AWS EC2 - Why is my SSH public key not present when connecting?

2
votes

I'm trying to set up a new Amazon EC2 instance with my own public key so I can connect via ssh. I have generated an RSA key pair using ssh-keygen as described in the aws docs, and uploaded the public key to Amazon using the web interface. The key shows up normally in my AWS dashboard. Let's say my public key fingerprint is aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa.

I can create a new instance and specify this public key using the web interface (and yes, I specify this before spinning up the machine - it's the last step before launch). The instance appears to be created and start normally. My public key is listed under the 'Key pair name' property for that instance. I'm using an Ubuntu 12.04 LTS OS, 64 bit image: ubuntu-precise-12.04-amd64-server-20131003.

However, when I attempt to connect via ssh, I do not see the fingerprint for my key:

>The authenticity of host 'ec2-00-00-00-00.us-west-2.compute.amazonaws.com (00.00.00.00)' can't be established.
>RSA key fingerprint is bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb.
>Are you sure you want to continue connecting (yes/no)? no

(I use the actual IP address when connecting)

I can run 'ec2-get-console-output' using the ec2 command line tools, as suggested by this answer. However, my public key does not appear anywhere in the console output. There are two other keys present:

>Your public key has been saved in /etc/ssh/ssh_host_rsa_key.pub.
>The key fingerprint is:
>bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb:bb root@ip-00-00-00-00
>...
>-----BEGIN SSH HOST KEY FINGERPRINTS-----
>ec2: 1024 cc:cc:cc:cc:cc:cc:cc:cc:cc:cc:cc:cc:cc:cc:cc:cc root@ip-00-00-00-00 (DSA)

If my key is being deployed onto the instance, why doesn't it show up?

1
amazon-web-servicessshamazon-ec2
What image you are using? what you describe sounds like a bug, your key should be the only one in ssh_host_rsa_key – Noam Rathaus
can you log in to this instance using the "connect" button in the AWS console, which uses a java applet – Brij Raj Singh - MSFT
Have you tried answering "yes" instead of "no?" The value shown at bb:bb... isn't about your key, it's about the identity of the host itself. – Michael - sqlbot
@nrathaus This is an Ubuntu 12.04 LTS OS, 64 bit build. ubuntu-precise-12.04-amd64-server-20131003 . I will edit the question to include this. – culix
@BrijRajSingh Thanks I had never seen the Java option before. While I'm suspicious and hesitant about running any Java code... I did try this ;) Unfortunately the Java console app shows the same server key when it tries to connect. At least that's consistent. – culix

1 Answers

6
votes

The fingerprint you are seeing is of the host id, NOT your rsa/dsa key id. Therefore there shouldn't be a match.

The public key that you upload is the key that the server uses to identify you. It has nothing to do with the server identity. If you wish to verify the server if you can use the ec2-get-console-output command, as you mention.

For more detail on ssh keypairs see this answer on Ask Ubuntu.