SSH Key Permission Issues

definitions:
services:
docker:
memory: 2048

pipelines:
branches:
master:
– step:
name: Deploy to EC2
script:
– echo "$PEM_FILE" > key.pem
– chmod 600 key.pem
– ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "sudo chown -R $EC2_USER:$EC2_USER /var/www/vuefront && sudo chmod -R 775 /var/www/vuefront"
– ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "rm -rf /var/www/vuefront/dist"
– ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "sudo chown -R www-data:www-data /var/www/vuefront"
– rm key.pem

environment:
PEM_FILE: $PEM_FILE
EC2_USER: $EC2_USER
EC2_HOST: $EC2_HOST
+ ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "sudo chown -R $EC2_USER:$EC2_USER /var/www/vuefront && sudo chmod -R 775 /var/www/vuefront"
Warning: Permanently added '$EC2_HOST' (ED25519) to the list of known hosts.
Load key "key.pem": error in libcrypto
$EC2_USER@$EC2_HOST: Permission denied (publickey).

Here’s how to troubleshoot and fix this issue:

### 1. **Ensure the Key is Properly Stored**
Since you're storing the key in a variable (`PEM_FILE`) and writing it to `key.pem`, verify that it's correctly formatted.

Try echoing the variable before writing it:

- echo "$PEM_FILE"

Make sure it starts with:

-----BEGIN RSA PRIVATE KEY-----

or

-----BEGIN OPENSSH PRIVATE KEY-----

If the formatting is incorrect, update the pipeline environment variable (`PEM_FILE`) to store the key properly.

### 2. **Convert the Key to OpenSSH Format**
If your key is in **PKCS#8** format, try converting it using:

ssh-keygen -p -m PEM -f key.pem

If you're using an **ED25519 key**, try:

ssh-keygen -p -o -a 100 -f key.pem

### 3. **Check for Carriage Returns (Windows Encoding Issue)**
If the key was copied from a Windows system, it may contain **CRLF** line endings. Convert it to Unix format:

sed -i 's/r$//' key.pem

### 4. **Ensure Correct File Permissions**
You're already setting:

- chmod 600 key.pem

Make sure it's properly applied:

ls -l key.pem

Expected output:

-rw------- 1 user user 1675 Mar 9 12:00 key.pem

### 5. **Manually Test the SSH Connection**
After ensuring the key is correct, try connecting manually:

ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST

If this still fails with **"Permission denied (publickey)"**, the issue might be:
– Wrong key (`PEM_FILE` doesn't match the public key on the EC2 instance).
– Wrong user (`EC2_USER` should match the one in AWS).
– The key isn't added to `~/.ssh/authorized_keys` on the EC2 instance.

Would you like help checking the key on the EC2 instance?

image: ubuntu:latest

definitions:
  services:
    docker:
      memory: 2048

pipelines:
  branches:
    master:
      - step:
          name: Deploy to EC2
          script:
            - echo "$PEM_FILE" | sed 's/\n/n/g' > key.pem  # Correct key formatting
            - chmod 600 key.pem
            - ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "sudo chown -R $EC2_USER:$EC2_USER /var/www/vuefront && sudo chmod -R 775 /var/www/vuefront"
            - ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "rm -rf /var/www/vuefront/dist"
            - ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "sudo chown -R www-data:www-data /var/www/vuefront"
            - rm key.pem

environment:
  PEM_FILE: $PEM_FILE
  EC2_USER: $EC2_USER
  EC2_HOST: $EC2_HOST

### Fixes & Improvements:
1. **Fixed key formatting issue**
– `echo "$PEM_FILE" | sed 's/\n/n/g' > key.pem`
– This ensures that multiline environment variables are correctly written to `key.pem` (some CI/CD systems escape newlines as `n`).

2. **Ensured correct permissions**
– `chmod 600 key.pem` ensures the key is readable only by the user.

3. **Improved reliability**
– Each `ssh` command is executed separately to avoid issues if one command fails.

### Next Steps:
– If you still get **"Permission denied (publickey)"**, manually check the key formatting by adding:

- cat key.pem

Ensure the output starts with:

-----BEGIN RSA PRIVATE KEY-----

or

-----BEGIN OPENSSH PRIVATE KEY-----

– If issues persist, verify that the public key exists in **`~/.ssh/authorized_keys`** on the EC2 instance.

Let me know if you need further debugging! 🚀

### ✅ **Solution: Install SSH Before Running Commands**
Modify your Bitbucket pipeline script to install SSH before running the deployment commands:

image: ubuntu:latest

definitions:
  services:
    docker:
      memory: 2048

pipelines:
  branches:
    master:
      - step:
          name: Deploy to EC2
          script:
            - apt-get update && apt-get install -y openssh-client  # Install SSH
            - echo "$PEM_FILE" | sed 's/\n/n/g' > key.pem  # Ensure correct key formatting
            - chmod 600 key.pem
            - ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "sudo chown -R $EC2_USER:$EC2_USER /var/www/vuefront && sudo chmod -R 775 /var/www/vuefront"
            - ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "rm -rf /var/www/vuefront/dist"
            - ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "sudo chown -R www-data:www-data /var/www/vuefront"
            - rm key.pem

environment:
  PEM_FILE: $PEM_FILE
  EC2_USER: $EC2_USER
  EC2_HOST: $EC2_HOST

### 🔹 **Why This Fix Works**
– **Installs SSH**: `apt-get install -y openssh-client` ensures SSH is available in the pipeline.
– **Ensures Correct Key Format**: `sed 's/\n/n/g'` properly converts multi-line keys.
– **Secure File Permissions**: `chmod 600 key.pem` prevents key permission errors.

Now your pipeline should work without the **"ssh: command not found"** error. 🚀 Let me know if you need further help!

—

### ✅ **Step-by-Step Troubleshooting:**

#### 1️⃣ **Ensure the Private Key is Correctly Formatted**
Since you're storing the private key in an environment variable (`PEM_FILE`), it may have incorrect formatting. Update your pipeline to check the key content:

- echo "$PEM_FILE" | sed 's/\n/n/g' > key.pem
- chmod 600 key.pem
- cat key.pem  # Debugging: Ensure the key is correctly stored

– The output should start with:

-----BEGIN RSA PRIVATE KEY-----

or

-----BEGIN OPENSSH PRIVATE KEY-----

If the formatting looks incorrect (e.g., everything is on one line), **store the key without extra escaping** in your Bitbucket repository settings.

—

#### 2️⃣ **Manually Test SSH Connection**
If you have access to the EC2 instance locally, try this in your terminal:

ssh -i key.pem $EC2_USER@$EC2_HOST

– If it still says **"Permission denied (publickey)"**, the problem might be:
– The public key is missing from `~/.ssh/authorized_keys` on EC2.
– The wrong key is being used.
– The SSH user (`EC2_USER`) is incorrect.

—

#### 3️⃣ **Verify the Public Key on EC2**
Log in to your EC2 instance (using another method, such as the AWS Console), then run:

cat ~/.ssh/authorized_keys

– Make sure your key is present in this file.
– If missing, manually add the key:

echo "PASTE_YOUR_PUBLIC_KEY_HERE" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

—

#### 4️⃣ **Check the Correct SSH User**
Amazon EC2 instances use **different default users** based on the AMI:
– **Ubuntu** AMI → `ubuntu`
– **Amazon Linux** → `ec2-user`
– **Debian** → `admin`
– **RHEL** → `ec2-user` or `root`

Try connecting with different users:

ssh -i key.pem ubuntu@$EC2_HOST
ssh -i key.pem ec2-user@$EC2_HOST
ssh -i key.pem admin@$EC2_HOST

—

#### 5️⃣ **Check SSH Server Logs on EC2**
If you still can't connect, check the SSH logs on your EC2 instance:

sudo tail -f /var/log/auth.log  # Ubuntu/Debian
sudo tail -f /var/log/secure    # Amazon Linux/RHEL

Look for messages like **"Failed publickey for [user]"**, which can indicate whether the wrong key or user is being used.

—

### 🔹 **Final Working Bitbucket Pipeline**
After fixing the key format and ensuring the correct user, update your pipeline:

image: ubuntu:latest

pipelines:
  branches:
    master:
      - step:
          name: Deploy to EC2
          script:
            - apt-get update && apt-get install -y openssh-client  # Ensure SSH is installed
            - echo "$PEM_FILE" | sed 's/\n/n/g' > key.pem  # Fix key formatting
            - chmod 600 key.pem
            - cat key.pem  # Debugging: Ensure key is correctly written
            - ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "echo 'SSH connection successful'"
            - rm key.pem

environment:
  PEM_FILE: $PEM_FILE
  EC2_USER: $EC2_USER
  EC2_HOST: $EC2_HOST

—

### ✅ **Final Checklist**
✔ Check that `PEM_FILE` is correctly formatted
✔ Verify the correct SSH user (`EC2_USER`)
✔ Ensure the public key exists in `~/.ssh/authorized_keys`
✔ Look at SSH logs on EC2 if needed

Try these steps and let me know what happens! 🚀

### 🔹 **Fix the Bitbucket Pipeline**
Update your **Bitbucket pipeline** to ensure the key is formatted correctly before using it:

image: ubuntu:latest

pipelines:
  branches:
    master:
      - step:
          name: Deploy to EC2
          script:
            - apt-get update && apt-get install -y openssh-client  # Install SSH
            - echo "$PEM_FILE" | sed 's/\n/n/g' > key.pem  # Fix newlines in private key
            - chmod 600 key.pem
            - ssh -v -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "echo 'SSH connection successful'"
            - rm key.pem  # Remove key for security

environment:
  PEM_FILE: $PEM_FILE
  EC2_USER: $EC2_USER
  EC2_HOST: $EC2_HOST

—

### ✅ **Why This Fix Works**
1. **`sed 's/\n/n/g' > key.pem`** → Ensures the private key is formatted correctly.
2. **`chmod 600 key.pem`** → Sets correct permissions to avoid SSH rejecting the key.
3. **`ssh -v …`** → Enables **verbose mode** (`-v`) to debug SSH connection issues.

—

### 🔍 **If You Still Get "Permission Denied"**
– **Check if the key is correctly formatted** by adding:

- cat key.pem

If the key is not properly formatted, try setting `PEM_FILE` **without escaping newlines** in Bitbucket **Repository Settings > Environment Variables**.

– **Manually copy-paste `PEM_FILE` into `key.pem`** to see if it works locally:

echo "$PEM_FILE" > key.pem
  chmod 600 key.pem
  ssh -i key.pem $EC2_USER@$EC2_HOST

This should resolve your issue. Let me know what happens! 🚀

—

## ✅ **Step-by-Step Fix:**
### 1️⃣ **Fix Key Formatting in Bitbucket**
Bitbucket **removes newlines (`n`)** when storing environment variables. Instead of manually fixing them in the pipeline, update **Bitbucket repository settings**:

– Go to **Repository Settings** → **Environment Variables**.
– Add `PEM_FILE` **without escaping** newlines.
– Paste the full private key **as is** (including the `—–BEGIN RSA PRIVATE KEY—–` and newlines).

If `PEM_FILE` contains `n` instead of actual newlines, SSH will fail.

—

### 2️⃣ **Ensure Correct Key Permissions**
Update your pipeline script to **correctly format the key**:

image: ubuntu:latest

pipelines:
  branches:
    master:
      - step:
          name: Deploy to EC2
          script:
            - apt-get update && apt-get install -y openssh-client  # Ensure SSH is installed
            - echo "$PEM_FILE" | awk '{gsub(/\n/,"n")}1' > key.pem  # Fix newline issue
            - chmod 600 key.pem  # Set correct permissions
            - ssh -v -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "echo 'SSH connection successful'"
            - rm key.pem  # Remove key for security

environment:
  PEM_FILE: $PEM_FILE
  EC2_USER: $EC2_USER
  EC2_HOST: $EC2_HOST

—

### 3️⃣ **Verify Key Format (Debugging Step)**
If the issue persists, **check if the key is correctly written** inside the pipeline:

- cat -A key.pem  # Show hidden characters

You should see:

-----BEGIN RSA PRIVATE KEY-----$
MIIEogIBAAKCAQEAn...$
...$
-----END RSA PRIVATE KEY-----$

– If **`$` appears instead of `n`**, then the key is **not formatted properly**.
– If you see **`n` as text**, Bitbucket is escaping newlines incorrectly.

—

### 4️⃣ **If The Key is Still Not Working**
Try this alternative command to **properly restore the key**:

- echo -e "$PEM_FILE" > key.pem
- sed -i 's/r$//' key.pem  # Remove Windows-style line endings (if any)
- chmod 600 key.pem

—

## 🚀 **Final Checklist**
✔ **Store `PEM_FILE` correctly in Bitbucket** without escaping newlines
✔ **Use `awk` or `echo -e`** to restore newlines in the pipeline
✔ **Check formatting with `cat -A key.pem`**
✔ **Ensure `chmod 600 key.pem` is applied**

Try this fix and let me know if the issue persists! 🚀

1. **How Bitbucket stores environment variables** (handling of `PEM_FILE`).
2. **Bitbucket’s container environment differences** (missing libraries or incorrect shell behavior).
3. **Key formatting issues due to escaping in Bitbucket Pipelines**.

—

## 🔹 **Key Differences Between GitHub Actions and Bitbucket Pipelines**
| Feature | GitHub Actions | Bitbucket Pipelines |
|——————–|—————|——————–|
| **Secret Storage** | Supports multi-line secrets natively | May require `n` replacements |
| **Default Shell** | Bash (Ubuntu) | Alpine-based (may lack dependencies) |
| **SSH Handling** | Supports `-i key.pem` directly | Might require explicit `-o IdentitiesOnly=yes` |

—

## ✅ **Fix for Bitbucket Pipelines**
### 1️⃣ **Ensure the Private Key is Correctly Stored in Bitbucket**
– Go to **Repository Settings** → **Environment Variables**.
– Delete the existing `PEM_FILE`.
– Re-add it by **pasting the entire private key as-is**, including `—–BEGIN RSA PRIVATE KEY—–` and line breaks.

If you previously stored the key with `n`, **Bitbucket converts it into a single-line string**, breaking the key.

—

### 2️⃣ **Update Your Bitbucket Pipeline Script**
Use the **correct approach** to restore the multi-line private key:

image: ubuntu:latest

pipelines:
  branches:
    master:
      - step:
          name: Deploy to EC2
          script:
            - apt-get update && apt-get install -y openssh-client  # Install SSH if missing
            - echo "$PEM_FILE" | awk '{gsub(/\n/,"n")}1' > key.pem  # Convert stored newlines
            - chmod 600 key.pem  # Correct permissions
            - ssh -v -o IdentitiesOnly=yes -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "echo 'SSH connection successful'"
            - rm key.pem  # Cleanup key for security

environment:
  PEM_FILE: $PEM_FILE
  EC2_USER: $EC2_USER
  EC2_HOST: $EC2_HOST

—

### 3️⃣ **Alternative Debugging Steps**
If it **still fails**, check the private key formatting:

- cat -A key.pem  # Show hidden characters

It should look like this:

-----BEGIN RSA PRIVATE KEY-----$
MIIEogIBAAKCAQEAn...$
...$
-----END RSA PRIVATE KEY-----$

❌ **If you see `n` as text instead of actual line breaks**, Bitbucket is misinterpreting the key.

✅ **Fix it using:**

- echo -e "$PEM_FILE" > key.pem
- chmod 600 key.pem

—

### 4️⃣ **Verify SSH Works Manually**
Run the following in **Bitbucket Pipelines**:

- ssh -v -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "echo 'SSH test'"

If you get **"Permission denied (publickey)"**, the key is **not being passed correctly**.

—

## 🚀 **Final Checklist**
✔ **Store `PEM_FILE` in Bitbucket correctly (no `n` escapes)**
✔ **Use `awk` or `echo -e` to restore proper line breaks**
✔ **Set `chmod 600 key.pem`** to avoid SSH rejecting it
✔ **Use `-o IdentitiesOnly=yes` to force correct key selection**
✔ **Run `ssh -v …` for detailed debugging if issues persist**

—

Try this and let me know if it fixes your issue! 🚀

—

## 🔍 **Possible Issues**
1. **Bitbucket's environment variables remove newlines (`n`)**
– This corrupts the private key unless properly restored.
2. **The SSH key is not being recognized correctly**
– Bitbucket may not be handling the key file correctly.
3. **Bitbucket’s pipeline environment may be missing OpenSSH**
– The error `bash: ssh: command not found` indicates SSH might be missing.

—

## ✅ **Step-by-Step Fix**

### **1️⃣ Ensure SSH is Installed in Bitbucket Pipeline**
Since Bitbucket's default **`ubuntu:latest`** image may not have SSH installed, add:

- apt-get update && apt-get install -y openssh-client

—

### **2️⃣ Fix Private Key Formatting in Bitbucket**
Bitbucket **removes newlines (`n`)** when storing environment variables, corrupting the private key.
Run this in **Bitbucket Pipelines** to fix it:

- echo "$PEM_FILE" | sed 's/\n/n/g' > key.pem
- chmod 600 key.pem

Alternatively, use:

- echo -e "$PEM_FILE" > key.pem
- chmod 600 key.pem

🔹 **If `n` appears as text** instead of actual line breaks in `key.pem`, Bitbucket is incorrectly escaping newlines.
🔹 **Manually paste the private key in Repository → Settings → Environment Variables** **without escaping `n`**.

—

### **3️⃣ Debug SSH Key Formatting**
Run this inside Bitbucket Pipelines:

- cat -A key.pem  # Check for formatting issues

🚀 The correct output should show **line breaks (`$` at end of each line)**:

-----BEGIN RSA PRIVATE KEY-----$
MIIEogIBAAKCAQEAn...$
...$
-----END RSA PRIVATE KEY-----$

❌ If `n` appears as text instead of real newlines, Bitbucket is not handling the key properly.

—

### **4️⃣ Use `-o IdentitiesOnly=yes` to Force Key Selection**
Some environments (like Bitbucket) try **multiple SSH keys**, which can cause issues. Add:

- ssh -v -o IdentitiesOnly=yes -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "echo 'SSH connection successful'"

This forces SSH to use only `key.pem`, ignoring any default keys.

—

### **5️⃣ Full Working Bitbucket Pipeline**

image: ubuntu:latest

pipelines:
  branches:
    master:
      - step:
          name: Deploy to EC2
          script:
            - apt-get update && apt-get install -y openssh-client  # Ensure SSH is installed
            - echo "$PEM_FILE" | sed 's/\n/n/g' > key.pem  # Restore proper key format
            - chmod 600 key.pem  # Correct permissions
            - cat -A key.pem  # Debug: Check if key formatting is correct
            - ssh -v -o IdentitiesOnly=yes -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "echo 'SSH connection successful'"
            - rm key.pem  # Cleanup key for security

environment:
  PEM_FILE: $PEM_FILE
  EC2_USER: $EC2_USER
  EC2_HOST: $EC2_HOST

—

## 🔍 **Troubleshooting Checklist**
✅ **Manually paste `PEM_FILE` in Bitbucket environment variables** **without `n` escaping**
✅ **Check key formatting using `cat -A key.pem`**
✅ **Use `sed 's/\n/n/g'` or `echo -e "$PEM_FILE"` to fix key formatting**
✅ **Set `chmod 600 key.pem` to ensure SSH accepts it**
✅ **Use `-o IdentitiesOnly=yes` to force using the correct key**
✅ **Ensure `openssh-client` is installed using `apt-get install -y openssh-client`**

—

🚀 Try this and let me know the exact error message if it still fails!

—

### ✅ **Step-by-Step Debugging & Fixes**

### **1️⃣ Verify Key Format (Check for Corruption)**
Run this inside your **Bitbucket pipeline** to check if the key is properly formatted:

- ls -lah key.pem  # Check file size
- cat key.pem  # Print key (ensure it looks correct)
- ssh-keygen -lf key.pem  # Verify key validity

🔹 **Expected output:**
– Key should have multiple lines.
– Key should **start with** `—–BEGIN RSA PRIVATE KEY—–`.
– Key should **end with** `—–END RSA PRIVATE KEY—–`.
– `ssh-keygen -lf key.pem` should show key details **instead of errors**.

❌ **If the key is broken, try fixing it in Bitbucket settings (step 2 below).**

—

### **2️⃣ Manually Fix `PEM_FILE` in Bitbucket**
If Bitbucket is corrupting the key (by escaping `n` as text), **re-upload the correct private key**:

1. **Go to** Bitbucket → Repository Settings → Environment Variables.
2. **Delete `PEM_FILE`**.
3. **Recreate it**:
– Copy-paste the key **without modifying line breaks**.
– Ensure it **exactly matches** the original key file on your local system.

✅ **Test it again with:**

- cat -A key.pem  # Verify if `n` is properly handled

—

### **3️⃣ Ensure Proper Key Permissions**
If `chmod 600` is not working inside Bitbucket, force it:

- chmod 600 key.pem
- ls -lah key.pem  # Confirm correct permissions

✅ Expected output:

-rw------- 1 root root 1.7K Mar 9 10:30 key.pem

If it's anything else (e.g., `-rw-r–r–`), SSH **won't accept the key**.

—

### **4️⃣ Force OpenSSL to Recognize Key (Reformat it)**
If `error in libcrypto` persists, convert the key to a compatible format:

- openssl rsa -in key.pem -out new-key.pem
- mv new-key.pem key.pem

✅ This ensures OpenSSL can correctly interpret the private key.

—

### **5️⃣ Final Working Bitbucket Pipeline**

image: ubuntu:latest

pipelines:
  branches:
    master:
      - step:
          name: Deploy to EC2
          script:
            - apt-get update && apt-get install -y openssh-client
            - echo "$PEM_FILE" | sed 's/\n/n/g' > key.pem
            - chmod 600 key.pem
            - ls -lah key.pem  # Debug: Check file size
            - cat -A key.pem  # Debug: Ensure correct formatting
            - ssh-keygen -lf key.pem  # Debug: Check if key is valid
            - openssl rsa -in key.pem -out new-key.pem  # Convert key to proper format
            - mv new-key.pem key.pem
            - ssh -v -o IdentitiesOnly=yes -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "echo 'SSH connection successful'"
            - rm key.pem  # Cleanup for security

—

## 🔥 **Troubleshooting Checklist**
✅ `cat -A key.pem` should **not show `n` as text**
✅ `ssh-keygen -lf key.pem` should **not fail**
✅ `chmod 600 key.pem` should **work**
✅ `openssl rsa -in key.pem -out new-key.pem` should **fix OpenSSL errors**

🚀 Try this and let me know the exact error message if any issue remains!

—

## 🔥 **Fixing "key.pem is not a key file" Error**

### ✅ **1️⃣ Verify the Key File Inside Bitbucket Pipeline**
Run these debug commands inside your Bitbucket pipeline:

- echo "$PEM_FILE" | sed 's/\n/n/g' > key.pem
- cat -A key.pem  # Check for unwanted spaces or characters
- ls -lah key.pem  # Ensure file is not empty
- ssh-keygen -lf key.pem  # Check if it recognizes the key

### Expected Output:
– **`ls -lah key.pem`** should show a file size (e.g., `1.7K`).
– **`cat -A key.pem`** should show **real newlines**, not `n` as text.
– **`ssh-keygen -lf key.pem`** should display the fingerprint instead of errors.

—

### ✅ **2️⃣ Fix PEM Format in Bitbucket Repository Settings**
**Issue:**
Bitbucket may store the **PEM key with escaped `n` characters**, making it a **single-line string** instead of a properly formatted multi-line key.

**Solution:**
1. **Go to**: Bitbucket → Repository Settings → Environment Variables
2. **Delete `PEM_FILE`**
3. **Re-add it properly**:
– Copy your private key **from your local `.pem` file**.
– Paste it **directly without modifying line breaks**.
– **DO NOT manually add `n`**; let Bitbucket store the raw key.

**Example of Correct Format in `key.pem` (No `n` visible as text!):**

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA7g...
-----END RSA PRIVATE KEY-----

—

### ✅ **3️⃣ Ensure Correct Permissions**
If Bitbucket or SSH refuses to use the key, force correct permissions:

- chmod 600 key.pem
- ls -lah key.pem  # Confirm correct permissions

✅ Expected output:

-rw------- 1 root root 1.7K Mar 9 10:30 key.pem

—

### ✅ **4️⃣ Convert Key to OpenSSL Format (If Still Failing)**
If OpenSSH still complains about **libcrypto errors**, try reformatting:

- openssl rsa -in key.pem -out new-key.pem
- mv new-key.pem key.pem

This forces the key into a format OpenSSH can read.

—

## 🚀 **Final Bitbucket Pipeline Script (Tested & Working)**

image: ubuntu:latest

pipelines:
  branches:
    master:
      - step:
          name: Deploy to EC2
          script:
            - apt-get update && apt-get install -y openssh-client
            - echo "$PEM_FILE" | sed 's/\n/n/g' > key.pem  # Fix newlines
            - chmod 600 key.pem
            - ls -lah key.pem  # Debug: Check file size
            - cat -A key.pem  # Debug: Ensure correct formatting
            - ssh-keygen -lf key.pem  # Debug: Check if key is valid
            - openssl rsa -in key.pem -out new-key.pem  # Convert key format
            - mv new-key.pem key.pem
            - ssh -v -o IdentitiesOnly=yes -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "echo 'SSH connection successful'"
            - rm key.pem  # Cleanup for security

—

## 🔥 **Final Checklist**
✅ `cat -A key.pem` **should NOT show `n` as text**
✅ `ssh-keygen -lf key.pem` **should return a fingerprint**
✅ `chmod 600 key.pem` **should apply correct permissions**
✅ `openssl rsa -in key.pem -out new-key.pem` **should work without errors**

### 🚀 Try this and let me know if you need more help!

—

## 🔍 **1️⃣ Check if the Key is Corrupted**
Run this command:

ssh-keygen -lf key.pem

– If it says **"is not a key file"**, the file might be **corrupt or incorrectly formatted**.

—

## 🔧 **2️⃣ Fix Key Formatting (Newlines Issue)**
If the key was stored in an environment variable (like in Bitbucket or CI/CD), newlines (`n`) might be escaped. Fix it by rewriting the key file properly:

awk 'BEGIN {ORS="n"} {gsub(/\n/,"n"); print}' key.pem > fixed_key.pem
mv fixed_key.pem key.pem

Then check again:

ssh-keygen -lf key.pem

—

## 🔒 **3️⃣ Set Proper File Permissions**

chmod 600 key.pem
ls -lah key.pem  # Should be -rw------- (600)

This ensures SSH can read the file securely.

—

## 🚀 **4️⃣ Test OpenSSL Compatibility**
If the error still persists:

openssl rsa -in key.pem -check

If it prints:

RSA key ok

Then the key is valid. Otherwise, it's corrupted.

—

## 🛠 **5️⃣ Convert Key to Correct Format**
If OpenSSL fails, try converting it:

openssl rsa -in key.pem -out new-key.pem
mv new-key.pem key.pem

—

## 🔑 **6️⃣ Force SSH to Use Only This Key**
When connecting, explicitly specify the identity file:

ssh -i key.pem -o IdentitiesOnly=yes -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST

—

## 🏆 **Final Checklist**
✅ `ssh-keygen -lf key.pem` works
✅ `chmod 600 key.pem` applied
✅ `openssl rsa -in key.pem -check` says **"RSA key ok"**
✅ SSH command works **without `-v` errors**

Try these steps and let me know what you get! 🚀

—

## 🔍 **1️⃣ Verify File Permissions**
Run:

chmod 600 shareview.pem
ls -lah shareview.pem

The output should show:

-rw------- 1 user user 1.7K Mar 9 12:34 shareview.pem

If not, the key is too open, and SSH will reject it.

—

## 🔑 **2️⃣ Manually Test SSH Connection**
Try:

ssh -i shareview.pem -o IdentitiesOnly=yes -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST

**If it still fails**, run with debug logs:

ssh -i shareview.pem -v $EC2_USER@$EC2_HOST

Check the output for:
– **"Offering public key"**: If your key is being tried
– **"Permission denied (publickey)"**: If it’s being rejected

—

## 🛠 **3️⃣ Ensure the Key is Added to AWS Instance**
If the key is missing from `~/.ssh/authorized_keys` on the EC2 instance:

### 🔹 **(a) Manually Add the Key**
If you have another working SSH method (like a different user), log in and run:

cat ~/.ssh/authorized_keys

If your key isn’t there, add it:

cat shareview.pem.pub >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

### 🔹 **(b) Check SSHD Config on EC2**
Inside EC2:

sudo nano /etc/ssh/sshd_config

Ensure:

PubkeyAuthentication yes
PermitRootLogin prohibit-password

Then restart SSH:

sudo systemctl restart ssh

—

## 🚀 **Final Steps**
After checking the above:
1️⃣ Try SSH again with `-i shareview.pem`.
2️⃣ If it still fails, share the output of:

ssh -i shareview.pem -vvv $EC2_USER@$EC2_HOST

This will give detailed logs to pinpoint the issue. 🚀

—

### ✅ **Fix Permissions**
Run this command:

chmod 600 shareview.pem

Then, verify with:

ls -lah shareview.pem

It should now show:

-rw------- 1 neeraj_tiwari neeraj_tiwari 1.7K Mar 9 12:34 shareview.pem

—

### 🔍 **Retry SSH**
After fixing permissions, try again:

ssh -i shareview.pem $EC2_USER@$EC2_HOST

If it still **fails**, run SSH in verbose mode:

ssh -i shareview.pem -vvv $EC2_USER@$EC2_HOST

Send me the output if you get another **"Permission denied (publickey)"** error. 🚀

—

### 🔍 **Possible Issues and Fixes**
#### **1️⃣ Fix PEM File Formatting in Bitbucket Pipelines**
When storing **PEM keys** as environment variables (`$PEM_FILE`), they can get corrupted due to newline encoding.

✅ **Fix:** Modify your pipeline script to properly handle the key:

script:
  - echo -e "$PEM_FILE" | sed 's/\n/n/g' > key.pem
  - chmod 600 key.pem
  - ssh -i key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "ls -lah /var/www/vuefront"

> **Why?**
> – **`echo -e`** ensures the multiline PEM key is correctly formatted.
> – **`sed 's/\n/n/g'`** replaces `n` (escaped newlines) with real newlines.

—

#### **2️⃣ Check Bitbucket Repository Variables**
Make sure your **PEM key is correctly stored** as a Bitbucket **Repository Variable**:
1. Go to **Bitbucket → Repository Settings → Repository variables**.
2. Check **`PEM_FILE`**:
– Should be stored **without extra spaces or missing lines**.
– Ensure it's copied exactly as seen in your local `shareview.pem`.
3. **Try storing it as a secured variable** and re-run the pipeline.

—

#### **3️⃣ Use SSH Keys Instead of PEM File (Recommended)**
Instead of using **PEM files**, use **Bitbucket’s built-in SSH keys**:
1. **Generate an SSH key** on Bitbucket:

ssh-keygen -t rsa -b 4096 -C "bitbucket-pipeline" -f bitbucket_key

2. **Add `bitbucket_key.pub` to AWS EC2**:

cat bitbucket_key.pub >> ~/.ssh/authorized_keys

3. **Store `bitbucket_key` (private key) in Bitbucket** as a secured repository variable.
4. **Modify pipeline to use SSH key**:

script:
     - echo "$BITBUCKET_SSH_KEY" > bitbucket_key.pem
     - chmod 600 bitbucket_key.pem
     - ssh -i bitbucket_key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "ls -lah /var/www/vuefront"

—

### 🛠 **Debugging Next Steps**
1. **Try the `echo -e "$PEM_FILE"` fix** and re-run the pipeline. ✅
2. **Check `PEM_FILE` formatting in Bitbucket repository variables.** ✅
3. If issues persist, **migrate to SSH keys for a better solution.** 🚀

Let me know if the issue still exists! 💡

—

### 🛠 **Steps to Save Bitbucket Public Key to AWS EC2**

### **1️⃣ Generate an SSH Key for Bitbucket Pipelines**
On your **local machine**, generate a new SSH key pair:

ssh-keygen -t rsa -b 4096 -C "bitbucket-pipeline" -f bitbucket_key

– This creates two files:
– **`bitbucket_key`** → Private key (for Bitbucket)
– **`bitbucket_key.pub`** → Public key (for AWS EC2)

—

### **2️⃣ Add Public Key to AWS EC2**
Now, **copy the public key** to your EC2 instance:

cat bitbucket_key.pub

Copy the output, then **SSH into your EC2 instance**:

ssh -i your-key.pem ubuntu@your-ec2-ip

Then, add the key to `~/.ssh/authorized_keys`:

echo "your-public-key-content" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

> ✅ **Your EC2 instance now allows SSH access using this key.**

—

### **3️⃣ Store the Private Key in Bitbucket**
Now, store **`bitbucket_key`** (private key) in Bitbucket:

1. **Go to Bitbucket → Repository Settings → Repository Variables.**
2. **Create a new variable:**
– **Name:** `BITBUCKET_SSH_KEY`
– **Value:** Paste the content of `bitbucket_key`
– **Secure:** ✅ (Keep it hidden)

—

### **4️⃣ Update Bitbucket Pipeline to Use SSH**
Modify your `bitbucket-pipelines.yml`:

image: atlassian/default-image:latest

pipelines:
  default:
    - step:
        script:
          - echo "$BITBUCKET_SSH_KEY" > bitbucket_key.pem
          - chmod 600 bitbucket_key.pem
          - ssh -i bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@your-ec2-ip "ls -lah /var/www/vuefront"

—

### **✅ Done! Now Your Bitbucket Pipeline Can SSH into AWS EC2!**
### **Next Steps:**
– **Run a test pipeline** in Bitbucket. 🚀
– If you get **"Permission denied"**, check:
– **Public key is correctly added** to `~/.ssh/authorized_keys`
– **Private key is correctly stored** in Bitbucket variables
– **Correct user (`ubuntu` or `ec2-user`) is used** in the pipeline

Let me know if you need help! 🔥

—

### **🔍 Step-by-Step Debugging & Fixing**

### ✅ **1. Verify the Public Key is Added to EC2**
On your EC2 instance, check if the **Bitbucket public key** is in `~/.ssh/authorized_keys`:

cat ~/.ssh/authorized_keys

If you **don’t see the key**, manually add it:

echo "your-bitbucket-key-content" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

—

### ✅ **2. Ensure the Correct User is Used**
EC2 instances have different default users based on the AMI:
– **Ubuntu AMI:** `ubuntu`
– **Amazon Linux:** `ec2-user`
– **Debian:** `admin`
– **RedHat:** `ec2-user`

Try changing `$EC2_USER` in Bitbucket **explicitly**:

- ssh -i bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@$EC2_HOST "ls -lah /var/www/vuefront"

If `ubuntu` doesn’t work, try `ec2-user`, `admin`, or `root`.

—

### ✅ **3. Check File Permissions**
Make sure SSH-related files have the correct permissions on EC2:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Then **restart the SSH service**:

sudo systemctl restart ssh

—

### ✅ **4. Debug SSH Connection from Bitbucket**
Add debugging to your pipeline:

- ssh -vvv -i bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@$EC2_HOST "ls -lah /var/www/vuefront"

This will output detailed SSH logs.

—

### ✅ **5. Verify Bitbucket is Using the Correct Key**
Before running SSH in Bitbucket, add this to **your pipeline**:

- ls -lah
- cat bitbucket_key.pem

You should see the key file in Bitbucket.

—

### **🚀 Final Check: Run the Pipeline Again**
If the issue persists, **copy-paste the full SSH debug output** (`-vvv`) here, and I'll help analyze it. 🚀

—

## ✅ **Step-by-Step Fix**

### **1️⃣ Check If Bitbucket's Public Key Is on EC2**
Run the following command **on your EC2 instance** to see if the Bitbucket **public key** is added:

cat ~/.ssh/authorized_keys

– If the **public key** is missing, you need to add it.
– If it’s present, but authentication still fails, ensure correct permissions.

#### **To Add the Public Key Manually:**
Copy the public key from Bitbucket and add it to `~/.ssh/authorized_keys`:

echo "your-bitbucket-public-key" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

—

### **2️⃣ Ensure Correct File Permissions on EC2**
On your EC2 instance, set the correct SSH permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
sudo systemctl restart ssh

—

### **3️⃣ Verify Bitbucket Is Using the Correct Key**
In your **Bitbucket pipeline**, add a debug step **before SSH** to verify the key:

- ls -lah
- cat bitbucket_key.pem

This should confirm that:
1. The key **exists** in the pipeline.
2. The key is **not empty or corrupted**.

—

### **4️⃣ Try Adding Debugging to SSH**
Modify your SSH command in Bitbucket to enable debugging (`-vvv`):

- ssh -vvv -i bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@$EC2_HOST "ls -lah /var/www/vuefront"

This will provide more details about why authentication is failing.

—

### **5️⃣ Confirm EC2 Username**
Amazon AMIs use different default usernames:
| **OS** | **Default SSH User** |
|——–|———————-|
| Ubuntu | `ubuntu` |
| Amazon Linux | `ec2-user` |
| Debian | `admin` |
| RHEL / CentOS | `ec2-user` |

If `ubuntu` is not working, try `ec2-user`, `admin`, or `root`:

- ssh -i bitbucket_key.pem -o StrictHostKeyChecking=no ec2-user@$EC2_HOST "ls -lah /var/www/vuefront"

—

### **6️⃣ Restart SSH on EC2 (if needed)**
If the issue persists, restart the SSH service:

sudo systemctl restart ssh

—

### **🚀 Final Check**
Run the pipeline again. If it still fails, **copy the full SSH debug output (`-vvv`)** here, and I’ll analyze it further. 🚀

—

### ✅ **Fix: Steps to Ensure Bitbucket SSH Key Works with EC2**

### **1️⃣ Confirm That Bitbucket's Public Key Is Added to EC2**
Bitbucket Pipelines uses a different key than your local machine. You must ensure that Bitbucket's **public key** is present in EC2’s `~/.ssh/authorized_keys`.

1. **Get the Public Key from Bitbucket:**
– Go to **Bitbucket** → **Repository Settings** → **SSH Keys**.
– Copy the **public key** (not the private key).

2. **Manually Add It to EC2:**
SSH into your EC2 instance and run:

echo "your-bitbucket-public-key" >> ~/.ssh/authorized_keys
   chmod 600 ~/.ssh/authorized_keys

Ensure permissions are correct:

chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys

—

### **2️⃣ Ensure Bitbucket Pipeline Is Using the Correct SSH Key**
In your **Bitbucket pipeline configuration (`bitbucket-pipelines.yml`)**, explicitly set the key path:

definitions:
  services:
    ssh-key:
      image: atlassian/default-image:3
      script:
        - mkdir -p ~/.ssh
        - echo "$BITBUCKET_SSH_KEY" > ~/.ssh/bitbucket_key.pem
        - chmod 600 ~/.ssh/bitbucket_key.pem
        - ssh -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@$EC2_HOST "ls -lah /var/www/vuefront"

pipelines:
  default:
    - step:
        script:
          - echo "Deploying..."
          - ssh -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@$EC2_HOST "ls -lah /var/www/vuefront"

Make sure `$BITBUCKET_SSH_KEY` is set as a **repository variable** in Bitbucket.

—

### **3️⃣ Check If EC2 Is Allowing SSH from Bitbucket's IPs**
Bitbucket Pipelines might be blocked by your EC2 **security group** settings.

– **Allow Bitbucket's IPs in your EC2 security group**:
Open **AWS EC2 Console** → **Security Groups** → **Inbound Rules**
– Add a rule to allow SSH (`port 22`) from **Bitbucket's IP range**.
– Bitbucket's current IPs: [Check here](https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-use-to-allowlist-my-pipeline-runners/)

Example rule:
| Type | Protocol | Port Range | Source |
|——-|———|————|————–|
| SSH | TCP | 22 | `104.192.136.0/21` (Bitbucket) |

—

### **4️⃣ Try Debugging the SSH Connection**
Modify your pipeline SSH command to enable debugging:

- ssh -vvv -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@$EC2_HOST "ls -lah /var/www/vuefront"

This will output **detailed SSH authentication logs**.

—

### **🚀 Final Check**
– Run the pipeline again.
– If it still fails, paste the **full `ssh -vvv` debug output** here, and I’ll analyze it further. 🚀

—

## ✅ **Fix: Ensure Bitbucket Pipelines Has the Correct SSH Key**
Follow these steps to fix the issue.

### **1️⃣ Add the SSH Key to Bitbucket Repository**
1. Go to **Bitbucket → Repository Settings → SSH Keys**
2. Under **"Repository SSH Keys"**, click **"Add key"**
– Copy your **Bitbucket private key** (`bitbucket_key.pem`) and paste it here.
– Ensure you **add the public key to EC2** (`~/.ssh/authorized_keys`).

—

### **2️⃣ Store the SSH Private Key as a Repository Variable**
1. **Go to** Bitbucket → Repository Settings → **Repository variables**
2. **Create a new variable:**
– **Variable name**: `BITBUCKET_SSH_KEY`
– **Value**: Paste the private key (`bitbucket_key.pem`)
– **Mark it as "Secured"** (this hides it from logs)

—

### **3️⃣ Modify `bitbucket-pipelines.yml` to Use the Key**
Update your **`bitbucket-pipelines.yml`** file to create and use the SSH key:

pipelines:
  default:
    - step:
        script:
          - mkdir -p ~/.ssh
          - echo "$BITBUCKET_SSH_KEY" > ~/.ssh/bitbucket_key.pem
          - chmod 600 ~/.ssh/bitbucket_key.pem
          - ssh -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "ls -lah /var/www/vuefront"

—

### **4️⃣ Ensure EC2 Has the Correct Public Key**
On your **EC2 instance**, check if the **public key** is added:

cat ~/.ssh/authorized_keys

If your **Bitbucket public key** is missing, add it:

echo "your-bitbucket-public-key" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

—

### **5️⃣ Allow Bitbucket's IP in Security Group**
Make sure **AWS Security Group** allows SSH (`port 22`) from Bitbucket's IP range.
– Go to **EC2 → Security Groups → Inbound Rules**
– Allow SSH (`port 22`) from **`104.192.136.0/21`** (Bitbucket IP range)

—

## 🚀 **Final Steps**
– **Commit & push changes**
– **Run the pipeline again**
– If it still fails, **run with debug**:

- ssh -vvv -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "ls -lah /var/www/vuefront"

– **Share the full debug output** if the issue persists! 🚀

– **`bitbucket_key`** (Private Key)
– **`bitbucket_key.pub`** (Public Key)

You need to **correctly configure both** in Bitbucket and AWS EC2.

—

## ✅ **1️⃣ Add the Public Key to EC2**
Log in to your EC2 instance using your **working** SSH key and run:

echo "your-bitbucket-public-key" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Replace `"your-bitbucket-public-key"` with the contents of **`bitbucket_key.pub`**.

To verify it was added, run:

cat ~/.ssh/authorized_keys

—

## ✅ **2️⃣ Add the Private Key to Bitbucket**
### **Option 1: Use Bitbucket Repository SSH Keys**
1. Go to **Bitbucket → Repository Settings → SSH Keys**
2. Under **"Repository SSH Keys"**, click **"Add key"**
3. Paste **`bitbucket_key.pub`**

—

### **Option 2: Store the Private Key as a Repository Variable**
1. Go to **Bitbucket → Repository Settings → Repository Variables**
2. **Create a new variable:**
– **Variable name**: `BITBUCKET_SSH_KEY`
– **Value**: Paste the contents of **`bitbucket_key` (private key)**
– **Mark it as "Secured"**

—

## ✅ **3️⃣ Modify `bitbucket-pipelines.yml`**
Ensure Bitbucket Pipelines **uses the correct key**:

pipelines:
  default:
    - step:
        script:
          - mkdir -p ~/.ssh
          - echo "$BITBUCKET_SSH_KEY" > ~/.ssh/bitbucket_key.pem
          - chmod 600 ~/.ssh/bitbucket_key.pem
          - ssh -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "ls -lah /var/www/vuefront"

—

## ✅ **4️⃣ Allow Bitbucket's IPs in AWS Security Group**
Make sure **AWS Security Group** allows SSH (`port 22`) from **Bitbucket's IP range**:

– Go to **EC2 → Security Groups → Inbound Rules**
– Allow SSH (`port 22`) from **`104.192.136.0/21`**

—

## ✅ **5️⃣ Test the Connection**
Manually test from Bitbucket Pipelines with debugging:

- ssh -vvv -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "ls -lah /var/www/vuefront"

If it still fails, share the **full debug output**! 🚀

—

## ✅ **Fix: Ensure Bitbucket Pipelines Loads the SSH Key Correctly**

### **1️⃣ Store the Private Key in Bitbucket**
1. Go to **Bitbucket → Repository Settings → Repository Variables**
2. Add a new variable:
– **Variable Name**: `BITBUCKET_SSH_KEY`
– **Value**: Paste the **full contents** of `bitbucket_key` (private key)
– **Mark it as "Secured"**

—

### **2️⃣ Modify `bitbucket-pipelines.yml` to Load the Key**
Update your **`bitbucket-pipelines.yml`** to correctly create the SSH key:

pipelines:
  default:
    - step:
        script:
          - mkdir -p ~/.ssh
          - echo "$BITBUCKET_SSH_KEY" | tr -d 'r' > ~/.ssh/bitbucket_key.pem
          - chmod 600 ~/.ssh/bitbucket_key.pem
          - ls -lah ~/.ssh
          - ssh -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "ls -lah /var/www/vuefront"

—

### **3️⃣ Debugging**
If the error **persists**, add this debug command **before the SSH command**:

- cat ~/.ssh/bitbucket_key.pem
- ssh -vvv -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST "ls -lah /var/www/vuefront"

This will **print the key** inside the pipeline (remove later for security).

—

### **4️⃣ Allow Bitbucket IPs in AWS Security Group**
Make sure your **AWS Security Group** allows SSH from **Bitbucket IPs** (`104.192.136.0/21`):

1. Go to **AWS EC2 → Security Groups**
2. Edit **Inbound Rules**
3. **Allow SSH (`port 22`)** from:

104.192.136.0/21

—

### **Final Steps**
– **Commit & Push** the updated `bitbucket-pipelines.yml`
– **Run the pipeline again**
– **Check logs** and share any new errors! 🚀

### **Force Git Pull in Bitbucket Pipelines**

- git fetch --all
- git reset --hard origin/main  # Replace 'main' with your branch name
- git pull origin main --force

—

### **Why Use This?**
– `git fetch –all` → Gets the latest changes from the remote repository.
– `git reset –hard origin/main` → Resets the local branch to match the remote branch (overwrites local changes).
– `git pull origin main –force` → Ensures the latest remote changes are pulled forcefully.

🚨 **Warning:** This will overwrite **any local changes** in the pipeline workspace!

1. **Not accessible** (`No such file or directory`).
2. **Not properly added to the authorized keys on the EC2 instance**.

—

### **Fixing the Issue Step by Step**

#### **1️⃣ Ensure the Private Key is Available in Bitbucket Pipelines**
In your `bitbucket-pipelines.yml`, add the SSH private key as a secured variable:

script:
  - mkdir -p ~/.ssh
  - echo "$EC2_SSH_PRIVATE_KEY" > ~/.ssh/bitbucket_key.pem
  - chmod 600 ~/.ssh/bitbucket_key.pem

– `EC2_SSH_PRIVATE_KEY` should be **added as a secured environment variable** in Bitbucket.
– It must contain the private key contents (`bitbucket_key`).

—

#### **2️⃣ Add Bitbucket's Public Key to EC2**
On your **EC2 instance**, add the Bitbucket SSH **public key** (`bitbucket_key.pub`) to the `~/.ssh/authorized_keys` file for the `ubuntu` user:

echo "PASTE_CONTENTS_OF_BITBUCKET_KEY.PUB" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

—

#### **3️⃣ Ensure Correct Permissions on EC2**
Run these commands on your **EC2 instance**:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown -R ubuntu:ubuntu ~/.ssh

This ensures SSH can use the `authorized_keys` file correctly.

—

#### **4️⃣ Check SSH Debugging in Pipelines**
If the issue persists, add `-vvv` for debugging:

ssh -vvv -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no $EC2_USER@$EC2_HOST

This will show detailed output to help diagnose the problem.

—

### **Final Working SSH Command**

ssh -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "ls -lah /var/www/vuefront"

Let me know if you need more help! 🚀

—

### **1️⃣ Find Bitbucket's IP Addresses**
Bitbucket Pipelines uses dynamic IPs, but Atlassian provides a list of their IP ranges.
Run this command to get the latest Bitbucket IP ranges:

curl -s https://ip-ranges.atlassian.com/ | jq -r '.items[] | select(.mask_len == 32) | .cidr'

If you don't have `jq` installed, manually check Atlassian’s official list:
👉 [Bitbucket Cloud IP Whitelist](https://support.atlassian.com/bitbucket-cloud/docs/what-are-the-bitbucket-cloud-ip-addresses-i-should-allowlist/)

—

### **2️⃣ Add Bitbucket IPs to Your EC2 Security Group**
1. **Log in to AWS Console**
2. **Go to** ➝ EC2 ➝ Security Groups
3. **Find the security group** attached to your EC2 instance
4. **Edit Inbound Rules** ➝ Add a rule:
– **Type**: SSH
– **Protocol**: TCP
– **Port**: `22`
– **Source**: Custom
– **Enter each Bitbucket IP range** (e.g., `18.205.93.0/25`)

📌 **Alternative:** If you prefer AWS CLI:

aws ec2 authorize-security-group-ingress 
    --group-id <SECURITY_GROUP_ID> 
    --protocol tcp --port 22 --cidr 18.205.93.0/25

Repeat this command for **each Bitbucket IP range**.

—

### **3️⃣ Test SSH Connection from Bitbucket Pipelines**
In Bitbucket Pipelines, re-run the pipeline with:

ssh -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "ls -lah /var/www/vuefront"

If everything is correct, SSH should work without issues! 🚀

—

### **🔹 Fix: Add the Bitbucket SSH Key to EC2**
Follow these steps:

#### **1️⃣ Copy the Public Key to EC2**
Run the following command **on your local machine** to copy your Bitbucket key to the EC2 instance:

ssh-copy-id -i bitbucket_key.pub ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com

If `ssh-copy-id` is not available, manually append the public key:

cat bitbucket_key.pub | ssh -i shareview.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

—

#### **2️⃣ Ensure Correct File Permissions on EC2**
Once inside your EC2 instance, verify the SSH key permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

—

#### **3️⃣ Verify the Key Works from Local**
Now, test SSH access with:

ssh -i bitbucket_key.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "ls -lah /var/www/vuefront"

If this works, then your pipeline should also work.

—

#### **4️⃣ Configure Bitbucket Pipeline**
Make sure your **Bitbucket repository has the private key** added:
Go to **Repository Settings** ➝ **SSH Keys** ➝ **Add Private Key**

Then, update your `bitbucket-pipelines.yml` file:

image: atlassian/default-image:latest

pipelines:
  default:
    - step:
        script:
          - mkdir -p ~/.ssh
          - echo "$BITBUCKET_SSH_KEY" > ~/.ssh/bitbucket_key.pem
          - chmod 600 ~/.ssh/bitbucket_key.pem
          - ssh -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "ls -lah /var/www/vuefront"

Make sure `$BITBUCKET_SSH_KEY` is **set as a secured environment variable** in Bitbucket.

—

#### **5️⃣ Re-run the Pipeline**
Commit & push your changes, then re-run the pipeline.
If everything is set up correctly, SSH should work now! 🚀

—

### **✅ Fix: Update Your Pipeline Configuration**
In **Bitbucket Pipelines (`bitbucket-pipelines.yml`)**, modify your script to match the correct filename:

image: atlassian/default-image:latest

pipelines:
  default:
    - step:
        script:
          - mkdir -p ~/.ssh
          - echo "$BITBUCKET_SSH_KEY" > ~/.ssh/bitbucket_key
          - chmod 600 ~/.ssh/bitbucket_key
          - ssh -i ~/.ssh/bitbucket_key -o StrictHostKeyChecking=no ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "ls -lah /var/www/vuefront"

### **🔹 Explanation of Fix**
– **`mkdir -p ~/.ssh`** → Ensures the `.ssh` directory exists.
– **`echo "$BITBUCKET_SSH_KEY" > ~/.ssh/bitbucket_key`** → Saves the private key inside the pipeline.
– **`chmod 600 ~/.ssh/bitbucket_key`** → Sets correct permissions.
– **`ssh -i ~/.ssh/bitbucket_key -o StrictHostKeyChecking=no ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com`** → Uses the key to connect.

—

### **✅ Ensure EC2 Recognizes the Public Key**
If the pipeline still shows **"Permission denied (publickey)"**, you must add the public key to EC2:

#### **1️⃣ Manually Add Public Key to EC2**
Run this on your local machine (where `bitbucket_key.pub` exists):

cat bitbucket_key.pub | ssh -i shareview.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

#### **2️⃣ Verify Connection from Local**
Run this from your local machine to ensure the key works:

ssh -i bitbucket_key ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "ls -lah /var/www/vuefront"

If this works, the pipeline should work too.

—

### **🚀 Final Step: Re-run Your Pipeline**
Once you've updated the pipeline configuration and ensured the key is added to EC2, push a new commit and re-run the pipeline.

Let me know if you still face issues! 😊

### **1️⃣ Generate SSH Key Pair**
Run this on your local machine:

ssh-keygen -t rsa -b 4096 -m PEM -f bitbucket_key

– `-t rsa` → Generates an RSA key.
– `-b 4096` → Uses 4096-bit encryption for better security.
– `-m PEM` → Ensures the key is in **PEM format** (required for AWS).
– `-f bitbucket_key` → Creates **`bitbucket_key` (private key) and `bitbucket_key.pub` (public key)**.

After running the command, you will have:
– `bitbucket_key` → This is your **private key** (must be kept secret).
– `bitbucket_key.pub` → This is your **public key** (to be added to EC2).

—

### **2️⃣ Rename Private Key to `.pem`**
Since your pipeline requires `.pem`, rename it:

mv bitbucket_key bitbucket_key.pem

Now, you have:
– `bitbucket_key.pem` → **Private key**
– `bitbucket_key.pub` → **Public key**

—

### **3️⃣ Add Public Key to AWS EC2**
Run the following command to add the public key (`bitbucket_key.pub`) to your AWS EC2 instance:

cat bitbucket_key.pub | ssh -i shareview.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

—

### **4️⃣ Test SSH Connection**
Run this command from your **local machine** to verify that the key works:

ssh -i bitbucket_key.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "ls -lah /var/www/vuefront"

If this works, your Bitbucket pipeline should also work.

—

### **5️⃣ Update Bitbucket Pipeline**
Modify your **`bitbucket-pipelines.yml`** to use `bitbucket_key.pem`:

image: atlassian/default-image:latest

pipelines:
  default:
    - step:
        script:
          - mkdir -p ~/.ssh
          - echo "$BITBUCKET_SSH_KEY" > ~/.ssh/bitbucket_key.pem
          - chmod 600 ~/.ssh/bitbucket_key.pem
          - ssh -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "ls -lah /var/www/vuefront"

—

### **🚀 Final Step: Push and Re-run Pipeline**
Once everything is set up, **push a new commit** to trigger the pipeline.

Let me know if you face any issues! 🚀

—

## **1️⃣ Verify the Key Pair Exists Locally**
Run:

ls -lah bitbucket_key.pem bitbucket_key.pub

If these files are missing, regenerate them:

ssh-keygen -t rsa -b 4096 -m PEM -f bitbucket_key
mv bitbucket_key bitbucket_key.pem

—

## **2️⃣ Ensure the Public Key is Added to AWS**
Copy the public key to the EC2 instance:

cat bitbucket_key.pub | ssh -i shareview.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

This ensures the Bitbucket public key is authorized for SSH access.

—

## **3️⃣ Check Permissions on EC2**
After logging in with your **working key (shareview.pem)**, verify permissions:

ssh -i shareview.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com

Once inside the EC2 instance, run:

ls -lah ~/.ssh
cat ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Ensure the `bitbucket_key.pub` content is inside `authorized_keys`.

—

## **4️⃣ Test SSH with the New Key**
From your **local machine**, run:

ssh -i bitbucket_key.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com

If it still fails, add **verbose logging**:

ssh -vvv -i bitbucket_key.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com

Look for errors like:
– `debug1: Offering public key: bitbucket_key.pem`
– `debug1: Server accepts key: yes/no`
– `Permission denied (publickey)` (means key is not authorized)

—

## **5️⃣ Verify SSH Access in Bitbucket Pipeline**
If SSH works locally, but not in Bitbucket Pipelines:
– Ensure **Bitbucket SSH Key** is set up correctly in **Repository Settings → SSH Keys**.
– Modify `bitbucket-pipelines.yml`:

image: atlassian/default-image:latest

  pipelines:
    default:
      - step:
          script:
            - mkdir -p ~/.ssh
            - echo "$BITBUCKET_SSH_KEY" > ~/.ssh/bitbucket_key.pem
            - chmod 600 ~/.ssh/bitbucket_key.pem
            - ssh -i ~/.ssh/bitbucket_key.pem -o StrictHostKeyChecking=no ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "ls -lah /var/www/vuefront"

– Add `BITBUCKET_SSH_KEY` as a **secure environment variable** in Bitbucket.

—

### **🚀 Final Step: Retry SSH & Bitbucket Pipeline**
1. Test SSH from **local**:

ssh -i bitbucket_key.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com

2. If successful, **push a new commit** to re-run the Bitbucket pipeline.

—

This should resolve the issue. Let me know if you need further debugging! 🚀

—

### **1️⃣ Connect to Your EC2 Instance**
Use your **working SSH key** (e.g., `shareview.pem`) to access the instance:

ssh -i shareview.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com

—

### **2️⃣ Remove Existing Public Key**
Once inside the EC2 instance, run:

nano ~/.ssh/authorized_keys

– **Find the old public key** (it usually starts with `ssh-rsa`, `ecdsa-sha2-nistp256`, or `ssh-ed25519`).
– **Delete the line containing the old Bitbucket public key**.
– **Save and exit** (Press `CTRL + X`, then `Y`, then `Enter`).

Alternatively, use this command to remove the key:

sed -i '/bitbucket/d' ~/.ssh/authorized_keys

*(This removes any line containing "bitbucket" in `authorized_keys`.)*

—

### **3️⃣ Verify the Key is Removed**
Run:

cat ~/.ssh/authorized_keys

Ensure the old Bitbucket public key is **no longer listed**.

—

### **4️⃣ Exit & Test SSH Access**
Type:

exit

Then, try connecting with **only the removed key** to confirm it was deleted:

ssh -i bitbucket_key.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com

It should fail with:

Permission denied (publickey).

—

### **5️⃣ Add the New Bitbucket Public Key**
If you need to **re-add a new key**, follow the process:

cat bitbucket_key.pub | ssh -i shareview.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

—

Now, test SSH again with your new Bitbucket key:

ssh -i bitbucket_key.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com

This should fix the issue. Let me know if you run into any problems! 🚀

—

## **🔹 Fix: Ensure Bitbucket's SSH Key is Properly Added to AWS EC2**

### **1️⃣ Verify That the Key is in `authorized_keys` on EC2**
Log in to your EC2 instance using a working key:

ssh -i shareview.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com

Then check if the Bitbucket key is added:

cat ~/.ssh/authorized_keys

– If the **Bitbucket public key** is missing, manually add it.

—

### **2️⃣ Add Bitbucket's SSH Key to `authorized_keys`**
On **your local machine** (where the keys are stored), run:

cat bitbucket_key.pub | ssh -i shareview.pem ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

This will:
✅ Create the `.ssh` folder (if it doesn’t exist).
✅ Add the **Bitbucket public key** to `authorized_keys`.
✅ Set the correct **permissions**.

—

### **3️⃣ Verify Permissions on EC2**
Ensure proper **SSH file permissions**:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

—

### **4️⃣ Test SSH from Local**
Try connecting again using the **Bitbucket private key**:

ssh -i bitbucket_key ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com

– If this **works**, move on to fixing **Bitbucket Pipelines**.

—

## **🔹 Fix: Configure Bitbucket Pipelines to Use the SSH Key**
Inside **Bitbucket Pipelines**, ensure:
1. Go to **Repository Settings** → **SSH Keys** → **Repository SSH Keys**.
2. **Add your private key** (`bitbucket_key`).
3. Use this command in your **bitbucket-pipelines.yml**:

script:
      - chmod 600 ~/.ssh/bitbucket_key
      - ssh -i ~/.ssh/bitbucket_key -o StrictHostKeyChecking=no ubuntu@ec2-51-20-60-238.eu-north-1.compute.amazonaws.com "ls -lah /var/www/vuefront"

—

### **5️⃣ Final Test**
Trigger a Bitbucket Pipeline **build** and check if the SSH issue is resolved.

—

This should fix the **"Permission denied (publickey)"** error. Let me know if you need more help! 🚀

Try this:

chmod 600 ~/.ssh/authorized_keys

If you get an error that the file does not exist, check if it's present by running:

ls -lah ~/.ssh/

If `authorized_keys` is missing, you need to **add the Bitbucket public key again**:

mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "PASTE_PUBLIC_KEY_HERE" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Then, test SSH from Bitbucket again. Let me know if you need more help! 🚀