Host key verification failed - amazon EC2

Question

I am working with win 7 and git bash as well as an amazon EC2 instance. I tried to log into my instance:

$ ssh -i f:mykey.pem ubuntu@ec2-52-10-**-**.us-west-2.compute.amazonaws.com
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
 Someone could be eavesdropping on you right now (man-in-the-middle attack)!
 It is also possible that a host key has just been changed.
 The fingerprint for the ECDSA key sent by the remote host is
 71:00:d7:d8:a------------------26.
 Please contact your system administrator.
 Add correct host key in /m/.ssh/known_hosts to get rid of this message.
 Offending ECDSA key in /m/.ssh/known_hosts:27
 ECDSA host key for ec2-52-10-**-**.us-west-2.compute.amazonaws.com has changed and you have request
 ed strict checking.
 Host key verification failed.

Logging in like this has worked fine in the past, but this problem started after I rebooted my EC2 instance. How can I get this working again?

edit:

$ ssh -i f:tproxy.pem ubuntu@ec2-52-10-**-**.us-west-2.compute.amazonaws.com
ssh: connect to host ec2-52-10-**-**.us-west-2.compute.amazonaws.com port 22: Bad file number

tried again:

The authenticity of host 'ec2-52-10-**-**.us-west-2.compute.amazonaws.com (52.10.**-**)' can't be
established.
ECDSA key fingerprint is d6:c4:88:-----------fd:65.
Are you sure you want to continue connecting (yes/no)? y
Please type 'yes' or 'no': yes
Warning: Permanently added 'ec2-52-10-**-**.us-west-2.compute.amazonaws.com,52.10.**-**' (ECDSA) t
o the list of known hosts.
Permission denied (publickey).

what should I do now?

Answer 1

Type the following command to set the permissions. Replace ~/mykeypair.pem with the location and file name of your key pair private key file.

chmod 400 ~/mykeypair.pem

In your case mykeypair.pem is tproxy.pem

I was facing the same issue and after making pem file private it was fixed.

Here is some more information on SSH Key Permissions

Answer 2

In BeanStalk environment, the issue is that it refers to the key from known_hosts for the respective IP. But it has changed. So using the same key would not work.

Removing the key for the IP from ~/.ssh/known_hosts and then connecting by ssh would work.

(Basically, when the entry is not there in ~/.ssh/known_hosts it will create a new one, and thus resolve the conflict)

Answer 3

This error says that something has been changed since your last login to this server and that the server you try to ssh to, might not be the server you think it is.

One thing to be aware of...
When you create an EC2 instance, No fixed IP assigned to this instance.
When you start this instance, it will get (dynamic) IP number and a DNS name which will be based on that IP.
If you shutdown the instance and start it again few hours later, it might get a new IP and a new DNS name.

If you are still trying to access the old DNS name/IP, you are actually trying to access a server that might not belong to you.
This will end with the same error msg as you had.
(It can happen because you pointed a DNS entry to the old IP, or you are using scripts that try to access the old DNS name/IP, or you just repeating the ssh command from your history...)

If this is the case, the solution is to use Elastic IP.
You can assign Elastic IP to your server, and this will force it to keep its IP address between reboots.

Elastic IP is free while your (attached) server is up.
But it will cost you some minor fees when the attached server is down.
This is done to make sure you are not "reserving" IP while not using/need it

Answer 4

The hostname has a new ssh key, so ssh tells you something has changed. The hint is here:

Offending ECDSA key in /m/.ssh/known_hosts:27

If you're sure the server on the other side is authentic, you should delete line 27 in /m/.ssh/known_hosts.