1

I have two EC2 instances:

Serve 1, OS: Centos - 7.5 Serve 2, OS: Centos - 7.5 Default username: centos

Both are configured for passwordless login, so I have the ssh key with me.

I am able to ssh to both servers using the ssh key from my host.

But when I am trying to ssh from Server 1 to Server 2, it's failing.

I found out that the private keys are under /etc/ssh

-rw-r-----. 1 root ssh_keys   1679 Oct  7 14:42 ssh_host_rsa_key

Error

sudo ssh -i ./ssh_host_rsa_key [email protected]
Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

So where I am going wrong?

Improve this question

3 Answers 3

Reset to default
1

The best way to approach this would be to create a new key for the user you want on the Server1 to be connecting to Server2, using ssh-keygen, and copying that user's PUBLIC key into ~/.ssh/authorized_keys of Server2, then repeating the same procedure for the reverse trip.

YOUR private key must remain yours, it must never leave your PC, don't use it by copying it on the servers, I can assure you that you're not simplifying anything by doing that.

In all my CentOS 7 servers the default SSH configuration resides in ~/.ssh, the private key is usually ~/.ssh/id_rsa and the public is usually ~/.ssh/id_rsa.pub these are the only 3 files you should need to create or edit for every machine:

~/.ssh/id_rsa
~/.ssh/id_rsa.pub
~/.ssh/authorized_keys

ensure that the ~/.ssh directory is chmod'ed 700 and the files inside 600.

You can use ssh-copy-id to send the public key from one server to another once you have created both sets of keys.

Improve this answer
2
  • Thanks, I have created a new user and used ssh-copy-id, and it worked. Do you know where is pvt key for the default user, ~/.ssh Folder is empty at the beginning
    – Hulk711
    Oct 21, 2018 at 7:09
  • At the beginning, ~/.ssh is correctly empty, using ssh-keygen you create both a private and a public key, at the same time. Keep in mind that you can recreate the public key from the private key, if you need.
    – Fanfurlio
    Oct 21, 2018 at 15:06
0

It seems like you are confusing the keys.

SSH authentication uses asymmetric crypto aka public key crypto. So every key consists of two parts, a private key (the one that must be kept secret) and a public key which is shared with the other party.

The private keys in /etc/ssh on the server are the ones for proving to the client that it is connecting to the right server.

The private keys for logging in are stored on the client normally in /home/user/.ssh/

Is there a particular reason why you want to ssh from one instance to the other? From a security perspective it is not a great idea.

Debugging ssh: For debugging ssh just use ssh -vv and add more v according to taste.

Improve this answer
8
  • 1
    sudo ssh -i ./id_rsa [email protected] Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
    – Hulk711
    Oct 18, 2018 at 16:52
  • I moved to the .ssh/ but I am stilling getting the error, I am trying to configure password less login for ansible.
    – Hulk711
    Oct 18, 2018 at 17:01
  • But you copied the keys from your local machine to the instance from which you are trying to connect?
    – Elias
    Oct 18, 2018 at 17:27
  • I compared the keys, which I have in PC, and the host, I found the keys which match is under /etc/ssh/, that is the same key which I am using for ssh from host1 to host2
    – Hulk711
    Oct 18, 2018 at 17:30
  • How do you know they "match"?
    – Elias
    Oct 18, 2018 at 17:30
0

It will be easier for you to create a new key for user centos in Server_A:

$ ssh-keygen

Once created, copy your /home/centos/.ssh/id_rsa.pub content to /home/centos/.ssh/authorized_keys on Server_B

Once completed, you can ssh in to Server_B from Server_A without a password.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .