New EC2 from account generated AMI disallowing sftp connections that work in original server/source of AMI

0
  1. I tested sftp set up on a free tier (.micro) server built from the aws linux ami (ami-06ca3ca175f37dd66). I was able to get it to work on this server with two sftp users using a 'Match Group' directive in the sshd_config. I could (and still can) login via sftp with both user accounts. We'll call this working set up 'SERVER 1'
  2. I created an ami from SERVER 1 and used it to launch a .medium sized server with all the same specs, security group, vpc, etc. We'll call the new server, 'SERVER 2'.
  3. I am able to ssh connect to SERVER 2, I am unable to connect either of the user accounts via sftp that work for SERVER 1.
  4. I get the error: Connection closed by authenticating user username ipaddress port portnum [preauth].
  5. This occurs both using an external client as well as attempting to connect from the sftp command on the same machine.

Anyone have any idea?

I have compared all the configs, sec groups, status messages I can think to compare and still can't figure out why two machines that appear be identical are giving two different behaviors. I also reset the passwords for the sftp users, same error.

2 réponses
1
Réponse acceptée

Found it. Feeling stupid.

Last line of Match Group directives in sshd_config was: PasswordAuthentication yes

on SERVER 1.

The AMI process changed it to: PasswordAuthentication no

which propagated to SERVER 2.

Changed 'no' to 'yes' and now it works. Missed the last line. Hopefully this helps someone else:

AMI Process changes your sshd_config file!

répondu il y a 10 mois
  • Hi, usually, you don't accept your own answer but the one which helped you find your problem. That's how a community works best ;-)

0

Hi, did you try ssh -v (or -vv or -vvv) on working and non-working machine to see what differs at ssh connection time?

If you sftp client does support -v option, you can also try it with sftp itself. But, AFAIK, not all do.

Maybe this will help in locating the issue on the sftp side.

Didier

profile pictureAWS
EXPERT
répondu il y a 10 mois
profile pictureAWS
EXPERT
iBehr
vérifié il y a 10 mois
  • Thank you for your speedy reply, I missed a line in the config that was changed during the AMI process.

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions