Amazon Lightsail Log in failed – CLIENT_UNAUTHORIZED

When trying to log in to Amazon Lightsail instance, I got the error

Log in failed. If this instance has just started up, try again in a minute or two.
CLIENT_UNAUTHORIZED [769]

This lightsail refused to connect error happens because when you update the system, you replaced the default /etc/ssh/sshd_config file provided by Amazon AWS.

To fix the error, connect to the Lightsail server using SSH (terminal on Linux/Mac, putty on windows), edit the file

vi /etc/ssh/sshd_config

At the end of the file, add the following 2 lines

TrustedUserCAKeys /etc/ssh/lightsail_instance_ca.pub
CASignatureAlgorithms +ssh-rsa

Restart ssh service

systemctl restart ssh

Now you should be able to login to Amazon Lightsail using AWS Console.

If your lightsail_instance_ca.pub file is corrupted, you can recreate it with the command

cat /var/lib/cloud/instance/user-data.txt | grep ^ssh-rsa > /etc/ssh/lightsail_instance_ca.pub

Method 2: Reover with shapshot

If you can’t SSH into the server using putty or a terminal, you need to take a snapshot of the server. Create a new lightsail server based on the snapshot. During the new server creation, you have the option to reset the PEM file. You can also enter a startup script, that gets executed when the server is started the first time.

Use the following startup script

sudo sh -c "cat /var/lib/cloud/instance/user-data.txt | grep ^ssh-rsa > /etc/ssh/lightsail_instance_ca.pub"
sudo sh -c "echo >> /etc/ssh/sshd_config" 
sudo sh -c "echo 'TrustedUserCAKeys /etc/ssh/lightsail_instance_ca.pub' >> /etc/ssh/sshd_config"
sudo sh -c "echo 'CASignatureAlgorithms ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa' >> /etc/ssh/sshd_config"
sudo systemctl restart sshd