WinSCP displays an empty directory in AWS environments primarily because the default root user is often restricted or locked out for security reasons. You must verify that you are connecting with a valid system user, such as
ec2-user for Amazon Linux or
ubuntu for Ubuntu instances, and ensure your SSH key permissions are correct.
Verifying the Correct Username
The most common reason files appear missing or the connection fails silently is using the wrong username. AWS EC2 instances do not use the generic
root account by default. Instead, each operating system image has a specific default user. If you attempt to log in as
root, the server will reject the authentication, or if it accepts it via password (which is rare), you might land in a home directory that lacks the expected application files.
For Amazon Linux 2 or 2023, the default username is
ec2-user. For Ubuntu Server instances, it is
ubuntu. Debian-based images typically use
admin or
debian. CentOS instances usually require
centos. Always check the documentation for the specific AMI (Amazon Machine Image) you launched. Using the incorrect user leads to confusion where users think they have access but are actually viewing an empty or permission-denied state. This issue is distinct from network connectivity problems; for instance, if you can resolve DNS but not ping the IP, refer to our guide on
Cannot Ping Public IP but Can Ping Public DNS of a Public EC2 Instance - Troubleshooting Guide to rule out network layer issues before diving into file visibility.
Checking SSH Key Permissions
WinSCP relies on the underlying SSH protocol, which enforces strict security policies regarding private key files. If the private key file (.pem) used for authentication has permissions that are too open, the SSH client will refuse to use it, resulting in authentication failure. On Windows, WinSCP handles this internally through its own key manager, but on Linux or macOS, or when using PuTTY directly, the file permissions must be set correctly.
Ensure that your private key file is readable only by you. On Unix-like systems, you should run
chmod 400 mykey.pem. If the permissions are set to
644 or
777, SSH will throw an error stating "Permissions are too open." In WinSCP, go to the Session settings, click on Advanced, then Connection, and ensure the private key path is correctly specified. If the key is invalid or improperly formatted, WinSCP may connect but show no files if it falls back to a guest mode or fails silently depending on the configuration.
Inspecting Directory Permissions and Ownership
Even with successful authentication, you might see an empty directory if the current user does not have read permissions for the target directory. By default, users are dropped into their home directory (
/home/ec2-user or
/home/ubuntu). If you navigate to
/var/www/html or another shared directory, you need appropriate access rights.
You can verify ownership by logging in via SSH and running
ls -la. Look at the first column for permissions and the third/fourth columns for owner and group. If you see
d--------- or similar restrictive flags, you cannot list contents. To fix this, an administrator must adjust permissions using
chmod or change ownership with
chown. For example,
sudo chown -R ec2-user:ec2-user /var/www ensures the default user owns the web directory. Without these changes, WinSCP will display the folder structure but leave individual files invisible due to lack of execute/read bits.
Configuring SFTP Subsystem Settings
Sometimes the issue lies in how WinSCP negotiates the SFTP subsystem with the AWS instance. The default SFTP server configuration on some Linux distributions may restrict chroot directories or disable certain features. In WinSCP, go to Preferences, select SFTP, and look for the Advanced settings. Ensure that the "SFTP server" path is set to
sftp-server or
/usr/libexec/openssh/sftp-server depending on your OS.
Additionally, check if the
Subsystem sftp line in the
/etc/ssh/sshd_config file on the EC2 instance is uncommented and points to the correct binary. Misconfiguration here can cause the session to hang or drop immediately after login, appearing as if no files are visible. If you are using a bastion host, ensure your WinSCP profile is correctly configured to tunnel through it, similar to setups described in
WinSCP Connection through Wallix Bastion Failure but Works with PuTTY, although direct EC2 connections rarely require such complex tunneling unless specifically architected.
Using the File Mask Filter
A less obvious cause for "missing" files is an active file mask filter in WinSCP. If you have previously saved a session with a specific mask, such as
*.txt or
!.*, WinSCP will hide all other file types. Check the bottom right corner of the WinSCP window for any text indicating a filter is active. Clear the mask or reset the session settings to default view to reveal hidden files, including those starting with a dot (like
.bashrc or
.ssh).
Frequently Asked Questions
Why can I connect to EC2 via SSH but WinSCP shows nothing?
This usually indicates a permissions issue on the remote side rather than a connection problem. Verify that the user you are logging into has read access to the current directory. Run
ls -la in your terminal to check if the directory is owned by your user or if others have read+execute permissions.
How do I find the default username for my AWS instance?
The username depends on the AMI type. Amazon Linux uses
ec2-user, Ubuntu uses
ubuntu, Debian uses
admin, and CentOS uses
centos. You can also check the AWS Console under the "Details" tab of your instance to see the platform information.
Can I enable root login in WinSCP for AWS?
No, AWS disables password-based root login by default for security. While you can technically modify
sshd_config to allow root SSH access, it is strongly discouraged. Use the default user and escalate privileges with
sudo when necessary instead.
What if my .pem file is rejected by WinSCP?
WinSCP requires keys in OpenSSH format. If you downloaded a .pem file, you may need to convert it using PuTTYgen. Load the .pem file in PuTTYgen, save the private key as a .ppk file, and then point WinSCP to the new .ppk file in the Authentication settings.
Why are hidden files not showing in WinSCP?
WinSCP hides files starting with a dot by default. Go to View > Show Hidden Files to toggle their visibility. Alternatively, clear any file masks in the session options that might be excluding dotfiles.