Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I followed How to Capture an Image of a Virtual Machine Running Linux to capture a VM image, after installing the packages I wanted on top of Ubuntu 12.04 LTS. I turned off the machine following a waagent -deprovision and Captured the image.

When I had created the first VM (which I later captured), I specified a certificate file key1.pem.

When I created a new VM from the My Images image, I specified a certificate file key2.pem.

When I attempted to connect to the new VM, I received the message Permission denied (public key).. To connect, I used ssh -i ssh/key2 -p myport

What's wrong? Are there special steps needed to use a different key than was used in the template image? Is this a bug?

share|improve this question
the key is used when certs are generated. if you switch the key without regenerating the related certs, I think this is the expected behavior. – user16081-JoeT Jan 28 '14 at 20:11
I created a new VM from the Captured image, and uploaded a new cert, generated from the new key, as part of the creation process of the new VM. I would expect to be able to authenticate using the key used in this creation process. – mpbloch Jan 28 '14 at 20:22
oh i thought you were talking about the server's ssh key. If it's your own key, maybe you just need to set the cert permissions to 600 – user16081-JoeT Jan 28 '14 at 22:29

At first glance it seems you're trying to deploy a .pem file as the public key of a SSH key-pair in ~azureuser/.ssh/authorized_keys so you can use key-based authentication rather then password based ssh login, is that the case?

I normally associate PEM files with SSL certificates and you should note, in the words of the man page, that SSH certificates are a different, and much simpler, format to the X.509 certificates used in SSL. So using SSL certificates instead of SSH keys/certificates is going to fail.

Normally a private use SSH key-pair is created with ssh-keygen -b 2048 -t rsa -f .ssh/mykey which will create 2048 bit RSA private key file ~/.ssh/mykey and the corresponding public key ~/.ssh/ That public key needs to be deployed to ~azureuser/.ssh/authorized_keys

Make sure that on the both your client and the server the ~/.ssh directory is only accessible to the owner with chmod 0700 and all the keyfiles are only readable for their owner i.e. chmod 0600.

Further debugging ssh can be done from the client with ssh -v -i ssh/mykey -p myport or even more verbosely with -vv.

share|improve this answer
Thanks, yes I am using an "SSL" PEM file, or rather, an X509 PEM file, with RSA public key. While it is perfectly possible to use normal SSH keys as you describe, and which I am very familiar with, I was hoping that the deployment tools provided from Azure Manager supported the use case I described. That is, provision a VM from a template captured VM, using a new x509 PEM than the original. – mpbloch Feb 10 '14 at 4:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.