<p>Apparently during the AMI creation process, the default user password gets locked - a ! is appended to the password in <code>/etc/shadow</code>.</p>
<p>I was able to just add <code>passwd -u ubuntu</code> to the user data of the launch template to unlock it and we are good to go.</p>

CC BY-SA 4.0
2022-11-29T02:14:22.933Z
2022-11-29T05:27:22.510Z
2022-11-29T05:27:22.510Z
chalmiller
<p>Utilizing Ansible AWS modules, I'm creating an AMI from an existing EC2 instance where I am able to ssh with both my user and default account (ubuntu). After the AMI is in a ready state, I then create a launch template with the new AMI and an autoscaling group that leverages that launch template. Once the instance from the autoscaling group is stood up, I am only able to ssh with the user account, but not the default name. The <code>key_name</code> used for the first instance and the launch template are identical.
The <code>/etc/ssh/sshd_config</code> file is also identical between the first instance and the autoscaled instance. The two instances also use the same security groups with port 22 accepting ssh traffic. I assume there might be some data lost during the AMI creation event, but I'm not sure. Any and all help would be appreciated and I'd be happy to provide more information if needed. Thank you!</p>
<pre><code>- name: Create a sandbox instance
  hosts: localhost
  become: False
  gather_facts: False
  tasks:
    - name: Launch instance
      ec2_instance:
        key_name: &quot;{{ keypair }}&quot;
        security_group: &quot;{{ security_group }}&quot;
        instance_type: &quot;{{ instance_type }}&quot;
        image_id: &quot;{{ image }}&quot;
        wait: true
        region: &quot;{{ region }}&quot;
        vpc_subnet_id: &quot;{{ vpc_subnet_id }}&quot;
        volumes:
          - device_name: /dev/sda1
            ebs:
              volume_size: 50
              delete_on_termination: true
        network:
          assign_public_ip: true
        tags:
          tmp: instance
      register: ec2

    - name: Debug EC2 variable availability
      ansible.builtin.debug:
        msg: ec2 instance {{ ec2.instances[0].network_interfaces[0].private_ip_address }}

    - name: Add new instance to host group
      add_host:
        hostname: &quot;{{ ec2.instances[0].network_interfaces[0].private_ip_address }}&quot;
        groupname: launched

    - name: Wait for SSH to come up
      delegate_to: &quot;{{ ec2.instances[0].network_interfaces[0].private_ip_address }}&quot;
      remote_user: &quot;{{ bootstrap_user }}&quot;
      wait_for_connection:
        delay: 60
        timeout: 320

- name: Configure instance
  hosts: launched
  become: True
  gather_facts: True
  remote_user: &quot;{{ bootstrap_user }}&quot;
  roles:
    - app_server
    - ruby
    - nginx
    - Datadog.datadog
  vars:
    datadog_checks:
      sidekiq:
        logs:
          - type: file
            path: /var/log/sidekiq.log
            source: sidekiq
            service: sidekiq
            tags:
              - &quot;env:{{rails_env}}&quot;

- hosts: launched
  become: yes
  gather_facts: no
  remote_user: &quot;{{ user_name }}&quot;
  become_user: &quot;{{ user_name }}&quot;
  # Need to set this hostname appropriately
  pre_tasks:
    - name: set hostname
      set_fact: hostname=&quot;sidekiq&quot;
  roles:
    - deploy_app

- hosts: launched
  become: yes
  gather_facts: no
  remote_user: &quot;{{ bootstrap_user }}&quot;
  roles:
    - sidekiq

- name: Generate AMI from newly generated EC2 instance
  hosts: localhost
  gather_facts: False
  pre_tasks:
    - set_fact: ami_date=&quot;{{lookup('pipe','date +%Y%m%d%H%M%S')}}&quot;
  tasks:
    - name: Debug EC2 instance variable availability
      ansible.builtin.debug:
        msg: EC2 Instances {{ ec2.instances }}

    - name: Create AMI
      ec2_ami:
        instance_id: &quot;{{ ec2.instances[0].instance_id }}&quot;
        name: &quot;sidekiq_ami_{{ ami_date }}&quot;
        device_mapping:
          - device_name: /dev/sda1
            size: 200
            delete_on_termination: true
            volume_type: gp3
        wait: True
        tags:
          env: &quot;{{ rails_env }}&quot;
      register: ami

    # - name: Terminate instances that were previously launched
    #   ec2:
    #     state: &quot;absent&quot;
    #     instance_ids: &quot;{{ ec2.instances[0].instance_id }}&quot;
    #     region:

    - name: Debug AMI variable availability
      ansible.builtin.debug:
        msg: AMI {{ ami }}

    - name: Create an ec2 launch template from new Sidekiq AMI
      ec2_launch_template:
        template_name: &quot;sidekiq_launch_template_{{ rails_env }}&quot;
        image_id: &quot;{{ ami.image_id }}&quot;
        key_name: &quot;{{ keypair }}&quot;
        instance_type: &quot;{{ instance_type }}&quot;
        disable_api_termination: true
        block_device_mappings:
          - device_name: /dev/sda1
            ebs:
              volume_size: 200
              volume_type: gp3
              delete_on_termination: true
        network_interfaces:
          - device_index: 0
            associate_public_ip_address: yes
            subnet_id: &quot;{{ subnet_id }}&quot;
            groups: [&quot;{{ security_group }}&quot;]
        user_data: &quot;{{ '#!/bin/bash\nsudo systemctl sidekiq.service restart' | b64encode }}&quot;
      register: template

    # Rolling ASG update with new launch template
    - name: Rolling update of the existing EC2 instances
      ec2_asg:
        name: &quot;sidekiq_autoscaling_group_{{ rails_env }}&quot;
        availability_zones:
          - us-west-1a
        launch_template:
          launch_template_name: &quot;sidekiq_launch_template_{{ rails_env }}&quot;
        health_check_period: 60
        health_check_type: EC2
        replace_all_instances: yes
        min_size: &quot;{{ min_size }}&quot;
        max_size: &quot;{{ max_size }}&quot;
        desired_capacity: &quot;{{ desired_capacity }}&quot;
        region: &quot;{{ region }}&quot;
        tags:
          - env: &quot;{{ rails_env }}&quot;
            Name: &quot;{{ rails_env }}-sidekiq&quot;
        vpc_zone_identifier: [&quot;{{ subnet_id }}&quot;]
      register: asg
</code></pre>

CC BY-SA 4.0
2022-11-28T07:14:48.253Z
Did you try creating a new instance with the same image manually? Is it giving you the same issue?
Nitesh B.
<amazon-web-services><ansible><ansible-galaxy>
Unable to login as `ubuntu` user on ec2 instance spawned from auto scaling group
Chris
# Unable to login as `ubuntu` user on ec2 instance spawned from auto scaling group

(Asked by: username_0 on 2022-11-28)

Utilizing Ansible AWS modules, I'm creating an AMI from an existing EC2 instance where I am able to ssh with both my user and default account (ubuntu). After the AMI is in a ready state, I then create a launch template with the new AMI and an autoscaling group that leverages that launch template. Once the instance from the autoscaling group is stood up, I am only able to ssh with the user account, but not the default name. The key_name used for the first instance and the launch template are identical.
The /etc/ssh/sshd_config file is also identical between the first instance and the autoscaled instance. The two instances also use the same security groups with port 22 accepting ssh traffic. I assume there might be some data lost during the AMI creation event, but I'm not sure. Any and all help would be appreciated and I'd be happy to provide more information if needed. Thank you!
- name: Create a sandbox instance
  hosts: localhost
  become: False
  gather_facts: False
  tasks:
    - name: Launch instance
      ec2_instance:
        key_name: "{{ keypair }}"
        security_group: "{{ security_group }}"
        instance_type: "{{ instance_type }}"
        image_id: "{{ image }}"
        wait: true
        region: "{{ region }}"
        vpc_subnet_id: "{{ vpc_subnet_id }}"
        volumes:
          - device_name: /dev/sda1
            ebs:
              volume_size: 50
              delete_on_termination: true
        network:
          assign_public_ip: true
        tags:
          tmp: instance
      register: ec2

    - name: Debug EC2 variable availability
      ansible.builtin.debug:
        msg: ec2 instance {{ ec2.instances[0].network_interfaces[0].private_ip_address }}

    - name: Add new instance to host group
      add_host:
        hostname: "{{ ec2.instances[0].network_interfaces[0].private_ip_address }}"
        groupname: launched

    - name: Wait for SSH to come up
      delegate_to: "{{ ec2.instances[0].network_interfaces[0].private_ip_address }}"
      remote_user: "{{ bootstrap_user }}"
      wait_for_connection:
        delay: 60
        timeout: 320

- name: Configure instance
  hosts: launched
  become: True
  gather_facts: True
  remote_user: "{{ bootstrap_user }}"
  roles:
    - app_server
    - ruby
    - nginx
    - Datadog.datadog
  vars:
    datadog_checks:
      sidekiq:
        logs:
          - type: file
            path: /var/log/sidekiq.log
            source: sidekiq
            service: sidekiq
            tags:
              - "env:{{rails_env}}"

- hosts: launched
  become: yes
  gather_facts: no
  remote_user: "{{ user_name }}"
  become_user: "{{ user_name }}"
  # Need to set this hostname appropriately
  pre_tasks:
    - name: set hostname
      set_fact: hostname="sidekiq"
  roles:
    - deploy_app

- hosts: launched
  become: yes
  gather_facts: no
  remote_user: "{{ bootstrap_user }}"
  roles:
    - sidekiq

- name: Generate AMI from newly generated EC2 instance
  hosts: localhost
  gather_facts: False
  pre_tasks:
    - set_fact: ami_date="{{lookup('pipe','date +%Y%m%d%H%M%S')}}"
  tasks:
    - name: Debug EC2 instance variable availability
      ansible.builtin.debug:
        msg: EC2 Instances {{ ec2.instances }}

    - name: Create AMI
      ec2_ami:
        instance_id: "{{ ec2.instances[0].instance_id }}"
        name: "sidekiq_ami_{{ ami_date }}"
        device_mapping:
          - device_name: /dev/sda1
            size: 200
            delete_on_termination: true
            volume_type: gp3
        wait: True
        tags:
          env: "{{ rails_env }}"
      register: ami

    # - name: Terminate instances that were previously launched
    #   ec2:
    #     state: "absent"
    #     instance_ids: "{{ ec2.instances[0].instance_id }}"
    #     region:

    - name: Debug AMI variable availability
      ansible.builtin.debug:
        msg: AMI {{ ami }}

    - name: Create an ec2 launch template from new Sidekiq AMI
      ec2_launch_template:
        template_name: "sidekiq_launch_template_{{ rails_env }}"
        image_id: "{{ ami.image_id }}"
        key_name: "{{ keypair }}"
        instance_type: "{{ instance_type }}"
        disable_api_termination: true
        block_device_mappings:
          - device_name: /dev/sda1
            ebs:
              volume_size: 200
              volume_type: gp3
              delete_on_termination: true
        network_interfaces:
          - device_index: 0
            associate_public_ip_address: yes
            subnet_id: "{{ subnet_id }}"
            groups: ["{{ security_group }}"]
        user_data: "{{ '#!/bin/bash\nsudo systemctl sidekiq.service restart' | b64encode }}"
      register: template

    # Rolling ASG update with new launch template
    - name: Rolling update of the existing EC2 instances
      ec2_asg:
        name: "sidekiq_autoscaling_group_{{ rails_env }}"
        availability_zones:
          - us-west-1a
        launch_template:
          launch_template_name: "sidekiq_launch_template_{{ rails_env }}"
        health_check_period: 60
        health_check_type: EC2
        replace_all_instances: yes
        min_size: "{{ min_size }}"
        max_size: "{{ max_size }}"
        desired_capacity: "{{ desired_capacity }}"
        region: "{{ region }}"
        tags:
          - env: "{{ rails_env }}"
            Name: "{{ rails_env }}-sidekiq"
        vpc_zone_identifier: ["{{ subnet_id }}"]
      register: asg

**Tags:** amazon-web-services, ansible, ansible-galaxy

> **Comments:**
> **username_1**: Did you try creating a new instance with the same image manually? Is it giving you the same issue?  

---

## 1 answers

### Answer by username_2 on 2022-11-29. Score: 1

Apparently during the AMI creation process, the default user password gets locked - a ! is appended to the password in `/etc/shadow`.

I was able to just add `passwd -u ubuntu` to the user data of the launch template to unlock it and we are good to go.


---

