Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am not able to scp from one EC2 instance to another EC2 instance. From my laptop I am able to ssh into each instance without issues.

I have two instances.

#worker1
ec2-107-20-7-57.compute-1.amazonaws.com

#master
ec2-50-19-8-109.compute-1.amazonaws.com

Here is what I have done so far.

I made a new key pair on the master node ssh-keygen -t dsa

I copy-and-pasted the id_dsa.pub from the master node to my laptop

scp -i ec2key.pem ubuntu@ec2-50-19-8-109.compute-1.amazonaws.com:/home/ubuntu/.ssh/id_dsa.pub /Users/me/somefolder

I copy-and-pasted the id_dsa.pub file from my laptop to the worker node

scp -i ec2key.pem /Users/me/somefolder/id_dsa.pub ubuntu@ec2-107-20-7-57.compute-1.amazonaws.com:/home/ubuntu/.ssh 

On the worker node I appended the id_dsa.pub file to my authorized_keys file

cat id_dsa.pub >> authorized_keys

I created a file on the master node: /home/ubuntu/test.txt and then tried to scp this file from the master node to the worker node

scp -v -i ubuntu@ec2-50-19-8-109.compute-1.amazonaws.com:/home/ubuntu/.ssh/id_dsa ubuntu@ec2-50-19-8-109.compute-1.amazonaws.com:/home/ubuntu/test.txt ubuntu@ec2-107-20-7-57.compute-1.amazonaws.com:

I got the following result

Permission denied (publickey).

Any ideas?

Additional details:

share|improve this question
    
What are the permissions of ~ubuntu, ~ubuntu/.ssh, and ~ubuntu/.ssh/authorized_keys on ec2-107-20-7-57.compute-1.amazonaws.com. You can get it via ls -ld ~ubuntu. –  becomingwisest Dec 25 '12 at 0:48
    
Are you running the final scp from your mac? What happens if you use the ec2key.pem for the final scp? I don't think -i allows use of a remote private key, so you would either need to use the ec2key.pem, or copy the ubuntu@ec2-50-19-8-109.compute-1.amazonaws.com:/home/ubuntu/.ssh/id_dsa private key to your local system. –  becomingwisest Dec 25 '12 at 0:55
1  
Check /var/log/secure on the target host to see why it's rejecting the keys. –  Jason Floyd Dec 25 '12 at 8:19
    
@becomingwisest The permissions output for ~ubuntu is drwxr-xr-x, drwx------ for ~ubuntu/.ssh, and -rw------- for ~ubuntu/.ssh/authorized_keys. –  Spicysheep Dec 26 '12 at 4:37
    
@becomingwisest I'm running the final command from the master node. I tried running the command from my Mac instead, using scp -i ec2key.pem, but that also gave me a permission denied response. I'd like to be able to issue the command from the master node because in the future I would like to write a script to move stuff around while my Mac is not involved. –  Spicysheep Dec 26 '12 at 5:19

4 Answers 4

up vote 0 down vote accepted

scp can't take a key from another server, even if that other server is the one you are on. Use a file system path to the identity file you want to use, if scp won't pick it up automatically.

scp -v -i /home/ubuntu/.ssh/id_dsa /home/ubuntu/test.txt ubuntu@ec2-107-20-7-57.compute-1.amazonaws.com:

or scp -v -i /home/ubuntu/test.txt ubuntu@ec2-107-20-7-57.compute-1.amazonaws.com:

share|improve this answer
    
I'm having trouble accessing the site through my phone. I'll upvote it too when I get to a computer. –  Spicysheep Dec 27 '12 at 17:16

Don't forget to check your security groups! I spent a few hours quadruple-checking settings in ~/.ssh, instance id, dns name, reading all sorts of tutorials when it turned out I had just forgotten I'd set my instance to a security group only allowing a single IP address. Once I fixed that, it was just a matter of copying keys and setting things up as usual.

share|improve this answer

I don't think you need to setup new keys for this task.

If you are able to login from your mac, to both the machines, then I believe your keys are already setup.

You simply need to use this command:

# scp $master:<file> $worker:<file>

and this command will simply work out of the box.

ThoughI would still love to understand why you are creating new keys for this task.

share|improve this answer
    
I tried your suggestion and got another "Permission denied (public key)" response. I then tried doing a scp -i mypemkey.pem variation and still got the permission denied response. –  Spicysheep Dec 26 '12 at 5:02
    
The end goal is to set up a Beowulf cluster similar to what is mentioned here: techtinkering.com/2009/12/02/…. I'm a bit new to servers, linux, Ubuntu, and setting up a cluster for parallel computing in EC2, so I tried to follow everything in the tutorial as closely as possible. Like you mention, I too wouldn't be surprised if use of the preexisting EC2 keys were somehow possible. I'm just not confident enough with all of the material to know that it wouldn't mess up something in the tutorial. –  Spicysheep Dec 26 '12 at 5:08

Use ssh-copy-id to ensure that the key is copied correctly and that permissions on the relevant files/directories are correct.

If your system doesn't include the command ssh-copy-id you can get it from the following openssh repo. openssh project repo & link to openssh-copy-id

share|improve this answer
    
This wouldn't overwrite the worker instance's existing public key (ie authorized_keys) file? –  Spicysheep Dec 24 '12 at 22:55
    
ssh-copy-id should be non-destructive, just adds to the authorized_keys file. –  slm Dec 24 '12 at 23:22
    
You can try using ssh -v or ssh -vv for more info. –  slm Dec 24 '12 at 23:22
    
I tried it but got a "command not found" response. I did some additional research and it looks like the ssh-copy-id command does not exist on Macs. I'm using a Mac. –  Spicysheep Dec 24 '12 at 23:25
    
See my edit to this question, i've included a link to the ssh-copy-id script for distros that are lacking it. –  slm Dec 25 '12 at 0:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.