Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an ubuntu server is on Amazon EC2. Earlier I used to login with the original pem key file generated at instance launch time.

ssh -i /path/to/key.pem ubuntu@instance-dns-name.com

I tried to stop password authentication and made the following changes in sshd_config.

ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no 

Boom. The key login stopped working and gives me 'Permission Denied(publicKey)' error.

The funny thing is, I had created a rsa key for a non-root user using ssh-keygen. That works even now. But the ec2 pem key file will not work.

Note: If I change UsePam to 'yes', the pem key starts functioning again. I'm able to reproduce this problem on another machine. However, on the first machine I've lost the ability to gain root privileges because of key file not working. So cannot make any changes to sshd_config file.

The ssh log looks like follows.

OpenSSH_5.9p1 Debian-5ubuntu1.1, OpenSSL 1.0.1 14 Mar 2012
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to ec2-xx.xx.us-west-2.compute.amazonaws.com    [xx.xx.xx.xx] port 22.
debug1: Connection established.
debug3: Incorrect RSA1 identifier
debug3: Could not load "/home/amitoj/.ssh/backupshard.pem" as a RSA1 public key
debug1: identity file /home/amitoj/.ssh/backupshard.pem type -1
debug1: identity file /home/amitoj/.ssh/backupshard.pem-cert type -1
debug1: Remote protocol version 2.0, remote software version OpenSSH_5.9p1Debian-        5ubuntu1.1
debug1: match: OpenSSH_5.9p1 Debian-5ubuntu1.1 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.9p1 Debian-5ubuntu1.1
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "ec2-xx.xx.xx.xx.us-          west-2.compute.amazonaws.com" from file "/home/amitoj/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/amitoj/.ssh/known_hosts:70
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-       cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-    sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa-cert-v01@openssh.com,ssh-dss-certv01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndaelcbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit: none,zlib@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdhsha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-sha2-256,hmac-sha2-256-96,hmac-sha2-512,hmac-sha2-512-96,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit: none,zlib@openssh.com
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA 2d:19:d0:63:49:d9:f7:30:26:3f:6e:ff:8e:63:4d:c5
debug3: load_hostkeys: loading entries for host "ec2-xx.xx.xx.uswest-2.compute.amazonaws.com" from file "/home/amitoj/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/amitoj/.ssh/known_hosts:70
debug3: load_hostkeys: loaded 1 keys
debug3: load_hostkeys: loading entries for host "xx.xx.xx.xx" from file "/home/amit/.ssh/known_hosts"
debug3: load_hostkeys: found key type ECDSA in file /home/amitoj/.ssh/known_hosts:71
debug3: load_hostkeys: loaded 1 keys
debug1: Host 'ec2-xx.xx.xx.xx.us-west-2.compute.amazonaws.com' is known and matches the ECDSA host key.
debug1: Found key in /home/amitoj/.ssh/known_hosts:70
debug1: ssh_ecdsa_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/amitoj/.ssh/backupshard.pem ((nil))
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/amitoj/.ssh/backupshard.pem
debug1: read PEM private key done: type RSA
debug3: sign_and_send_pubkey: RSA 69:ff:93:01:27:57:00:23:6e:2b:90:72:16:15:65:bb
debug2: we sent a publickey packet, wait for reply
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
Permission denied (publickey).

Any idea on how to gain entry to root user with the 'pem' key file?

share|improve this question
    
Can you 'sudo' from the regular user account? –  rickhg12hs Nov 15 '13 at 11:54
    
@rickhg12hs - Nope. It would have been a non-issue otherwise. –  Neo Nov 15 '13 at 11:57
    
Don't suppose you could boot into 'Recovery Mode'/'Single User'/'Run Level 1'? –  rickhg12hs Nov 15 '13 at 12:08
    
ec2 does not have any such facility. –  Neo Nov 15 '13 at 12:15
1  
Sorry, don't know the EC2 constraints ... Can you instantiate another VM that can mount the partition that has the file you need to edit? I.e., shutdown current VM, launch new VM with its own OS, mount partition of 1st VM, make edits, shutdown, then boot 1st VM. –  rickhg12hs Nov 15 '13 at 13:09
show 3 more comments

2 Answers

On next instantiation, use one of the 'CloudInit' features and provide a User-Data Script that will edit/fix 'sshd_config'. A simple 'sed' command should work.

share|improve this answer
add comment

Did you try to

PermitRootLogin without-password

in /etc/ssh/sshd_config?

share|improve this answer
    
No. That is set to No –  Neo Nov 15 '13 at 15:43
    
This is really a comment, not an answer. With a bit more rep, you will be able to post comments. –  slm Nov 15 '13 at 15:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.