<p>Solved by SSH Forwarding from the local PC to the jump server so that keypair authentication does not fail when ssh from this jump server to another ec2.</p>

CC BY-SA 4.0
2024-09-22T13:00:55.390Z
2024-09-22T13:00:55.390Z
Mostafa Nabil
<p>I need to use SSH-Copy-ID instead of manually copying the public key from one ec2 host instance to the remote ec2 instance. but copying key using this command always fails due to Permission denied (publickey).</p>
<p>However i set the permissions and the needed configurations as below:</p>
<p><strong>Directory permissions:</strong></p>
<ol>
<li>The .ssh directory on the target instance should has the correct
permissions as below output.</li>
</ol>
<pre><code>drwx------ 2 ssh-server ssh-server 4096 Jul 31 10:00 .ssh
</code></pre>
<ol start="2">
<li>The authorized_keys file on the target instance should has the correct permissions as below output</li>
</ol>
<pre><code>-rw------- 1 ssh-server ssh-server    0 Jul 30 21:59 authorized_keys
</code></pre>
<ol start="3">
<li><p>The SSH configuration file /etc/ssh/sshd_config on the target instance allows password authentication <strong>(PasswordAuthentication yes)</strong> and pubkey authentication <strong>(PubkeyAuthentication yes)</strong>.</p>
</li>
<li><p>User permissions: The ssh-server user on the target instance has root privileges.</p>
</li>
<li><p>using <code>sudo tail -f /var/log/auth.log</code> on the target server while trying to copy key again using ssh-copy-id from client i got the following logs from server</p>
</li>
</ol>
<pre><code>    2024-07-30T22:46:13.300537+00:00 ip-172-31-30-59 sudo: ssh-server : TTY=pts/0 ; PWD=/home/ssh-server/.ssh ; USER=root ; COMMAND=/usr/bin/tail -f /var/log/auth.log
    2024-07-30T22:46:13.304903+00:00 ip-172-31-30-59 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by ubuntu(uid=1001)
    2024-07-30T22:46:34.368226+00:00 ip-172-31-30-59 sshd[2922]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56072 [preauth]
    2024-07-30T22:46:34.630364+00:00 ip-172-31-30-59 sshd[2924]: AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys ssh-server SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk failed, status 22
    2024-07-30T22:46:34.691004+00:00 ip-172-31-30-59 sshd[2924]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56088 [preauth]
    2024-07-30T22:46:34.936124+00:00 ip-172-31-30-59 sshd[2940]: AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys ssh-server SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk failed, status 22
    2024-07-30T22:46:34.957691+00:00 ip-172-31-30-59 sshd[2940]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56104 [preauth]
</code></pre>
<p><strong>from client server:</strong></p>
<pre><code>ssh-client@ip-172-31-21-170:~/.ssh$ ssh-copy-id -i id_rsa.pub ssh-server@13.51.64.255
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: &quot;id_rsa.pub&quot;
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
ssh-server@13.51.64.255: Permission denied (publickey).
</code></pre>
<p><strong>Debug Mode from client</strong></p>
<pre><code>ssh-client@ip-172-31-21-170:~/.ssh$ ssh -vvv ssh-server@13.51.64.255
OpenSSH_9.6p1 Ubuntu-3ubuntu13.4, OpenSSL 3.0.13 30 Jan 2024
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolve_canonicalize: hostname 13.51.64.255 is address
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -&gt; '/home/ssh-client/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -&gt; '/home/ssh-client/.ssh/known_hosts2'
debug3: channel_clear_timeouts: clearing
debug3: ssh_connect_direct: entering
debug1: Connecting to 13.51.64.255 [13.51.64.255] port 22.
debug3: set_sock_tos: set socket 3 IP_TOS 0x10
debug1: Connection established.
debug1: identity file /home/ssh-client/.ssh/id_rsa type 0
debug1: identity file /home/ssh-client/.ssh/id_rsa-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_ecdsa type -1
debug1: identity file /home/ssh-client/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/ssh-client/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_ed25519 type -1
debug1: identity file /home/ssh-client/.ssh/id_ed25519-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_ed25519_sk type -1
debug1: identity file /home/ssh-client/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_xmss type -1
debug1: identity file /home/ssh-client/.ssh/id_xmss-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_dsa type -1
debug1: identity file /home/ssh-client/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.6p1 Ubuntu-3ubuntu13.4
debug1: compat_banner: match: OpenSSH_9.6p1 Ubuntu-3ubuntu13.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 13.51.64.255:22 as 'ssh-server'
debug3: record_hostkey: found key type ED25519 in file /home/ssh-client/.ssh/known_hosts:1
debug3: load_hostkeys_file: loaded 1 keys from 13.51.64.255
debug1: load_hostkeys: fopen /home/ssh-client/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug3: order_hostkeyalgs: have matching best-preference key type ssh-ed25519-cert-v01@openssh.com, using HostkeyAlgorithms verbatim
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com
debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-s,kex-strict-s-v00@openssh.com
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug3: kex_choose_conf: will use strict KEX ordering
debug1: kex: algorithm: sntrup761x25519-sha512@openssh.com
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server-&gt;client cipher: chacha20-poly1305@openssh.com MAC: &lt;implicit&gt; compression: none
debug1: kex: client-&gt;server cipher: chacha20-poly1305@openssh.com MAC: &lt;implicit&gt; compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:G9t/oDI5ze8ctYGbkt9oRReWW3JVc64cmotyFyAaUQY
debug3: record_hostkey: found key type ED25519 in file /home/ssh-client/.ssh/known_hosts:1
debug3: load_hostkeys_file: loaded 1 keys from 13.51.64.255
debug1: load_hostkeys: fopen /home/ssh-client/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '13.51.64.255' is known and matches the ED25519 host key.
debug1: Found key in /home/ssh-client/.ssh/known_hosts:1
debug3: send packet: type 21
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug2: ssh_set_newkeys: mode 1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: Sending SSH2_MSG_EXT_INFO
debug3: send packet: type 7
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug2: ssh_set_newkeys: mode 0
debug1: rekey in after 134217728 blocks
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug3: kex_input_ext_info: extension server-sig-algs
debug1: kex_ext_info_client_parse: server-sig-algs=&lt;ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256&gt;
debug3: kex_input_ext_info: extension publickey-hostbound@openssh.com
debug1: kex_ext_info_check_ver: publickey-hostbound@openssh.com=&lt;0&gt;
debug3: kex_input_ext_info: extension ping@openssh.com
debug1: kex_ext_info_check_ver: ping@openssh.com=&lt;0&gt;
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug3: kex_input_ext_info: extension server-sig-algs
debug1: kex_ext_info_client_parse: server-sig-algs=&lt;ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256&gt;
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Will attempt key: /home/ssh-client/.ssh/id_rsa RSA SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk
debug1: Will attempt key: /home/ssh-client/.ssh/id_ecdsa
debug1: Will attempt key: /home/ssh-client/.ssh/id_ecdsa_sk
debug1: Will attempt key: /home/ssh-client/.ssh/id_ed25519
debug1: Will attempt key: /home/ssh-client/.ssh/id_ed25519_sk
debug1: Will attempt key: /home/ssh-client/.ssh/id_xmss
debug1: Will attempt key: /home/ssh-client/.ssh/id_dsa
debug2: pubkey_prepare: done
debug1: Offering public key: /home/ssh-client/.ssh/id_rsa RSA SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/ssh-client/.ssh/id_ecdsa
debug3: no such identity: /home/ssh-client/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /home/ssh-client/.ssh/id_ecdsa_sk
debug3: no such identity: /home/ssh-client/.ssh/id_ecdsa_sk: No such file or directory
debug1: Trying private key: /home/ssh-client/.ssh/id_ed25519
debug3: no such identity: /home/ssh-client/.ssh/id_ed25519: No such file or directory
debug1: Trying private key: /home/ssh-client/.ssh/id_ed25519_sk
debug3: no such identity: /home/ssh-client/.ssh/id_ed25519_sk: No such file or directory
debug1: Trying private key: /home/ssh-client/.ssh/id_xmss
debug3: no such identity: /home/ssh-client/.ssh/id_xmss: No such file or directory
debug1: Trying private key: /home/ssh-client/.ssh/id_dsa
debug3: no such identity: /home/ssh-client/.ssh/id_dsa: No such file or directory
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
ssh-server@13.51.64.255: Permission denied (publickey).
ssh-client@ip-172-31-21-170:~/.ssh$
</code></pre>

CC BY-SA 4.0
2024-07-31T15:48:26.070Z
Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
Community
CC BY-SA 4.0
2024-07-31T17:18:47.947Z
@Community .. i cannot copy public key from one ec2 instance to another ec2 using ssh-copy-id ... so that i can login passwordless without hardcoding the public to the authorized_keys ... when i use ssh-copy-id it does work and face the attached error in the topic
Mostafa Nabil
<amazon-web-services><amazon-ec2><ssh>
issue when trying to use ssh-copy-id to copy your SSH public key to a remote EC2 instance
Mostafa Nabil
# issue when trying to use ssh-copy-id to copy your SSH public key to a remote EC2 instance

(Asked by: username_0 on 2024-07-31)

I need to use SSH-Copy-ID instead of manually copying the public key from one ec2 host instance to the remote ec2 instance. but copying key using this command always fails due to Permission denied (publickey).
However i set the permissions and the needed configurations as below:
Directory permissions:

The .ssh directory on the target instance should has the correct
permissions as below output.

drwx------ 2 ssh-server ssh-server 4096 Jul 31 10:00 .ssh


The authorized_keys file on the target instance should has the correct permissions as below output

-rw------- 1 ssh-server ssh-server    0 Jul 30 21:59 authorized_keys


The SSH configuration file /etc/ssh/sshd_config on the target instance allows password authentication (PasswordAuthentication yes) and pubkey authentication (PubkeyAuthentication yes).

User permissions: The ssh-server user on the target instance has root privileges.

using sudo tail -f /var/log/auth.log on the target server while trying to copy key again using ssh-copy-id from client i got the following logs from server


    2024-07-30T22:46:13.300537+00:00 ip-172-31-30-59 sudo: ssh-server : TTY=pts/0 ; PWD=/home/ssh-server/.ssh ; USER=root ; COMMAND=/usr/bin/tail -f /var/log/auth.log
    2024-07-30T22:46:13.304903+00:00 ip-172-31-30-59 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by ubuntu(uid=1001)
    2024-07-30T22:46:34.368226+00:00 ip-172-31-30-59 sshd[2922]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56072 [preauth]
    2024-07-30T22:46:34.630364+00:00 ip-172-31-30-59 sshd[2924]: AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys ssh-server SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk failed, status 22
    2024-07-30T22:46:34.691004+00:00 ip-172-31-30-59 sshd[2924]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56088 [preauth]
    2024-07-30T22:46:34.936124+00:00 ip-172-31-30-59 sshd[2940]: AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys ssh-server SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk failed, status 22
    2024-07-30T22:46:34.957691+00:00 ip-172-31-30-59 sshd[2940]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56104 [preauth]

from client server:
ssh-client@ip-172-31-21-170:~/.ssh$ ssh-copy-id -i id_rsa.pub ssh-server@13.51.64.255
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
ssh-server@13.51.64.255: Permission denied (publickey).

Debug Mode from client
ssh-client@ip-172-31-21-170:~/.ssh$ ssh -vvv ssh-server@13.51.64.255
OpenSSH_9.6p1 Ubuntu-3ubuntu13.4, OpenSSL 3.0.13 30 Jan 2024
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolve_canonicalize: hostname 13.51.64.255 is address
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/ssh-client/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/ssh-client/.ssh/known_hosts2'
debug3: channel_clear_timeouts: clearing
debug3: ssh_connect_direct: entering
debug1: Connecting to 13.51.64.255 [13.51.64.255] port 22.
debug3: set_sock_tos: set socket 3 IP_TOS 0x10
debug1: Connection established.
debug1: identity file /home/ssh-client/.ssh/id_rsa type 0
debug1: identity file /home/ssh-client/.ssh/id_rsa-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_ecdsa type -1
debug1: identity file /home/ssh-client/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/ssh-client/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_ed25519 type -1
debug1: identity file /home/ssh-client/.ssh/id_ed25519-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_ed25519_sk type -1
debug1: identity file /home/ssh-client/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_xmss type -1
debug1: identity file /home/ssh-client/.ssh/id_xmss-cert type -1
debug1: identity file /home/ssh-client/.ssh/id_dsa type -1
debug1: identity file /home/ssh-client/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.6p1 Ubuntu-3ubuntu13.4
debug1: compat_banner: match: OpenSSH_9.6p1 Ubuntu-3ubuntu13.4 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 13.51.64.255:22 as 'ssh-server'
debug3: record_hostkey: found key type ED25519 in file /home/ssh-client/.ssh/known_hosts:1
debug3: load_hostkeys_file: loaded 1 keys from 13.51.64.255
debug1: load_hostkeys: fopen /home/ssh-client/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug3: order_hostkeyalgs: have matching best-preference key type ssh-ed25519-cert-v01@openssh.com, using HostkeyAlgorithms verbatim
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com
debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-s,kex-strict-s-v00@openssh.com
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug3: kex_choose_conf: will use strict KEX ordering
debug1: kex: algorithm: sntrup761x25519-sha512@openssh.com
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:G9t/oDI5ze8ctYGbkt9oRReWW3JVc64cmotyFyAaUQY
debug3: record_hostkey: found key type ED25519 in file /home/ssh-client/.ssh/known_hosts:1
debug3: load_hostkeys_file: loaded 1 keys from 13.51.64.255
debug1: load_hostkeys: fopen /home/ssh-client/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '13.51.64.255' is known and matches the ED25519 host key.
debug1: Found key in /home/ssh-client/.ssh/known_hosts:1
debug3: send packet: type 21
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug2: ssh_set_newkeys: mode 1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: Sending SSH2_MSG_EXT_INFO
debug3: send packet: type 7
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug2: ssh_set_newkeys: mode 0
debug1: rekey in after 134217728 blocks
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug3: kex_input_ext_info: extension server-sig-algs
debug1: kex_ext_info_client_parse: server-sig-algs=
debug3: kex_input_ext_info: extension publickey-hostbound@openssh.com
debug1: kex_ext_info_check_ver: publickey-hostbound@openssh.com=<0>
debug3: kex_input_ext_info: extension ping@openssh.com
debug1: kex_ext_info_check_ver: ping@openssh.com=<0>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug3: kex_input_ext_info: extension server-sig-algs
debug1: kex_ext_info_client_parse: server-sig-algs=
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Will attempt key: /home/ssh-client/.ssh/id_rsa RSA SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk
debug1: Will attempt key: /home/ssh-client/.ssh/id_ecdsa
debug1: Will attempt key: /home/ssh-client/.ssh/id_ecdsa_sk
debug1: Will attempt key: /home/ssh-client/.ssh/id_ed25519
debug1: Will attempt key: /home/ssh-client/.ssh/id_ed25519_sk
debug1: Will attempt key: /home/ssh-client/.ssh/id_xmss
debug1: Will attempt key: /home/ssh-client/.ssh/id_dsa
debug2: pubkey_prepare: done
debug1: Offering public key: /home/ssh-client/.ssh/id_rsa RSA SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/ssh-client/.ssh/id_ecdsa
debug3: no such identity: /home/ssh-client/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /home/ssh-client/.ssh/id_ecdsa_sk
debug3: no such identity: /home/ssh-client/.ssh/id_ecdsa_sk: No such file or directory
debug1: Trying private key: /home/ssh-client/.ssh/id_ed25519
debug3: no such identity: /home/ssh-client/.ssh/id_ed25519: No such file or directory
debug1: Trying private key: /home/ssh-client/.ssh/id_ed25519_sk
debug3: no such identity: /home/ssh-client/.ssh/id_ed25519_sk: No such file or directory
debug1: Trying private key: /home/ssh-client/.ssh/id_xmss
debug3: no such identity: /home/ssh-client/.ssh/id_xmss: No such file or directory
debug1: Trying private key: /home/ssh-client/.ssh/id_dsa
debug3: no such identity: /home/ssh-client/.ssh/id_dsa: No such file or directory
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
ssh-server@13.51.64.255: Permission denied (publickey).
ssh-client@ip-172-31-21-170:~/.ssh$

**Tags:** amazon-web-services, amazon-ec2, ssh

> **Comments:**
> **username_1**: Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.  
> **username_0**: @username_1 .. i cannot copy public key from one ec2 instance to another ec2 using ssh-copy-id ... so that i can login passwordless without hardcoding the public to the authorized_keys ... when i use ssh-copy-id it does work and face the attached error in the topic  

---

## 1 answers

### Answer by username_0 on 2024-09-22. Score: 0

Solved by SSH Forwarding from the local PC to the jump server so that keypair authentication does not fail when ssh from this jump server to another ec2.


---

