4. Amazon EC2: Launch and Connect to Your Linux Server
4.4 Key Pairs, chmod 400 and SSH from Linux/Mac
Key pair mhanje tumchi digital killi. AWS kade public key rahte, private key (.pem) fakt tumchyakade – ti ekdach download hote. Ti haravli tar AWS punha deu shakat nahi.
Default usernames
| AMI | SSH user |
|---|---|
| Amazon Linux 2023 / Amazon Linux 2 | ec2-user |
| Ubuntu | ubuntu |
| CentOS Stream 9 (official) | ec2-user (older CentOS 7/8 AMIs: centos) |
| RHEL | ec2-user |
| Debian | admin |
| SUSE | ec2-user |
From Linux or macOS (OpenSSH)
cd ~/Downloads
chmod 400 mykey.pem # private key must not be readable by others
ssh -i mykey.pem ec2-user@<PUBLIC_IP> # Amazon Linux / CentOS Stream
ssh -i mykey.pem ubuntu@<PUBLIC_IP> # Ubuntu
Type yes when asked "Are you sure you want to continue connecting?" (first time only — it stores the server fingerprint in ~/.ssh/known_hosts).
UNPROTECTED PRIVATE KEY FILE!
If you see Permissions 0644 for 'mykey.pem' are too open, SSH refuses to use the key. Fix with chmod 400 mykey.pem. Never share your .pem, never upload it to GitHub, never e-mail it.
Why chmod 400? SSH client refuses a private key that other users on your laptop can read, because a readable key is as good as a stolen key. 400 means owner read-only, nobody else anything.
ls -l mykey.pem # -rw-r--r-- -> too open, SSH will refuse
chmod 400 mykey.pem
ls -l mykey.pem # -r-------- -> correct
ssh -v -i mykey.pem ec2-user@<PUBLIC_IP> # -v shows every step if login fails
Why this matters for security
Private keys leaked on GitHub, in e-mail or in shared folders are a common cause of cloud compromise. Treat a .pem like the password to the whole server: one key per person, chmod 400, never committed to Git, and rotated when a team member leaves.
Ravindra Bagale's Tip
"Permission denied (publickey)" aala ki khup students key punha download karayla jatat – pan ti punha milat nahi! Bahutek vela chuk username chi asate: Amazon Linux la ec2-user, Ubuntu la ubuntu. Aadhi username aani chmod 400 check kara, mag ssh -v chalva.
Practice task
Create a folder ~/aws-keys, move your key into it, run chmod 400, and connect to both instances using the correct user names.