Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created an EC2 instance Stopped it Again started it .

Got the following error

Aloks-MacBook-Pro:AWS alokmandloi$  ssh -i working_key.pem 
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
Please contact your system administrator.
Add correct host key in /Users/alokmandloi/.ssh/known_hosts to get rid of this message.
Offending RSA key in /Users/alokmandloi/.ssh/known_hosts:11
RSA host key for has changed and you have requested strict checking.
Host key verification failed.

I looked up over for a solution and found

Which suggested that i remove the 11th entry in known_hosts. After doing that i get the following error

Aloks-MacBook-Pro:AWS alokmandloi$  ssh -v -i working_key.pem 
OpenSSH_5.9p1, OpenSSL 0.9.8r 8 Feb 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: Connecting to [] port 22.
debug1: Connection established.
debug1: identity file working_key.pem type -1
debug1: identity file working_key.pem-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3
debug1: match: OpenSSH_5.3 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: RSA 3d:f2:79:cc:38:66:83:71:1b:86:6c:7e:36:ad:27:bc
debug1: Host '' is known and matches the RSA host key.
debug1: Found key in /Users/alokmandloi/.ssh/known_hosts:10
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: working_key.pem
debug1: read PEM private key done: type RSA
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).
share|improve this question
up vote 1 down vote accepted

Either you have the wrong key or the wrong address for the instance (which has rejected your key).

share|improve this answer
Or the wrong username. – ceejayoz Mar 8 '13 at 15:35
Possibly -- but ubuntu is a default username on many standard AMIs. – Flup Mar 8 '13 at 15:39
Only if they're Ubuntu ones. – ceejayoz Mar 8 '13 at 15:41
Stranger things have happened than someone firing up Amazon Linux while reading an Ubuntu-oriented tutorial. :-p – ceejayoz Mar 8 '13 at 15:43
Stranger things keep me employed :-) – Flup Mar 8 '13 at 15:44

If you stopped and started your instance, your public IP & hostname changes. Even if you're using an ElasticIP, 'stopping' it will disassociate the EIP.

Check back in your AWS Console and see what the new Public IP/Hostname is, you might be trying to connect to the old DNS name, which is likely assigned to someone else's instance now.

share|improve this answer
If inside of a VPC (I'm not sure why anyone wouldn't use a VPC at this point), EIP->EC2 mappings persist through stop/start cycles. – EEAA Mar 9 '13 at 18:23

it is better because more fail-prove to remove the offending hostkey with

ssh-keygen -R hostname

in your case

ssh-keygen -R

If you are sure your secret-key is correct, you may also verify on the server that .ssh/authorized_keys has the right permissions (700 for .ssh/, 600 for .ssh/authorized_keys)

share|improve this answer

When you stop a running instance, the following happens:

The instance performs a normal shutdown and stops running; its status changes to stopping and then stopped.

Any Amazon EBS volumes remain attached to the instance, and their data persists.

Any data stored in the RAM of the host computer or the instance store volumes of the host computer is gone.

EC2-Classic: We release the public and private IP addresses for the instance when you stop the instance, and assign new ones when you restart it.

EC2-VPC: The instance retains its private IP addresses when stopped and restarted. We release the public IP address and assign a new one when you restart it.

You instance must have got New Public IP . Please check and try to login to your server with new IP .

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.