Although my issue looks very generic and common, it doesn't seem to be identical to anything discussed here in stackoverflow. SecurityGroup has been set up with "MyIP" for ssh connection and I have been using correct pub IP to connect. Yet, I'm still getting timeout error as below. Is there something that I need to change in my Mac?
MacBook-Pro ~ % ssh -vvv -i ~/Documents/awsdemo/aws-livelessons.pem ec2-user#18.181.146.195
OpenSSH_7.9p1, LibreSSL 2.7.3
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug2: resolve_canonicalize: hostname 18.181.146.195 is address
debug2: ssh_connect_direct
debug1: Connecting to 18.181.146.195 [18.181.146.195] port 22.
debug1: connect to address 18.181.146.195 port 22: Operation timed out
ssh: connect to host 18.181.146.195 port 22: Operation timed out
Here's my Security Group. You can see that it does have correct protocol and entered with my public IP.
Security Group Screenshot
And I can confirm that it does match when I look up via terminal.
MacBook-Pro ~ % dig TXT +short o-o.myaddr.l.google.com #ns1.google.com
"58.12.38.113"
And the EC2 instance does have this security group attached.
EC2 Instance Screenshot
If there are any other ways to troubleshoot this, I'd really appreciate it.
Based on the comments, the issue was due to use of non-default NACLs. The solution was to allow SSH in the NACLs.
Related
Three weeks ago, I could launch an aws instance spot and ssh to it using:
ssh -v -i /home/me/.ssh/aws3.pem ubuntu#ec2-3-145-53-84.us-east-2.compute.amazonaws.com
where the adress was the one under 'Public IPv4 DNS'. Now they have changed the interface and when I go through the hops of launching a spot instance, and it runs, and I get the Public IPv4 DNS, and I plug it in the command above, I get:
OpenSSH_7.6p1 Ubuntu-4ubuntu0.7, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /home/me/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to ec2-3-145-53-84.us-east-2.compute.amazonaws.com [3.145.53.84] port 22.
debug1: connect to address 3.145.53.84 port 22: Connection timed out
ssh: connect to host ec2-3-145-53-84.us-east-2.compute.amazonaws.com port 22: Connection timed out
Fixed. In the new launch menu you have to replace the default
security group (under additional launch parameters - optional) by one of the existing ones (I picked launch-wizard-1). I guess they updated the default launch security group to something less user friendly.
I am trying to connect to an EC2 machine with the following command line on my terminal:
ssh -i id_rsa_aws <ec2_ip_address> -l ec2-user -vvv
Here is the result:
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 48: Applying options for *
debug2: resolve_canonicalize: hostname <ec2_ip_address> is address
debug2: ssh_connect_direct
debug1: Connecting to <ec2_ip_address> [<ec2_ip_address>] port 22.
debug1: Connection established.
debug1: identity file id_rsa_aws type 0
debug1: identity file id_rsa_aws-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.8
ssh_exchange_identification: read: Operation timed out
My ssh_config file:
Host *
SendEnv LANG LC_*
I know the problem must come from my computer. I have tried using the .pem file and I am getting the same error.
Any help would be appreciated.
Thank you
Things to check:
The instance is running Linux
The instance is launched in a public subnet, which is defined as having a Route Table entry to points to an Internet Gateway
The instance has a public IP address, which you are using for the connection
The Network Access Control Lists (NACLs) are set to their default "Allow All" values
A Security Group associated with the instance that permits inbound access on port 22 (SSH) either from your IP address, or from the Internet (0.0.0.0/0)
Your network permits an outbound SSH connection (try alternate networks, eg home vs work vs tethered to your phone)
See also: Troubleshooting connecting to your instance - Amazon Elastic Compute Cloud
$ ssh -vvv -i "AMSKeyPair.pem" ec2-user#ec2-52-43-0-65.us-west-2.compute.amazonaws.com
OpenSSH_7.4p1, LibreSSL 2.5.0 debug1: Reading configuration data
/etc/ssh/ssh_config debug2: resolving
"ec2-52-43-0-65.us-west-2.compute.amazonaws.com" port 22 debug2:
ssh_connect_direct: needpriv 0 debug1: Connecting to
ec2-52-43-0-65.us-west-2.compute.amazonaws.com [52.43.0.65] port 22.
debug1: connect to address 52.43.0.65 port 22: Operation timed out
ssh: connect to host ec2-52-43-0-65.us-west-2.compute.amazonaws.com
port 22: Operation timed out
Corresponding Security Group allos all inbound traffic on all ports.
I tried on different internet connections, so I don't think NAT is there.
PS: I am not a first time ec2 user, used it before.
Changed Security Group's source from sg-57710f2a to 0.0.0.0/0
Now it works. As #john-hanley pointed out sg-57710f2a allows only connection from within host under that Security Group not outside
I am not able to connect to my AWS EC2 instance via my college proxy. However it connects when using a non-proxy connection. The error is as follows:
$ ssh -i .ssh/aws-key-fast-ai.pem ubuntu#ec2-*----.us-west-2.compute.amazonaws.com -vvv
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to ________.us-west-2.compute.amazonaws.com [34.208.50.122] port 22.
debug1: connect to address *.*.*.* port 22: Connection refused
ssh: connect to host *-*-*-*-*.us-west-2.compute.amazonaws.com port 22: Connection refused
You can access it only if your ip is mentioned under inbound of aws server. When you are using a proxy , IP is getting changed which probably is not mentioned under the inbound.
I just found the answer.
https://wiki.metakgp.org/w/How_to_SSH_into_a_server_that_is_outside_the_campus_network
You have to install corkscrew and follow the procedure listed in the link above. Thanks.
The quickstart mentions a few times that, "You should be able to ssh into any node in your cluster ..." (e.g., http://kubernetes.io/v1.0/docs/user-guide/connecting-applications.html#environment-variables). I have tried as described below but I am getting timed out.
I used export KUBERNETES_PROVIDER=aws; curl -sS https://get.k8s.io | bash to start the cluster
I have only specified AWS_REGION in my environment
The nodes are residing in VPC and I am able to ping them from a bastion
This is the result:
ubuntu#ip-10-128-1-26:~$ ssh core#170.20.0.248 -v
OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to 170.20.0.248 [170.20.0.248] port 22.
debug1: connect to address 170.20.0.248 port 22: Connection timed out
ssh: connect to host 170.20.0.248 port 22: Connection timed out
ubuntu#ip-10-128-1-26:~$
Any idea or pointers would be appreciated. Thank you.
It looks like your problem is with making sure the corresponding security group is open to ssh from whichever nodes you'd like to connect from. Make sure it's open to the public IP or the private IP, depending on which you're connecting from. For the right ssh key to use: it'll be whichever one you setup when spinning up the nodes. You can check that in the EC2 pane of AWS in the "key pairs" side bar option: