Simple SSH connection to AWS is making me pull my hair out

Question

I created a simple free tier EC2 instance on AWS.

I'm trying to connect to it via SSH on my Windows 10 computer.

I downloaded the key before creating the instance, and stored it in a folder E:\folder

I installed the SSH client and server features on Win10.

The problem: I cannot resolve the permissions issues on my key.

I've googled and checked about 100 links now on the proper way to set up the permissions on my key file, but with everything I've tried, I always get "bad permissions" or "invalid format" accompanied by "Permission denied (publickey)."

Something is wrong with the permissions. I tried CHMOD even with cygwin but it hasn't resolved the issue.

I'm sure I'm missing the simplest thing but I've been racking my brain for a long while now and would really appreciate any assistance.

Thank you kindly,

Answer 1

Keys must only be accessible to the user and no other account, service, or group.

---

OpenSSH should be installed from the Win32-OpenSSH GitHub, not via Windows' Add Features

1. Remove the SSH client and server packages installed via Windows' Add Features.
2. Install Win32-OpenSSH:
   1. Configure user-specific ssh_config: %UserProfile%/.ssh/config (man page)
      Must be done prior to Step 3, else Step 3 will need to be completed again
      
      
   2. Configure system-wide sshd_config: %ProgramData%\ssh\sshd_config
      (man page), even if you're not going to utilize the SSH server portion, as the config linked to is more secure than the default
      Must be done prior to Step 3, else Step 3 will need to be completed again
      
      
   3. Configure system-wide ssh_config: %ProgramData%\ssh\ssh_config (man page)
      Must be done prior to Step 3, else Step 3 will need to be completed again
      
      
3. Execute the following scripts to fix permissions (as Administrator):

   powershell -ExecutionPolicy Bypass -File "$Env:Programfiles\OpenSSH\FixHostFilePermissions.ps1"
   powershell -ExecutionPolicy Bypass -File "$Env:Programfiles\OpenSSH\FixUserFilePermissions.ps1"
   

4. Create the PID file where OpenSSH expects it to be (as Administrator):

   mkdir "$Env:Programfiles\OpenSSH\appfiles"
   echo > "$Env:Programfiles\OpenSSH\appfiles\sshd.pid"
   

5. Ensure user's SSH directory (%UserProfile%\.ssh || ~/.ssh) has the correct permissions:

   ---

   Windows / Powershell Terminal

   ---

   • GUI:
     • [File] Properties - Security - Advanced
       1. Set Owner to the key's user
       2. Remove all users, groups, and services, except for the key's user, under Permission Entries
       3. Set key's user to Full Control
          
          

   • CLI:

     # Set Variable:
       $key="C:\Path\to\key"
       $ssh="$env:userprofile\.ssh"
     
     # Remove Inheritance:
       Icacls $ssh /c /t /Inheritance:d
       Icacls $key /c /t /Inheritance:d
     
     # Set Ownership to Owner:
       Icacls $ssh /c /t /Grant $(echo $env:UserName):F
       Icacls $key /c /t /Grant $(echo $env:UserName):F
     
     # Remove All Users, except for Owner:
       Icacls $ssh /c /t /Remove Administrator BUILTIN\Administrators BUILTIN Everyone System Users
       Icacls $key /c /t /Remove Administrator BUILTIN\Administrators BUILTIN Everyone System Users
     
     # Verify:
       Icacls $ssh
       Icacls $key
     

     
     

   ---

   WSL/Cygwin Terminal

   ---

   • CLI

     # Set Variables
     
       # Key
         key="/path/to/key"
     
       # User:
         user="$(echo $USER)"
     
     # Set Ownership
       # Assumes user's name is also user's group name
         chown $user:$user $key
     
     # Set Access Rights
       chmod 0600 $key
     
     # Verify
       ls -l $key
     

Answer 2

The windows 10 ssh client last year (and likely currently) only supported EdDSA ssh keys, AWS provides and only supports RSA.

Try installing putty and testing ssh with your keypair. If that works and you'd prefer to use the windows 10 ssh client, generate a keypair with the windows 10 client and replace the public key on your ec2 instance.

If that fails, verify the key you have is not missing any dashes on the first or last line.

It should resemble:

-----BEGIN RSA PRIVATE KEY-----
(key contents)
-----END RSA PRIVATE KEY-----

5 dashes at each end.