2

I am not able to scp from one EC2 instance to another EC2 instance. From my laptop I am able to ssh into each instance without issues.

I have two instances.

#worker1
ec2-107-20-7-57.compute-1.amazonaws.com

#master
ec2-50-19-8-109.compute-1.amazonaws.com

Here is what I have done so far.

I made a new key pair on the master node ssh-keygen -t dsa

I copy-and-pasted the id_dsa.pub from the master node to my laptop

scp -i ec2key.pem [email protected]:/home/ubuntu/.ssh/id_dsa.pub /Users/me/somefolder

I copy-and-pasted the id_dsa.pub file from my laptop to the worker node

scp -i ec2key.pem /Users/me/somefolder/id_dsa.pub [email protected]:/home/ubuntu/.ssh

On the worker node I appended the id_dsa.pub file to my authorized_keys file

cat id_dsa.pub >> authorized_keys

I created a file on the master node: /home/ubuntu/test.txt and then tried to scp this file from the master node to the worker node

scp -v -i [email protected]:/home/ubuntu/.ssh/id_dsa [email protected]:/home/ubuntu/test.txt [email protected]:

I got the following result

Permission denied (publickey).

Any ideas?

Additional details:

Improve this question
7
  • What are the permissions of ~ubuntu, ~ubuntu/.ssh, and ~ubuntu/.ssh/authorized_keys on ec2-107-20-7-57.compute-1.amazonaws.com. You can get it via ls -ld ~ubuntu.
    – becomingwisest
    Dec 25, 2012 at 0:48
  • Are you running the final scp from your mac? What happens if you use the ec2key.pem for the final scp? I don't think -i allows use of a remote private key, so you would either need to use the ec2key.pem, or copy the [email protected]:/home/ubuntu/.ssh/id_dsa private key to your local system.
    – becomingwisest
    Dec 25, 2012 at 0:55
  • 1
    Check /var/log/secure on the target host to see why it's rejecting the keys.
    – Jason Floyd
    Dec 25, 2012 at 8:19
  • @becomingwisest The permissions output for ~ubuntu is drwxr-xr-x, drwx------ for ~ubuntu/.ssh, and -rw------- for ~ubuntu/.ssh/authorized_keys.
    – Spicysheep
    Dec 26, 2012 at 4:37
  • @becomingwisest I'm running the final command from the master node. I tried running the command from my Mac instead, using scp -i ec2key.pem, but that also gave me a permission denied response. I'd like to be able to issue the command from the master node because in the future I would like to write a script to move stuff around while my Mac is not involved.
    – Spicysheep
    Dec 26, 2012 at 5:19

5 Answers 5

Reset to default
0

scp can't take a key from another server, even if that other server is the one you are on. Use a file system path to the identity file you want to use, if scp won't pick it up automatically.

scp -v -i /home/ubuntu/.ssh/id_dsa /home/ubuntu/test.txt [email protected]:

or scp -v -i /home/ubuntu/test.txt [email protected]:

Improve this answer
1
  • I'm having trouble accessing the site through my phone. I'll upvote it too when I get to a computer.
    – Spicysheep
    Dec 27, 2012 at 17:16
1

Use ssh-copy-id to ensure that the key is copied correctly and that permissions on the relevant files/directories are correct.

If your system doesn't include the command ssh-copy-id you can get it from the following openssh repo. openssh project repo & link to openssh-copy-id

Improve this answer
6
  • This wouldn't overwrite the worker instance's existing public key (ie authorized_keys) file?
    – Spicysheep
    Dec 24, 2012 at 22:55
  • ssh-copy-id should be non-destructive, just adds to the authorized_keys file.
    – slm
    Dec 24, 2012 at 23:22
  • You can try using ssh -v or ssh -vv for more info.
    – slm
    Dec 24, 2012 at 23:22
  • I tried it but got a "command not found" response. I did some additional research and it looks like the ssh-copy-id command does not exist on Macs. I'm using a Mac.
    – Spicysheep
    Dec 24, 2012 at 23:25
  • See my edit to this question, i've included a link to the ssh-copy-id script for distros that are lacking it.
    – slm
    Dec 25, 2012 at 0:21
0

I don't think you need to setup new keys for this task.

If you are able to login from your mac, to both the machines, then I believe your keys are already setup.

You simply need to use this command:

# scp $master:<file> $worker:<file>

and this command will simply work out of the box.

ThoughI would still love to understand why you are creating new keys for this task.

Improve this answer
2
  • I tried your suggestion and got another "Permission denied (public key)" response. I then tried doing a scp -i mypemkey.pem variation and still got the permission denied response.
    – Spicysheep
    Dec 26, 2012 at 5:02
  • The end goal is to set up a Beowulf cluster similar to what is mentioned here: techtinkering.com/2009/12/02/…. I'm a bit new to servers, linux, Ubuntu, and setting up a cluster for parallel computing in EC2, so I tried to follow everything in the tutorial as closely as possible. Like you mention, I too wouldn't be surprised if use of the preexisting EC2 keys were somehow possible. I'm just not confident enough with all of the material to know that it wouldn't mess up something in the tutorial.
    – Spicysheep
    Dec 26, 2012 at 5:08
0

Don't forget to check your security groups! I spent a few hours quadruple-checking settings in ~/.ssh, instance id, dns name, reading all sorts of tutorials when it turned out I had just forgotten I'd set my instance to a security group only allowing a single IP address. Once I fixed that, it was just a matter of copying keys and setting things up as usual.

Improve this answer
0

You just have to do one thing open the sshd_config file and edit the line PasswordAuthentication no to PasswordAuthentication yes Then set the password for the user using passwd command and restart the service.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .