unable to SSH into aws ec2 instance with gitbash: permission denied

Question

I encountered the permission denied error while trying to ssh into my aws ec2 instance - centos with a valid private key (.pem) file using the windows gitbash. Debug logs are as given below.

OpenSSH_8.1p1, OpenSSL 1.1.1d  10 Sep 2019
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to ec2-#####.ap-south-1.compute.amazonaws.com [####] port 22.
debug1: Connection established.
debug1: identity file mbrace.pem type -1
debug1: identity file mbrace.pem-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to ec2-13-126-107-143.ap-south-1.compute.amazonaws.com:22 as 'centos'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5Qu3MuE9zz27Ywx1d+dQyZwaC8KN/khaRLIRSUVLZ6s
debug1: Host 'ec2-13-126-107-143.ap-south-1.compute.amazonaws.com' is known and matches the ECDSA host key.
debug1: Found key in /c/Users/####/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: mbrace.pem  explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: publickey
debug1: Trying private key: mbrace.pem
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: No more authentication methods to try.
centos@ec2-######.ap-south-1.compute.amazonaws.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

Another reference file knownhosts file contents is as given below .ssh/config/known_hosts

ec2-13-126-107-143.ap-south-1.compute.amazonaws.com,13.126.107.143 ecdsa-sha2-nistp256 
AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlz..........

Update

On advise from VONC, created a new key pair using ssh-key gen tool, which generated a .pub file and subsequently imported the key to aws ec2 successfully. On trying the command again, permission denied is the same result, though the logs change a bit. Here are the logs:

$ ssh -i "C:/Users/mbrace/.ssh/mbrace2.pem" centos@ec2-13-126-107-143.ap-south-1.compute.amazonaws.com -v
    OpenSSH_8.1p1, OpenSSL 1.1.1d  10 Sep 2019
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to ec2-13-126-107-143.ap-south-1.compute.amazonaws.com [13.126.107.143] port 22.
debug1: Connection established.
debug1: identity file C:/Users/mbrace/.ssh/mbrace2.pem type -1
debug1: identity file C:/Users/mbrace/.ssh/mbrace2.pem-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to ec2-13-126-107-143.ap-south-1.compute.amazonaws.com:22 as 'centos'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5Qu3MuE9zz27Ywx1d+dQyZwaC8KN/khaRLIRSUVLZ6s
debug1: Host 'ec2-13-126-107-143.ap-south-1.compute.amazonaws.com' is known and matches the ECDSA host key.
debug1: Found key in /c/Users/mbrace/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: C:/Users/mbrace/.ssh/mbrace2.pem  explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: publickey
debug1: Trying private key: C:/Users/mbrace/.ssh/mbrace2.pem
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: No more authentication methods to try.
centos@ec2-13-126-107-143.ap-south-1.compute.amazonaws.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

Tried all methods given in the forum including changing permissions of .ssh folder and .pem file, but to no use. Do guide us as where we are going wrong.

Update 2

Just as you mentioned, recreated the key without any extension "mbrace2" and imported the .pub key to ec2 successfully under "key pairs". Now when we try to ssh into the server again, we encounter the same error (permission denied). Based on other answers, i also tried changing permissions of the key to 400,500,600 but there was no change in the status.

Also, when we add this code ^^^ (.no pub) at the end, it gives me this error:

bash: syntax error near unexpected token `('. So had to run the earlier said command without it.

Do guide us as where we are going wrong.

Update 3 As asked by you, here is the command and its corresponding output.

The Command

$ ssh -i "C:/Users/mbrace/.ssh/mbrace2" centos@ec2-13-126-107-143.ap-south-1.compute.amazonaws.com -Tv

The Output

OpenSSH_8.1p1, OpenSSL 1.1.1d  10 Sep 2019
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to ec2-13-126-107-143.ap-south-1.compute.amazonaws.com [13.126.107.143] port 22.
debug1: Connection established.
debug1: identity file C:/Users/mbrace/.ssh/mbrace2 type 0
debug1: identity file C:/Users/mbrace/.ssh/mbrace2-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: Authenticating to ec2-13-126-107-143.ap-south-1.compute.amazonaws.com:22 as 'centos'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:5Qu3MuE9zz27Ywx1d+dQyZwaC8KN/khaRLIRSUVLZ6s
debug1: Host 'ec2-13-126-107-143.ap-south-1.compute.amazonaws.com' is known and matches the ECDSA host key.
debug1: Found key in /c/Users/mbrace/.ssh/known_hosts:1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: Will attempt key: C:/Users/mbrace/.ssh/mbrace2 RSA SHA256:+47/xVuTP15NDpN+2OZbSOIfQ9umTAi6P+i8vufO6q8 explicit
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: Next authentication method: publickey
debug1: Offering public key: C:/Users/mbrace/.ssh/mbrace2 RSA SHA256:+47/xVuTP15NDpN+2OZbSOIfQ9umTAi6P+i8vufO6q8 explicit
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic
debug1: No more authentication methods to try.
centos@ec2-13-126-107-143.ap-south-1.compute.amazonaws.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

VonC_6309 · Answer

Will attempt key: mbrace.pem explicit

That means you have a /c/Users/####/.ssh/config file which does explicitly reference in an IndentityFile filed the mbrace.pem file.
You need to make sure, following "EC2: Connect to your Linux instance using SSH", that (to emulate ssh -i /path/my-key-pair.pem my-instance-user-name@my-instance-public-dns-name):

the remote user (field User in the SSH config file) is the correct one (my-instance-user-name)
the key (private mbrace.pem in IdentityFile) is referenced through its full path (~/.ssh/mbrace.pem works, even on Windows)
the matching public key is visible in the .ssh/authorized_keys file on the instance.
the inbound SSH traffic from your IP address to your instance is enabled

To test a new key, you new to use its private key:

ssh -i "C:/Users/mbrace/.ssh/mbrace2" my-instance-user-name@my-instance-public-dns-name -v
                                 ^^^ (no .pub)

unable to SSH into aws ec2 instance with gitbash: permission denied

1 Answers