I have an instance I created from the web console, using the "Classic" wizard & the default Amazon Linux image.

When I go to Instance Actions, Connect, and select the "Connect with a standalone SSH Client" option, it has the correct string, using ec2-user@.

I saved that as an AMI, and then created a new instance via the ec2 command-line tools:

ec2-run-instances <ami> -k <my key> -g <my security group>

Now when I get the connect string, it uses root@, which doesn't work - I need to change that to ec2-user to actually connect.

This isn't a big deal, but I'm wondering why there's a difference - is there a missing parameter when I create it via the command line?


ec2-user and root are two different users on the server. By default, root SSH access is not allowed per /etc/ssh/sshd_config. You could change this, of course, but it's considered a good security practice. (Root is a known, privileged account, and therefore a prime target for attackers.)

How old are your ec2 command-line tools? I'd guess that they used to allow root access previously, but no longer do that.

| improve this answer | |
  • It's the AWS web console that's producing the root@ or ec2-user@ ssh commands, depending on whether the command line tool or the web console was used to create the instance. Tools are all up to date. – chris Oct 24 '12 at 0:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.