Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an instance I created from the web console, using the "Classic" wizard & the default Amazon Linux image.

When I go to Instance Actions, Connect, and select the "Connect with a standalone SSH Client" option, it has the correct string, using ec2-user@.

I saved that as an AMI, and then created a new instance via the ec2 command-line tools:

ec2-run-instances <ami> -k <my key> -g <my security group>

Now when I get the connect string, it uses root@, which doesn't work - I need to change that to ec2-user to actually connect.

This isn't a big deal, but I'm wondering why there's a difference - is there a missing parameter when I create it via the command line?

share|improve this question

ec2-user and root are two different users on the server. By default, root SSH access is not allowed per /etc/ssh/sshd_config. You could change this, of course, but it's considered a good security practice. (Root is a known, privileged account, and therefore a prime target for attackers.)

How old are your ec2 command-line tools? I'd guess that they used to allow root access previously, but no longer do that.

share|improve this answer
It's the AWS web console that's producing the root@ or ec2-user@ ssh commands, depending on whether the command line tool or the web console was used to create the instance. Tools are all up to date. – chris Oct 24 '12 at 0:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.