I am not able to scp from one EC2 instance to another EC2 instance. From my laptop I am able to ssh into each instance without issues.

I have two instances.



Here is what I have done so far.

I made a new key pair on the master node ssh-keygen -t dsa

I copy-and-pasted the id_dsa.pub from the master node to my laptop

scp -i ec2key.pem ubuntu@ec2-50-19-8-109.compute-1.amazonaws.com:/home/ubuntu/.ssh/id_dsa.pub /Users/me/somefolder

I copy-and-pasted the id_dsa.pub file from my laptop to the worker node

scp -i ec2key.pem /Users/me/somefolder/id_dsa.pub ubuntu@ec2-107-20-7-57.compute-1.amazonaws.com:/home/ubuntu/.ssh 

On the worker node I appended the id_dsa.pub file to my authorized_keys file

cat id_dsa.pub >> authorized_keys

I created a file on the master node: /home/ubuntu/test.txt and then tried to scp this file from the master node to the worker node

scp -v -i ubuntu@ec2-50-19-8-109.compute-1.amazonaws.com:/home/ubuntu/.ssh/id_dsa ubuntu@ec2-50-19-8-109.compute-1.amazonaws.com:/home/ubuntu/test.txt ubuntu@ec2-107-20-7-57.compute-1.amazonaws.com:

I got the following result

Permission denied (publickey).

Any ideas?

Additional details:

  • What are the permissions of ~ubuntu, ~ubuntu/.ssh, and ~ubuntu/.ssh/authorized_keys on ec2-107-20-7-57.compute-1.amazonaws.com. You can get it via ls -ld ~ubuntu. Dec 25 '12 at 0:48
  • Are you running the final scp from your mac? What happens if you use the ec2key.pem for the final scp? I don't think -i allows use of a remote private key, so you would either need to use the ec2key.pem, or copy the ubuntu@ec2-50-19-8-109.compute-1.amazonaws.com:/home/ubuntu/.ssh/id_dsa private key to your local system. Dec 25 '12 at 0:55
  • 1
    Check /var/log/secure on the target host to see why it's rejecting the keys. Dec 25 '12 at 8:19
  • @becomingwisest The permissions output for ~ubuntu is drwxr-xr-x, drwx------ for ~ubuntu/.ssh, and -rw------- for ~ubuntu/.ssh/authorized_keys.
    – Spicysheep
    Dec 26 '12 at 4:37
  • @becomingwisest I'm running the final command from the master node. I tried running the command from my Mac instead, using scp -i ec2key.pem, but that also gave me a permission denied response. I'd like to be able to issue the command from the master node because in the future I would like to write a script to move stuff around while my Mac is not involved.
    – Spicysheep
    Dec 26 '12 at 5:19

scp can't take a key from another server, even if that other server is the one you are on. Use a file system path to the identity file you want to use, if scp won't pick it up automatically.

scp -v -i /home/ubuntu/.ssh/id_dsa /home/ubuntu/test.txt ubuntu@ec2-107-20-7-57.compute-1.amazonaws.com:

or scp -v -i /home/ubuntu/test.txt ubuntu@ec2-107-20-7-57.compute-1.amazonaws.com:

  • I'm having trouble accessing the site through my phone. I'll upvote it too when I get to a computer.
    – Spicysheep
    Dec 27 '12 at 17:16

Use ssh-copy-id to ensure that the key is copied correctly and that permissions on the relevant files/directories are correct.

If your system doesn't include the command ssh-copy-id you can get it from the following openssh repo. openssh project repo & link to openssh-copy-id

  • This wouldn't overwrite the worker instance's existing public key (ie authorized_keys) file?
    – Spicysheep
    Dec 24 '12 at 22:55
  • ssh-copy-id should be non-destructive, just adds to the authorized_keys file.
    – slm
    Dec 24 '12 at 23:22
  • You can try using ssh -v or ssh -vv for more info.
    – slm
    Dec 24 '12 at 23:22
  • I tried it but got a "command not found" response. I did some additional research and it looks like the ssh-copy-id command does not exist on Macs. I'm using a Mac.
    – Spicysheep
    Dec 24 '12 at 23:25
  • See my edit to this question, i've included a link to the ssh-copy-id script for distros that are lacking it.
    – slm
    Dec 25 '12 at 0:21

I don't think you need to setup new keys for this task.

If you are able to login from your mac, to both the machines, then I believe your keys are already setup.

You simply need to use this command:

# scp $master:<file> $worker:<file>

and this command will simply work out of the box.

ThoughI would still love to understand why you are creating new keys for this task.

  • I tried your suggestion and got another "Permission denied (public key)" response. I then tried doing a scp -i mypemkey.pem variation and still got the permission denied response.
    – Spicysheep
    Dec 26 '12 at 5:02
  • The end goal is to set up a Beowulf cluster similar to what is mentioned here: techtinkering.com/2009/12/02/…. I'm a bit new to servers, linux, Ubuntu, and setting up a cluster for parallel computing in EC2, so I tried to follow everything in the tutorial as closely as possible. Like you mention, I too wouldn't be surprised if use of the preexisting EC2 keys were somehow possible. I'm just not confident enough with all of the material to know that it wouldn't mess up something in the tutorial.
    – Spicysheep
    Dec 26 '12 at 5:08

Don't forget to check your security groups! I spent a few hours quadruple-checking settings in ~/.ssh, instance id, dns name, reading all sorts of tutorials when it turned out I had just forgotten I'd set my instance to a security group only allowing a single IP address. Once I fixed that, it was just a matter of copying keys and setting things up as usual.


You just have to do one thing open the sshd_config file and edit the line PasswordAuthentication no to PasswordAuthentication yes Then set the password for the user using passwd command and restart the service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.