“Server Refused our key” after launching instance

Question

I have created my own EBS AMI, shared it with another AWS account, launched NEW instance based on this image with NEW key-pair and now when I am trying to connect to this new instance I am getting error: "Server Refused our key".

This is what I did (step by step):

1. Configured new CentOS 6.3 server in my personal account (with my personal key-pair)
2. Created EBS AMI image of that server
3. Shared this image with my client's account
4. Launched new instance in my clients account based on this shared image + new key-pair
5. New launched instance doesnt want to take new key-pair. After some testing I figure that it accepts my personal key-pair instead.

How do I make new instance from my image to accept new key-pairs? I even tried removing ".ssh/authorized_keys" file in original image, launch new instance based on this image without public key and still no success.

Please advise how to create images that would not be attached to old key-pairs

Answer 1

By default, Amazon will append the new key with the existing one. We can resolve it by mounting the drive on other active instance, and remove the content from file .ssh/authorized_keys and add the your pem keys file of your new key.

Answer 2

It could be only one reason to show Server Refused our key.

That is: server's Key Pair and Username combination is not correct, i have faced many times.

Answer 3

this means that you are not using correct user name for logging into your ec2 instance. here is list of users you can use in putty to connect to ec2 instance For an Amazon Linux AMI, the user name is ec2-user. For a RHEL5 AMI, the user name is either root or ec2-user. For an Ubuntu AMI, the user name is ubuntu. For a Fedora AMI, the user name is either fedora or ec2-user. For SUSE Linux, the user name is either root or ec2-user. Otherwise, if ec2-user and root don't work, check with the AMI provider.

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/TroubleshootingInstancesConnecting.html#TroubleshootingInstancesConnectingPuTTY

Answer 4

I had this issue and it turned out I was typing ec2_user when it was meant to be ec2-user

Answer 5

Since your AMI originates from a community AMI and not an official public AMI, it is possible that it has not been setup to copy the ssh keys on instance startup, or that it uses a different mechanism to do it.

My understanding is that for the ssh keys to be copied on startup, some shell script must be run inside the instance itself, as briefly described here.

The AMI description page mentions that it has been "cloud-init enabled", so maybe there is a way to do it through CloudInit. See the doc here.

Answer 6

I had this issue with a new SUSE instance. I was finally able to connect using user 'root'. It kept rejecting ec2-user.