Mac终端连接EC2实例报错‘Not a directory’及权限问题求助

终端报错信息 #

apple@Apples-MacBook-Pro-2 ~ % ssh ec2-13-127-165-161.ap-south-1.compute.amazonaws.com                                                    
hostkeys_find_by_key_hostfile: hostkeys_foreach failed for /Users/apple/.ssh/known_hosts: Not a directory
The authenticity of host 'ec2-13-127-165-161.ap-south-1.compute.amazonaws.com (13.127.165.161)' can't be established.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Failed to add the host to the list of known hosts (/Users/apple/.ssh/known_hosts).
apple@ec2-13-127-165-161.ap-south-1.compute.amazonaws.com: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).
apple@Apples-MacBook-Pro-2 ~ % 

已执行的操作步骤 #

按照教程完成以下操作：

• 下载EC2实例的.pem密钥文件
• 在AWS控制台选择目标实例，点击「Actions」→「Connect」→「Connect with a Standalone SSH Client」
• 在Mac终端执行命令：

  # 创建.ssh目录
  mkdir -p ~/.ssh
  # 移动pem文件到.ssh目录
  mv ~/Downloads/ec2private.pem ~/.ssh
  # 设置pem文件权限
  chmod 400 ~/.ssh/ec2private.pem
  # 创建SSH配置文件
  vim ~/.ssh/config
  

• 在config文件中添加内容：

  Host *amazonaws.com
  IdentityFile ~/.ssh/ec2private.pem
  User ec2-user
  

• 尝试用SSH命令连接实例

Debug输出 #

OpenSSH_9.0p1, LibreSSL 3.3.6
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 21: include /etc/ssh/ssh_config.d/* matched no files
debug1: /etc/ssh/ssh_config line 54: Applying options for *
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/Users/apple/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/Users/apple/.ssh/known_hosts2'
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Connecting to ec2-54-23-23-23-34.example.amazonaws.com port 22.
ssh: Could not resolve hostname ec2-54-23-23-23-34.example.amazonaws.com: nodename nor servname provided, or not known
apple@Apples-MacBook-Pro-2 ~ % 

解决方案 #

1. 修复known_hosts文件异常 #

报错中提示/Users/apple/.ssh/known_hosts不是目录，说明该路径被错误创建为目录而非文件，执行以下命令修复：

# 删除错误的目录
rm -rf ~/.ssh/known_hosts
# 创建空的known_hosts文件
touch ~/.ssh/known_hosts
# 设置正确权限
chmod 600 ~/.ssh/known_hosts

2. 确认密钥文件与配置匹配 #

• 检查~/.ssh/config中的IdentityFile路径是否与实际的.pem文件名一致，若你的密钥文件不是ec2private.pem，需修改路径为实际文件名
• 确保密钥文件权限为400，再次执行：

  chmod 400 ~/.ssh/你的密钥文件名.pem
  

3. 验证连接域名与用户名 #

• Debug中的域名解析错误是使用了示例域名，连接时必须替换为你自己的EC2实例公网域名（即第一个报错中的ec2-13-127-165-161.ap-south-1.compute.amazonaws.com）
• 确认EC2实例的镜像对应的正确用户名：
  • Amazon Linux/CentOS：ec2-user或centos
  • Ubuntu：ubuntu
  • Debian：admin或debian
    可以直接指定用户名连接测试：

  ssh -i ~/.ssh/你的密钥文件名.pem 正确用户名@ec2-13-127-165-161.ap-south-1.compute.amazonaws.com
  

4. 检查EC2安全组规则 #

登录AWS控制台，进入目标EC2实例的安全组设置，确保入站规则允许你的本地IP地址访问22端口（SSH协议），如果当前规则是0.0.0.0/0（允许所有IP），可暂时用来测试连接，确认后再限制为自己的IP。

内容的提问来源于stack exchange，提问作者ramana