thank you for your time.
I have an EC2 instance, but for security reasons i need to change the pem files associated in .ssh/authorized_keys. I do understand that the public pem file goes into authorized_keys.
I do not want to mount the volume of the ec2 instance to a new one. I am considering as a last option since I do have access to the EC2 instance.
How can this be done?
I have tried:
This post Change key pair for ec2 instance the answer by Pat Mcb, but no luck.
Run this command after you download your AWS pem.
ssh-keygen -f YOURKEY.pem -y Then dump the output into
authorized_keys.
Or copy pem file to your AWS instance and execute following commands
chmod 600 YOURKEY.pem and then
ssh-keygen -f YOURKEY.pem -y >> ~/.ssh/authorized_keys
But that didn't work for me. If i follow it exactly download aws key pair key, and follow the instructions by coping the key when ssh into the instance, when i do ssh-keygen -f YOURKEY.pem -y >> ~/.ssh/authorized_keys It asks for a passphrase (never had to input one)
What i am doing is the following.
I create a new key with
ssh-keygen newpem.pem
and the .pub file i copy it in .ssh/authorized_keys
Can someone explain what i am doing incorrectly?
Note the authorized_keys file has the correct permissions.
Seems like you want to deprecate the old key and use a new key instead. These steps may help you -
Create a new key pair using the aws console and download it onto your system.
Retrieve the public key from the private key(.pem) file using the command - "ssh-keygen -y"
SSH into the instance using the old key.
Once you have access to the instance add the public key you got in step 2 into the "~/.ssh/authorized_keys" files and then save the file.
Log out of the instance and then try accessing the instance with the new key.
Hope it helps. Thank You !
You Don't even need to do all of this just mind few things with AWS EC2 you get a private key for default users . like ec2-user /ubuntu etc.
You are doing the right step
ssh-keygen -t rsa -C "your_email#example.com"
if it ask for entering any paraphrase leave it blank.
Just press to accept the default location and file name. If the .ssh directory doesn't exist, the system creates one for you.
Enter, and re-enter, if passphrase prompted
you have that key now .
Copy that key
Login to your Ec2 server.
sudo su
vim ~/.ssh/authorized_keys
paste the key.
:wq!
You'll see a key there copy it and save it as a backup somewhere.
Now paste your newly generated key in that file
and save the file.
now final step to take care is the permission, so run the following command.
sudo chmod 700 .ssh && chmod 600 .ssh/authorized_keys
Now you're good to go you.
Following are the steps to change your keypair on AWS EC2.
Login to AWS Console. Go to the Network and Security >> Keypair.
Give the name of your keypair (mykeypair) and keytype (RSA) and Private
keyformat (.pem). and click on the create keypair. It will ask you to
download .pem file in your local machine. Save it at and remember the
location.
Login to your EC2 instance and go to the .ssh. location. Create a new file called
(mykeypair.pem) and paste the content from the file we downloaded in step no.2
Run the command: sudo chmod 600 mykeypair.pem
Run the command: ssh-keygen -f mykeypair.pem -y and it will generate some
content. Copy that content. Open the file called autherized_keys and
remove all the content from it.
Paste the copied content that we have generated in the previous step. Also enter your file name (mykeypair) in last after entering space.
Reboot your instance. Go to the puttygen and generate the .ppk file
using the pem file you have downloaded from the keypair. You will be able to login your ec2 with the newly generated .ppk from putty.
Okay I figured out my problem. First of all I had been hacked by a hacker apparently because I didn't know that permitpasswordlogin: yes DISABLES pubkey authentication.... I thought it was additional security. So i used a very loose password that could be easily guessed. Anyways, I believe this because I went to the root folder and found that there was actually a new key in the root named "el patrono 1337" which actually means "the master/boss" in spanish... LOL. Anyways... So i changed that back to my secure key (made a new one actually) and then I went to login as ec2-user and couldnt, but could as root. was driving me crazy for 30 minutes or so until I realized I had accidentally changed the owner of my ec2-user folder to root and therefore ssh was not searching the ec2-user .ssh/authorized_keys when I tried to log in. Wow very glad that's over lol. And just fyi guys I don't think the hacker installed anything malicious, but I did get tipped off that he tried to ssh into other people's servers (who claim they get attacked by ssh alot according to the aws abuse report) from my machine. I'm running a very simple website with zero sensitive data etc. He didn't even block me out of the machine by disabling password authentication.(i guess he didn't want me to know?). I will build a new instance from scratch next time I want to add anything(will be pretty soon) just to be on the safe side.
I've been trying for ages to deploy a library to clojars without having to specify username and password using lein deploy clojars. But I end up with the following error message:
gpg: gpg-agent is not available in this session
gpg: can't query passphrase in batch mode
gpg: Invalid passphrase; please try again ...
gpg: can't query passphrase in batch mode
gpg: Invalid passphrase; please try again ...
gpg: can't query passphrase in batch mode
gpg: decryption failed: secret key not available
Could not decrypt credentials from /Users/johan/.lein/credentials.clj.gpg
nil
See `lein help gpg` for how to install gpg.
No credentials found for clojars
See `lein help deploying` for how to configure credentials to avoid prompts.
My ~./lein/credentials.clj.gpg looks like this (unencrypted):
{ #"https://clojars.org/repo"
{:username "<username>" :password "<password>"}}}
I know that the username and password are correct (they are just copied from 1password).
Running gpg --list-keys gives me:
/Users/myname/.gnupg/pubring.gpg
-------------------------------
pub 2048R/0486A2C5 2010-10-12
uid My Name <myname#somemail.com>
sub 2048R/0617110A 2010-10-12
I've tried specifiying both 0486A2C5 and 0617110A in ~/.lein/profiles.clj (:signing {:gpg-key "<key>"}) but it doesn't make any difference.
I've also made sure that use-agent is uncommented in ~/.gnupg/gpg.conf and I've also made sure that gpg-agent is installed on my machine (brew install gpg-agent).
Update 1
Running gpg --list-secret-keys gives me:
/Users/myname/.gnupg/secring.gpg
-------------------------------
sec 2048R/0486A2C5 2010-10-12
uid My Name <myname#somemail.com>
ssb 2048R/0617110A 2010-10-12
Running gpg --quiet --batch --decrypt ~/.lein/credentials.clj.gpg prompts me for my password and then yields the unencrypted results.
Update 2
I'm using gpg 1.4.20 and gpg-agent 2.0.29 (both installed using brew) on Mac OS X El Capitan.
What am I missing!?
I solved this by uninstalling gpg from brew (brew uninstall gpg) and then install the binaries from gpgtools. I then opened the terminal and created a symbolic link from gpg2 to gpg:
$ ln -s /usr/local/MacGPG2/bin/gpg2 /usr/local/MacGPG2/bin/gpg
Then I added /usr/local/MacGPG2/bin to the PATH in my ~/.profile. When running lein clojars deploy I now get a graphical user interface where I enter the password and afterwards it successfully signs the release and publish the artifacts.
The easiest way to address this issue is to attempt to decrypt a file using gpg with the --batch flag. I think you'll find that your agent is installed but has not been started, or is perhaps improperly configured. If you can get gpg to work with --batch, then the deploy command will work.
My experience has been that naming the jar file you want to deploy with -SNAPSHOT on the end means that you do not have to set up public/private keys.
I'm totally new using SaltStack and AWS, probably this is a dumb question, I created an AMI (using packer) with SaltStack (masterless) as a provisioner... I was able to connect via ssh and make a configuration to the minion. I was able to run salt-call state.highstate successfully.
Later, I lost the connection to my instance,
([root#<ip> ec2-user]# Write failed: Broken pipe) and after that, I wasn't able to connect again.
What's been tried:
Reboot the instance and didn't work
I've checked the permissions on the .ssh files and they seem fine
Create a new instance and use the same key.pem and I was able to connect to this new instance.
I'm not sure if I'm missing a configuration in SaltStack. Is there a possibility that the keys on my instance changed after running salt-call state.highstate ??
What am I doing wrong?
There's nothing inherent in running highstate that would have terminated the SSH connection and prevented you from reconnecting. I would suspect it's something in your SLS files which is breaking SSH - which is applied when you run highstate.
Things that might have been done by your Salt states:
your SSH keys were removed/mangled
opensshd config was changed
openssh-server was uninstalled
EDIT: Having seen the output from Salt in the pastebin linked in comments, it's probably the AuthorizedKeysFile option being commented out:
-AuthorizedKeysFile .ssh/authorized_keys
+#AuthorizedKeysFile .ssh/authorized_keys
I recommend using file.replace to patch in specific changes you need, as opposed to replacing the whole /etc/ssh/sshd_config with a new version.
I want to deploy a Clojure library using Leiningen. I have done the following things:
installed gpg
created a gpg key-pair
encrypted my Clojars credential into ~/.lein/credentials.clj.gpg
installed gpg-agent
installed Keychain
When I call 'lein deploy clojars', I get the following output:
WARNING: please set :license in project.clj.
Could not decrypt credentials from ~/.lein/credentials.clj.gpg
gpg: can't query passphrase in batch mode
gpg: decryption failed: secret key not available
See `lein help gpg` for how to install gpg.
No credentials found for clojars
See `lein help deploy` for how to configure credentials.
Username:
I then uninstalled gpg, installed gpg2 and made a symlink from gpg to gpg2. When I now call 'lein deploy clojars', I get:
WARNING: please set :license in project.clj.
^CCould not decrypt credentials from ~/.lein/credentials.clj.gpg
pinentry-curses: no LC_CTYPE known - assuming UTF-8
pinentry-curses: no LC_CTYPE known - assuming UTF-8
pinentry-curses: no LC_CTYPE known - assuming UTF-8
pinentry-curses: no LC_CTYPE known - assuming UTF-8
gpg: signal Interrupt caught ... exiting
See `lein help gpg` for how to install gpg.
No credentials found for clojars
See `lein help deploy` for how to configure credentials.
Username:
After the warning, the command waits for an input, from which I can only exit by pressing ctrl-c.
Can anyone tell me what I need to do in order to deploy the library?
lein made deploying to clojars as simple as possible with lein-clojar plugin.
First, create ~/.lein/profiles.clj file with the following content:
{:user {:plugins [[lein-clojars "0.9.1"]]}}
Unfortunately, you can't use passphrased keys with lein-clojar plugin, but you can generate new ssh key with lein keygen command. It will place new ssh key into ~/.leiningen/, so it will be used only by lein.
After generating a key, lein will print its public part to the console. You should copy it to your clojars account.
At last, you can deploy your project with lein push.
Of course, you can deploy your project without this plugins using lein deploy clojars and any ssh or pgp key. Probably, it's possible to use pathphrased keys with lein deploy clojars, but I'm not sure about it.
I've just setup my EC2 server following this video here exactly - http://www.youtube.com/watch?v=bBajLxeKqoY
I even chose the same server type, everything went well until it asked for the root password to my EC2 server...
Any suggestions?
Update
Updating this answer because of the activity:
Depending on if the system is ubuntu or Rhel the user varies.
For ubuntu it is
ssh -i my-pem-file.pem ubuntu#my-ec2-instance-address
For RHEL it is
ssh -i my-pem-file.pem root#my-ec2-instance-address
Connecting to an ec2 instance does not require a password, it would require only a pem file
and this is how you connect to it
ssh -i my-pem-file.pem ec2-user#my-instance-address
and remember to chmod 400 your pem file before ssh'ing
If you need to do things as root once you are in as ec2-user, use sudo su - that gets you to root and doesn't need a password. Somethings you do need that for, like looking at the tomcat log files
I had the same problem and after a lot of struggle, I read this page again:
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.html
Notice in the 4th topic it talks about the user name. It is usually ec2-user but if you are using RHEL5 distro it can be root and if you are using the Ubuntu the user name will be ubuntu - which was my case.
So alternatively try those:
ssh -i my-pem-file.pem ubuntu#my-ec2-instance-address for Ubuntu
or
ssh -i my-pem-file.pem root#my-ec2-instance-address for RHEL5
Hope it helps!
You will be asked for password when you enable PasswordAuthentication yes in your sshd_config. Try changing that to no. that should fix it.
Just for anyone else that might have the same problem
Just do
sudo su -
Worked for me
If you've moved/copied the pem file from another machine, the owner of the file may be different to the user that is running the ssh client. To change the owner of the file:
sudo chown <currentusername> <filename.pem>
Please use --query 'KeyMaterial' while generating key.
Info:
keyMaterial - an unencrypted PEM encoded RSA private key.
In my case, we had been copying a text file to keep a ubiquitous key. Someone accidentally added characters to this file, and we started getting prompted for a password from the now-corrupt .pem file, when we had never set a password.
In my case, the problem was the file's break type. Try this:
1.- Open the .pem file with TextWrangler
2.- At Bottom of app, verify if the Break Type is "Windows(CRLF)".
Regards
This is the way to connect:
ssh -i /path/my-key-pair.pem ec2-user#public-ip
Now, instead of ec2-user, it could be root, or centos, or ubuntu, or something else. You can check under the "Usage Instructions". If it's not there, and you've tried all the above users, find out from the documentation that came with the AMI.
There is one bug on AWS that cost me a lot of time. If you're launching an instance from a saved AMI under "Images > AMIs", note that it uses the original keys of the running instance it was created from. When launching the AMI, it will prompt you to choose a new key, and even show such key under the description, but the truth is those keys will never work!
So if you're using a custom/saved AMI you'll have to either get the original keys and use them, or just create a brand new one from AWS or the market place. If you haven't created the AMI or can't remember where it came from, look under the details tab. You can then launch a new instance or create a new AMI from the same source. This will then use the keys that you specify.
chmod 400 pem_file
ssh -i /path_to_the_pem_file ec2-user#ServerIP
or
ssh -i /path_to_the_pem_file ubuntu#ServerIP
root access is prohibited by default by AWS AMIs.
hope it helps.
Check your .pem file is not corrupt. Using this line
openssl rsa -check -in test.pem -noout
It should return RSA Key OK. If it doesn't then there is most likely a problem with some sort of formatting or something in your pem file.
You should use the *.pem instead of a root password. Once you have logged in use passwd to set a password.
It could be a Linux problem.
But there is also a chance that you use the wrong address/key (you started a new instance but still using the old address; or 2 pem have similar name, used the wrong one), "ssh with non-existing user".
I am using TurboLinux instance, on Mac OS system, please try this command:
ssh -i xxxxx.pem root#xxx.xxx.xxx.xxx (public address of allocated VM)
I can get through without asking password anymore.
In case someone else bumps into this, the solution for my problem was that I had to run it with sudo:
sudo ssh -i my-pem-file.pem root#my-ec2-instance-address
For me, the issue was that I had created an AMI from an existing instance, so when I launched the AMI, even though I selected a new key, the instance's original key was what worked.
Login to Amazone console in browser:
https://us-east-2.console.aws.amazon.com/ec2/xxxxxxxx
Click on instances from left panel -> then select your instance -> click on connect button at top right
You will see a window open and there will be a button ssh Client
Here you can see exact command to connect with your instance.