Answers: <p>Solved by SSH Forwarding from the local PC to the jump server so that keypair authentication does not fail when ssh from this jump server to another ec2.</p>
  
Answers: CC BY-SA 4.0
Answers: 2024-09-22T13:00:55.390Z
Answers: 2024-09-22T13:00:55.390Z
Answers: Mostafa Nabil
Body: <p>I need to use SSH-Copy-ID instead of manually copying the public key from one ec2 host instance to the remote ec2 instance. but copying key using this command always fails due to Permission denied (publickey).</p>
  <p>However i set the permissions and the needed configurations as below:</p>
  <p><strong>Directory permissions:</strong></p>
  <ol>
  <li>The .ssh directory on the target instance should has the correct
  permissions as below output.</li>
  </ol>
  <pre><code>drwx------ 2 ssh-server ssh-server 4096 Jul 31 10:00 .ssh
  </code></pre>
  <ol start="2">
  <li>The authorized_keys file on the target instance should has the correct permissions as below output</li>
  </ol>
  <pre><code>-rw------- 1 ssh-server ssh-server    0 Jul 30 21:59 authorized_keys
  </code></pre>
  <ol start="3">
  <li><p>The SSH configuration file /etc/ssh/sshd_config on the target instance allows password authentication <strong>(PasswordAuthentication yes)</strong> and pubkey authentication <strong>(PubkeyAuthentication yes)</strong>.</p>
  </li>
  <li><p>User permissions: The ssh-server user on the target instance has root privileges.</p>
  </li>
  <li><p>using <code>sudo tail -f /var/log/auth.log</code> on the target server while trying to copy key again using ssh-copy-id from client i got the following logs from server</p>
  </li>
  </ol>
  <pre><code>    2024-07-30T22:46:13.300537+00:00 ip-172-31-30-59 sudo: ssh-server : TTY=pts/0 ; PWD=/home/ssh-server/.ssh ; USER=root ; COMMAND=/usr/bin/tail -f /var/log/auth.log
      2024-07-30T22:46:13.304903+00:00 ip-172-31-30-59 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by ubuntu(uid=1001)
      2024-07-30T22:46:34.368226+00:00 ip-172-31-30-59 sshd[2922]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56072 [preauth]
      2024-07-30T22:46:34.630364+00:00 ip-172-31-30-59 sshd[2924]: AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys ssh-server SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk failed, status 22
      2024-07-30T22:46:34.691004+00:00 ip-172-31-30-59 sshd[2924]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56088 [preauth]
      2024-07-30T22:46:34.936124+00:00 ip-172-31-30-59 sshd[2940]: AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys ssh-server SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk failed, status 22
      2024-07-30T22:46:34.957691+00:00 ip-172-31-30-59 sshd[2940]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56104 [preauth]
  </code></pre>
  <p><strong>from client server:</strong></p>
  <pre><code>ssh-client@ip-172-31-21-170:~/.ssh$ ssh-copy-id -i id_rsa.pub ssh-server@13.51.64.255
  /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: &quot;id_rsa.pub&quot;
  /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
  /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
  ssh-server@13.51.64.255: Permission denied (publickey).
  </code></pre>
  <p><strong>Debug Mode from client</strong></p>
  <pre><code>ssh-client@ip-172-31-21-170:~/.ssh$ ssh -vvv ssh-server@13.51.64.255
  OpenSSH_9.6p1 Ubuntu-3ubuntu13.4, OpenSSL 3.0.13 30 Jan 2024
  debug1: Reading configuration data /etc/ssh/ssh_config
  debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
  debug1: /etc/ssh/ssh_config line 21: Applying options for *
  debug2: resolve_canonicalize: hostname 13.51.64.255 is address
  debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -&gt; '/home/ssh-client/.ssh/known_hosts'
  debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -&gt; '/home/ssh-client/.ssh/known_hosts2'
  debug3: channel_clear_timeouts: clearing
  debug3: ssh_connect_direct: entering
  debug1: Connecting to 13.51.64.255 [13.51.64.255] port 22.
  debug3: set_sock_tos: set socket 3 IP_TOS 0x10
  debug1: Connection established.
  debug1: identity file /home/ssh-client/.ssh/id_rsa type 0
  debug1: identity file /home/ssh-client/.ssh/id_rsa-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_ecdsa type -1
  debug1: identity file /home/ssh-client/.ssh/id_ecdsa-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_ecdsa_sk type -1
  debug1: identity file /home/ssh-client/.ssh/id_ecdsa_sk-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_ed25519 type -1
  debug1: identity file /home/ssh-client/.ssh/id_ed25519-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_ed25519_sk type -1
  debug1: identity file /home/ssh-client/.ssh/id_ed25519_sk-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_xmss type -1
  debug1: identity file /home/ssh-client/.ssh/id_xmss-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_dsa type -1
  debug1: identity file /home/ssh-client/.ssh/id_dsa-cert type -1
  debug1: Local version string SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.4
  debug1: Remote protocol version 2.0, remote software version OpenSSH_9.6p1 Ubuntu-3ubuntu13.4
  debug1: compat_banner: match: OpenSSH_9.6p1 Ubuntu-3ubuntu13.4 pat OpenSSH* compat 0x04000000
  debug2: fd 3 setting O_NONBLOCK
  debug1: Authenticating to 13.51.64.255:22 as 'ssh-server'
  debug3: record_hostkey: found key type ED25519 in file /home/ssh-client/.ssh/known_hosts:1
  debug3: load_hostkeys_file: loaded 1 keys from 13.51.64.255
  debug1: load_hostkeys: fopen /home/ssh-client/.ssh/known_hosts2: No such file or directory
  debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
  debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
  debug3: order_hostkeyalgs: have matching best-preference key type ssh-ed25519-cert-v01@openssh.com, using HostkeyAlgorithms verbatim
  debug3: send packet: type 20
  debug1: SSH2_MSG_KEXINIT sent
  debug3: receive packet: type 20
  debug1: SSH2_MSG_KEXINIT received
  debug2: local client KEXINIT proposal
  debug2: KEX algorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com
  debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
  debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
  debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
  debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
  debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
  debug2: compression ctos: none,zlib@openssh.com,zlib
  debug2: compression stoc: none,zlib@openssh.com,zlib
  debug2: languages ctos:
  debug2: languages stoc:
  debug2: first_kex_follows 0
  debug2: reserved 0
  debug2: peer server KEXINIT proposal
  debug2: KEX algorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-s,kex-strict-s-v00@openssh.com
  debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
  debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
  debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
  debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
  debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
  debug2: compression ctos: none,zlib@openssh.com
  debug2: compression stoc: none,zlib@openssh.com
  debug2: languages ctos:
  debug2: languages stoc:
  debug2: first_kex_follows 0
  debug2: reserved 0
  debug3: kex_choose_conf: will use strict KEX ordering
  debug1: kex: algorithm: sntrup761x25519-sha512@openssh.com
  debug1: kex: host key algorithm: ssh-ed25519
  debug1: kex: server-&gt;client cipher: chacha20-poly1305@openssh.com MAC: &lt;implicit&gt; compression: none
  debug1: kex: client-&gt;server cipher: chacha20-poly1305@openssh.com MAC: &lt;implicit&gt; compression: none
  debug3: send packet: type 30
  debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
  debug3: receive packet: type 31
  debug1: SSH2_MSG_KEX_ECDH_REPLY received
  debug1: Server host key: ssh-ed25519 SHA256:G9t/oDI5ze8ctYGbkt9oRReWW3JVc64cmotyFyAaUQY
  debug3: record_hostkey: found key type ED25519 in file /home/ssh-client/.ssh/known_hosts:1
  debug3: load_hostkeys_file: loaded 1 keys from 13.51.64.255
  debug1: load_hostkeys: fopen /home/ssh-client/.ssh/known_hosts2: No such file or directory
  debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
  debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
  debug1: Host '13.51.64.255' is known and matches the ED25519 host key.
  debug1: Found key in /home/ssh-client/.ssh/known_hosts:1
  debug3: send packet: type 21
  debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
  debug2: ssh_set_newkeys: mode 1
  debug1: rekey out after 134217728 blocks
  debug1: SSH2_MSG_NEWKEYS sent
  debug1: Sending SSH2_MSG_EXT_INFO
  debug3: send packet: type 7
  debug1: expecting SSH2_MSG_NEWKEYS
  debug3: receive packet: type 21
  debug1: ssh_packet_read_poll2: resetting read seqnr 3
  debug1: SSH2_MSG_NEWKEYS received
  debug2: ssh_set_newkeys: mode 0
  debug1: rekey in after 134217728 blocks
  debug3: send packet: type 5
  debug3: receive packet: type 7
  debug1: SSH2_MSG_EXT_INFO received
  debug3: kex_input_ext_info: extension server-sig-algs
  debug1: kex_ext_info_client_parse: server-sig-algs=&lt;ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256&gt;
  debug3: kex_input_ext_info: extension publickey-hostbound@openssh.com
  debug1: kex_ext_info_check_ver: publickey-hostbound@openssh.com=&lt;0&gt;
  debug3: kex_input_ext_info: extension ping@openssh.com
  debug1: kex_ext_info_check_ver: ping@openssh.com=&lt;0&gt;
  debug3: receive packet: type 6
  debug2: service_accept: ssh-userauth
  debug1: SSH2_MSG_SERVICE_ACCEPT received
  debug3: send packet: type 50
  debug3: receive packet: type 7
  debug1: SSH2_MSG_EXT_INFO received
  debug3: kex_input_ext_info: extension server-sig-algs
  debug1: kex_ext_info_client_parse: server-sig-algs=&lt;ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256&gt;
  debug3: receive packet: type 51
  debug1: Authentications that can continue: publickey
  debug3: start over, passed a different list publickey
  debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
  debug3: authmethod_lookup publickey
  debug3: remaining preferred: keyboard-interactive,password
  debug3: authmethod_is_enabled publickey
  debug1: Next authentication method: publickey
  debug1: Will attempt key: /home/ssh-client/.ssh/id_rsa RSA SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk
  debug1: Will attempt key: /home/ssh-client/.ssh/id_ecdsa
  debug1: Will attempt key: /home/ssh-client/.ssh/id_ecdsa_sk
  debug1: Will attempt key: /home/ssh-client/.ssh/id_ed25519
  debug1: Will attempt key: /home/ssh-client/.ssh/id_ed25519_sk
  debug1: Will attempt key: /home/ssh-client/.ssh/id_xmss
  debug1: Will attempt key: /home/ssh-client/.ssh/id_dsa
  debug2: pubkey_prepare: done
  debug1: Offering public key: /home/ssh-client/.ssh/id_rsa RSA SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk
  debug3: send packet: type 50
  debug2: we sent a publickey packet, wait for reply
  debug3: receive packet: type 51
  debug1: Authentications that can continue: publickey
  debug1: Trying private key: /home/ssh-client/.ssh/id_ecdsa
  debug3: no such identity: /home/ssh-client/.ssh/id_ecdsa: No such file or directory
  debug1: Trying private key: /home/ssh-client/.ssh/id_ecdsa_sk
  debug3: no such identity: /home/ssh-client/.ssh/id_ecdsa_sk: No such file or directory
  debug1: Trying private key: /home/ssh-client/.ssh/id_ed25519
  debug3: no such identity: /home/ssh-client/.ssh/id_ed25519: No such file or directory
  debug1: Trying private key: /home/ssh-client/.ssh/id_ed25519_sk
  debug3: no such identity: /home/ssh-client/.ssh/id_ed25519_sk: No such file or directory
  debug1: Trying private key: /home/ssh-client/.ssh/id_xmss
  debug3: no such identity: /home/ssh-client/.ssh/id_xmss: No such file or directory
  debug1: Trying private key: /home/ssh-client/.ssh/id_dsa
  debug3: no such identity: /home/ssh-client/.ssh/id_dsa: No such file or directory
  debug2: we did not send a packet, disable method
  debug1: No more authentication methods to try.
  ssh-server@13.51.64.255: Permission denied (publickey).
  ssh-client@ip-172-31-21-170:~/.ssh$
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2024-07-31T15:48:26.070Z
Comments: Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
Comments: Community
Comments: CC BY-SA 4.0
Comments: 2024-07-31T17:18:47.947Z
Comments: @Community .. i cannot copy public key from one ec2 instance to another ec2 using ssh-copy-id ... so that i can login passwordless without hardcoding the public to the authorized_keys ... when i use ssh-copy-id it does work and face the attached error in the topic
Comments: Mostafa Nabil
Tags: <amazon-web-services><amazon-ec2><ssh>
Title: issue when trying to use ssh-copy-id to copy your SSH public key to a remote EC2 instance
UserDisplayName: Mostafa Nabil
ThreadText: # issue when trying to use ssh-copy-id to copy your SSH public key to a remote EC2 instance
  
  (Asked by: username_0 on 2024-07-31)
  
  I need to use SSH-Copy-ID instead of manually copying the public key from one ec2 host instance to the remote ec2 instance. but copying key using this command always fails due to Permission denied (publickey).
  
  However i set the permissions and the needed configurations as below:
  
  **Directory permissions:**
  
  1. The .ssh directory on the target instance should has the correct
     permissions as below output.
  
  ```
  drwx------ 2 ssh-server ssh-server 4096 Jul 31 10:00 .ssh
  
  ```
  
  2. The authorized\_keys file on the target instance should has the correct permissions as below output
  
  ```
  -rw------- 1 ssh-server ssh-server    0 Jul 30 21:59 authorized_keys
  
  ```
  
  3. The SSH configuration file /etc/ssh/sshd\_config on the target instance allows password authentication **(PasswordAuthentication yes)** and pubkey authentication **(PubkeyAuthentication yes)**.
  4. User permissions: The ssh-server user on the target instance has root privileges.
  5. using `sudo tail -f /var/log/auth.log` on the target server while trying to copy key again using ssh-copy-id from client i got the following logs from server
  
  ```
      2024-07-30T22:46:13.300537+00:00 ip-172-31-30-59 sudo: ssh-server : TTY=pts/0 ; PWD=/home/ssh-server/.ssh ; USER=root ; COMMAND=/usr/bin/tail -f /var/log/auth.log
      2024-07-30T22:46:13.304903+00:00 ip-172-31-30-59 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by ubuntu(uid=1001)
      2024-07-30T22:46:34.368226+00:00 ip-172-31-30-59 sshd[2922]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56072 [preauth]
      2024-07-30T22:46:34.630364+00:00 ip-172-31-30-59 sshd[2924]: AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys ssh-server SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk failed, status 22
      2024-07-30T22:46:34.691004+00:00 ip-172-31-30-59 sshd[2924]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56088 [preauth]
      2024-07-30T22:46:34.936124+00:00 ip-172-31-30-59 sshd[2940]: AuthorizedKeysCommand /usr/share/ec2-instance-connect/eic_run_authorized_keys ssh-server SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk failed, status 22
      2024-07-30T22:46:34.957691+00:00 ip-172-31-30-59 sshd[2940]: Connection closed by authenticating user ssh-server 13.48.178.150 port 56104 [preauth]
  
  ```
  
  **from client server:**
  
  ```
  ssh-client@ip-172-31-21-170:~/.ssh$ ssh-copy-id -i id_rsa.pub ssh-server@13.51.64.255
  /usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "id_rsa.pub"
  /usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
  /usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
  ssh-server@13.51.64.255: Permission denied (publickey).
  
  ```
  
  **Debug Mode from client**
  
  ```
  ssh-client@ip-172-31-21-170:~/.ssh$ ssh -vvv ssh-server@13.51.64.255
  OpenSSH_9.6p1 Ubuntu-3ubuntu13.4, OpenSSL 3.0.13 30 Jan 2024
  debug1: Reading configuration data /etc/ssh/ssh_config
  debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
  debug1: /etc/ssh/ssh_config line 21: Applying options for *
  debug2: resolve_canonicalize: hostname 13.51.64.255 is address
  debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/ssh-client/.ssh/known_hosts'
  debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/ssh-client/.ssh/known_hosts2'
  debug3: channel_clear_timeouts: clearing
  debug3: ssh_connect_direct: entering
  debug1: Connecting to 13.51.64.255 [13.51.64.255] port 22.
  debug3: set_sock_tos: set socket 3 IP_TOS 0x10
  debug1: Connection established.
  debug1: identity file /home/ssh-client/.ssh/id_rsa type 0
  debug1: identity file /home/ssh-client/.ssh/id_rsa-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_ecdsa type -1
  debug1: identity file /home/ssh-client/.ssh/id_ecdsa-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_ecdsa_sk type -1
  debug1: identity file /home/ssh-client/.ssh/id_ecdsa_sk-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_ed25519 type -1
  debug1: identity file /home/ssh-client/.ssh/id_ed25519-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_ed25519_sk type -1
  debug1: identity file /home/ssh-client/.ssh/id_ed25519_sk-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_xmss type -1
  debug1: identity file /home/ssh-client/.ssh/id_xmss-cert type -1
  debug1: identity file /home/ssh-client/.ssh/id_dsa type -1
  debug1: identity file /home/ssh-client/.ssh/id_dsa-cert type -1
  debug1: Local version string SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.4
  debug1: Remote protocol version 2.0, remote software version OpenSSH_9.6p1 Ubuntu-3ubuntu13.4
  debug1: compat_banner: match: OpenSSH_9.6p1 Ubuntu-3ubuntu13.4 pat OpenSSH* compat 0x04000000
  debug2: fd 3 setting O_NONBLOCK
  debug1: Authenticating to 13.51.64.255:22 as 'ssh-server'
  debug3: record_hostkey: found key type ED25519 in file /home/ssh-client/.ssh/known_hosts:1
  debug3: load_hostkeys_file: loaded 1 keys from 13.51.64.255
  debug1: load_hostkeys: fopen /home/ssh-client/.ssh/known_hosts2: No such file or directory
  debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
  debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
  debug3: order_hostkeyalgs: have matching best-preference key type ssh-ed25519-cert-v01@openssh.com, using HostkeyAlgorithms verbatim
  debug3: send packet: type 20
  debug1: SSH2_MSG_KEXINIT sent
  debug3: receive packet: type 20
  debug1: SSH2_MSG_KEXINIT received
  debug2: local client KEXINIT proposal
  debug2: KEX algorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com
  debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
  debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
  debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
  debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
  debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
  debug2: compression ctos: none,zlib@openssh.com,zlib
  debug2: compression stoc: none,zlib@openssh.com,zlib
  debug2: languages ctos:
  debug2: languages stoc:
  debug2: first_kex_follows 0
  debug2: reserved 0
  debug2: peer server KEXINIT proposal
  debug2: KEX algorithms: sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-s,kex-strict-s-v00@openssh.com
  debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
  debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
  debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
  debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
  debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
  debug2: compression ctos: none,zlib@openssh.com
  debug2: compression stoc: none,zlib@openssh.com
  debug2: languages ctos:
  debug2: languages stoc:
  debug2: first_kex_follows 0
  debug2: reserved 0
  debug3: kex_choose_conf: will use strict KEX ordering
  debug1: kex: algorithm: sntrup761x25519-sha512@openssh.com
  debug1: kex: host key algorithm: ssh-ed25519
  debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
  debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
  debug3: send packet: type 30
  debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
  debug3: receive packet: type 31
  debug1: SSH2_MSG_KEX_ECDH_REPLY received
  debug1: Server host key: ssh-ed25519 SHA256:G9t/oDI5ze8ctYGbkt9oRReWW3JVc64cmotyFyAaUQY
  debug3: record_hostkey: found key type ED25519 in file /home/ssh-client/.ssh/known_hosts:1
  debug3: load_hostkeys_file: loaded 1 keys from 13.51.64.255
  debug1: load_hostkeys: fopen /home/ssh-client/.ssh/known_hosts2: No such file or directory
  debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
  debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
  debug1: Host '13.51.64.255' is known and matches the ED25519 host key.
  debug1: Found key in /home/ssh-client/.ssh/known_hosts:1
  debug3: send packet: type 21
  debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
  debug2: ssh_set_newkeys: mode 1
  debug1: rekey out after 134217728 blocks
  debug1: SSH2_MSG_NEWKEYS sent
  debug1: Sending SSH2_MSG_EXT_INFO
  debug3: send packet: type 7
  debug1: expecting SSH2_MSG_NEWKEYS
  debug3: receive packet: type 21
  debug1: ssh_packet_read_poll2: resetting read seqnr 3
  debug1: SSH2_MSG_NEWKEYS received
  debug2: ssh_set_newkeys: mode 0
  debug1: rekey in after 134217728 blocks
  debug3: send packet: type 5
  debug3: receive packet: type 7
  debug1: SSH2_MSG_EXT_INFO received
  debug3: kex_input_ext_info: extension server-sig-algs
  debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256>
  debug3: kex_input_ext_info: extension publickey-hostbound@openssh.com
  debug1: kex_ext_info_check_ver: publickey-hostbound@openssh.com=<0>
  debug3: kex_input_ext_info: extension ping@openssh.com
  debug1: kex_ext_info_check_ver: ping@openssh.com=<0>
  debug3: receive packet: type 6
  debug2: service_accept: ssh-userauth
  debug1: SSH2_MSG_SERVICE_ACCEPT received
  debug3: send packet: type 50
  debug3: receive packet: type 7
  debug1: SSH2_MSG_EXT_INFO received
  debug3: kex_input_ext_info: extension server-sig-algs
  debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256>
  debug3: receive packet: type 51
  debug1: Authentications that can continue: publickey
  debug3: start over, passed a different list publickey
  debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
  debug3: authmethod_lookup publickey
  debug3: remaining preferred: keyboard-interactive,password
  debug3: authmethod_is_enabled publickey
  debug1: Next authentication method: publickey
  debug1: Will attempt key: /home/ssh-client/.ssh/id_rsa RSA SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk
  debug1: Will attempt key: /home/ssh-client/.ssh/id_ecdsa
  debug1: Will attempt key: /home/ssh-client/.ssh/id_ecdsa_sk
  debug1: Will attempt key: /home/ssh-client/.ssh/id_ed25519
  debug1: Will attempt key: /home/ssh-client/.ssh/id_ed25519_sk
  debug1: Will attempt key: /home/ssh-client/.ssh/id_xmss
  debug1: Will attempt key: /home/ssh-client/.ssh/id_dsa
  debug2: pubkey_prepare: done
  debug1: Offering public key: /home/ssh-client/.ssh/id_rsa RSA SHA256:1Jjz1P6A+z9Ab3xom0sY4BgYRU7NNwokVB/etb9eNuk
  debug3: send packet: type 50
  debug2: we sent a publickey packet, wait for reply
  debug3: receive packet: type 51
  debug1: Authentications that can continue: publickey
  debug1: Trying private key: /home/ssh-client/.ssh/id_ecdsa
  debug3: no such identity: /home/ssh-client/.ssh/id_ecdsa: No such file or directory
  debug1: Trying private key: /home/ssh-client/.ssh/id_ecdsa_sk
  debug3: no such identity: /home/ssh-client/.ssh/id_ecdsa_sk: No such file or directory
  debug1: Trying private key: /home/ssh-client/.ssh/id_ed25519
  debug3: no such identity: /home/ssh-client/.ssh/id_ed25519: No such file or directory
  debug1: Trying private key: /home/ssh-client/.ssh/id_ed25519_sk
  debug3: no such identity: /home/ssh-client/.ssh/id_ed25519_sk: No such file or directory
  debug1: Trying private key: /home/ssh-client/.ssh/id_xmss
  debug3: no such identity: /home/ssh-client/.ssh/id_xmss: No such file or directory
  debug1: Trying private key: /home/ssh-client/.ssh/id_dsa
  debug3: no such identity: /home/ssh-client/.ssh/id_dsa: No such file or directory
  debug2: we did not send a packet, disable method
  debug1: No more authentication methods to try.
  ssh-server@13.51.64.255: Permission denied (publickey).
  ssh-client@ip-172-31-21-170:~/.ssh$
  
  ```
  
  **Tags:** amazon-web-services, amazon-ec2, ssh
  
  > **Comments:**
  > **username_1**: Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.  
  > **username_0**: @username_1 .. i cannot copy public key from one ec2 instance to another ec2 using ssh-copy-id ... so that i can login passwordless without hardcoding the public to the authorized_keys ... when i use ssh-copy-id it does work and face the attached error in the topic  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2024-09-22. Score: 0
  
  Solved by SSH Forwarding from the local PC to the jump server so that keypair authentication does not fail when ssh from this jump server to another ec2.
  
  
  ---
  
  