无法通过 SSH 连接到 EC2：权限被拒绝（公钥）

Posted 2023-03-04

【中文标题】无法通过 SSH 连接到 EC2：权限被拒绝（公钥）

【英文标题】：Can't SSH into EC2: Permission denied (publickey)

【发布时间】：2021-06-16 08:58:23

【问题描述】：

我无法通过 SSH 连接到由 Elastic Beanstalk 创建的 EC2 实例。我在 Stack Overflow 上浏览了有关此主题的所有答案，但没有找到帮助，所以我正在创建一个新答案。

我正在使用以下命令进行连接：

ssh -i <path-to-key.pem> ec2-user@<ec2-public-ipv4-dns>

当我这样做时，我得到：

ec2-user@<ec2-public-ipv4-dns> Permission denied (publickey).

我检查了以下几点：

我正在使用正确的密钥对。它连接到 EC2 和 EBS。 附加到 EC2 的安全组具有来自源 0.0.0.0/0 的 SSH 端口 22 的入站规则。 我还尝试了不同的用户名，例如 ubuntu 和另一个（现在不记得了）。结果相同。从历史上看，我一直是 ec2-user。

我在这里缺少什么？我需要担心 IAM 角色等吗？密钥对和开放的 SSH 端口应该是您通过 SSH 连接到实例所需的一切，对吧？

编辑：

这是详细的输出：

OpenSSH_8.1p1, LibreSSL 2.7.3
debug1: Reading configuration data /Users/<USERNAME>/.ssh/config
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 47: Applying options for *
debug1: Connecting to ec2-18-198-112-139.eu-central-1.compute.amazonaws.com port 22.
debug1: Connection established.
debug1: identity file <KEYPAIRNAME>.pem type -1
debug1: identity file <KEYPAIRNAME>.pem-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug3: fd 5 is O_NONBLOCK
debug1: Authenticating to ec2-18-198-112-139.eu-central-1.compute.amazonaws.com:22 as 'ec2-user'
debug3: hostkeys_foreach: reading file "/Users/<USERNAME>/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/<USERNAME>/.ssh/known_hosts:10
debug3: load_hostkeys: loaded 1 keys from ec2-18-198-112-139.eu-central-1.compute.amazonaws.com
debug3: order_hostkeyalgs: prefer hostkeyalgs: [e-mail],[e-mail],[e-mail],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: [e-mail],[e-mail],[e-mail],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[e-mail],[e-mail],[e-mail],[e-mail],ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail]
debug2: ciphers stoc: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail]
debug2: MACs ctos: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[e-mail],zlib
debug2: compression stoc: none,[e-mail],zlib
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,[e-mail],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: host key algorithms: ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail],aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: ciphers stoc: [e-mail],aes128-ctr,aes192-ctr,aes256-ctr,[e-mail],[e-mail],aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc
debug2: MACs ctos: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: [e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],[e-mail],hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,[e-mail]
debug2: compression stoc: none,[e-mail]
debug2: languages ctos: 
debug2: languages stoc: 
debug2: first_kex_follows 0 
debug2: reserved 0 
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: [e-mail] MAC: <implicit> compression: none
debug1: kex: client->server cipher: [e-mail] MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:Be7wt5aVyxQ8j9mnjb5HL3ooQ49VJcgfJKtxKfrDjVo
debug3: hostkeys_foreach: reading file "/Users/<USERNAME>/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/<USERNAME>/.ssh/known_hosts:10
debug3: load_hostkeys: loaded 1 keys from ec2-18-198-112-139.eu-central-1.compute.amazonaws.com
debug3: hostkeys_foreach: reading file "/Users/<USERNAME>/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /Users/<USERNAME>/.ssh/known_hosts:10
debug3: load_hostkeys: loaded 1 keys from 18.198.112.139
debug1: Host 'ec2-18-198-112-139.eu-central-1.compute.amazonaws.com' is known and matches the ECDSA host key.
debug1: Found key in /Users/<USERNAME>/.ssh/known_hosts:10
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: <KEYPAIRNAME>.pem  explicit
debug2: pubkey_prepare: done
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: <KEYPAIRNAME>.pem
debug3: sign_and_send_pubkey: RSA SHA256:tEa4FVGQ3Bhw+PjrN88Z/1b8qPqw148Wu0gkhCgW8I8
debug3: sign_and_send_pubkey: signing using rsa-sha2-512
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.

【问题讨论】：

请使用ssh -vvv ...获取日志并将输出包含在您的问题中。

您使用的是eb cli吗？你试过eb ssh吗？也相关：***.com/questions/4742478/…

完成。我也尝试了 eb ssh 并得到了相同的输出。

【参考方案1】：

这意味着两件事：

您使用了错误的安全密钥或没有使用安全密钥。请查看您的 EC2 实例配置以确保您已为其分配了正确的密钥。

您使用了错误的用户。确保您已启动 Amazon Linux 2 EC2 实例，并确保您使用的是用户 ec2-user。这是您在 SSH 命令或 Putty 配置中执行 ec2-user@（例如：ec2-user@35.180.242.162）时指定的内容。