What is the right file permission for a .pem file to SSH and SCP

Question

I have tried to SSH into my AWS Ubuntu server and copy the directory to my local machine. Throughout the process I experience different file permission errors (noted below).

Is there one specific file permission needed for the .pem file that allows me to SSH and SCP?
Or do I need to change the file permission twice - once for SSH and another for SCP after I login?

Here are the commands I'm using:

SSH:

ssh -i sentiment.pem [email protected]

Copy from remote to local computer with:

scp [email protected]:/home/ubuntu/sentimentfolder /Users/Toga/Desktop/sentimentlocal

I'm on a Mac OS X 10.7.5.

Trial and Error:

After I initially downloaded the .pem file, its permissions were set to, I THINK: 0644

-rw-r--r--@ 1 Toga  staff  1692 Feb 18 21:27  sentiment.pem

I then tried to SSH via terminal and received the following:

WARNING: UNPROTECTED PRIVATE KEY FILE! 
Permissions 0644 for 'sentiment.pem' are too open.
It is recommended that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: sentiment.pem
Permission denied (publickey).

I updated the file permissions to:

chmod 660 sentiment.pem

After the update, the permissions were set to:

-rw-rw----@ 1 Toga  staff  1692 Feb 18 21:27 sentiment.pem

I then tried to SSH via terminal and received the following:

WARNING: UNPROTECTED PRIVATE KEY FILE! 
Permissions 0660 for 'sentiment.pem' are too open.
It is recommended that your private key files are NOT accessible by others.
This private key will be ignored.
bad permissions: ignore key: sentiment.pem
Permission denied (publickey).

I updated the file permissions to:
```
chmod 600 sentiment.pem
```
After the update, the permissions were set to:
```
-rw-------@ 1 Toga  staff 1692 Feb 18 21:27 sentiment.pem
```
I then tried to SSH via terminal and was successful!!

Now logged in, I run the a command to copy the remote directory to my local computer with:

scp [email protected]:/home/ubuntu/sentimentfolder /Users/Toga/Desktop/sentimentlocal

Which returns:

Permission denied (publickey).

SCP Commands Attempted:

added the option -i and referenced the .pem file:

scp -i sentiment.pem [email protected]:/home/ubuntu/sentimentfolder /Users/Toga/Desktop/sentimentlocal

added the option -i, referenced the .pem file, and changed the user for AWS to ec2-user:

scp -i sentiment.pem [email protected]:/home/ubuntu/sentimentfolder /Users/Toga/Desktop/sentimentlocal

added the option -i, referenced the .pem file, changed the user for AWS to ec2-user, and added the complete file path for the location of the .pem file:

scp -i /Users/Toga/Desktop/rollup/Personal/Serial_Project_Starter/sentiment/sentiment.pem [email protected]:/home/ubuntu/sentiment /Users/Toga/Desktop/sentimentlocal

thank you for calling that out @danielkullmann that makes sense. I tried a combination of commands that referenced the .pem file directly but nothing has worked yet. I have updated the question with a section titled: "SCP Commands Attempted" to catalog what I tried. If you an alternative command, please let me know. Thank you. — George Jester, Feb 19 '14 at 08:22

score 191 · Answer 1 · edited May 10 '22 at 06:36

TL;DR:

chmod 400 ~/.ssh/ec2private.pem

Visit here How to Connect to Amazon EC2 Remotely Using SSH or refer below.

How to Connect to Amazon EC2 Remotely Using SSH:

Download the .pem file.
In Amazon Dashboard choose "Instances" from the left side bar, and then select the instance you would like to connect to.
Click on "Actions", then select "Connect"
Click on "Connect with a Standalone SSH Client"
Open up a Terminal window
Create a directory:
```
 # mkdir -p ~/.ssh
```
Move the downloaded .pem file to the .ssh directory we just created:
```
 # mv ~/Downloads/ec2private.pem ~/.ssh
```
Change the permissions of the .pem file so only the root user can read it:
```
 # chmod 400 ~/.ssh/ec2private.pem
```

Create a config file:

 # vim ~/.ssh/config

Enter the following text into that config file:

 Host *amazonaws.com
 IdentityFile ~/.ssh/ec2private.pem
 User ec2-user

Save that file.

Use the ssh command with your public DNS hostname to connect to your instance.
e.g.:
```
# ssh ec2-54-23-23-23-34.example.amazonaws.com
```

Excellent answer. To avoid moving the pem around, you can use the ssh -i flag to specify the public key to use. eg: ssh -i path/to/ec2private.pem ec2-54-23-23-23-34.example.amazonaws.com — Mafro34, Feb 11 '15 at 17:23

score 41 · Answer 2 · edited Feb 02 '16 at 07:50

41

chmod 400 {keyfile}.pem is what amazon instructed and it works.

edited Feb 02 '16 at 07:50

PersianGulf

10,728
8
51
78

answered Feb 02 '16 at 01:05

John Zhang

411
4
3

3

This is the answer I was looking for, all of the instructions in the accepted answer are good practice... but irrelevant to the problem. – Kabir Sarin May 16 '18 at 18:09

score 7 · Answer 3 · edited Nov 24 '14 at 23:08

7

chmod 0400 pemfile.pem

and

ssh -i path_to_pem_file -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no ec2-machine name

edited Nov 24 '14 at 23:08

HalosGhost

4,732
10
33
41

answered Nov 24 '14 at 22:36

harsha konreddy

71
1
1

3

Please explain your `ssh` command (and also provide a reference, if possible). BTW, the `chmod 400` was provided in an answer nine months ago. – Scott - Слава Україні Nov 24 '14 at 23:05
worked for me after ssh -i _private.pem root@ip – matinict Dec 08 '19 at 17:25

daniel kullmann · Answer 4 · 2014-02-20T18:03:17.407

It seems you are not supposed to use the IP address, but the full host name of the system in the SCP command. The AWS docs describe this on http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstancesLinux.html under the section "Transferring Files to Linux/Unix Instances from Linux/Unix with SCP".

And use -r to copy directories.

And note that the default user name is different for different images:

For Amazon Linux, the default user name is ec2-user. For RHEL5, the user name is often root but might be ec2-user. For Ubuntu, the user name is ubuntu. For SUSE Linux, the user name is root. Otherwise, check with your AMI provider.

So, use this command:

scp -r -i  /Users/Toga/Desktop/rollup/Personal/Serial_Project_Starter/sentiment/sentiment.pem [email protected]:~/sentiment /Users/Toga/Desktop/sentimentlocal

A good head smack reminder for me to use the correct user name. Get the above error and I needed to remember to use the ubuntu user on ubuntu instances. — md_rasler, Apr 16 '19 at 16:01

score 2 · Answer 5 · answered Feb 19 '14 at 19:56

2

The "Permission denied (publickey)" is from the remote server, so you're either using the wrong key, it's not allowed to connect or there's a typo in the remote authorized_keys file.

answered Feb 19 '14 at 19:56

maedox

61
4

score 0 · Answer 6 · answered Apr 29 '20 at 10:42

0

I fixed it by adding "sudo" to the command

chmod 0400 pemfile.pem

Then run

sudo ssh -i "your-file.pem" [email protected]

answered Apr 29 '20 at 10:42

Ha Doan

109

What is the right file permission for a .pem file to SSH and SCP

6 Answers6

Linked