Stephane: Okay, so let's learn all the common issues
around SSH for troubleshooting.
So the first one is that
if you don't have the right permissions on your PEM file,
you're going to get an unprotected private key file error,
and need to fix it before being able to SSH.
Also, you need to make sure that the username you provide
when doing the SSH command is correct
based on the OS you're connecting to,
otherwise, you will get an error
that will say host key not found, permission denied
or connection closed by the instance on port 22.
And finally, if you get a connection timeout error by SSH,
you know, this is network-related.
So that means that your security group
is not configured correctly,
or you need to check that the route table for the subnets
also are not configured correctly,
maybe it's a NACL that is not configured correctly.
So all these things are related to networking.
Also, it's possible that the instance
just doesn't have a public IPv4,
and therefore you can't reach it obviously,
or if your EC2 Instance is doing a lot of work
and is swamped,
and the CPU is maxed out at 100%,
then the instance will sort of be unreachable
and so you will also get a connection timeout error.
Okay, the second type of SSH issue in (mumbles)
is when using SSH versus EC2 Instance Connect.
So we're going to do a little bit of a deeper dive
into how EC2 Instance Connect works.
So the first one is that when you connect using SSH,
we know we have a rule
and the user that has a IP that fits the inbound rule
will be allowed to SSH onto your EC2 Instance,
and a user with a different IP will not be allowed to SSH.
So this is something we already know.
But now for EC2 Instance Connect,
things are a little bit different.
So your EC2 Instance will have an inbound rule
in which we allow a specific range of IP from AWS
that corresponds to the EC2 Instance Connect range.
So how do we get this range?
We'll see this there's adjacent file available online,
which gives us for a specific region,
what is the IP prefix
coming from the EC2 Instance Connect service.
What does that mean?
That means that a user
with an IP that is completely different from that range,
for example, 1, 2, 3, 4,
will be using the AWS API
to use the EC2 Instance Connect API,
and then EC2 Instance Connect will be pushing
a one-time SSH public key that is valid for 60 seconds
onto our EC2 Instance and connect to it
from this IP group that we have defined before.
So this is why when you use EC2 Instance Connect,
you don't provide your SSH key,
it actually pushes a one-time SSH public key
onto your EC2 Instance and connect directly to it,
and what we do is that we just interface
with the EC2 Instance Connect service directly.
So let's have a look at all these cases and the hands-on.
So we have our EC2 Instance right here,
and I'm going to copy the IPv4,
and then launch an SSH command.
So if we launch a SSH command
with the right key pair and so on,
we are able to log into it
because SSH security group is open.
Now, if I change the permissions of my KeyPair file,
and try to run again this command.
As we can see,
we get a warning, unprotected private key file.
So this is not going to work.
We need to first revert the permission.
So to a 400 for my DemoKeyPair file,
and then you will be allowed to run the SSH command
and login.
Okay, this is perfect.
The second kind of issue
is if we launch using the wrong username.
So we're using right now EC2 user
because we're doing it into Amazon and X2,
but say that we mistakenly think that it's Ubuntu.
So we do SSH Ubuntu at the IP.
Then as we can see,
we receive a response from the instance
saying too many authentication failures,
and then we're disconnected.
The idea is that we still are accessing the instance
over port 22,
but then we are presenting the username Ubuntu
and the KeyPair, DemoKeyPair.pem,
which is not a valid combination for my instance,
and so we get an authentication error.
So again, we need to make sure that we are using
the correct username for your operating system,
and this is something you can only know
by having a look from the AMI you are into.
The other thing is around security and timeouts.
So right now we have port 22 open on my security group.
But if I open my security group,
edit the inbound rules,
and for example, I will delete this rule and save this,
and now we try to SSH into my instance.
Then we can see that we are timing out
and this is not going to work.
And if you wanted a restrictive kind of rule,
you could edit the inbound rule, add a rule,
and then you would do SSH from my IP
and then save the rule.
And now if I try again,
I'm able to connect into my EC2 Instance,
which brings us on to EC2 Instance Connect.
So as we can see right now,
and I will close this page.
As we can see,
the inbound rule that is available
is SSH in port 22 from my IP.
So one would think that if we do EC2 Instance Connect,
then it will work,
but it turns out that if you do this,
it will not work,
because the CIDR range we need
is not the one we have configured.
So if we look at the documentation around configuration
and of this,
we need to allow the SSH traffic, okay?
Coming from the list of IP range.
So there is this IP address range right here
that we can have a look at,
and we need to look for the EC2 Instance Connect block
for my specific region.
So let's open this IP address range.
We click on download
and it's going to open the IP address range.
And so we'll look at prefixes,
and I'm going to just filter the JSON
for EC2 Instance Connect,
is going to be a bit quicker,
and which you expend all.
And this is something that I'm using Firefox
just for this example,
so this is why it's a little bit slow.
Okay, and I'm going to look at the raw data
is going to be even better.
Okay, here we go.
We're going to look for EC2 Instance Connect.
Okay.
And as we can see now,
we need to have a look at the EC2 Instance Connect IP range
for the region we're in.
And currently I am in the Frankfurt region,
which is eu-central-1.
So we'll go in here and I will look for eu-central-1.
So it's going to take a little bit of time,
but I think it was used right before.
Here we go.
Eu-central-1 and the service is EC2 Instance Connect.
And here's the IP prefix I need to enable
into my security group
for the EC2 Instance Connect service to work.
So let's go back in here into my instance,
security, security group,
and then I will edit the inbound rules.
And so we'll remove this rule
and instead add this specific CIDR block,
which comes from this file we have just downloaded.
So I'll click on save the rule and now my source is correct.
So it's gonna be different obviously for you
if you are in a different region.
And then I will retry access using EC2 Instance Connect,
and Vwa-lah, I am connected into my EC2 Instance,
but of course, if I try to SSH directly into it,
it's not going to work.
So that's it.
We've seen all the SSH and connection issues,
troubleshooting for EC2 Instance.
I hope you liked it,
and I will see you in the next lecture.