# Created Users on EC2 Instance, Now I Can't SSH There **URL:** \ **Category:** Ansible Project\ **Created:** [August 27, 2018, 8:07pm UTC](https://forum.ansible.com/t/created-users-on-ec2-instance-now-i-cant-ssh-there/28430 "2018-08-27T20:07:47Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ttwalto](https://avatars.discourse-cdn.com/v4/letter/t/ecb155/32.png) [@ttwalto](https://forum.ansible.com/u/ttwalto)\ **Post date:** [August 27, 2018, 8:07pm UTC](https://forum.ansible.com/t/created-users-on-ec2-instance-now-i-cant-ssh-there/28430/1 "2018-08-27T20:07:47Z")
I’ve run a playbook that creates an EC2 instance. The AMI used to create the instance is using CentOS and installs an SSH key so that I can ssh in as username “centos” without a password. It works fine. But now I’ve created a subsequent playbook that configures the new server. One of the things it does is create two new users: - name: Create Users user: name: ‘{{ item.name }}’ home: /home/centos create\_home: yes groups: - wheel - developer append: yes comment: “CastleBranch Developer Admin” state: present loop: “{{ ansible\_server\_users }}” Notice that it’s creating the new users with /home/centos as the home directory. I thought it would just set that as home directory for my new user, and that I would then be able to ssh in as that new user, using the same keys. However, after running this I am now unable to login as _anything_. Not the new users, and not “centos” either. I can kill the instance and create it anew. That’s not a problem. But anyone have any guesses as to what happened that I can’t login now? ---
**Author:** ![Jonathan\_Lozada\_De\_L](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@Jonathan\_Lozada\_De\_L](https://forum.ansible.com/u/Jonathan_Lozada_De_L)\ **Post date:** [August 27, 2018, 8:18pm UTC](https://forum.ansible.com/t/created-users-on-ec2-instance-now-i-cant-ssh-there/28430/2 "2018-08-27T20:18:32Z")
Looks like you are creating the user but, not putting the public keys in their home dir. ---
**Author:** ![ttwalto](https://avatars.discourse-cdn.com/v4/letter/t/ecb155/32.png) [@ttwalto](https://forum.ansible.com/u/ttwalto)\ **Post date:** [August 28, 2018, 1:49pm UTC](https://forum.ansible.com/t/created-users-on-ec2-instance-now-i-cant-ssh-there/28430/3 "2018-08-28T13:49:52Z")
The public keys are already there, since it’s re-using the /home/centos directory. But it’s not using those keys when logging in as the new user, the keys that are (theoretically) in the new user’s home directory. ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [August 28, 2018, 2:00pm UTC](https://forum.ansible.com/t/created-users-on-ec2-instance-now-i-cant-ssh-there/28430/4 "2018-08-28T14:00:27Z")
ssh is very strict on permission. ~/.ssh need to have mode 0600, and the private key require mode 0400 or 0600. So sharing the same home folder among several user to reuse .ssh wont work since only one user can be the owner of a file/directory at any given time. ---
**Author:** ![ttwalto](https://avatars.discourse-cdn.com/v4/letter/t/ecb155/32.png) [@ttwalto](https://forum.ansible.com/u/ttwalto)\ **Post date:** [August 28, 2018, 2:14pm UTC](https://forum.ansible.com/t/created-users-on-ec2-instance-now-i-cant-ssh-there/28430/5 "2018-08-28T14:14:14Z")
Interesting. I know that SSH is strict about the permissions applied, but I’ve never heard of it checking the owner/group of the files. ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [August 28, 2018, 2:29pm UTC](https://forum.ansible.com/t/created-users-on-ec2-instance-now-i-cant-ssh-there/28430/6 "2018-08-28T14:29:54Z")
ssh is enforcing that the owner is the only one that with access, by checking the mode, it don't care about the owner id or group id. But the filesystem will, it wont let user1 use user2 files/directory if they have 0400/0600/0700. ---
**Author:** ![Karl\_Auer](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Karl\_Auer](https://forum.ansible.com/u/Karl_Auer)\ **Post date:** [August 28, 2018, 2:31pm UTC](https://forum.ansible.com/t/created-users-on-ec2-instance-now-i-cant-ssh-there/28430/7 "2018-08-28T14:31:56Z")
Which is the point of the permissions 🙂 ---
**Author:** ![ttwalto](https://avatars.discourse-cdn.com/v4/letter/t/ecb155/32.png) [@ttwalto](https://forum.ansible.com/u/ttwalto)\ **Post date:** [August 28, 2018, 3:05pm UTC](https://forum.ansible.com/t/created-users-on-ec2-instance-now-i-cant-ssh-there/28430/8 "2018-08-28T15:05:05Z")
Okay, I get that. I actually hadn’t thought about that aspect of it. But there’s still a couple of things that don’t make sense to me. One is that the authorized keys file is still read-writable by the “developer” group, which the existing user _and_ the new users are in. And that’s the only one that really matters, right? I have the private key here on my laptop. SSH verifies that public key entry against my private key, and so should be good. Also, why would the existing user, “centos”, who could log in before, no longer be able to? Ooooh… wait… after my ‘user’ play I ran a play that recursively changed permissions on /home/centos to 2775. I bet that caused this. _facepalm_