Introduction

If an EC2 SSH connection asks for a password, the usual cause is that key-based authentication did not succeed and the SSH client fell back to another method. The fix is almost never "figure out the password." The fix is to identify why the key, username, or server-side SSH configuration is wrong.

Start with the Correct SSH Command

A normal EC2 login should look something like this:

ssh -i my-key.pem [email protected]

Or for Ubuntu images:

ssh -i my-key.pem [email protected]

The username matters. Different AMIs use different default accounts:

• 'ec2-user for Amazon Linux'
• 'ubuntu for Ubuntu'
• 'admin for some Debian-based images'
• 'centos for CentOS'

If the username is wrong, your key may be fine and you can still end up at a password prompt or an authentication failure.

Make Sure the Private Key Is the Right One

The .pem file must match the public key that was installed on the instance at launch time or through later configuration.

A very common mistake is using:

• the wrong key pair for that instance
• a converted key file that does not actually match
• an old key after rebuilding the instance

Use verbose SSH output to confirm what the client is trying.

ssh -vvv -i my-key.pem [email protected]

Look for lines that show whether the offered key was accepted or rejected.

Check Local File Permissions

OpenSSH will ignore a private key that is too permissive.

chmod 400 my-key.pem

Then try again:

ssh -i my-key.pem [email protected]

If the SSH client refuses to use the key, no amount of server-side troubleshooting will fix the connection.

Confirm the Instance Actually Has Your Public Key

On EC2, the public key is usually injected during first boot by cloud-init. If the instance was created incorrectly, restored oddly, or manually modified, the expected public key may not be present in ~/.ssh/authorized_keys.

If you have another access path such as SSM Session Manager or the EC2 serial console, inspect:

cat ~/.ssh/authorized_keys

If your key is missing there, SSH key authentication cannot succeed.

Password Prompt Often Means SSH Is Falling Back

A password prompt does not necessarily mean the instance is supposed to allow password logins. It often means:

• key authentication failed
• the client kept trying other auth methods
• the server offered password auth as a fallback

That is why the prompt itself is not the real problem. The real problem happened earlier in the authentication sequence.

To force the client to use only public-key authentication:

ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no -i my-key.pem [email protected]

This makes the failure mode clearer.

Server-Side SSH Settings

If you control the instance, inspect the SSH daemon configuration.

Relevant settings in sshd_config include:

• 'PubkeyAuthentication yes'
• 'PasswordAuthentication no'
• 'AuthorizedKeysFile .ssh/authorized_keys'

If the server disables public-key auth or points to the wrong authorized keys file, EC2-style login will fail even with the right client key.

Network Checks Still Matter

Before diving deep into SSH auth, confirm the basics:

• the instance is reachable
• port 22 is open in the security group
• the subnet and route table allow inbound access
• you are using the correct public IP or DNS name

A quick network check:

nc -vz 203.0.113.10 22

If port 22 is not reachable, the password prompt issue is not your first problem.

Recovery Options

If key access is broken and you cannot log in normally, recovery usually means one of these:

• use AWS Systems Manager Session Manager
• use EC2 Instance Connect if supported
• attach the root volume to another instance and repair authorized_keys
• use the EC2 serial console where available

Trying random passwords is the wrong path. Most EC2 Linux instances are not meant to have a known default SSH password at all.

Common Pitfalls

• Using the wrong default username for the AMI.
• Pointing SSH at a private key that does not belong to the instance.
• Forgetting to restrict local permissions on the .pem file.
• Assuming a password prompt means EC2 expects password-based login.
• Troubleshooting authentication before checking basic network reachability.

Summary

• EC2 SSH should normally authenticate with a key pair, not a password.
• A password prompt usually means key authentication failed and SSH is falling back.
• Verify the username, the correct .pem file, and local key permissions first.
• Use ssh -vvv to see exactly where authentication is going wrong.
• Recover access through AWS management paths if the instance no longer has the right public key.