I am trying to SSH into my EC2 instances of my ElasticBeanstalk environment. I could SSH into the instance. Then I terminated the instance and pinned up the new instance. Then it broke when I tried to SSH again. This I what I have done so far.
I created an SSH KeyPair in the AWS console named MyanEatSSH.
Then I set up the SSH running the following command.
eb ssh --setup
I selected the Key name I created.
Then I downloaded the key and put it under ~/.ssh/ folder.
I could ssh into the EC2 machine running the following command.
eb ssh
It was working as expected. The problem began when I deleted the instance in the EC2 console. I deleted an EC2 instance. Then, the Beanstalk spin up the new instance since it has the health check and Auto Scaling capability.
Then I ssh again into the new instance. This time, I got the following error.
###########################################################
# WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! #
###########################################################
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:enloOGgT3a/TLEoeibCGEbAmDogbpqHZWdy8qP5WyEE.
Please contact your system administrator.
Add correct host key in /Users/wai/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /Users/wai/.ssh/known_hosts:35
ECDSA host key for {ip} has changed and you have requested strict checking.
Host key verification failed.
As an attempt to fix it, I tried setting up the SSH running this command again,
eb ssh --setup
It still does not work. I tried to create a new SSH Key and tried setting it up again. It does not work too. It is throwing the same error. What is wrong and how can I fix it?
When you reinstall the server or associate elastic IP with new launch server of previous instance its identity changes, and you'll start to get this message.
Simply remove the key from known_hosts by deleting the relevant entry
ssh-keygen -R <IP>
Related
I got stuck when connecting to my EC2 instance. I did try both SSH with .pem file or EC2 Instance Connect. Everything was ok in the first time. But after that, something went wrong.
I tried to terminate my instance and launch new one once. But the new instance get this error too. Too weird.
This is error text when connecting via EC2 Instance Connect.
And this is log when connecting via SSH with verbose
And this is the security rules for my instance
Does anyone know solution for this case? Thank in advance.
-- UPDATE 1--
Result after run Reachability Analyzer with source (gateway) and destination (instance)
yes, all problems in ssh is in the user name inside of the instance, So follow these steps to solve your problem:
go to ec2 dashboard and check what is the user name inside your
instance.
make new connect with instance and download new file ".pem" from
ec2 dashboard.
make new file and named it "config" in local machine with this
path :
~/.ssh/config
write this code below in your config file
# Enter the alias of the ECS instance to connect to the instance by using an SSH key pair.
Host ec2
#Enter the public IP address of the instance.
HostName <public IP>
#Enter the port number. The default port number is 22.
Port 22
#Enter the logon account.
User <put the user name you found in your instance>
#Enter the address of the .pem private key file on your PC.
IdentityFile <~/Desktop/myservice.pem>
if you want to ssh it just do like this
ssh ec2
I create ec2-instance on the AWS server:
Now I try to connect to the server with putty.
First of all, I downloaded the PPK for instance:
In the next I created a connection with putty:
After I launch connection and set the username as ec2-user:
in the result I got the error:
How to correctly connect to the ec2 instance with PPK?
What I understand from the question is that you did launch an EC2 instance successfully and afterwards you generated a new SSH key pair which does not have any connection to the already created EC2 instance.
What you should have done is to create a new key when the instance was launched:
OR select an existing key:
Now, the easiest way to solve this problem is to terminate the EC2 instance and recreate it with your existing key pair. You should be able to chose wlifter-ppk from the dropdown.
If, for some reason, you don't want to do this or it is not possible to terminate and relaunch the instance, there are several ways to rescue the instance and attach an existing SSH key.
I. Manually rescue the instance:
From Putty convert you .ppk to RSA public key.
Use EC2 Instance Connect or Session Manager to connect to your instance.
Locate the .ssh/authorized_keys file. For Amazon Linux instances this can be found in /home/ec2-user/.ssh folder.
Open authorized_keys, append the new RSA public key and save the file.
Connect to the instance using Putty.
II. Use EC2Rescue tool https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-boot-issues/
I assume you have local Windows and you'd like to connect to your EC2 AWS linux VM.
Use PuTTYgen to generate SSH-2 RSA key, 2048 bits.
Save keys into file, ie. myaws1.pub and myaws1.
In AWS dashboard, find your live instance, open up shell. It'll open up in the browser.
You will be logged in most likely as ec2-user
vi .ssh/authorized_keys
On your Windows, open up myaws1.pub file. take the relevant part and make it one line. Yes, it's broken up into multiple lines. Now press CTRL-C. And over in the browser where you Linux shell, press ESC-I (for insert), now CTRL-V (paste). Save and exit vi.
Back to Amazon Dashboard, in Network Security -> Security Groups, create SSH inbound rule with source 0.0.0.0/0
Now, when connecting to your instance from Putty use "Auth" in options.
This is what your new line in auth file should look like. I shortened it
ssh-rsa AAAAB3......... aws1
I have created an EC2 Linux Instance in AWS. I used Ubuntu Server 20.04 LTS (HVM) AMI. After create the instance I was downloaded the key pair file (.pem). I gave it a name "EC2-Key-Pair". Then I launched the instance. Then in my Kali Linux system I open a Linux terminal where I saved the .pem file. After that I used this command:
chmod 400 EC2-Key-Pair
After run this command, I used this command:
ssh -i "EC2-Key-Pair.pem" ubuntu#ec2-13-232-252-152.ap-south-1.compute.amazonaws.com
Where ubuntu is the username and
ubuntu#ec2-13-232-252-152.ap-south-1.compute.amazonaws.com
is the Public IPv4 DNS of my instance. But when I executed this command I get this error:
Host key verification failed.
How to fix this error. I have executed this command using sudo and not using sudo. But both way was failed. Even I searched the error on internet, I found a solution that by using this command I can fix this error:
ssh-keygen -R Hostname
Where I used my instance's public IPv4 DNS as Hostname:
ssh-keygen -R ec2-13-232-252-152.ap-south-1.compute.amazonaws.com
But it shows an error that:
Cannot stat /home/sanniddha/.ssh/known_hosts: No such file or directory
Error after execute the SSH command as root user
Error after execute the SSH command
Error after execute ssh-keygen -R Hostname
This error means that there is something changed in your instance since the last login, and most properly
you created the EC2 instance, with No fixed IP assigned to this instance. so
When you start this instance, it will get (dynamic) IP and a DNS name which will be based on that IP.
If you shutdown the instance and start it again few hours later, it might get a new IP and a new DNS name.
The trouble you are getting because of the ssh key fingerprint changed. In general, it is not a bad thing and you accept the warning but double-check everything.
What is an SSH key fingerprint and how is it generated?
What can cause a changed ssh fingerprint
In your case, it might be because you launched an instance earlier and which has a similar DNS name that got added to ~/.ssh/known_hosts file.
xx.xx.xx.xx ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBP2oAPXOCdClEnRzlXuxKtygT3AROcruefiPi6JPdzo+=
You can clean ~/.ssh/known_hosts by issueing following command
ssh-keygen -R ec2-13-232-252-152.ap-south-1.compute.amazonaws.com
As the IP got recycled on AWS side for the instance when you launched a new instance. The new instance has a different ssh fingerprint from the one you have in your ~/.ssh/known_hosts file, hence the warning.
As pointed out already, you need to open port 22 for your IP to access the instance.
If possible use IP address instead of DNS name for ssh. Plus for ssh you don't need sudo
I'm trying to use elastic beanstalk to deploy an application and one of the things I need to do is be able to log into the underlying ec2 instance and add dependencies. I added a key pair to the instance and put the private key file in ~/.ssh on my computer. Next I specified the key pair for the ec2 instance and it restarted and eventually the status was green
When I try to ssh into the ec2 instance I get the following error:
$ ssh ec2-user#myinstance.us-east-1.elasticbeanstalk.com
ec2-user#myinstance.us-east-1.elasticbeanstalk.com: Permission denied (publickey).
In the docs is says this could be due to an incorrect username.
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.html
Does anyone know what the default username is for ec2 instances created by elastic beanstalk?
Also if I'm doing this all wrong would appreciate some pointers there too.
1.To make sure that the there's no mistake the way you connect:
Go to EC2-> Instances
Select your instance
And press Connect
You should get the command to connect from the instructions from the Connect Popup. The correct username is mentioned there plus instructiins on how to set the correct permissions on the pem (applies to linux)
2.
Make sure that you modified the security group of the instance you're trying to connect do that it allows ssh from the ip of your pc. (This is not the case for the question, since the error is Permission denied (publickey), it means that it's not an sg issue, thx #diego)
3.
Also if you connect from a corporate network, try connecting from another network. It might be firewall issue.
4.
Last but not least make sure you ssh inside the .ssh path, or provide the correct pem path
The following instructions are given for the ec2 instance that I'm trying to connect to:
To access your instance: Open an SSH client. (find out how to connect
using PuTTY)
CHECK!
Locate your private key file (keypair.pem). The wizard automatically
detects the key you used to launch the instance.
I launched Putty with a .ppk and I also still have the .pem sitting on my local machine. However, how does this help once I am in the aws Linux terminal?
It sounds to me that the .pem should now be located on the remote machine, not my local one.
Your key must not be publicly viewable for SSH to work. Use this
command if needed: chmod 400 keypair.pem
This is fine once the previous step is clearer.
Connect to your instance using its Public DNS:
ec2-xxxxxxxxxxxxx.eu-west-1.compute.amazonaws.com
Example: ssh -i "keypair.pem"
root#ec2-xxxxxxxxxxxxx.eu-west-1.compute.amazonaws.com
I am currently typing this in (also trying ec2-user instead of root) but I get the following:
Warning: Identity file keypair.pem not accessible: No such file or directory.
Permission denied (publickey).
Please note that in most cases the username above will be correct,
however please ensure that you read your AMI usage instructions to
ensure that the AMI owner has not changed the default AMI username.
In case this is important, what user name are they referring to here?
I have also made sure the I can SSH into the security group from all locations.
Christopher, I am not sure if you have access to the AWS console, but If you do, then it will be easy to find out the correct user name of your EC2 machine. click on the check mark box to pick your instance, then click Connect, and it will show you the correct user name. If it is an amazon AMI image, it will most likely be ec2-user, other images can have root, ubuntu, bitnami, or any other user configured by the AMI creator.
Your error message: " Warning: Identity file keypair.pem not accessible" indicates an issue with your private key not being accessible.
You said you converted the .pem to ppk for putty, which will enable you to SSH via putty. If you need to SSH from an EC2 machine to another EC2 machine, you will need that private key with the "pem" extension.
Think of your private key as your password, except that it's stored in a file.
ssh -i "keypair.pem" root#ec2-xxxxxxxxxxxxx.eu-west-1.compute.amazonaws.com
This command says: Log me in via SSH protocol to server xxxx.eu... using password file (Private key) "keypair.pem" that resides in the current directory.
if you do an "ls" and you don't see "keypair.pem" then that is your issue.
I hope that helps!