New EC2 from account generated AMI disallowing sftp connections that work in original server/source of AMI

0
  1. I tested sftp set up on a free tier (.micro) server built from the aws linux ami (ami-06ca3ca175f37dd66). I was able to get it to work on this server with two sftp users using a 'Match Group' directive in the sshd_config. I could (and still can) login via sftp with both user accounts. We'll call this working set up 'SERVER 1'
  2. I created an ami from SERVER 1 and used it to launch a .medium sized server with all the same specs, security group, vpc, etc. We'll call the new server, 'SERVER 2'.
  3. I am able to ssh connect to SERVER 2, I am unable to connect either of the user accounts via sftp that work for SERVER 1.
  4. I get the error: Connection closed by authenticating user username ipaddress port portnum [preauth].
  5. This occurs both using an external client as well as attempting to connect from the sftp command on the same machine.

Anyone have any idea?

I have compared all the configs, sec groups, status messages I can think to compare and still can't figure out why two machines that appear be identical are giving two different behaviors. I also reset the passwords for the sftp users, same error.

2 Answers
1
Accepted Answer

Found it. Feeling stupid.

Last line of Match Group directives in sshd_config was: PasswordAuthentication yes

on SERVER 1.

The AMI process changed it to: PasswordAuthentication no

which propagated to SERVER 2.

Changed 'no' to 'yes' and now it works. Missed the last line. Hopefully this helps someone else:

AMI Process changes your sshd_config file!

answered 10 months ago
  • Hi, usually, you don't accept your own answer but the one which helped you find your problem. That's how a community works best ;-)

0

Hi, did you try ssh -v (or -vv or -vvv) on working and non-working machine to see what differs at ssh connection time?

If you sftp client does support -v option, you can also try it with sftp itself. But, AFAIK, not all do.

Maybe this will help in locating the issue on the sftp side.

Didier

profile pictureAWS
EXPERT
answered 10 months ago
profile pictureAWS
EXPERT
iBehr
reviewed 10 months ago
  • Thank you for your speedy reply, I missed a line in the config that was changed during the AMI process.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions