AWS SSH Key Login Failed Permission denied (publickey,gssapi-keyex,gssapi-with-mic)

Having trouble logging into an AWS instance using an SSH key? I was too and when I finally figured out what the issue was I was kicking myself. Recently I was called to assist figuring out information about a clients AWS deployment for a project where the original developers were no longer available or answering questions. Most of the instances that I initially worked on had no issues once I was able to obtain the correct SSH key pem file from Amazon. When the project was closing down I was asked to assist backing things up and it appeared the SSH key was failing for two of the instances which also happened to be the oldest two instances (2 years old). Below I describe the error I was seeing via SSH as well as the easy resolution to the problem.

I typically use SecureCRT for SSH so the first error displayed below is from SecureCRT. The text from the error is printed below the image so if someone else attempts to locate an answer with the error that SecureCRT was providing they will easily find it here.

SecureCRT Error Logging Into AWS Instance With SSH-Key:

SecureCRT Error Logging Into AWS Instance With SSH-Key Text:

The server recognized your public key, <ssh-agent>, but none of the known signature mechanisms were accepted. This normally means that the server you are connecting to does not comply with any of the supported standards. If you are connecting to a 2.0.12 server (either the non-commerical or the F-Secure version), public key authentication is not approved.

OSX Terminal Error Logging Into AWS Instance With SSH-Key:

Next I attempted to login using SSH from a OSX Terminal window as sometimes SecureCRT can act differently when using ssh-keys. In this instance however I was still receiving an error as noted below.

As you can see above permission denied on the last line by spitting out the error “Permission denied (publickey,gssapi-keyex,gssapi-with-mic).”.

Now the good news. It is likely that there will not be many people that run into this issue as my scenario was unique coming in after all of the instances had been configured. Turns out that the two instances I could not login (they were running Fedora 14) to were using AMI’s that configure the ec2-user user to use the ssh-key instead of the root user! So if you change your username from root to ec2-user you should be able to login without issue.

Initially I was over thinking the problem and so if I had done a little searching first I would have been able to figure out the username was incorrect and then been able to search for default instance usernames and would have been able to resolve the issue much quicker by finding that ec2-user is used on some AWS AMI’s by default.

APPIP ERROR: amazonproducts[
AccessDeniedAwsUsers|The Access Key Id 1ZNGM52M8EWAXJFFRR82 is not enabled for accessing this version of Product Advertising API. Please migrate your credentials as referred here https://webservices.amazon.com/paapi5/documentation/migrating-your-product-advertising-api-account-from-your-aws-account.html.
]

APPIP ERROR: amazonproducts[
AccessDeniedAwsUsers|The Access Key Id 1ZNGM52M8EWAXJFFRR82 is not enabled for accessing this version of Product Advertising API. Please migrate your credentials as referred here https://webservices.amazon.com/paapi5/documentation/migrating-your-product-advertising-api-account-from-your-aws-account.html.
]