ssh private instance in a subnet through public instance in same subnet AWS

0
votes

I am new to AWS. I created a VPC and created 2 subnets (1 private and 1 public). Enabled the internet gateway and updated the Route table with internet gateway entries.

Then created 2 Linux EC2 Instances for the private subnet and public subnet and associated security groups accordingly i.e. for public instance (SSH and HTTP) and for private (SSH, HTTP, ICMP, HTTPS) inbound rules.

I am using putty as a windows user to ssh into my public instance using mypkv.ppk and successfully able to login into that. And i am successfully able to ping the private instance from this public instance using 

command: ping private-ip-address

But I don't know how to ssh into this private instance through this public instance? I have tried the following command:

ssh ec2-user@private-ip-address -i mypvk.pem  
ssh ec2-user@private-ip-address -i mypvk.ppk

where mypvk.pem and mypvk.ppk are files stored onto my public instance which are private keys given my AWS while creating EC2 instances.

This above command says: 

Enter passphrase for key 'mypvk.pem': 
Enter passphrase for key 'mypvk.ppk':

I don't know the passphrase or what does that mean and how to ssh into private instance? Any help would be appreciated.

4
amazon-web-servicesamazon-ec2amazon-vpc

4 Answers

1
votes

Passphrase is just another passoword to gain access to system, if you have tried converting pem to ppk then you would see that in putty ... since you don't know what passphrase is I can assume that you did not enter a passphrase for the key

ssh ec2-user@private-ip-address -i mypvk.pem ; use this and not the ppk file as in the second command , can you get more logs on this .. probably the verbose

ssh ec2-user@private-ip-address -i mypvk.pem -vv ,

Possibly you tried to setup the public key, but ended up with setting it with a passphrase

1
votes
  1. Enable agent forwarding in your putty. Under “Connection” -> “SSH” -> “Auth”.
  2. Login to Public Instance and do ssh ec2-user@private-ip-address

enter image description here

Image Source

0
votes

Assuming both the public and private instances were launched with the same key, in order to gain access to the private instance from the public instance you will need to enable key forwarding with putty.

There is a good answer on how to do this on superuser, but basically it involves running the agent (pageant.exe) and adding the appropriate key(s).

0
votes

copy the pem file to your instance in public subnet, the try to connect to your private. make sure there are no errors in the contents of the file pem even a character.