0

I managed to lock myself out of the root account of an Amazon EC2 Ubuntu instance by changing some permissions to .ssh.

Below are the steps I tried and failed miserable.

  1. Create a new, temporary instance (created a volume by itself).
  2. Stop the old instance. At this step, I am able to login to new instance.
  3. Detach the EBS volume from the old instance (Volume was /dev/sda1).
  4. Attach the old volume to new instance on /dev/sdb1.

Actual result: 5. Reboot the new instance and now can't login and permission key error. PS: If I dont reboot the new instance, I am able to login but when I am mounting using mount /dev/sdb1 /mnt and I get an error drive not found.

Expected result: 5. Mount the device in new instance. 6. Edit the sudoers file. 7. Unmount the device. 8. Detach the volume. 9. Attach the volume to old instance on /dev/sda1. 10. Boot old instance. 11. Link the old instance back to the elastic IP address. 12. Start breathing again. 13. Delete the temporary instance.

2

Not sure if this will work but instead of what you did above.

Attach the old EBS drive instance to /dev/sdb2 and don't detach the current /dev/sdb1 as this is running an instance that you can still SSH into.

Inside the new running instance you should be able to run

sudo mount /dev/sdb2 /mnt
chmod /home/ubuntu/.ssh 700

# assumes the home directory is the default ubuntu one 
# for ubuntu/debian instances.

Followed by:

sudo umount /mnt

Now detach the drive in EC2 console and reattach it to your old instance and start it back up. Hopefully now you'll be able to ssh back in.

0

Looks like you managed to replace the drive from the temporary instance with the one from the broken instance.

It doesn't sound like this is your problem, but just in case...if you started with an AMI from the Marketplace, you cannot detach the root volume to do this sort of repair. Apparently to "protect" the marketplace vendors from people altering their stuff.

0

@Matt: Thanks for the help. I was able to get it working.I needed to attach old volume to new instance without restarting and then mount it. For some reason, AWS console on web was showing dev/sda1 but when i looked at logs, the drive was dev/zsda1.

Below are the steps that worked (Only need to ensure the volume names are correct)

1.Create a new, temporary instance (created a volume by itself). 2.Stop the old instance. At this step, I am able to login to new instance. 3.Detach the EBS volume from the old instance (Volume was /dev/sda1). 4.Attach the old volume to new instance on /dev/sdb1. 5. Mount the device in new instance. 6. Edit the sudoers file. 7. Unmount the device. 8. Detach the volume. 9. Attach the volume to old instance on /dev/sda1. 10. Boot old instance. 11. Link the old instance back to the elastic IP address. 12. Start breathing again. 13. Delete the temporary instance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.