Answers: <p>Apparently during the AMI creation process, the default user password gets locked - a ! is appended to the password in <code>/etc/shadow</code>.</p>
  <p>I was able to just add <code>passwd -u ubuntu</code> to the user data of the launch template to unlock it and we are good to go.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-11-29T02:14:22.933Z
Answers: 2022-11-29T05:27:22.510Z
Answers: 2022-11-29T05:27:22.510Z
Answers: chalmiller
Body: <p>Utilizing Ansible AWS modules, I'm creating an AMI from an existing EC2 instance where I am able to ssh with both my user and default account (ubuntu). After the AMI is in a ready state, I then create a launch template with the new AMI and an autoscaling group that leverages that launch template. Once the instance from the autoscaling group is stood up, I am only able to ssh with the user account, but not the default name. The <code>key_name</code> used for the first instance and the launch template are identical.
  The <code>/etc/ssh/sshd_config</code> file is also identical between the first instance and the autoscaled instance. The two instances also use the same security groups with port 22 accepting ssh traffic. I assume there might be some data lost during the AMI creation event, but I'm not sure. Any and all help would be appreciated and I'd be happy to provide more information if needed. Thank you!</p>
  <pre><code>- name: Create a sandbox instance
    hosts: localhost
    become: False
    gather_facts: False
    tasks:
      - name: Launch instance
        ec2_instance:
          key_name: &quot;{{ keypair }}&quot;
          security_group: &quot;{{ security_group }}&quot;
          instance_type: &quot;{{ instance_type }}&quot;
          image_id: &quot;{{ image }}&quot;
          wait: true
          region: &quot;{{ region }}&quot;
          vpc_subnet_id: &quot;{{ vpc_subnet_id }}&quot;
          volumes:
            - device_name: /dev/sda1
              ebs:
                volume_size: 50
                delete_on_termination: true
          network:
            assign_public_ip: true
          tags:
            tmp: instance
        register: ec2
  
      - name: Debug EC2 variable availability
        ansible.builtin.debug:
          msg: ec2 instance {{ ec2.instances[0].network_interfaces[0].private_ip_address }}
  
      - name: Add new instance to host group
        add_host:
          hostname: &quot;{{ ec2.instances[0].network_interfaces[0].private_ip_address }}&quot;
          groupname: launched
  
      - name: Wait for SSH to come up
        delegate_to: &quot;{{ ec2.instances[0].network_interfaces[0].private_ip_address }}&quot;
        remote_user: &quot;{{ bootstrap_user }}&quot;
        wait_for_connection:
          delay: 60
          timeout: 320
  
  - name: Configure instance
    hosts: launched
    become: True
    gather_facts: True
    remote_user: &quot;{{ bootstrap_user }}&quot;
    roles:
      - app_server
      - ruby
      - nginx
      - Datadog.datadog
    vars:
      datadog_checks:
        sidekiq:
          logs:
            - type: file
              path: /var/log/sidekiq.log
              source: sidekiq
              service: sidekiq
              tags:
                - &quot;env:{{rails_env}}&quot;
  
  - hosts: launched
    become: yes
    gather_facts: no
    remote_user: &quot;{{ user_name }}&quot;
    become_user: &quot;{{ user_name }}&quot;
    # Need to set this hostname appropriately
    pre_tasks:
      - name: set hostname
        set_fact: hostname=&quot;sidekiq&quot;
    roles:
      - deploy_app
  
  - hosts: launched
    become: yes
    gather_facts: no
    remote_user: &quot;{{ bootstrap_user }}&quot;
    roles:
      - sidekiq
  
  - name: Generate AMI from newly generated EC2 instance
    hosts: localhost
    gather_facts: False
    pre_tasks:
      - set_fact: ami_date=&quot;{{lookup('pipe','date +%Y%m%d%H%M%S')}}&quot;
    tasks:
      - name: Debug EC2 instance variable availability
        ansible.builtin.debug:
          msg: EC2 Instances {{ ec2.instances }}
  
      - name: Create AMI
        ec2_ami:
          instance_id: &quot;{{ ec2.instances[0].instance_id }}&quot;
          name: &quot;sidekiq_ami_{{ ami_date }}&quot;
          device_mapping:
            - device_name: /dev/sda1
              size: 200
              delete_on_termination: true
              volume_type: gp3
          wait: True
          tags:
            env: &quot;{{ rails_env }}&quot;
        register: ami
  
      # - name: Terminate instances that were previously launched
      #   ec2:
      #     state: &quot;absent&quot;
      #     instance_ids: &quot;{{ ec2.instances[0].instance_id }}&quot;
      #     region:
  
      - name: Debug AMI variable availability
        ansible.builtin.debug:
          msg: AMI {{ ami }}
  
      - name: Create an ec2 launch template from new Sidekiq AMI
        ec2_launch_template:
          template_name: &quot;sidekiq_launch_template_{{ rails_env }}&quot;
          image_id: &quot;{{ ami.image_id }}&quot;
          key_name: &quot;{{ keypair }}&quot;
          instance_type: &quot;{{ instance_type }}&quot;
          disable_api_termination: true
          block_device_mappings:
            - device_name: /dev/sda1
              ebs:
                volume_size: 200
                volume_type: gp3
                delete_on_termination: true
          network_interfaces:
            - device_index: 0
              associate_public_ip_address: yes
              subnet_id: &quot;{{ subnet_id }}&quot;
              groups: [&quot;{{ security_group }}&quot;]
          user_data: &quot;{{ '#!/bin/bash\nsudo systemctl sidekiq.service restart' | b64encode }}&quot;
        register: template
  
      # Rolling ASG update with new launch template
      - name: Rolling update of the existing EC2 instances
        ec2_asg:
          name: &quot;sidekiq_autoscaling_group_{{ rails_env }}&quot;
          availability_zones:
            - us-west-1a
          launch_template:
            launch_template_name: &quot;sidekiq_launch_template_{{ rails_env }}&quot;
          health_check_period: 60
          health_check_type: EC2
          replace_all_instances: yes
          min_size: &quot;{{ min_size }}&quot;
          max_size: &quot;{{ max_size }}&quot;
          desired_capacity: &quot;{{ desired_capacity }}&quot;
          region: &quot;{{ region }}&quot;
          tags:
            - env: &quot;{{ rails_env }}&quot;
              Name: &quot;{{ rails_env }}-sidekiq&quot;
          vpc_zone_identifier: [&quot;{{ subnet_id }}&quot;]
        register: asg
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2022-11-28T07:14:48.253Z
Comments: Did you try creating a new instance with the same image manually? Is it giving you the same issue?
Comments: Nitesh B.
Tags: <amazon-web-services><ansible><ansible-galaxy>
Title: Unable to login as `ubuntu` user on ec2 instance spawned from auto scaling group
UserDisplayName: Chris
ThreadText: # Unable to login as `ubuntu` user on ec2 instance spawned from auto scaling group
  
  (Asked by: username_0 on 2022-11-28)
  
  Utilizing Ansible AWS modules, I'm creating an AMI from an existing EC2 instance where I am able to ssh with both my user and default account (ubuntu). After the AMI is in a ready state, I then create a launch template with the new AMI and an autoscaling group that leverages that launch template. Once the instance from the autoscaling group is stood up, I am only able to ssh with the user account, but not the default name. The `key_name` used for the first instance and the launch template are identical.
  The `/etc/ssh/sshd_config` file is also identical between the first instance and the autoscaled instance. The two instances also use the same security groups with port 22 accepting ssh traffic. I assume there might be some data lost during the AMI creation event, but I'm not sure. Any and all help would be appreciated and I'd be happy to provide more information if needed. Thank you!
  
  ```
  - name: Create a sandbox instance
    hosts: localhost
    become: False
    gather_facts: False
    tasks:
      - name: Launch instance
        ec2_instance:
          key_name: "{{ keypair }}"
          security_group: "{{ security_group }}"
          instance_type: "{{ instance_type }}"
          image_id: "{{ image }}"
          wait: true
          region: "{{ region }}"
          vpc_subnet_id: "{{ vpc_subnet_id }}"
          volumes:
            - device_name: /dev/sda1
              ebs:
                volume_size: 50
                delete_on_termination: true
          network:
            assign_public_ip: true
          tags:
            tmp: instance
        register: ec2
  
      - name: Debug EC2 variable availability
        ansible.builtin.debug:
          msg: ec2 instance {{ ec2.instances[0].network_interfaces[0].private_ip_address }}
  
      - name: Add new instance to host group
        add_host:
          hostname: "{{ ec2.instances[0].network_interfaces[0].private_ip_address }}"
          groupname: launched
  
      - name: Wait for SSH to come up
        delegate_to: "{{ ec2.instances[0].network_interfaces[0].private_ip_address }}"
        remote_user: "{{ bootstrap_user }}"
        wait_for_connection:
          delay: 60
          timeout: 320
  
  - name: Configure instance
    hosts: launched
    become: True
    gather_facts: True
    remote_user: "{{ bootstrap_user }}"
    roles:
      - app_server
      - ruby
      - nginx
      - Datadog.datadog
    vars:
      datadog_checks:
        sidekiq:
          logs:
            - type: file
              path: /var/log/sidekiq.log
              source: sidekiq
              service: sidekiq
              tags:
                - "env:{{rails_env}}"
  
  - hosts: launched
    become: yes
    gather_facts: no
    remote_user: "{{ user_name }}"
    become_user: "{{ user_name }}"
    # Need to set this hostname appropriately
    pre_tasks:
      - name: set hostname
        set_fact: hostname="sidekiq"
    roles:
      - deploy_app
  
  - hosts: launched
    become: yes
    gather_facts: no
    remote_user: "{{ bootstrap_user }}"
    roles:
      - sidekiq
  
  - name: Generate AMI from newly generated EC2 instance
    hosts: localhost
    gather_facts: False
    pre_tasks:
      - set_fact: ami_date="{{lookup('pipe','date +%Y%m%d%H%M%S')}}"
    tasks:
      - name: Debug EC2 instance variable availability
        ansible.builtin.debug:
          msg: EC2 Instances {{ ec2.instances }}
  
      - name: Create AMI
        ec2_ami:
          instance_id: "{{ ec2.instances[0].instance_id }}"
          name: "sidekiq_ami_{{ ami_date }}"
          device_mapping:
            - device_name: /dev/sda1
              size: 200
              delete_on_termination: true
              volume_type: gp3
          wait: True
          tags:
            env: "{{ rails_env }}"
        register: ami
  
      # - name: Terminate instances that were previously launched
      #   ec2:
      #     state: "absent"
      #     instance_ids: "{{ ec2.instances[0].instance_id }}"
      #     region:
  
      - name: Debug AMI variable availability
        ansible.builtin.debug:
          msg: AMI {{ ami }}
  
      - name: Create an ec2 launch template from new Sidekiq AMI
        ec2_launch_template:
          template_name: "sidekiq_launch_template_{{ rails_env }}"
          image_id: "{{ ami.image_id }}"
          key_name: "{{ keypair }}"
          instance_type: "{{ instance_type }}"
          disable_api_termination: true
          block_device_mappings:
            - device_name: /dev/sda1
              ebs:
                volume_size: 200
                volume_type: gp3
                delete_on_termination: true
          network_interfaces:
            - device_index: 0
              associate_public_ip_address: yes
              subnet_id: "{{ subnet_id }}"
              groups: ["{{ security_group }}"]
          user_data: "{{ '#!/bin/bash\nsudo systemctl sidekiq.service restart' | b64encode }}"
        register: template
  
      # Rolling ASG update with new launch template
      - name: Rolling update of the existing EC2 instances
        ec2_asg:
          name: "sidekiq_autoscaling_group_{{ rails_env }}"
          availability_zones:
            - us-west-1a
          launch_template:
            launch_template_name: "sidekiq_launch_template_{{ rails_env }}"
          health_check_period: 60
          health_check_type: EC2
          replace_all_instances: yes
          min_size: "{{ min_size }}"
          max_size: "{{ max_size }}"
          desired_capacity: "{{ desired_capacity }}"
          region: "{{ region }}"
          tags:
            - env: "{{ rails_env }}"
              Name: "{{ rails_env }}-sidekiq"
          vpc_zone_identifier: ["{{ subnet_id }}"]
        register: asg
  
  ```
  
  **Tags:** amazon-web-services, ansible, ansible-galaxy
  
  > **Comments:**
  > **username_1**: Did you try creating a new instance with the same image manually? Is it giving you the same issue?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2022-11-29. Score: 1
  
  Apparently during the AMI creation process, the default user password gets locked - a ! is appended to the password in `/etc/shadow`.
  
  I was able to just add `passwd -u ubuntu` to the user data of the launch template to unlock it and we are good to go.
  
  
  ---
  
  