0

I originally created an EC2 instance in US-East and wanted to move it to US-West. I stopped the instance, created an image of the AMI, and then copied it to the US-West availability zone. After launching the instance from this AMI in US-West I'm now unable to SSH into the instance (it keeps asking for the password).

The base image is FreeBSD 10-CURRENT, which by default uses the ec2-user for SSH access. After some experimenting I found that launching a new instance from this image in US-East (the original availability zone) I'm able to SSH, so I'm not certain what the issue is with the US-West instance. I created a new keypair, I'm using the keypair (ssh ec2-user@IP -i ~/.ssh/key.pem) and the security group allows SSH on port 22.

Here's the output of ssh -v:

OpenSSH_6.9p1, LibreSSL 2.1.8
debug1: Reading configuration data /Users/lander/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 20: Applying options for *
debug1: /etc/ssh/ssh_config line 102: Applying options for *
debug1: Connecting to ec2-54-213-127-207.us-west-2.compute.amazonaws.com [54.213.127.207] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /Users/lander/.ssh/key.pem type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/lander/.ssh/key.pem-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1_hpn13v11 FreeBSD-20140420
debug1: match: OpenSSH_6.6.1_hpn13v11 FreeBSD-20140420 pat OpenSSH_6.6.1* compat 0x04000000
debug1: Authenticating to ec2-54-213-127-207.us-west-2.compute.amazonaws.com:22 as 'ec2-user'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client chacha20-poly1305@openssh.com <implicit> none
debug1: kex: client->server chacha20-poly1305@openssh.com <implicit> none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:TKZStqOUSM3Eh0LLCEXU3k1LXq2qd1FwxNLQ8r7jkfo
debug1: Host 'EC2 PUBLIC DNS' is known and matches the ECDSA host key.
debug1: Found key in /Users/lander/.ssh/known_hosts:41
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /Users/lander/.ssh/id_rsa
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Offering RSA public key: /Users/lander/.ssh/other_key.pem
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Trying private key: /Users/lander/.ssh/key.pem
debug1: Authentications that can continue: publickey,keyboard-interactive
debug1: Next authentication method: keyboard-interactive
0

After discussing with a friend he suggested that it may still be using the old SSH key, so I gave it a try and sure enough that was the issue. I suppose this is because the system is imaged and the step of adding the new keypair is not done, so the old SSH key remains in the image's authorized_keys file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.