Connect to a Linux instance by using Workbench with a password or a key - Elastic Compute Service

Workbench is a more efficient and convenient connection tool than Virtual Network Computing (VNC) and allows multiple users to connect to a single Linux Elastic Compute Service (ECS) instance at the same time. Workbench supports the following authentication methods for logons to ECS instances: password-based authentication, SSH key pair-based authentication, temporary SSH key pair-based authentication, and credential-based authentication.

Prerequisites

A service-linked role for Workbench is created. The first time you use Workbench to connect to an instance, you are prompted to create a service-linked role for Workbench. For more information, see Workbench service-linked role.
Important
When you use Workbench to connect to an instance as a Resource Access Management (RAM) user, make sure that the RAM user has the permissions included in the AliyunECSWorkbenchFullAccess system policy. If the RAM user does not have the permissions, an error message appears indicating that you do not have the required permissions. For information about how to grant permissions to a RAM user, see Grant permissions to a RAM user.
A logon password is configured for or a key pair is bound to the Linux instance to which you want to connect. For more information, see Reset the logon password of an instance or Bind an SSH key pair.
The Linux instance is in the Running state.
Cloud Assistant Agent is installed on the Linux instance. For more information, see Install Cloud Assistant Agent.

Security group rules that allow the IP addresses related to Workbench to access the Linux instance are added to the security groups to which the Linux instance belongs. The security group rules vary based on the network type of the Linux instance. For more information, see Add a security group rule.

Instance that resides in a virtual private network (VPC)

If you want to connect to an instance that resides in a VPC, find a security group to which the instance belongs, go to the Security Group Details page, and then add a rule on the Inbound tab. The following table describes the parameters that you must configure for the rule.

Action	Priority	Protocol type	Port range	Authorization object
Allow	1	Custom TCP	To open port 22, which is the default port, on the Linux instance, select SSH (22). To open other ports on the Linux instance, specify a port range.	To connect to the instance by using the static public IP address (also called auto-assigned or system-assigned public IP address) or the elastic IP address (EIP) that is associated with the instance, specify 161.117.0.0/16. To connect to the instance by using the private IP address of the instance, specify 100.104.0.0/16. Warning You can specify 0.0.0.0/0 as the authorization object to allow inbound access from all IP addresses. However, this exposes the instance to security risks. Proceed with caution.

Instance that resides in the classic network

If you want to connect to an instance that resides in the classic network over the Internet, find a security group to which the instance belongs, go to the Security Group Details page, and then add a rule on the Internet Ingress tab. The following table describes the parameters that you must configure for the rule.

Action	Priority	Protocol type	Port range	Authorization object
Allow	1	Custom TCP	To open port 22, which is the default port, on the Linux instance, select SSH (22). To open other ports on the Linux instance, specify a port range.	To connect to the instance by using the static public IP address or the EIP that is associated with the instance, specify 161.117.90.22. Warning You can specify 0.0.0.0/0 as the authorization object to allow inbound access from all IP addresses. However, this exposes the instance to security risks. Proceed with caution.

If you want to connect to an instance that resides in the classic network over the internal network, find a security group to which the instance belongs, go to the Security Group Details page, and then add a rule on the Inbound tab. The following table describes the parameters that you must configure for the rule.

Action	Priority	Protocol type	Port range	Authorization object
Allow	1	Custom TCP	To open port 22, which is the default port, on the Linux instance, select SSH (22). To open other ports on the Linux instance, specify a port range.	To connect to the instance that resides in the classic network by using the internal IP address of the instance, specify 161.117.90.22. Warning If you specify 0.0.0.0/0 as the authorization object, high security risks may arise. We recommend that you do not specify 0.0.0.0/0.

Procedure

By default, a Workbench remote connection persists for 6 hours. If you do not perform operations for 6 hours, the remote connection is closed. You must reconnect to the Linux instance.

Log on to the ECS console.
In the left-side navigation pane, choose Instances & Images > Instances.
In the top navigation bar, select the region and resource group to which the resource belongs.
On the Instance page, find the Linux instance to which you want to connect. In the Actions column, click Remote connection.
In the Remote connection dialog box, click Sign in now in the Workbench section.

In the Instance Login dialog box, configure parameters.

The following table describes the required parameters in the dialog box.

Parameter	Description
Instance	The information of the current instance is automatically populated. You can enter the IP address or the name of another instance.
Connection	To connect to an instance that resides in a VPC, use the public or private IP address of the instance. To connect to an instance that resides in the classic network, use the public or internal IP address of the instance. For information about different network types, see Overview and IP addresses of ECS instances in the classic network.
Authentication	Select an authentication method. Valid values: Password-based: password-based authentication. Enter a username, such as root or ecs-user, and the password for the username. SSH Key Authentication: SSH key pair-based authentication. Enter a username, such as root or ecs-user, and then enter or upload a private key file. If the private key file is encrypted, enter the passphrase of the private key. Credential-based: credential-based authentication. Select or create a credential. Credentials are used to store instance information, such as usernames, passwords, and keys. You can use credentials to log on to instances in a secure manner without the need to enter usernames and passwords. If no credentials exist for a Linux instance in Workbench, create a credential for the instance. For more information, see the Create a credential to allow password-free logon section in this topic. Temporary SSH Key-based: temporary SSH key pair-based authentication. Enter a username, such as root or ecs-user. By default, the root username is used. Note Temporary SSH key pair-based authentication is implemented by using common Cloud Assistant commands. When you use Workbench to log on to a Linux instance, a temporary SSH key pair is generated that has a validity period of 1 minute. Cloud Assistant calls the InvokeCommand operation to run the `ACS-ECS-EnableSshPublicKey-linux.sh` and `ACS-ECS-SendSshPublicKey-linux.sh` common commands to send the public key of the temporary SSH key pair to the Linux instance. On the Linux instance, the public key is delivered to Cloud Assistant Agent. You are logged on to the instance by using Workbench and the temporary SSH key pair. Workbench does not store the temporary SSH key pair to the database. When the temporary SSH key pair expires, Workbench generates another temporary SSH key pair to maintain the logon connection.

In the lower part of the dialog box, click More Options to show the optional parameters. The following table describes the parameters.

Parameter	Description
Resource Group	By default, All is selected. You can select a resource group from the drop-down list.
Region	By default, All is selected. You can select a region from the drop-down list.
Protocol	By default, Terminal Connection (SSH) is selected. Note To use Remote Desktop (RDP) to connect to the Linux instance, install a Remote Desktop Protocol (RDP) service, such as xrdp, and a graphical desktop on the instance. For information about how to install a graphical desktop on a Linux instance, see Installing a graphical desktop environment for a Linux instance.
Port	If you set Protocol to Terminal Connection (SSH), this parameter is automatically set to 22. If you specified a different port as the remote connection port, enter the port number. Note If you set Protocol to Remote Desktop (RDP), this parameter is automatically set to 3389.
Language	Select your preferred language. The selected language affects the outputs of the Linux instance. We recommend that you select Default. This way, Workbench detects the language settings of the Linux instance and configures the appropriate settings.
Character Set	Select your preferred character set. The selected character set affects the outputs of the Linux instance. We recommend that you select Default. This way, Workbench detects the character set settings of the Linux instance and configures the appropriate settings.

Click OK.

If all prerequisites are met but the Linux instance cannot be connected, perform the following checks on the instance:

Check whether the sshd service, such as sshd in Linux, is enabled. If the sshd service is disabled, enable the service.
Check whether the required SSH port, typically port 22, is open. If the required SSH port is closed, open the port.
To use the root username to log on to the Linux instance, make sure that the /etc/ssh/sshd_config file contains the PermitRootLogin yes and PasswordAuthentication yes settings. For more information, see the Enable root logon over SSH on a Linux instance section of this topic.

Create a credential to allow password-free logon

This section describes how to create a credential for a Linux instance in Workbench. After you create a credential, you can use the credential for authentication when you log on to the Linux instance.

Log on to the ECS console.
In the left-side navigation pane, choose Instances & Images > Instances.
In the top navigation bar, select the region and resource group to which the resource belongs.
On the Instance page, find the Linux instance to which you want to connect. In the Actions column, click Remote connection.
In the Remote connection dialog box, click Sign in now in the Workbench section.
In the Instance Login dialog box, configure parameters.

Create a credential.

The following table describes the required parameters in the dialog box.

Parameter	Description
Instance	The information of the current instance is automatically populated. You can select another instance from the drop-down list.
Connection	To connect to a Linux instance that resides in a VPC, use the public or private IP address of the instance. To connect to a Linux instance that resides in the classic network, use the public or internal IP address of the instance.
Authentication	Select Credential-based. Select Create Credential from the Credential drop-down list.

In the Add Credential dialog box, configure parameters. The following table describes the parameters.

Parameter	Description
Credential Name	Enter a name for the credential.
Username	Enter a username, such as root or ecs-user.
Credential Type	Select a credential type. Valid values: Password: If you select this value, you must enter the logon password of the Linux instance. Private Key: If you select this value, you must enter or upload a private key file. If the private key file is encrypted, enter the passphrase of the private key.
Material Name	Enter a name for the authentication material.
Password	Enter the logon password of the Linux instance.
Fingerprint	The fingerprint is automatically generated based on the authentication material.

Click OK.

In the Instance Login dialog box, select the credential that you created from the Credential drop-down list and click OK.

Enable root logon over SSH on a Linux instance

In specific Linux operating systems, sshd disables root logon by default. In this case, you are prompted that your username or password is invalid when you attempt to connect to a Linux instance as root over SSH. To enable root logon over SSH on a Linux instance, perform the following steps:

Connect to the Linux instance by using VNC.
For more information, see Connect to an instance by using VNC.
Open the SSH configuration file.
```
vim /etc/ssh/sshd_config
```
Press the I key to enter Insert mode.
Set the PermitRootLogin and PasswordAuthentication parameters to yes as displayed in the following lines:
```
PermitRootLogin yes
PasswordAuthentication yes
```
Press the Esc key and enter :wq to save the changes.
Restart sshd.
```
systemctl restart sshd.service
```