1

I'm working with Apache on an ec2 box. I'm trying to generate keys for a user, apache on the system.

However, I don't have permission, because it's ec2. So, I sudo - and get asked for a password for sudo apache. I have no password. I can not set a password.

I use keys to access the systems via these users.

How on earth am I meant to generate a key for apache to use?

2 Answers 2

2

Keys are associated with users by storing them in the authorized_keys file in the .ssh directory of the user's home folder.

  • Generate your key using ec2-create-keypair
  • Save the private key (and move it off the server)
  • Sudo to root (either preface the following commands with sudo, or try sudo -i) - on Amazon's Linux AMI you do not need a password (I don't know what AMI you are using).
  • Append the public key to the /users/home/folder/.ssh/authorized_keys file.
    • If the .ssh folder doesn't exist, create it (mkdir /users/home/folder/.ssh) and set permissions to 700.
    • If the file (authorized_keys) does not exist, you can simply move the public key created by ec2-create-keypair to the correct folder (and rename it authorized_keys). Permissions should be set to 600 or less.
    • If there is already an authorized_keys file, append to it, using something like cat ec2_public_key.pub >> /users/home/folder/.ssh/authorized_keys

The key is associated with the user by virtue of the fact it is within the user's home folder, and accessible only by that user. You may also need to permit SSH access for the specified user in etc/ssh/sshd_config as well as to change the shell associated with that user.

2
  • Thanks for this particularly helpful guide. I've certainly got further. But, I'm not constantly getting asked for passphrase, which my normal one doesn't work. Just as a side note, I didn't have a home dir for apache. So have created one and chown'd chmod'd as appropriate - I'm getting further here by trying logged into bash and then php -a > still doesnt seem to work in script. But, I can come to that.
    – waxical
    Nov 8, 2011 at 9:21
  • You shouldn't be asked for a passphrase if you didn't set one - ideally, you should pipe the output of the command directly to file to avoid any stray characters. Also, if you are just trying to setup user accounts on the one machine, you can use ssh-keygen instead of the ec2 command (the difference being that the keypair won't be registered with AWS). I don't think you mentioned why you were trying to login as Apache - offhand, it seems like an unusual task.
    – cyberx86
    Nov 8, 2011 at 19:29
0

As described in the manual: http://docs.amazonwebservices.com/AWSEC2/latest/CommandLineReference/ApiReference-cmd-CreateKeyPair.html

1
  • Hmm, this is for creating a generic key pair. Not one attached to a particular user, no? I mean, I have a pem file it can use. This is coming from the fact that apache user is not able to ssh. Ah I dunno. Round in circles. Thanks.
    – waxical
    Nov 7, 2011 at 18:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .