Troubleshoot issues connecting to your Amazon EC2 Linux instance

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, choose Instances, and then select your instance.

3. On the Security tab at the bottom of the console page, under Inbound rules, check the list of rules that are in effect for the selected instance. Verify that there is a rule that allows traffic from your local computer to port 22 (SSH).

   If your security group does not have a rule that allows inbound traffic from your local computer, add a rule to your security group. For more information, see Rules to connect to instances from your computer.

4. For the rule that allows inbound traffic, check the Source field. If the value is a single IP address, and if the IP address is not static, a new IP address will be assigned each time you restart your computer. This will result in the rule not including your computer's IP address traffic. The IP address might not be static if your computer is on a corporate network, or you're connecting through an internet service provider (ISP), or your computer IP address is dynamic and changes each time you restart your computer. To ensure that your security group rule allows inbound traffic from your local computer, instead of specifying a single IP address for Source, rather specify the range of IP addresses used by your client computers.

   For more information about security group rules, see Security group rules in the Amazon VPC User Guide.

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, choose Instances, and then select your instance.

3. On the Networking tab, make note of the values for VPC ID and Subnet ID.

4. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

5. In the navigation pane, choose Internet Gateways. Verify that there is an internet gateway attached to your VPC. Otherwise, choose Create internet gateway, enter a name for the internet gateway, and choose Create internet gateway. Then, for the internet gateway you created, choose Actions, Attach to VPC, select your VPC, and then choose Attach internet gateway to attach it to your VPC.

6. In the navigation pane, choose Subnets, and then select your subnet.

7. On the Route table tab, verify that there is a route with 0.0.0.0/0 as the destination and the internet gateway for your VPC as the target. If you're connecting to your instance using its IPv6 address, verify that there is a route for all IPv6 traffic (::/0) that points to the internet gateway. Otherwise, do the following:

   1. Choose the ID of the route table (rtb-xxxxxxxx) to navigate to the route table.

   2. On the Routes tab, choose Edit routes. Choose Add route, use 0.0.0.0/0 as the destination and the internet gateway as the target. For IPv6, choose Add route, use ::/0 as the destination and the internet gateway as the target.

   3. Choose Save routes.

Check the network access control list (ACL) for the subnet.

The network ACLs must allow inbound SSH traffic from your local IP address on port 22. It must also allow outbound traffic to the ephemeral ports (1024-65535).

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

2. In the navigation pane, choose Subnets.

3. Select your subnet.

4. On the Network ACL tab, for Inbound rules, verify that the rules allow inbound traffic from your computer on the required port. Otherwise, delete or modify the rule that is blocking the traffic.

5. For Outbound rules, verify that the rules allow outbound traffic to your computer on the ephemeral ports. Otherwise, delete or modify the rule that is blocking the traffic.

If the private key file is incorrectly configured, follow these steps to resolve the error

1. Create a new key pair. For more information, see Create a key pair using Amazon EC2.

   Note

   Alternatively, you can create a new key pair using a third-party tool. For more information, see Create a key pair using a third-party tool and import the public key to Amazon EC2.

2. Add the new key pair to your instance. For more information, see I've lost my private key. How can I connect to my instance?.

3. Connect to your instance using the new key pair.

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. In the navigation pane, choose Instances and then select your instance.

3. On the Details tab, under Instance details, verify the value of Key pair name.

4. If you did not specify a key pair when you launched the instance, you can terminate the instance and launch a new instance, ensuring that you specify a key pair. If this is an instance that you have been using but you no longer have the .pem file for your key pair, you can replace the key pair with a new one. For more information, see I've lost my private key. How can I connect to my instance?.

To verify the permissions on your instance

1. Stop your instance and detach the root volume. For more information, see Stop and start Amazon EC2 instances.

2. Launch a temporary instance in the same Availability Zone as your current instance (use a similar or the same AMI as you used for your current instance), and attach the root volume to the temporary instance.

3. Connect to the temporary instance, create a mount point, and mount the volume that you attached.

4. From the temporary instance, check the permissions of the /home/instance-user-name/ directory of the attached volume. If necessary, adjust the permissions as follows:

   [ec2-user ~]$ chmod 600 mount_point/home/instance-user-name/.ssh/authorized_keys

   [ec2-user ~]$ chmod 700 mount_point/home/instance-user-name/.ssh

   [ec2-user ~]$ chmod 700 mount_point/home/instance-user-name

5. Unmount the volume, detach it from the temporary instance, and re-attach it to the original instance. Ensure that you specify the correct device name for the root volume; for example, /dev/xvda.

6. Start your instance. If you no longer require the temporary instance, you can terminate it.

1. Navigate to your .pem file.

2. Right-click on the .pem file and select Properties.

3. Choose the Security tab.

4. Select Advanced.

5. Verify that you are the owner of the file. If not, change the owner to your username.

6. Select Disable inheritance and Remove all inherited permissions from this object.

7. Select Add, Select a principal, enter your username, and select OK.

8. From the Permission Entry window, grant Read permissions and select OK.

9. Click Apply to ensure all settings are saved.

10. Select OK to close the Advanced Security Settings window.

11. Select OK to close the Properties window.

12. You should be able to connect to your Linux instance from Windows using SSH.

1. From the command prompt, navigate to the file path location of your .pem file.

2. Run the following command to reset and remove explicit permissions:

   icacls.exe $path /reset

3. Run the following command to grant Read permissions to the current user:

   icacls.exe $path /GRANT:R "$($env:USERNAME):(R)"

4. Run the following command to disable inheritance and remove inherited permissions.

   icacls.exe $path /inheritance:r

5. You should be able to connect to your Linux instance from Windows using SSH.

1. Connect to your instance using a method other than EC2 Instance Connect.

2. Run the following command on your instance to update the ec2-instance-connect package to the latest version.

   apt update && apt upgrade

To get information about your original instance

1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

2. Choose Instances in the navigation pane, and then select the instance that you'd like to connect to. (We'll refer to this as the original instance.)

3. On the Details tab, make note of the instance ID and AMI ID.

4. On the Networking tab, make note of the Availability Zone.

5. On the Storage tab, under Root device name, make note of the device name for the root volume (for example, /dev/xvda). Then, under Block devices, find this device name and make note of the volume ID (for example, vol-0a1234b5678c910de).

To launch a temporary instance

1. In the navigation pane, choose Instances, and then choose Launch instances.

2. In the Name and tags section, for Name, enter Temporary.

3. In the Application and OS Images section, select the same AMI that you used to launch the original instance. If this AMI is unavailable, you can create an AMI that you can use from the stopped instance. For more information, see Create an Amazon EBS-backed AMI.

4. In the Instance type section, keep the default instance type.

5. In the Key pair section, for Key pair name, select the existing key pair to use or create a new one.

6. In the Network settings section, choose Edit, and then for Subnet, select a subnet in the same Availability Zone as the original instance.

7. In the Summary panel, choose Launch.

1. In the navigation pane, choose Volumes and select the root device volume for the original instance (you made note of its volume ID in a previous step). Choose Actions, Detach volume, and then choose Detach. Wait for the state of the volume to become available. (You might need to choose the Refresh icon.)

2. With the volume still selected, choose Actions, and then choose Attach volume. Select the instance ID of the temporary instance, make note of the device name specified under Device name (for example, /dev/sdf), and then choose Attach volume.

   Note

   If you launched your original instance from an AWS Marketplace AMI and your volume contains AWS Marketplace codes, you must first stop the temporary instance before you can attach the volume.

1. Connect to the temporary instance.

2. From the temporary instance, mount the volume that you attached to the instance so that you can access its file system. For example, if the device name is /dev/sdf, use the following commands to mount the volume as /mnt/tempvol.

   Note

   The device name might appear differently on your instance. For example, devices mounted as /dev/sdf might show up as /dev/xvdf on the instance. Some versions of Red Hat (or its variants, such as CentOS) might even increment the trailing letter by 4 characters, where /dev/sdf becomes /dev/xvdk.

   1. Use the lsblk command to determine if the volume is partitioned.

      [ec2-user ~]$ lsblk
      NAME    MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
      xvda    202:0    0    8G  0 disk
      └─xvda1 202:1    0    8G  0 part /
      xvdf    202:80   0  101G  0 disk
      └─xvdf1 202:81   0  101G  0 part
      xvdg    202:96   0   30G  0 disk

      In the preceding example, /dev/xvda and /dev/xvdf are partitioned volumes, and /dev/xvdg is not. If your volume is partitioned, you mount the partition (/dev/xvdf1) instead of the raw device (/dev/xvdf) in the next steps.

   2. Create a temporary directory to mount the volume.

      [ec2-user ~]$ sudo mkdir /mnt/tempvol

   3. Mount the volume (or partition) at the temporary mount point, using the volume name or device name that you identified earlier. The required command depends on your operating system's file system. Note that the device name might appear differently on your instance. See the note in Step 6 for more information.

      • Amazon Linux, Ubuntu, and Debian

        [ec2-user ~]$ sudo mount /dev/xvdf1 /mnt/tempvol

      • Amazon Linux 2, CentOS, SUSE Linux 12, and RHEL 7.x

        [ec2-user ~]$ sudo mount -o nouuid /dev/xvdf1 /mnt/tempvol

   Note

   If you get an error stating that the file system is corrupt, run the following command to use the fsck utility to check the file system and repair any issues:

   [ec2-user ~]$ sudo fsck /dev/xvdf1

3. From the temporary instance, use the following command to update authorized_keys on the mounted volume with the new public key from the authorized_keys for the temporary instance.

   Important

   The following examples use the Amazon Linux username ec2-user. You might need to substitute a different username, such as ubuntu for Ubuntu instances.

   [ec2-user ~]$ cp .ssh/authorized_keys /mnt/tempvol/home/ec2-user/.ssh/authorized_keys

   If this copy succeeded, you can go to the next step.

   (Optional) Otherwise, if you don't have permission to edit files in /mnt/tempvol, you must update the file using sudo and then check the permissions on the file to verify that you are able to log into the original instance. Use the following command to check the permissions on the file.

   [ec2-user ~]$ sudo ls -l /mnt/tempvol/home/ec2-user/.ssh
   total 4
   -rw------- 1 222 500 398 Sep 13 22:54 authorized_keys

   In this example output, 222 is the user ID and 500 is the group ID. Next, use sudo to re-run the copy command that failed.

   [ec2-user ~]$ sudo cp .ssh/authorized_keys /mnt/tempvol/home/ec2-user/.ssh/authorized_keys

   Run the following command again to determine whether the permissions changed.

   [ec2-user ~]$ sudo ls -l /mnt/tempvol/home/ec2-user/.ssh

   If the user ID and group ID have changed, use the following command to restore them.

   [ec2-user ~]$ sudo chown 222:500 /mnt/tempvol/home/ec2-user/.ssh/authorized_keys

1. From the temporary instance, unmount the volume that you attached so that you can reattach it to the original instance. For example, use the following command to unmount the volume at /mnt/tempvol.

   [ec2-user ~]$ sudo umount /mnt/tempvol

2. Detach the volume from the temporary instance (you unmounted it in the previous step): From the Amazon EC2 console, choose Volumes in the navigation pane, select the root device volume for the original instance (you made note of the volume ID in a previous step), choose Actions, Detach volume, and then choose Detach. Wait for the state of the volume to become available. (You might need to choose the Refresh icon.)

3. Reattach the volume to the original instance: With the volume still selected, choose Actions, Attach volume. Select the instance ID of the original instance, specify the device name that you noted earlier in Step 2 for the original root device attachment (/dev/sda1 or /dev/xvda), and then choose Attach volume.

   Important

   If you don't specify the same device name as the original attachment, you cannot start the original instance. Amazon EC2 expects the root device volume at sda1 or /dev/xvda.