I was doing some maintenance on the Amazon EC2 instance that underpins DLTJ and in the process managed to mess up the .ssh/authorized_keys file. (Specifically, I changed the permissions so it was group- and world-readable, which causes `sshd` to not allow users to log in using those private keys.) Unfortunately, there is only one user on this server, so effectively I just locked myself out of the box.
After browsing the Amazon support forums I managed to puzzle this one out. Since I didn't see this exact solution written up anywhere, I'm posting it here hoping that someone else will find it useful. And since you are reading this, you know that they worked.
Basically we've got to get the root filesystem mounted on another EC2 instance so we can get access to it. I'm using placeholder identifiers like
vol-rootfs in place of real values.
- Stop the target EC2 instance (
- Note the location of and unmount its root filesystem, and detach its EBS volume (
vol-rootfs) from the target instance (
- Attach the volume (
vol-rootfs) on another EC2 instance (
i-scratch) and mount the filesystem.
- Change the file permissions (or whatever needs to be done).
- Unmount the filesystem and detach the volume (
vol-rootfs) from the other EC2 instance (
- Attach the volume (
vol-rootfs) to the target EC2 instance (
i-target) and start it.
Assuming you've got all of the environment variables set up with the appropriate AWS credentials, these are the commands:
Stop the Target Instance
Detach Root EBS Volume
A couple of steps here. We need to remember where the root filesystem is mounted so we can put it back at the end. So first get a description of the instance. It will look something like this.
In this case we need to remember
/dev/sda1. (Note that we can ignore the
vol-datafs -- on my instance it is where the database and other data is stored. If you don't know which volume is your root volume, you might be facing some trial and error in the steps below until you find it.) Now we detach it:
Attach Volume Elsewhere
This set of instructions assumes that you have another EC2 instance running somewhere else. If you don't have one, start a micro instance for this purpose then terminate it when you are done. We're going to attach it as
Now log into
i-scratch and mount the volume.
In my case:
Unmount/Detach from i-Scratch
While still on the i-scratch server:
Detatch from the scratch server.
Reattach the Volume and Start the Server
We're on the home stretch now. Note that in the first command we're using the mount point we found in the second step.
After the instance starts, you should be able to log in. If not, go through the steps again and read the syslog files in
/var/log to figure out what is going on.