Durch die Nutzung von AWS re:Post stimmt du den AWS re:Post Nutzungsbedingungen
AWS re:Postre:Post

New EC2 from account generated AMI disallowing sftp connections that work in original server/source of AMI

0
  1. I tested sftp set up on a free tier (.micro) server built from the aws linux ami (ami-06ca3ca175f37dd66). I was able to get it to work on this server with two sftp users using a 'Match Group' directive in the sshd_config. I could (and still can) login via sftp with both user accounts. We'll call this working set up 'SERVER 1'
  2. I created an ami from SERVER 1 and used it to launch a .medium sized server with all the same specs, security group, vpc, etc. We'll call the new server, 'SERVER 2'.
  3. I am able to ssh connect to SERVER 2, I am unable to connect either of the user accounts via sftp that work for SERVER 1.
  4. I get the error: Connection closed by authenticating user username ipaddress port portnum [preauth].
  5. This occurs both using an external client as well as attempting to connect from the sftp command on the same machine.

Anyone have any idea?

I have compared all the configs, sec groups, status messages I can think to compare and still can't figure out why two machines that appear be identical are giving two different behaviors. I also reset the passwords for the sftp users, same error.

Themen
KalkulationVernetzung & Bereitstellung von Inhalten
Tags
EC2 Image BuilderAmazon EC2KalkulationSicherheitsgruppeAmazon Linux
Sprache
English
OrbitBen
gefragt vor 10 Monaten316 Aufrufe
2 Antworten
1
Akzeptierte Antwort

Found it. Feeling stupid.

Last line of Match Group directives in sshd_config was: PasswordAuthentication yes

on SERVER 1.

The AMI process changed it to: PasswordAuthentication no

which propagated to SERVER 2.

Changed 'no' to 'yes' and now it works. Missed the last line. Hopefully this helps someone else:

AMI Process changes your sshd_config file!

OrbitBen
beantwortet vor 10 Monaten
  • Didier_Durand EXPERTE
    vor 10 Monaten

    Hi, usually, you don't accept your own answer but the one which helped you find your problem. That's how a community works best ;-)

0

Hi, did you try ssh -v (or -vv or -vvv) on working and non-working machine to see what differs at ssh connection time?

If you sftp client does support -v option, you can also try it with sftp itself. But, AFAIK, not all do.

Maybe this will help in locating the issue on the sftp side.

Didier

profile pictureAWS
EXPERTE
Didier_Durand
beantwortet vor 10 Monaten
profile pictureAWS
EXPERTE
iBehr
überprüft vor 10 Monaten
  • OrbitBen
    vor 10 Monaten

    Thank you for your speedy reply, I missed a line in the config that was changed during the AMI process.

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen

Relevanter Inhalt