To log in to a Linux server from a terminal you do not use a password but an SSH key: a file you keep on your computer and that the machine recognises. It is more secure than a password, and for that very reason, when the file is lost, there is no "forgot your password?". You formatted the laptop, the technician who had it is gone, the file stayed on an old disk: the machine keeps running but nobody can get in.
Think about what would happen if it were tomorrow, with a client's website in service: in AWS there is no support team that will log in for you; the machine is yours and so is the key. In Lightsail there is usually a way out, because its console can open a terminal on the machine without your key and from there you set a new one. But that way out fails more often than it seems (an internal firewall, a broken SSH configuration, the wrong box in Networking), in EC2 it simply does not exist, and then the path goes through snapshots and new machines, or through nothing at all. This guide walks through every way out, from the easy one to the last, and ends with what you should leave in place so you never go through this again.
Before you start: what each thing means
- SSH
- The way to give orders to a Linux server by typing commands from another computer, in encrypted form.
- SSH key (key pair)
- Two files that go together: the private key, which you keep and never share, and the public one, which is left on the server. The server lets you in if you have the private key matching the public one it knows.
- Lightsail default key
- When you create a machine without further ado, Lightsail uses a key of its own per region, which you can download from your account at any time.
- Browser terminal
- The "Connect using SSH" button in the Lightsail console. It opens a terminal on the machine using a temporary key managed by Amazon, without needing yours.
- authorized_keys
- The file, inside the machine, holding the public keys authorised to log in. Adding a line there means adding a key.
- Snapshot
- A complete copy of the machine. When creating a new machine from it you can choose a different SSH key.
Step by step
Check whether the machine uses the default key
In the Lightsail console, open the machine. The Connect tab says which key it uses: if it says the "default key" for your region, you are in luck: go to your account menu (top right), Account, SSH keys tab, and download the default key for that region. With that file you can log in as usual. If the machine used a key you uploaded or created with your own name, keep reading.
Log in with the browser terminal
Click the machine's Connect using SSH button. A terminal opens in a browser window, already inside the machine, without asking you for anything: Lightsail uses a temporary key of its own for this. If it opens, the problem is half solved; now you will set a key of your own to log in again from your computer.
Create a new key on your computer
On Windows (PowerShell), Mac or Linux, type in a terminal on your computer:
ssh-keygen -t ed25519 -f ~/.ssh/lightsail-nuevaIt asks you for a passphrase to protect the key (recommended). It creates two files:
lightsail-nueva(private, do not share it) andlightsail-nueva.pub(public). Open the.pubwith a text editor and copy its single line, which starts withssh-ed25519.Add the public key on the machine
Go back to the browser terminal and type, pasting your line between the quotes:
echo "ssh-ed25519 AAAA...tu-clave... comentario" >> ~/.ssh/authorized_keys chmod 600 ~/.ssh/authorized_keysPasting into the browser terminal is done with the clipboard icon of the window itself (pressing Ctrl+V does not always work there). Check with
tail -1 ~/.ssh/authorized_keysthat the whole line has gone in.Test from your computer
From the terminal on your computer:
ssh -i ~/.ssh/lightsail-nueva bitnami@IP-de-la-maquinaThe user is
bitnamion application blueprints,ubuntuon Ubuntu,ec2-useron Amazon Linux oradminon Debian. If you get in, store the private key somewhere safe (a password manager accepts files) and, this time, write down where it is.If the browser terminal cannot get in either: snapshot
Sometimes an internal firewall on the machine or a broken SSH configuration blocks even the browser terminal. Then: Snapshots tab, create one (or use the most recent automatic one), and from it Create new instance. In the creation form, in the SSH key section, choose the default one or a new one. The new machine is an exact copy with a key you do have. Move the static IP to the new one (guide in this section) and delete the old one once you check everything works. Allow a good hour and some downtime, and do it calmly: this is the moment when it is easiest to break something else.
In EC2 there is no browser terminal: the official procedure
In EC2 the AWS console cannot log in for you. There are two ways out. The automatic one: AWSSupport-ResetAccess, in Systems Manager → Automation, which stops the machine, works on its disk from a helper machine and starts it again with a new key (the machine will be stopped for a few minutes). The manual one, for those who know their way around: stop the machine, detach its root disk, attach it to another EC2 machine, mount the disk and add your public key to the user's
authorized_keys, then put the disk back in its place. If the machine has the Systems Manager agent and an IAM role, Session Manager opens a terminal without a key and saves you all of the above.And if there is no snapshot either
This is the end of the chain and it is worth facing squarely. If the browser terminal cannot get in, if it is not Lightsail, if the machine was deleted or the disk is damaged, and no copy exists, there is nothing to recover: the application, the database, the files, the configurations and the years of work inside are lost. AWS cannot recover what was never copied, and there is no technical service to call. It is not a rare case: it happens every year to businesses that took the machine for "something that just works".
Access recovered: leave in place what would have spared you all this
- Automatic snapshots, every night, and if possible a copy in another region. It is the only difference between an hour of work and losing everything.
- An emergency door that does not depend on files on laptops or on the AWS console: a rescue user that only accepts certificates signed by you, as explained in the spare key guide.
- The private key in a password manager, shared with whoever should have it, and a note of where it is.
What can go wrong
The browser terminal says it cannot connect
It is almost always that the machine's internal firewall (ufw, firewalld) is not letting it through, or that when you restricted port 22 to your IP in Lightsail, "Allow SSH from the Lightsail browser" got unticked. Check that box in the Networking tab. If it is the internal firewall, only the snapshot route is left.
I log in with the new key but it asks for a password
It is asking for the key's passphrase, the one you set in ssh-keygen, not the machine's password. That is normal. If you did not set one and it still asks for a password, the server has not recognised the key: check that the line in authorized_keys is complete and that the permissions are 600.
The person who had the key no longer works here
As well as adding yours, delete theirs from authorized_keys (it is one line; its final comment usually says whose it is). And check whether they also had access to the AWS console.
I have lost the key to many machines at once
Repeat the process on each one from the browser terminal. If there are many, it is time to consider a centralised way of logging in that does not depend on files on laptops.
In Simplio
In Simplio nobody keeps key files: the terminal in the browser opens with a button from the machine itself, asking for the two-factor code, and uses the same temporary key of a few minutes that the Lightsail console uses. The administrator decides which people can open it and on which machines, and every opening is logged with user, machine, date and IP. If someone leaves the company, their access is removed with a tick box, on all machines at once.
And for the day when not even the Lightsail console can get in, the spare key: an emergency user that Simplio leaves on the machine with one button, with no password, that only accepts five-minute certificates signed by Simplio and only from Simplio's IP. Simplio checks every day that it still opens. If you get locked out, with your two-factor code you add a new public key to the user or give it a password, with no snapshots or new machines. How the spare key works.
The same task, in AWS and in Simplio
| In the AWS console | In Simplio | |
|---|---|---|
| Get back in | Lightsail console, browser terminal, generate key, paste it, test: 6 steps, 15 minutes and terminal know-how | "Terminal" button on the machine, with two-factor: 10 seconds, no key files |
| Give someone else access | Repeat steps 3 to 5 with their key | Tick the "terminal" action and the machine on their user |
| Take their access away | Log in and delete their line from authorized_keys on each machine | Untick the box; it is recorded in the activity log |
| If the browser terminal cannot get in | Snapshot, new machine, move the IP, check services: a good hour and some downtime | With the spare key created: "Rescue" → new public key or new password for the user, in a minute, without stopping anything |
| If there is no snapshot either | Everything is lost: there is nobody to call | Scheduled snapshots every night, also in another region, with a warning if they fail |