Configuring a New User on AWS EC2 with SSH (Ubuntu)

To configure a new user on an AWS EC2 instance with SSH, you must first connect as the default ubuntu user, then create the new account using adduser, and finally grant it sudo privileges. You will also need to add your local public SSH key to the new user's ~/.ssh/authorized_keys file to enable passwordless authentication. This process ensures secure access while maintaining proper permission structures for administrative tasks.

Connecting to the Default User

Before creating any new accounts, you need to establish a connection to your EC2 instance. Ubuntu instances typically use the ubuntu username by default. Ensure you have your private key file (usually ending in .pem) downloaded and accessible on your local machine. Use the following command in your terminal to connect:

ssh -i /path/to/key.pem ubuntu@your-instance-public-ip

If this is your first time connecting, you may see a warning about the host's authenticity. Type yes to accept and continue. Once connected, you are operating as the ubuntu user, which has sudo privileges but should not be used for daily operations due to security best practices.

Creating the New User Account

With root-level access via sudo, you can now create a new user. Replace newusername with your desired username. Run the following command:

sudo adduser newusername

The system will prompt you to set a password. While SSH keys are preferred, setting a strong password acts as a fallback if key authentication fails. You can leave the other optional fields (Full Name, Room Number, etc.) blank by pressing Enter. These details are stored in /etc/passwd and are not critical for SSH functionality.

Granting Sudo Privileges

By default, newly created users do not have administrative rights. To allow the new user to execute commands with elevated privileges, add them to the sudo group. Execute this command:

sudo usermod -aG sudo newusername

The -aG flags append the user to the specified group without removing them from other groups. Verify that the user was added correctly by checking the group membership:

groups newusername

You should see sudo listed among the groups. If it is missing, repeat the previous command or check for typos.

Setting Up SSH Key Authentication

To allow the new user to log in without a password, you must copy your public SSH key into their authorized keys file. First, switch to the new user context or create the necessary directories manually. It is safer to do this step-by-step to avoid permission errors. Create the .ssh directory for the new user:

sudo mkdir -p /home/newusername/.ssh

Next, create the authorized_keys file inside this directory:

sudo touch /home/newusername/.ssh/authorized_keys

Now, you need to populate this file with your public key. On your local machine, display your public key using:

cat ~/.ssh/id_rsa.pub

Copy the entire output string. Then, edit the remote file using sudo nano:

sudo nano /home/newusername/.ssh/authorized_keys

Paste your public key into this file and save it. Alternatively, you can append it directly from your local machine using a one-liner:

cat ~/.ssh/id_rsa.pub | ssh -i /path/to/key.pem ubuntu@your-instance-public-ip "sudo tee -a /home/newusername/.ssh/authorized_keys"

This method avoids manual copying and pasting errors.

Fixing Permissions

SSH is extremely strict about file permissions. If the .ssh directory or authorized_keys file are too open, SSH will ignore them. Set the correct ownership and permissions:

sudo chown -R newusername:newusername /home/newusername/.ssh
sudo chmod 700 /home/newusername/.ssh
sudo chmod 600 /home/newusername/.ssh/authorized_keys

These commands ensure that only the owner can read, write, or execute files within the .ssh directory. Incorrect permissions are a common cause of login failures. For more details on troubleshooting permission issues, see SSH Permission Denied (Publickey) Error on AWS EC2: Authorized Keys Modification.

Testing the New Login

Open a new terminal window on your local machine and attempt to log in as the new user:

ssh -i /path/to/key.pem newusername@your-instance-public-ip

If successful, you will be logged in without being prompted for a password. Test sudo access by running:

sudo whoami

It should return root. If you encounter issues, check the SSH logs on the server at /var/log/auth.log for detailed error messages.

Disabling Root or Default User Login (Optional)

For enhanced security, you may wish to disable direct login for the ubuntu user after confirming the new user works correctly. Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Find the line PermitRootLogin and change it to no. Similarly, you can restrict the ubuntu user by adding DenyUsers ubuntu at the end of the file. Restart the SSH service to apply changes:

sudo systemctl restart sshd

Always ensure you have at least one working user before disabling others to prevent lockout.

Frequently Asked Questions

What if I get a permission denied error after adding the key?

This usually means the .ssh directory or authorized_keys file has incorrect permissions. Ensure the directory is owned by the user and has mode 700, while the key file has mode 600. Check ownership with ls -la ~/.ssh.

Can I use password authentication instead of SSH keys?

While possible, it is strongly discouraged for EC2 instances. Passwords are less secure and vulnerable to brute-force attacks. If you must use passwords, ensure PasswordAuthentication yes is set in /etc/ssh/sshd_config, though modern Ubuntu versions often disable this by default. See Notable: Connecting to an EC2 instance using SSH with password authentication - Ubuntu 22.04.

How do I reset the password if I lose SSH access?

You cannot easily reset the password remotely if SSH access is lost. The recommended approach is to stop the instance, detach the root volume, attach it to another running instance, modify the filesystem, and reattach it. This requires console access and stopping the instance.

Why does SSH still ask for a password even after adding the key?

Check if your local SSH agent is forwarding the key correctly. Also, verify that the public key in authorized_keys matches exactly what is in your local id_rsa.pub. Trailing spaces or line breaks can cause mismatches.

Is it safe to disable the ubuntu user immediately?

No. Always test the new user account thoroughly before disabling the default user. If you disable the default user and the new user fails to authenticate, you will be locked out and need to use the AWS Console serial console or recovery methods to regain access.