15

I am working with win 7 and git bash as well as an amazon EC2 instance. I tried to log into my instance:

$ ssh -i f:mykey.pem ubuntu@ec2-52-10-**-**.us-west-2.compute.amazonaws.com
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
 Someone could be eavesdropping on you right now (man-in-the-middle attack)!
 It is also possible that a host key has just been changed.
 The fingerprint for the ECDSA key sent by the remote host is
 71:00:d7:d8:a------------------26.
 Please contact your system administrator.
 Add correct host key in /m/.ssh/known_hosts to get rid of this message.
 Offending ECDSA key in /m/.ssh/known_hosts:27
 ECDSA host key for ec2-52-10-**-**.us-west-2.compute.amazonaws.com has changed and you have request
 ed strict checking.
 Host key verification failed.

Logging in like this has worked fine in the past, but this problem started after I rebooted my EC2 instance. How can I get this working again?

edit:

$ ssh -i f:tproxy.pem ubuntu@ec2-52-10-**-**.us-west-2.compute.amazonaws.com
ssh: connect to host ec2-52-10-**-**.us-west-2.compute.amazonaws.com port 22: Bad file number

enter image description here

tried again:

The authenticity of host 'ec2-52-10-**-**.us-west-2.compute.amazonaws.com (52.10.**-**)' can't be
established.
ECDSA key fingerprint is d6:c4:88:-----------fd:65.
Are you sure you want to continue connecting (yes/no)? y
Please type 'yes' or 'no': yes
Warning: Permanently added 'ec2-52-10-**-**.us-west-2.compute.amazonaws.com,52.10.**-**' (ECDSA) t
o the list of known hosts.
Permission denied (publickey).

what should I do now?

4 Answers 4

12

The hostname has a new ssh key, so ssh tells you something has changed. The hint is here:

Offending ECDSA key in /m/.ssh/known_hosts:27

If you're sure the server on the other side is authentic, you should delete line 27 in /m/.ssh/known_hosts.

5
  • There were only 7 entries although each was made of 4 lines, so i deleted the entite knownhosts file. Please see edit above Commented Mar 17, 2015 at 18:19
  • Now it's a different problem - your key is being rejected. Try using -i mykey.pem (without the -f)
    – Adam Matan
    Commented Mar 19, 2015 at 9:06
  • Thanks for looking at this Adam. Not knowing any better, I tried to create a new key-pair and overwrote the old ones, Then I read that only the original key-pair will work with any 1 instance on EC2, So I've deleted my instance and am rebuilding it now. I have a new key pair and can now login. Obviously this is not the preferred way to go. Commented Mar 19, 2015 at 15:25
  • Sure. Two more points - 1. It is always advised to add a new RSA key to all of your machines, and use the original pem key as an emergency backup. 2. This question probably belongs to serverfault.com
    – Adam Matan
    Commented Mar 19, 2015 at 15:27
  • Thanks for your help again. Is it to late to create a new key pair for my ec2 instance now that I've launched it? Commented Mar 19, 2015 at 15:36
7

This error says that something has been changed since your last login to this server and that the server you try to ssh to, might not be the server you think it is.

One thing to be aware of...
When you create an EC2 instance, No fixed IP assigned to this instance.
When you start this instance, it will get (dynamic) IP number and a DNS name which will be based on that IP.
If you shutdown the instance and start it again few hours later, it might get a new IP and a new DNS name.

If you are still trying to access the old DNS name/IP, you are actually trying to access a server that might not belong to you.
This will end with the same error msg as you had.
(It can happen because you pointed a DNS entry to the old IP, or you are using scripts that try to access the old DNS name/IP, or you just repeating the ssh command from your history...)

If this is the case, the solution is to use Elastic IP.
You can assign Elastic IP to your server, and this will force it to keep its IP address between reboots.

Elastic IP is free while your (attached) server is up.
But it will cost you some minor fees when the attached server is down.
This is done to make sure you are not "reserving" IP while not using/need it

3

In BeanStalk environment, the issue is that it refers to the key from known_hosts for the respective IP. But it has changed. So using the same key would not work.

Removing the key for the IP from ~/.ssh/known_hosts and then connecting by ssh would work.

(Basically, when the entry is not there in ~/.ssh/known_hosts it will create a new one, and thus resolve the conflict)

0

Type the following command to set the permissions. Replace ~/mykeypair.pem with the location and file name of your key pair private key file.

chmod 400 ~/mykeypair.pem

In your case mykeypair.pem is tproxy.pem

I was facing the same issue and after making pem file private it was fixed.

Here is some more information on SSH Key Permissions

1
  • Thanks @ioneyed, I will try to take care of formatting in future. Commented Aug 5, 2020 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.