You can connect to an Ubuntu 22.04 EC2 instance using SSH with password authentication by creating a new user, setting a password, and configuring the SSH daemon to allow this method. This approach bypasses the default key-based security model, allowing direct credential entry via standard SSH clients like PuTTY or OpenSSH.
Creating the User Account
The first step involves establishing a dedicated user account on the EC2 instance. While the root user exists, it is best practice to create a separate administrative user for daily operations. You can achieve this by connecting to the instance using your existing key pair or the AWS Systems Manager Session Manager. Once you have shell access, execute the
useradd command followed by the desired username. For example, running
sudo useradd -m demo117 creates the user and automatically generates a home directory. The
-m flag ensures that the necessary directory structure is initialized within
/home.
After the user is created, you must assign a password. Use the
passwd command followed by the username. Running
sudo passwd demo117 prompts you to enter and confirm a strong password. This password will be used for subsequent SSH login attempts. It is crucial to choose a complex password that meets security standards, as password authentication is generally less secure than key-based methods.
Configuring SSH Daemon Settings
By default, Ubuntu 22.04 instances disable password authentication for security reasons. To enable it, you must modify the SSH daemon configuration file. Open the file located at
/etc/ssh/sshd_config using a text editor such as
nano or
vim. Search for the directive labeled
PasswordAuthentication. In many default configurations, this line may be commented out with a hash symbol (
#) or set to
no.
Change the value to
yes. If the line is commented out, remove the leading hash symbol to uncomment it. Ensure the line reads exactly as
PasswordAuthentication yes. Additionally, verify that the
PermitRootLogin directive is set appropriately. For enhanced security, it is recommended to keep root login disabled (
PermitRootLogin no) and use your new user account instead. After making these changes, save the file and exit the editor.
To apply the changes, restart the SSH service. Run the command
sudo systemctl restart sshd. This action reloads the configuration without requiring a full server reboot. If the service fails to restart, check the logs for syntax errors in the configuration file.
Connecting via SSH
With the user created and the SSH daemon configured, you can now initiate a connection from your local machine. Open your terminal or SSH client and use the standard SSH syntax. The command structure is
ssh username@public_ip_address. Replace
username with the name you created, such as
demo117, and
public_ip_address with the public IPv4 address of your EC2 instance.
For example:
ssh [email protected]
Your client will prompt you for the password you set earlier. Enter the password carefully; note that characters will not be displayed on the screen for security purposes. Press Enter after typing the password. If the credentials are correct and the network security group allows inbound traffic on port 22, you will gain access to the remote shell.
If you encounter connection issues, ensure that the EC2 security group associated with the instance has an inbound rule allowing TCP traffic on port 22 from your IP address. Without this rule, the connection attempt will time out regardless of the SSH configuration. You can also refer to
Configuring a New User on AWS EC2 with SSH (Ubuntu) for additional context on user management best practices.
Troubleshooting Common Issues
Several factors can prevent successful password authentication. First, verify that the SSH service is actually running on the instance. Use
sudo systemctl status sshd to check its state. If it is inactive, start it with
sudo systemctl start sshd.
Second, check the SSH logs for detailed error messages. The log file is typically located at
/var/log/auth.log. Look for entries related to
sshd around the time of your connection attempt. Common errors include "Permission denied" if the password is incorrect or "Connection refused" if the port is blocked.
Another potential issue is the SSH client configuration on your local machine. Some clients or system-wide configurations may prioritize key-based authentication over passwords. You can force password authentication by adding the
-o PreferredAuthentications=password flag to your SSH command. This tells the client to only attempt password login, ignoring any private keys present in your
.ssh directory.
For more insights on securing your SSH sessions, consider reviewing
Avoiding Google Authenticator Re-Authentication in Existing SSH Sessions on EC2.
Frequently Asked Questions
Is password authentication secure for EC2 instances?
Password authentication is generally considered less secure than key-based authentication because passwords can be guessed or brute-forced. AWS recommends using key pairs for all new instances to enhance security. However, password auth can be useful for temporary access or specific legacy systems.
How do I disable password authentication again?
To disable password authentication, edit the
/etc/ssh/sshd_config file and change
PasswordAuthentication back to
no. Restart the SSH service using
sudo systemctl restart sshd for the changes to take effect.
What if I forget the password I set?
If you forget the password, you cannot recover it directly. You must reset it by accessing the instance through the AWS Console's EC2 Instance Connect feature or by stopping the instance, detaching the root volume, attaching it to another instance, and modifying the password file manually.
Can I use password authentication with root user?
While technically possible, enabling password authentication for the root user is strongly discouraged due to high security risks. It is safer to create a regular user with sudo privileges and use password authentication for that user instead.
Why does my SSH connection still fail after changing settings?
Ensure that the security group attached to your EC2 instance allows inbound traffic on port 22 from your current IP address. Additionally, verify that the SSH service is running and that there are no typos in the configuration file that might prevent the service from restarting properly.