thing I would like to do is add a new user and remove the default "ubuntu" user. From my experience with other VPS (VMWare and Rackspace cloud) you only have root on your fresh install (tho that is with Red Hat and not Ubuntu).

Should I have any problems removed the default ubuntu user?

Or should I just not touch the user "ubuntu" and create a new user for my to login and do my work.

share|improve this question
    
You should consider first searching for questions on pem auth/pub-priv ssh key auth, and if you don't find a satisfactory answer, then splitting them out into their own question and removing them from this one. –  VxJasonxV Nov 4 '10 at 7:32
    
Yeah I thought as I typed it last night i was asking too many questions. I removed the pem question now only on the "ubuntu" user –  Zuhaib Nov 4 '10 at 17:44

2 Answers 2

up vote 1 down vote accepted

Of course you can remove the ubuntu user, just make sure that the new user you created is able to sudo, etc..

All in all it doesn't really matter what your users are called. Services like cloudwatch also don't log into your instance to gain vitals. The instance is a virtual environment, what Amazon exposes is available to them from the host system.

Also, I don't see this user as a security hole -- by contrast, it was added to the Ubuntu AMIs because every other AMI allows you to login with root. That's more of a security issue. ;-)

Further more, the account is protected with a private key so I don't see an issue here unless your private key is compromised. In which case you should generate a new pair on the AWS console.

If you really want another login, you could try to rename it: usermod -l NEWNAME ubuntu

share|improve this answer
    
Till, That is a good point if I view Ubuntu as root. Then again the first thing I do on a box is not allow root to SSH. I guess I was a little confused about how the control panel communicated with the Instance but its started to get clear. I think I will just nuke it and use my current SSH Keys with it. –  Zuhaib Nov 7 '10 at 5:59
    
Of course it's a security hole. Unless maybe you are a one man operation. If you have many people logging in using the same username, how do you audit what they are doing. If you only have experience playing with toy deployments then fine, but a real commercial site needs to be able to log who logs in. –  BillR Mar 7 '13 at 22:09
    
@BillR That's a different concern though? I'd never share the same user account among different people. But that's something you will have to setup and no one is keeping you from it. We use chef to achieve the same. –  Till Mar 9 '13 at 2:23

Go ahead and create yourself a new user. Just make sure to put that user in the "admin" group and test logging in as that user before you blow away the 'ubuntu' user.

I haven't found any reason to keep the ubuntu user, and it strikes me as a potential security hole.

It's possible that you're cutting yourself off from other AWS tools like Cloud Watch or something else that expects the AWS sitekey to allow you to login to the box, but I don't use those services.

share|improve this answer
    
Security hole -- hardly? And cloudwatch logs into an instance? –  Till Nov 5 '10 at 11:12
    
Sure, ssh keys make it fairly secure. However anyone with access to my AWS login could pull those down. By changing the default login from a well known user account to something unique to my deployment, I can single out attack traffic much easier. Also managing my private keys myself instead of using a third party's keys takes away that potential for abuse. –  Joel K Nov 5 '10 at 17:14
    
Someone with access to your AWS login can't pull down your private ssh key -- it's a one-time deal, and after you've created and downloaded it it's no longer available in your AWS account. –  Mike Scott Jan 20 at 18:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.