I have a question about the aws ssh issue since I have a private and public subnet in VPC, I created a NAT server in public subnet and plan to use this NAT server to connect to our web server in private subnet, I also use the same key pair, which is AWS console provide, to build up both instance (NAT and web server), when I tried to connect to the NAT with public IP with this key, it works, when I tried to use this NAT server to remote login into webserver, it always ask me a passphrase, I don't know how to find the default passphrase with AWS provide, both instances uses Amazon linux instance as server. I have tried the following things

  1. change the authroized_key in NAT server owner ship chmod 600 ~/.ssh/authorized_key

  2. Wait over 5 mins to buildup both instances, but it doesn't work

  3. Applied all traffic with inbound and outbound, and also security group is

migrated from stackoverflow.com Jun 3 '16 at 7:03

This question came from our site for professional and enthusiast programmers.

  • Can you be more explicit about what you mean by "tried to use this NAT server to remote login into webserver" ? – Robbie Averill May 27 '16 at 3:21
  • Post the output of ssh with -v option. – helloV May 27 '16 at 4:44
  • The following ssh -v as below – user2302406 May 27 '16 at 5:13
  • This is unrelated to EC2, but about ssh key usage and files in general. You can't log in to A then from there log in to B unless you have a copy of a private key on A that you can use when logging in to B... and you don't. authorized_keys contains public keys, not private. Leave it alone. It's not an identity file, not usable with -i. You "could" put B's private key on A, but you "should" use an SSH tunnel through A to B. Security groups are unrelated, and the is 0 wait time needed. – Michael - sqlbot May 27 '16 at 10:57
  • Look at forwarding the ssh agent. Either with a -A flag to the ssh client or by adding ForwardAgent yes to your ~/.ssh/config file. Test the forwarding with ssh-add -l on the remove shell. – Amos Shapira Dec 21 '16 at 22:50

by using putty directly you can't login to private server. You have to login to bastion server and then ssh to private through bastion server. And also try to change the key permissions to 400, by using chmod command.

So by using winscp share that pem file to the bastion server and change the permission of file to 400 and then try ssh to private.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.