# Boundary connect ssh permission denied

**URL:** <https://discuss.hashicorp.com/t/boundary-connect-ssh-permission-denied/18285>\
**Category:** Boundary\
**Created:** [December 1, 2020, 8:46am UTC](https://discuss.hashicorp.com/t/boundary-connect-ssh-permission-denied/18285 "2020-12-01T08:46:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![neolunar7](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/neolunar7/32/8173_2.png) [@neolunar7](https://discuss.hashicorp.com/u/neolunar7)\
**Post date:** [December 1, 2020, 8:46am UTC](https://discuss.hashicorp.com/t/boundary-connect-ssh-permission-denied/18285/1 "2020-12-01T08:46:39Z")

</div>

Hi, I’m following the terraform boundary example in [https://github.com/hashicorp/boundary-reference-architecture/tree/main/deployment/aws#deploy](https://github.com/hashicorp/boundary-reference-architecture/tree/main/deployment/aws#deploy) .

Logging in with the code below is successful.

```auto
BOUNDARY_ADDR='https://boundary-test-controller-<random_name>-<some sha>.elb.us-east-1.amazonaws.com:9200' \
  boundary authenticate password \
  -login-name=jim \
  -password foofoofoo \
  -auth-method-id=ampw_<some ID>

```

However, connecting the target instance with the code below is unsuccessful.

```auto
boundary connect ssh --username ubuntu -target-id ttcp_jDSpPLkudz

```

The target id above is from the target below.

 ![image](https://global.discourse-cdn.com/hashicorp/original/2X/8/81580f867c28055135f2f043977bc5b4783a8758.png)

The error I receive is unauthorized error.

```auto
ubuntu@127.0.0.1: Permission denied (publickey).

```

I followed hashicorp’s official example. Is there anything I should check to successfully authorize myself?

---

<div class="post-metadata">

**Author:** ![neolunar7](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/neolunar7/32/8173_2.png) [@neolunar7](https://discuss.hashicorp.com/u/neolunar7)\
**Post date:** [December 1, 2020, 9:11am UTC](https://discuss.hashicorp.com/t/boundary-connect-ssh-permission-denied/18285/4 "2020-12-01T09:11:08Z")

</div>

Hi, I’m a bit confused. I thought Boundary worker starts the session with the pem key. Does it start the authentication with the password?

By the way, my target instance’s option has Passwordauthentication turned off.

I can’t quite understand how turning this option will solve the problem. Any more detailed explanation will be grateful. Thanks.

---

<div class="post-metadata">

**Author:** ![neolunar7](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/neolunar7/32/8173_2.png) [@neolunar7](https://discuss.hashicorp.com/u/neolunar7)\
**Post date:** [December 1, 2020, 9:13am UTC](https://discuss.hashicorp.com/t/boundary-connect-ssh-permission-denied/18285/5 "2020-12-01T09:13:50Z")

</div>

Plus, changing the `sshd_config` seems unnatural to me.

---

<div class="post-metadata">

**Author:** ![jorhett](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jorhett/32/14812_2.png) [@jorhett](https://discuss.hashicorp.com/u/jorhett)\
**Post date:** [December 1, 2020, 7:21pm UTC](https://discuss.hashicorp.com/t/boundary-connect-ssh-permission-denied/18285/6 "2020-12-01T19:21:42Z")

</div>

> [@neolunar7](#):
>
> I thought Boundary worker starts the session with the pem key

Think of Boundary (at the current time) as an authorization and transit layer. The fact that you got refused by public key means that you successfully authenticated to Boundary and connected to the worker, which connected you to the endpoint so that SSH communication could begin.

What seems to be failing here is that you aren’t presenting the right credentials to log into that node. This is a matter of your SSH config -or- command line options. The solution to this current problem will be to change your SSH command line in whatever way would be necessary if you had direct connectivity to the endpoint and Boundary didn’t exist.

Enabling verbose output from SSH client will help you solve this:

```auto
boundary connect ssh --username ubuntu -target-id ttcp_jDSpPLkudz -- -vv

```

…anything after the `--` is passed through to the ssh comand.