Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is my first Amazon EC2 instance but I'm having a hard time and google can't help me out. These are the steps I have taken:

  1. Generate a keypair called aws
  2. Download aws.pem and put in my /Users/Jim/Documents/sshkeys folder
  3. CHmod both file and folder to 700
  4. Create an instance from official Amazon Debian 6 AMI
  5. Verify security settings include SSH on port 22 (TCIP 22 (SSH) 0.0.0.0/0)
  6. Run this command:

ssh -v -i /Users/James/Documents/sshkeys/aws.pem root@myec2ip

This is the message I get:

  • OpenSSH_5.9p1, OpenSSL 0.9.8r 8 Feb 2011
  • debug1: Reading configuration data /etc/ssh_config
  • debug1: /etc/ssh_config line 20: Applying options for *
  • debug1: Connecting to myec2ip port 22.
  • debug1: Connection established.
  • debug1:identity file /Users/James/Documents/sshkeys/aws.pem type -1
  • debug1: identity file /Users/James/Documents/sshkeys/aws.pem-cert type -1
  • debug1:Remote protocol version 2.0, remote software version OpenSSH_5.5p1 Debian-6+squeeze3
  • debug1: match: OpenSSH_5.5p1 Debian-6+squeeze3 pat OpenSSH* debug1: Enabling compatibility mode for protocol 2.0
  • debug1:Local version string SSH-2.0-OpenSSH_5.9
  • debug1: SSH2_MSG_KEXINIT sent
  • debug1: SSH2_MSG_KEXINIT received
  • debug1: kex: server->client aes128-ctr hmac-md5 none
  • debug1: kex: client->server aes128-ctr hmac-md5 none
  • debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
  • debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
  • debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
  • debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
  • debug1: Server host key: RSA ef:06:a0:a3:26:9f:c5:e7:c0:a6:0d:9a:1a:24:27:ef
  • debug1: Host 'myec2ip' is known and matches the RSA host key.
  • debug1: Found key in /Users/James/.ssh/known_hosts:6
  • debug1:ssh_rsa_verify: signature correct
  • debug1: SSH2_MSG_NEWKEYS sent
  • debug1: expecting SSH2_MSG_NEWKEYS
  • debug1: SSH2_MSG_NEWKEYS received
  • debug1: Roaming not allowed by server
  • debug1: SSH2_MSG_SERVICE_REQUEST sent
  • debug1: SSH2_MSG_SERVICE_ACCEPT received
  • debug1: Authentications that can continue: publickey
  • debug1: Next authentication method:publickey
  • debug1: Trying private key: /Users/James/Documents/sshkeys/aws.pem
  • debug1: read PEM private key done: type RSA
  • debug1: Authentications that can continue: publickey debug1: No more authentication methods to try. Permission denied (publickey).

I've tried a few different things, can anyone help me work out where I am going wrong please?

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

Most likely you have this in your /etc/ssh/sshd_config:

PermitRootLogin no

This is a good thing, however. If you want to perform privileged actions, you should do them with sudo or at least start a root shell with sudo -s.

There will likely be a reason for the failed login in /var/log/auth.log on the server. It doesn't look like you put the public key in /root/.ssh/authorized_keys on your server, which is where it needs to be for root to log in.


Buried in the fine print here is the titbit that the default user is admin, not root in the Debian AMI. That's where Amazon will have put the public key that matches the private key you downloaded. Use this:

ssh -i /Users/James/Documents/sshkeys/aws.pem admin@myec2ip

The default user is ec2-user in the Amazon AMI and ubuntu in the Ubuntu AMI. I don't know about any others.

share|improve this answer
    
Thank you for the reply. Amazon EC2 don't seem to have "public" keys though and by setting that as the keypair on amazon does it not allow the EC2 to have this key authorised? I wish I could see var/log/auth.log but I can't access it, but I have updated my original message to include more details –  James Willson Mar 16 '13 at 20:39
    
The Red Hat AMI also uses ec2-user fyi. –  georgeb_dba Mar 21 at 14:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.