Permission denied when trying to run keymaker install

[mrjk05]

Not sure what is happening....

Followed the instructions using a fresh AWS Ubuntu 16.04 AMI
Process:

Create a user group called "keymaker_

• Add users to give acesss to EC2 instances into keymaker group

• Launch EC2 instance - in this case Ubuntu

• upgrade server
  sudo apt-get update && sudo apt-get -y upgrade

• install AWS CLI
  sudo apt-get install awscli

• install python
  sudo apt install python

• install pip
  sudo apt-get install python-pip

• Install Keymaker
  pip install keymaker

• Run keymaker install
  keymaker install

however when run keymaker install i receive the following error:
useradd: Permission denied.
useradd: cannot lock /etc/passwd; try again later.
Traceback (most recent call last):
File "/home/ubuntu/.local/bin/keymaker", line 87, in <module>
locals()[args.command](args)
File "/home/ubuntu/.local/lib/python2.7/site-packages/keymaker/__init__.py", line 94, in install
"--shell", "/usr/sbin/nologin"])
File "/usr/lib/python2.7/subprocess.py", line 541, in check_call
raise CalledProcessError(retcode, cmd)
subprocess.CalledProcessError: Command '[u'useradd', u'keymaker', u'--comment', u'Keymaker SSH key daemon', u'--shell', u'/usr/sbin/nologin']' returned non-zero exit status 1

[ozmium]

To workaround the "Permission denied" problem, try running the command like this:

Install Keymaker
pip install keymaker

Check the install path of the binary
type keymaker
# Output is: keymaker is /home/ubuntu/.local/bin/keymaker

Run the keymaker installer, using the absolute path
sudo /home/ubuntu/.local/bin/keymaker install

Then check that it has added a "keymaker" user to the system accounts:

cat /etc/passwd
or
cat /etc/passwd | grep "keymaker"

[kislyuk]

@mrjk05 please disregard the advice from @ozmium.

keymaker only supports global installation. You must run it as root, for example using sudo pip install keymaker, not as your own user. You will not be able to make keymaker work by performing a user installation (as running it without sudo will result in).

[kislyuk]

I should clarify, for the avoidance of doubt, that because of the content of the issue, I'm talking only about installing Keymaker on a server that will provide SSH access, as opposed to on a client (where the users will log in from and upload their SSH keys to IAM from).

On a server, you must install keymaker globally.

On a client, keymaker doesn't need to interact with sshd or other system components, so can be installed as a user install.