[Music]
hello I'm Walter a call Support Engineer
here at the a table staffs in Cape Town
sometimes customers tell me they've lost
their SSH private key to connect to
Amazon ec2 instance if there were no
additional or alternative users to login
in you are lock it out of your instance
when this happens the only way to
recover access to your instance is to
create a new key pair and replace it in
your existing instance not to worry let
me show you how to create a new key pair
and replace the last one on Amazon Linux
let's get started first because the
recovery procedure requires I stopped in
start of your instance you need to
confirm that your ec2 instance is an EB
se Beckett instance it's not possible to
do this procedure on instance Easter
Beckett instance now let's go to our AWS
management console to check that open
the ec2 console
on the left menu select instance
in my case I have only one instance so
click on the instance name and check the
description tab on the bottom looking at
the description tab check if the root
device type its EBS if its EBS it's ok
and we can proceed with this procedure
please take a lot of the availability
zone on the same description tab as we
are going to launch a new instance in
the same availability zone to replace
the keeper now let's start a new
instance creation wizard choose launch
instance and select the army or
operation system that you need to
replace the keeper in this example we
select Amazon Linux
choose any instance type I suggest the
ship is too unlike teachin an ort to
micro because it's a quicker procedure
so I will choose the T to nano and click
on next
under configure instance details select
the same V PC and subnet to make sure
that the new instance is mentioned in
the correct availability zone in our
case that availability zone is us West
one be just next and keep the storage
option as is select in X again on the
edit tags page let's add a new tag and
the key will be named and the value will
be recovered instance to make it easy to
identify this instance after we finish
the procedure click on next
select pre-existing security group or
create a new one in my case I will use
the an existing group and I will select
the default security group click on
review and lunch when we click on the
launch button on the bottom right it's
time to create a new key pair so change
it from choosing an existing key pair to
create a new key pair give it a name for
example KC video example and download
the keeper and now launch the instance
remember to keep the key pair
safe and if possible make a security
copy on an external device or secure
location to avoid losing it again we can
click on the instance ID to check the
status
as the instance estate is running and
the instance is passing day starts check
let's connect to the instance using the
new key pair this is my local terminal
and I'm going to connect the recovery
instance using the new key pair this bed
permission message is very common to Mac
and Linux users so to correct this just
set the read permissions to the user
with chmod so we need the key pair path
to correct the permission we need to use
the siege mode common and the permission
zero four zero zero two the keeper file
let's try to connect again
there you go we are logging in the
recovery instance so now it's time to
stop the instance where you need to
replace the loss keeper so I'm going
back to the ec2 management console on
the instance page select the instance
that you need to replace the keeper in
our example is the lost SSH key select
the instance select the actions instance
estate and stop
confirm this top if your instance does
not have analyze KP the instance a
period this will change when we started
again
when the instance estate changed to stop
it we can detach the root volume in
attach each to the recovery instance so
selecting the instance that we want to
recover the keeper on the details tab
choose the root device click on it and
click on the volume ID
then select actions and the touch volume
yes the touch after confirming the
detachment wait for the volume state
change to available you can quickly
refresh the status on the top right side
refresh icon now the volume state is
available we can attach it to the
recovery instance so select the action
attach volume
and in the instance field type the
recover instance name in our example is
recovery instance and select the
instance use the device name as /dev SDF
and attach the volume
when the very states change to use go
back to the SSH session now I'm back on
my SSH session on the recovery instance
let's list the block devices attached to
the instance with the LS be L key common
we can see the X vdf device attached to
the instance but is not mounted on the
OS so let's create a temporary directory
to mount the device on the operational
system
now let's mount the device to the
operational system using the mount
common
let's check again with the LS blk you
can see the device is already mounted to
the OS on the /mnt Thank You vol
directory so those are the files from
the original instance now from the
recover instance let's copy the
authorize it Keys file be sure to use
the correct user for the OS that you are
using such as Ubuntu for an Ubuntu
instance or CentOS for same to OS
instance our root for Red Hat basically
is the same user that you use to connect
to their recovery instance if you choose
the same us in this example the user is
the ec2 - user what is the default user
for Amazon Linux so let's copy from our
local user and look out folder SSH to
write the keys
to the device attached to the instance
in the same location you see two
let's check the fire on the destination
folder
if you have problems copying the file
try to repeat the process using pseudo
if you need pseudo to perform the
section remember to adjust the file
permissions to the correct user and
group ID after copying the file
in your case we are using the same user
so we don't need you
sudo and we can just proceed with the
steps the next step is to unmount the
device on the recovery instance so we
can do this with the unmount Coleman
oops wrong comment it's just your mouth
there we go
so let's list the block devices again
and see that is not attached to the
instance anymore we need to detach the
volume using the ec2 management console
and attach it again to the original
instance
now I'm back to ec2 management console
on the environments description page so
we need to detach this volume from the
recovery instance so select the volume
select the actions detach volume and
confirm the detachment monitor this
state and when the environment becomes
available we cannot touch it back to its
original instance so the volume is
available now so let's select actions
again and attach volume in the instance
field select the original instance name
in this case the lost SSH
keeper and input the device as /dev xvd
a slash they have xvd a or slash dev
access CDA are the default device names
on ec2 so you can proceed and attach if
we scroll to the right we can see the
attachment information column so click
on the instance ID and it will open the
ec2 instance details page with the
instance selected choose action instance
state and start
he too may take a few moments
now that our instance is running you can
connect to it using the new key pair
that we created before now I will get my
instance public IP and I will try to
connect using the new cue pair using my
terminal come back to my terminal screen
and I will try to connect to my original
instance using the new key pair
I was up the fingerprint
and that's it I mean thanks for watching
and hepcat computing from all of us here
at AWS
[Music]