[SOLVED] Google cloud platform, vm instance's ssh permission

Issue

In my Google Cloud Platform, vm instance, I accidentally changed the permission of /etc/ssh, and now I can't access it using ssh nor filezilla.

The log is as below:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions 0660 for '/etc/ssh/ssh_host_ed25519_key' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
key_load_private: bad permissions

The only thing I can access to is gcloud command or serial console.

I know I need to change the directory's permission back to 644 or 400, but I have no idea how as I can't access the ssh.

How do I change the permission without accessing ssh?

Any help would be much appreciated!

Solution

This problem can be solved by attaching the boot disk to another instance.

STEP 1:

Shutdown your instance with the SSH problem. Login into the Google Cloud Console. Go to Compute Engine -> VM instances. Click on your instance and make note of the "Boot disk" name. This will be the first disk under "Boot disk and local disks".

STEP 2:

Create a snapshot of the boot disk before doing anything further. While still in Compute Engine -> Disk. Click on your boot disk. Click on "CREATE SNAPSHOT".

STEP 3:

Create a new instance in the same zone. A micro instance will work.

STEP 4:

Open a Cloud Shell prompt (this also works from your desktop if gcloud is setup). Execute this command. Replace NAME with your instance name (broken SSH system) and DISK with the boot disk name and ZONE with the zone that the system is in:

gcloud compute instance detach-disk NAME --disk=DISK --zone=ZONE

Make sure that the previous command did not report an error.

STEP 5:

Now we will attach this disk to the new instance that you created.

Make sure that the repair instance is running. Sometimes an instance can get confused on which disk to boot from if more than one disk is bootable.

Go to Compute Engine -> VM instances. Click on your instance. Click Edit. Under "Additional disks" click "Add item". For name enter/select the disk that you detached from your broken instance. Click Save.

STEP 6:

SSH into your new instance with both disks attached.

STEP 7:

Follow these steps carefully. We will mount the second disk to the root file system. Then change the permissions on the /mnt/repair/etc/ssh directory and contents.

• Become superuser. Execute sudo -s
• Execute df. Make sure that /dev/sdb1 is not mounted.
• Create a directory for the mountpoint: mkdir /mnt/repair
• Mount the second disk: mount /dev/sdb1 /mnt/repair
• Change directories: cd /mnt/repair/etc
• Set permissions for /etc/ssh (notice relative paths here): chmod 755 ssh
• Change directories: cd ssh
• Execute: chmod 644 *.pub
• Execute: chmod 400 *key
• ssh_config and sshd_config should still be 644. If not fix them too.
• Shutdown the repair system: halt

STEP 8:

Now reverse the procedure and move the second disk back to your original instance and reattach. Start your instance and connect via SSH.

Note: To reattach the boot disk you have to use gcloud with the -boot option.

gcloud beta compute instances attach-disk NAME --disk=DISK --zone=ZONE --boot

Answered By - John Hanley

Answer Checked By - Pedro (WPSolving Volunteer)