New EC2 from account generated AMI disallowing sftp connections that work in original server/source of AMI

Question

1. I tested sftp set up on a free tier (.micro) server built from the aws linux ami (ami-06ca3ca175f37dd66). I was able to get it to work on this server with two sftp users using a 'Match Group' directive in the sshd_config. I could (and still can) login via sftp with both user accounts. We'll call this working set up 'SERVER 1'
2. I created an ami from SERVER 1 and used it to launch a .medium sized server with all the same specs, security group, vpc, etc. We'll call the new server, 'SERVER 2'.
3. I am able to ssh connect to SERVER 2, I am unable to connect either of the user accounts via sftp that work for SERVER 1.
4. I get the error: Connection closed by authenticating user *username* *ipaddress* port *portnum* [preauth]. 
5. This occurs both using an external client as well as attempting to connect from the sftp command on the same machine.

Anyone have any idea?

I have compared all the configs, sec groups, status messages I can think to compare and still can't figure out why two machines that appear be identical are giving two different behaviors. I also reset the passwords for the sftp users, same error.

Accepted Answer

Found it. Feeling stupid.

Last line of Match Group directives in sshd_config was:
*PasswordAuthentication yes*

on SERVER 1.

The AMI process changed it to:
*PasswordAuthentication no*

which propagated to SERVER 2.

Changed 'no' to 'yes' and now it works. Missed the last line. Hopefully this helps someone else:

AMI Process changes your sshd_config file!

Answer

Hi, 
did you try ssh -v (or -vv or -vvv) on working and non-working machine to see what differs at ssh connection time?

If you sftp client does support -v option, you can also try it with sftp itself. But, AFAIK, not all do.

Maybe this will help in locating the issue on the sftp side.

Didier

New EC2 from account generated AMI disallowing sftp connections that work in original server/source of AMI

関連するコンテンツ