Sorry to ask this question again, as I know its been asked a crap load of times... I have been through a bunch of previous posts but have had no luck. Have tried everything...


  1. Launch Instance
  2. Update security-groups to allow ssh connection on port 22 from my IP address
  3. Create new KeyPair - save .pem file
  4. Use puttygen to convert it to PPK: Load -> Save private key
  5. Attempt putty connection to ubuntu@myInstancePublicDNS using my saved .ppk as auth key (loaded under SSH->Auth)

I have repeated the exact same steps once previously at a friends house, and it worked. I'm not doing anything any different. I can't imagine it has anything to do with location as I've also added my IP to security-groups and the message I'm getting is a denied key.

  • I have tried using cygwin and open-ssh to connect with the downloaded .pem private key.
  • I have tried setting chmod 600 on my pk.
  • I have tried removing the ec2 instance from the known_hosts file and trying again
  • I have tried using ssh -i <keyDir> -v ubuntu@myInstancePublicDNS to get a bit of extra output to debug
  • I have tried using user = ec2-user or root
  • I have tried uploading a public key for a generated key/pair I made with puttygen
  • I have tried terminating the instance and launching a new one...

But every time, without fail, I get the following:

OpenSSH_6.8p1, OpenSSL 1.0.2d 9 Jul 2015
debug1: Connecting to XX.XX.XXX.XX [XX.XX.XXX.XX] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file .ssh/test.pem type -1
debug1: key_load_public: No such file or directory
debug1: identity file .ssh/test.pem-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.8
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.2
debug1: match: OpenSSH_6.2 pat OpenSSH* compat 0x04000000
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr [email protected] none
debug1: kex: client->server aes128-ctr [email protected] none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:SUYkrQtUYkQ4Fl2Dh5K/4kc/b0kYliZGrdFdXeHxLtk
debug1: Host 'XX.XX.XXX.XX' is known and matches the ECDSA host key.
debug1: Found key in /home/MY_USERNAME/.ssh/known_hosts:2
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Trying private key: .ssh/test.pem
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
Permission denied (publickey).

I'm at my wits end and hoping someone else has experienced something similar!!

1 Answer 1


1.) Launch Instance 2.) Update security-groups to allow ssh connection on port 22 from my ip address 3.) Create new KeyPair - save .pem file

You have these steps in the wrong order. The keypair needs to be specified when creating the instance in order for the public key to be properly deployed.

You presumably already have a keypair created in AWS (and have downloaded the private key), so all you need to do is specify that key pair in the EC2 Instance Launch wizard and you should be able to connect.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .