0

There are a lot of questions on ServerFault and StackOverflow about the problem of 'authenticity of host can not be established'. For instance:

https://stackoverflow.com/questions/2360842/ec2-ssh-problem-authenticating

and this:

https://stackoverflow.com/questions/11443687/the-authenticity-of-host-cant-be-established

In the comments to those questions are some people who complain that the problem has no resolution. This problem has built up for me slowly, but now I can't get around it.

I created a new EC2 instance on August 9th, and I created a new key-pair. I downloaded the key and I've used it to ssh to the server. I added this alias to my .bash_profile file:

alias lynssh='ssh -vvv -i /Users/jgallant/projects/sugarbest/susan-ecommerce-demo.pem ec2-user@ec2-52-90-226.compute-1.amazonaws.com '

This initially worked. I typed "lynssh" and I saw:

The authenticity of host 'ec2-22-90-226.compute-1.amazonaws.com (52.20.110.126)' can't be established.
ECDSA key fingerprint is SHA256:Ogme1H3edswKHrnfBLCO9bwNd+X//dHbka8mtoc.
Are you sure you want to continue connecting (yes/no)? yes

I typed "yes" and logged in. I worked for 4 hours, then stopped for lunch. When I got back from lunch, I had been automatically logged out when my Macbook shut down, so I logged in again.

Again I was asked:

The authenticity of host 'ec2-22-90-226.compute-1.amazonaws.com (52.20.110.126)' can't be established.
ECDSA key fingerprint is SHA256:Ogme1H3edswKHrnfBLCO9bwNd+X//dHbka8mtoc.
Are you sure you want to continue connecting (yes/no)? yes

And again I typed "yes" and I got in and I did a few hours of work.

The next day when I started working I was again asked:

The authenticity of host 'ec2-22-90-226.compute-1.amazonaws.com (52.20.110.126)' can't be established.
ECDSA key fingerprint is SHA256:Ogme1H3edswKHrnfBLCO9bwNd+X//dHbka8mtoc.
Are you sure you want to continue connecting (yes/no)? yes

I again typed "yes" and I again got several hours of work done.

But now I can no longer get in. I type "lynssh" and I get:

The authenticity of host 'ec2-22-90-226.compute-1.amazonaws.com (52.20.110.126)' can't be established.
ECDSA key fingerprint is SHA256:Ogme1H3edswKHrnfBLCO9bwNd+X//dHbka8mtoc.
Are you sure you want to continue connecting (yes/no)? yes

I type "yes" and I am confronted with:

Failed to add the host to the list of known hosts (/Users/jgallant/.ssh/known_hosts).

ec2-user@ec2-22-90-226.compute-1.amazonaws.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

I checked in the EC2 console on AWS to make sure the server was running okay. And it is. It has not restarted, and the IP is still the same. The EC2 instance is running standard Amazon Linux, with no modifications.

So first I had a symptom: I was asked "Are you sure you want to continue" every time I logged in.

And now I have a real problem: I can not log in at all.

I deleted:

~/.ssh/known_hosts

Then I tried lynssh again.

The information about this host is successfully written to ~/.ssh/known_hosts so that problem is solved. But I'm still locked out of the server.

When I run ssh with the vvv option, I get:

OpenSSH_7.6p1, LibreSSL 2.6.2
debug1: Reading configuration data /Users/jgallant/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to ec2-22-90-226.compute-1.amazonaws.com port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /Users/jgallant/projects/sugarbest/susan-ecommerce-demo.pem type -1
debug1: key_load_public: No such file or directory
debug1: identity file /Users/jgallant/projects/sugarbest/susan-ecommerce-demo.pem-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug3: fd 5 is O_NONBLOCK
debug1: Authenticating to ec2-22-90-226.compute-1.amazonaws.com:22 as 'ec2-user'
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:Ogme1H3edswKHrnfBLCO9bwNd+X//dHbka8mtoc
The authenticity of host 'ec2-22-90-226.compute-1.amazonaws.com (52.20.110.126)' can't be established.
ECDSA key fingerprint is SHA256:Ogme1H3edswKHrnfBLCO9bwNd+X//dHbka8mtoc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'ec2-22-90-226.compute-1.amazonaws.com,52.20.110.126' (ECDSA) to the list of known hosts.
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: /Users/jgallant/projects/sugarbest/susan-ecommerce-demo.pem (0x0), explicit
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug3: start over, passed a different list publickey,gssapi-keyex,gssapi-with-mic
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /Users/jgallant/projects/sugarbest/susan-ecommerce-demo.pem
debug3: sign_and_send_pubkey: RSA SHA256:cq/vY8nn8pqDjuS6VUHYYrINfcaG0Jct0ITBtLOLk28
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
ec2-user@ec2-22-90-226.compute-1.amazonaws.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
  • Do you have a firewall with SSH/SSL Inspection? This can cause issues with SSH if you don't have the proper middle certificate installed on the machine. Also, check the server's sshd_config and ensure your ciphers line up. – David Eisen Aug 13 '18 at 5:16
  • How do I check the server's sshd_config if I can not log into the machine? – JeffGallant Aug 13 '18 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.