ssh with password into AWS EC2 instance - amazon-web-services

Question

I'm trying to set up an AWS instance for about 90 people where they can sftp in and drop files, but it appears that AWS blocks passwords for ssh and only allows in ssh keyed logins by default.
Does there exist a way to undo this behavior inside AWS and allow for normal ssh and thus sftp to occur? If I don't need to manage ssh keys along with user names and passwords that would be great.

Answer 1

You can enable Password Authentication following helloV's advice, however I would advise against this.
Why would you not just use SSH keys?
Each of these 90 people should have their own private key files that they use daily - each person who needs access to this machine, you should ask for their public key.
Take each developer's public key, and add them, line by line, to a file on the EC2 host at
/home/<user>/.ssh/authorized_keys
From here, each user will be able to login using
ssh -i /path/to/private/key <user>#ec2.host.com
sftp -oIdentityFile=~/.ssh/keyfile <user>#ec2.host.com
This is much more secure in that you will not need to have a single password shared between 90+ developers, that password which will at some point be written on a sticky note and lost, or someone changes and locks out the other 89 developers.
This also has advantages in that, if a single one of those 90 developers leaves the company, all you will need to do is remove their public key from _authorized_keys_ and that person looses access to the machine, you will not need to change that shared password for all users.

Answer 2

First open few terminal sessions to the EC2 machine, in case modifying SSH config fails, you still have an option to restore it to its old values.
Edit /etc/ssh/sshd_config (after saving a backup file to sshd_config.bak) and change the following lines to:
# Change to no to disable tunnelled clear text passwords
PasswordAuthentication yes
In addition, if you want to disable key based authentication:
PubkeyAuthentication no
Save the file and restart the SSH daemon:
sudo service ssh restart
Create a new user and set a password or if a password has been already set for an existing user: open a new SSH session and you should be able to login using a password. If the solution didn't work, use any of the other open terminal sessions to restore the old sshd_config, restart the ssh service and continue debugging.

Answer 3

The critical part is to modify /etc/ssh/sshd_config on the server and restart the SSH server (usually "service sshd restart" - note it is "sshd", not "ssh" at least on Red Hat).
PasswordAuthentication yes
You may also want to run
sshd -t
before you run "service sshd restart", to make sure that you don't accidentally lock yourself out by a typo in the sshd_config file.
Using public keys for authentication probably makes more sense, depending on your scenario.
If you use public key authentication and have anything like 50 people, make sure you also manage the keys properly. See https://www.ssh.com/iam/ssh-key-management or NIST IR 7966 more information. Properly terminating keys for people who leave is also required by most compliance regulations if you happen to be in health care, finance, government, critical infrastructure, or anything else that is regulated. Shared passwords are expressly forbidden by most regulations and generally bad security practice.
You might also want to look at CryptoAuditor https://www.ssh.com/products/cryptoauditor/, which can enforce file transfer policies (direction etc), make sure you don't accidentally give people shell access if not needed, and it can record who did what (for both file transfers and shell access).