I am new to EC2 and I am getting this error:
Using username "ec2-user"
Server refused our key
Disconnected: No supported authentication methods available (server sent: publickey)
I am using Amazon Linux AMI 2017.03.1 (HVM), SSD Volume Type so my username is correct. I have also converted the pem file into ppk file and added into SSH-Auth in putty console.
I have looked at all the solutions in StackOverflow for my problem but none seem to work.
In my VPC dashboard -> Network ACLs -> Inbound Rules
Rule # Type Protocol Port Range Source Allow / Deny
100 ALL Traffic ALL ALL 0.0.0.0/0 ALLOW
* ALL Traffic ALL ALL 0.0.0.0/0 DENY
Could this be a reason for the error?
The Network Access Control List (NACL) is not a problem. Just leave it at the default setting. The fact that you are connecting to the server (even though it is refusing the connection) is proof that there is connectivity between your computer and the Amazon EC2 instance.
The problem lies in authentication. It is basically saying that it doesn't like your key pair.
Make sure the PEM file that you converted has the same name as the Key Pair associated with the instance (as shown in the management console)
Try converting the key again -- it might not be in the right format
See: Use PuTTY to access EC2 Linux Instances via SSH from Windows (You don't need to use Pageant.)
Related
I have an EC2 Windows 2019 Server instance in a VPC in the private subnet. I have a bastion instance in the public subnet, and I know the bastion instance works, because it is being used for internet access for my Lambda API. I have VPC endpoints to:
com.amazonaws.eu-west-2.ssm
com.amazonaws.eu-west-2.ec2messages
com.amazonaws.eu-west-2.ec2
I would like to connect with RDP to the EC2 instance to manage my MySQL RDS instance. I have been trying to get Systems Manager Session Manager Port Forwarding to work, following several guides.
I have tried every guide I could find, and everything seem correctly setup.
Is it required to have specific ports setup inbound / outbound on the bastion instance SG, or on the SG the EC2 I want to RDP to is in? I have not been able to see that anywhere.
I have run AWSSupport-TroubleshootRDP and everything pass with "Success" and from the output everything looks good.
When I run the port forwarding command on my machine it starts the session, but I never get "Connection accepted" and the RDP connection fails when I try that.
Can anyone point me to what else I can do to verify that I have the correct network configurations, and to test why I am not getting "Connection accepted", as I have seen I should be getting from the guides.
Thanks in advance.
To test the ability to run RDP via Session Manager Port Forwarding, I did the following:
Launched an Amazon EC2 instance running Microsoft Windows Server 2019 Base
Associated an IAM Role with AmazonSSMManagedInstanceCore permissions
Set the Security Group to no inbound connections (to confirm that connections were being made via Session Manager)
Confirmed that I could use Session Manager to connect to PowerShell on the instance (using the Session Manager console)
Ran the following command on my Mac:
aws ssm start-session --target i-xxx --document-name AWS-StartPortForwardingSession --parameters '{"portNumber":["3389"],"localPortNumber":["3389"]}'
Used Microsoft Remote Desktop (which connects via RDP) to connect to localhost
It prompted me for a password. I used Get Windows Password to decode and obtain the password.
It connected successfully
So, yes, you can use Session Manager Port Forwarding to establish an RDP connection with a Windows instance even if it is in a private subnet (which I simulated by removing all inbound rules on the security group).
If you are having further problems, it might be due to your VPC Endpoint configurations.
i have a problem, im trying to connect to my instance EC2 with SSH, but say: Connection closed by IP port 22
I was checking all the configuration, im using a Mac with iTerm (also try with terminal) and is not working, looks like AWS EC2 block my Key PEM.
I ask to AWS support, but they said my IP is not block and they dont see any problem...
What I try is open my port 22, enable the remote login, change the permission to my pem.
Also I configure my inbound connection, with the same configuration of another instance and is working.
I was searching for a solution, but I don't have a solution, maybe I can create another instance and move the content to another instance, but I don't know if I can do that?
any information will be helpful
Check that the username was incorrect. On ubuntu instances it should be "ubuntu" and on amazon instances it should be "ec2-user".
You need to check for the following steps in order to connect EC2 from Mac:
First download the pem file used / created at the time of instance creation.
We have a benefit using Linux / Mac over windows as PEM file created can directly be used to connect. For windows we need to convert it into PPK file.
Now change the permission of the file to Read / Write and make sure the file extension is .pem and not .txt
Check the EC2 permission weather the port is being enabled or not using the following sub steps:
Check the Routes Table for port 22 incoming request is allowed or not.
Check the Network Access Control List of the VPC at the subnet weather the incoming request at port 22 is allowed or not.
Check the Security Group of the instance that weather port 22 request is allowed or not.
By default all the incoming request is being Blocked by the AWS. And
we need to enable the port with the corresponding protocol to allow or
not.
If you have no idea then simply you can set the permission to ALL REQUEST to 0.0.0.0/0, this will enable to connect your EC2 to the internet and to your ssh as well.
Hope this helps.
After many days of struggling with this issue i found solution. You just have to stop your instances and de-attach your volumes and reattach them and it will work like charm. Hope it help you out.
I recently changed port field with custom port sshd_config file on amazon ec2.
However, it doesn't respond to ssh -p1234 user#domain.com because of security groups.
I have my ssh port (22) open on security group but I need to make it 1234 but on aws console, when I changed ssh source to 0.0.0.0/1234 it says unable to find group.
So, how do I set security group right ?
You appear to have confused the port with the CIDR address.
The CIDR annotation describes the range of addresses which are permitted to establish connections on a port - if you want anyone to be able to access the port from any address, use 0.0.0.0/0.
You then specify the port separately, which in your case is 1234.
Please note that changing your ssh port is not considered as a best practice. Network scanners will find your 'hidden' ssh port in no time. It is actually worse than having ssh on 22 since it provides you with false sense of security.
Consider restricting the actual scope of this service to your home / office IP addresses (as instructed by AWS Trusted Advisor)
You can even utilize Dome9 to have this port normally closed and only opened on demand.
(disclaimer: I'm a proud Dome9'er)
Am following this tutorial
http://thoughtsandideas.wordpress.com/2012/05/17/monitoring-and-managing-amazon-rds-databases-using-mysql-workbench/
I am not able to Test DB Connection while creating new server instance to connect to the RDS database.
It says Bad_Authentication[allowed_types=public_key], i have a tried different .pem files and have done through a lot of forums.
I have also allowed access to my IP in the DB SecurityGroups for RDS and the Security Groups for EC2.
Please help me out. Thanks.
This worked for me. Assuming you have logged into AWS:
Go to RDS -> Databases -> Select your database
Make sure the Public Accessibility value is Yes
Check your IP address using http://checkip.amazonaws.com/. If it is not added to the Security Rule Groups, you should add it. this step is crucial
3.1. Click on the rule name. This will open up a new tab, then click in the name of the rule.
3.2. Click on Edit inbound rules
3.3. Click on Add new rule, and add a rule with the following values:
Type: MYSQL/Aurora.
Protocol: TCP (default)
Port range: 3306 (default)
Source: My IP -> This will be the IP Address you got at http://checkip.amazonaws.com/.
Fill information in MySQL Workbench
Hostname: Use the value you have for Endpoint at Connectivity and Security
Port: Use the value you have for Port at Connectivity and Security, by default it is 3306.
Username: Use the value you have for master username at Configuration
Password: Use the value you set when you created the database instance.
If you forgot the password, you can change it by clicking on Modify in your database instance)
I hope this also helps you.
In my scenario the problem was simple
I had to enable 3306 port for MYSQL in the related Security group in RDS > db instance section.
For RDS no need to use ssh. You can directly connect the RDS with MySql workbench.
Follow the following steps-
Make sure that in Security Group you should have provide access for MYSQL
Open MySQL workbench and setup New Connection.
Provide a Connection Name.
Connection Method is set to Standard (TCP/IP)
In the HostName provide your RDS end point
Port is 3306
Enter the username what you have given in the RDS.
Test Connection, and provide the password.
That's it.
For Reference GoTo This Link
If you are not using EC2 Instance to connect with RDS DB Instance then DB Instance should have public access to connect.
While launching DB Instance you need to set Publicly Accessible to yes. You will get Public IP to connect from outside network. That means outside of VPC.
You need to launch DB Instance in Public Subnet which has directly access to Internet. To check Subnet has Internet access, you need to check Route Table which was attached with the subnet. In Route table, check Internet Gateway is attached to the subnet.
You don't need to SSH into DB Instance. Though the option is not available also.
In MySQL WorkBench, click on Setup New Connection.
Give connection name. Choose Standard (TCP/IP) option. You are not trying to connect DB Instance over EC2 Instance so the option with SSH with not work out in this case. You have to provide MySQL hostname, username, password and port.
To verify connection, click on Test Connection button.
If you want to use EC2 Instance and connect DB Instance over EC2 Instance, you have to use Standard (TCP/IP) over SSH option. Check the following link
What would prevent me from connecting to a MySQL server on AWS RDS from an AWS EC2 VM?
I had the same issue. I think you need to enable inbound traffic to the VPC. Follow the below article and you'll be fine. Default VPC is not allowing users to access 3306 by default and you need to allow traffic.
RDS and MySQL Connectivity
Make sure Public accessibility should be yes.
Also, Inside security Group section, click on the security link and then add a new rule under inbound rule section which will whitelist your IP address with the below data :
Type: MYSQL/Aurora.
Protocol: TCP (default)
Port range: 3306 (default)
Source: My IP -> This will be the IP Address you got at http://checkip.amazonaws.com/.
Hope this will help to connect with AWS RDS successfully. Thanks!
Based on the details in your question, it seems that you are trying to SSH into the RDS instance. This is not supported on RDS, it only works for EC2 based MySQL servers.
You should instead connect directly to the MySQL server, on port 3306 (or the one you set manually, if this is the case) and using the username and password you created when provisioning the RDS instance. This means using the Connection Type "Standard TCP/IP" in WB.
Also, the public IP address of the machine you're using MySQL Workbench on should be allowed in the RDS security group.
Even I had the same issue, like after trying all the things out there. A thing worked is modifying the RDS database and making it publically accessible. That sorted things out.
All of the other answers are extremely helpful to debug the connection process but for me the literal fix was to not put in the password into the keychain when initializing the MySQL Connections. Instead, I pressed Test and put in the password when prompted to do so. Running on macOS Monterey V.12.3.1 with a MBP M1, 2020
I created a VM using Hyper-V on my local machine which I can RDP onto fine. I exported the VHDX to VHD and then uploaded it to AWS via the API.
This created a new EC2 instance for me but I cannot connect to it as it has no security keypair associated.
Thus I created a private AMI from the instance and re-instantiated a new EC2 instance from this AMI, setting the keypair in the process to ensure HTTP, RDP etc are permitted. The EC2 instance is running, but when I download teh RDP shortcut if fails to connect. I've tried rebooting the instance several times (as this was one of the suggested solutions on here when I searched) but it hasn't helped.
I also cannot ping any of these instances via the public DNS or private DNS.
Any idea what I'm doing wrong? I'm not even getting as far as the password prompt, its the connectivity is the problem.
Thanks
I had a similar problem - this is the tip from the AWS documentation that helped me solve it:
Verify that the route table for the subnet has a route that sends all traffic
destined outside the VPC (0.0.0.0/0) to the Internet gateway for the VPC
Additional debugging tips for this problem can be found here: Remote Desktop can't connect to the remote computer
The problem is probably the security group configuration attached to the instance. Make sure you have inbound TCP port 3389 permitted to be able to connect via RDP.
in username type:
.\Administrator
....and your decrypted password
See, this is local user. but you dont know real local hostname, that different from public DNS name.
Was helpful for me, hope for you too.
My guess for the reason you aren't getting anywhere has to do with the host certificates.
Be mindful that each computer connecting to the server via RDP needs to have an IAM user in AWS with an X.509 certificate uploaded to their account.
When importing or creating a windows AMI it is best to install and configure the EC2Config service.
The EC2 Config service does the following when you launch the instance:
At initial setup:
Sets the hostname to the private DNS name
Generates and sets a random password on the Administrator account
Initializes and formats the ephemeral disks
Generates and installs the host certificate used for Terminal
Services
Syncs the instance clock with a time server
After initial setup:
Writes the last three entries in the System event log to the Amazon
EC2 console so you can debug startup problems.
Prepares instances for bundling
Also, by default, security groups do not allow you to ping the instances. You must enable ICMP in the security group.
Hope that helps.
EDIT: Here is the link to the 64bit version of the EC2Config Installer
I also had the same problem. This is what I got from EC2.
Public DNS ec2-23-22-109-251.compute-1.amazonaws.com
User name Administrator
Password MyPassword
On the remote desktop, enter the domain and user name as
ec2-23-22-109-251\Administrator
If you paste the password is may not work, try to paste it but reenter the last 1 or 2 characters. Once you get the security certificate prompt accept/install it and your connection should open soon.
This is what worked for me:
Use your cell phone as a "hot spot" - which gives you a static IP address. That worked. Now, I'll need to contact my Internet provider to assign a static IP to my wireless router. Currently, it is spitting out DHCP IP addresses.
UPDATE:
12.7.2016
You need to go to the Security Group, select the Instance, then EDIT the RDP. If you click "MyIP" that should work for those of us working from home. If you are onsite, you may need to put in a custom CIDR.
After rebooting an EC2 instance, I found that I needed to reassociate the Elastic IP address associated with the instance. You click the button below then select the instance and private instance IP address when prompted.
RDP access worked after this step.
After patching Windows 2019 on my server, I couldn't access the instance anymore despite all my working settings didn't change. I used EC2Rescue to fix my issue
Please refer to the link below for details on how to use it: https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/troubleshoot-connect-windows-instance.html#AWSSupport-ExecuteEC2Rescue