Workbench is a more efficient and convenient connection tool than Virtual Network Computing (VNC) and allows multiple users to connect to a single Elastic Compute Service (ECS) instance at the same time. Workbench supports the following authentication methods for logons to instances: password-based authentication, key-based authentication, and credential-based authentication.
Prerequisites
A service-linked role for Workbench is created. The first time you use Workbench to connect to an instance, you are prompted to create a service-linked role for Workbench. For more information, see Workbench service-linked role.
ImportantWhen you use Workbench to connect to an instance as a Resource Access Management (RAM) user, make sure that the RAM user has the permissions included in the AliyunECSWorkbenchFullAccess system policy. If the RAM user does not have the permissions, an error message appears indicating that you do not have the required permissions. For information about how to grant permissions to a RAM user, see Grant permissions to a RAM user.
A logon password is configured for or a key pair is bound to the instance to which you want to connect. For information about how to configure a logon password for an instance, see Reset the logon password of an instance.
NoteThe ECS console cannot be used to bind key pairs to Windows instances. If you want to use a key pair to log on to a Windows instance, you can enable the sshd service (such as Cygwin SSHD or WinSSHD in Windows) and configure a key pair for the instance. For more information about how to enable the sshd service in Windows, see Get started with OpenSSH for Windows.
The instance is in the Running state.
Security group rules are added to allow the IP addresses related to the Workbench service to access the instance.
Instance that resides in a virtual private network (VPC)
Action
Priority
Protocol type
Port range
Authorization object
Allow
1
Custom TCP
To open port 3389, which is the default port, on the Windows instance, select RDP (3389).
To open other ports on the Windows instance, specify a port range.
To connect to the instance by using the static public IP address (also called auto-assigned or system-assigned public IP address) or the elastic IP address (EIP) that is associated with the instance, specify 161.117.0.0/16.
To connect to the instance by using the private IP address of the instance, specify 100.104.0.0/16.
Instance that resides in the classic network
If you want to connect to a Windows instance that resides in the classic network over the Internet, find a security group of the instance, go to the Security Group Rules page, and then add a rule on the Internet Ingress tab. The following table describes the parameters that must be configured for the rule.
Action
Priority
Protocol type
Port range
Authorization object
Allow
1
Custom TCP
To open port 3389, which is the default port, on the Windows instance, select RDP (3389).
To open other ports on the Windows instance, specify a port range.
To connect to the instance by using the static public IP address or the EIP that is associated with the instance, specify 161.117.90.22.
WarningYou can specify 0.0.0.0/0 as the authorization object to allow inbound access from all IP addresses. However, this exposes the instance to security risks. Proceed with caution.
If you want to connect to a Windows instance that resides in the classic network over the internal network, find a security group of the instance, go to the Security Group Rules page, and then add a rule on the Inbound tab. The following table describes the parameters that must be configured for the rule.
Action
Priority
Protocol type
Port range
Authorization object
Allow
1
Custom TCP
To open port 3389, which is the default port, on the Windows instance, select RDP (3389).
To open other ports on the Windows instance, specify a port range.
To connect to the instance that resides in the classic network by using the internal IP address of the instance, specify 161.117.90.22.
WarningIf you specify 0.0.0.0/0 as the authorization object, high security risks may arise. We recommend that you do not specify 0.0.0.0/0.
Procedure
By default, a Workbench remote session persists for 6 hours. If you do not perform operations for 6 hours, the remote connection is closed. You must reconnect to the instance.
Log on to the ECS console.
In the left-side navigation pane, choose .
In the top navigation bar, select the region and resource group to which the resource belongs.
On the Actions page, find the instance to which you want to connect and click Remote connection in the Actions column.
In the Remote connection dialog box, click Sign in now in the Workbench section.
In the Instance Login dialog box, configure parameters.
Configure the required parameters that are described in the following table.
Parameter
Description
Instance
The information of the current instance is automatically populated. You can enter the IP address or the name of another instance.
Connection
To connect to a Windows instance that resides in a VPC, use the public or private IP address of the instance.
To connect to a Windows instance that resides in the classic network, use the public or internal IP address of the instance.
For information about different network types, see Overview and IP addresses of ECS instances in the classic network.
Authentication
Select an authentication method. Valid values:
Password-based: password-based authentication. Enter a username, such as Administrator, and a password.
Credential-based: credential-based authentication. Select or create a credential.
Credentials are used to store instance information, such as usernames, passwords, and keys. You can use credentials to log on to instances in a secure manner without the need to enter usernames and passwords. For more information, see the Create a credential in Workbench section of this topic.
In the lower part of the dialog box, click More Options to show the optional parameters. The following table describes the parameters.
Parameter
Description
Resource Group
By default, All is selected. You can select a resource group from the drop-down list.
Region
By default, All is selected. You can select a region from the drop-down list.
Protocol
By default, Remote Desktop (RDP) is selected.
NoteIf you want to use SSH to connect a Windows instance, install the Cygwin SSHD or WinSSHD service on the instance. For information about how to enable the sshd service in Windows, see Get started with OpenSSH for Windows.
Port
If you set Protocol to Remote Desktop (RDP), this parameter is automatically set to 3389.
If you specified a different port as the remote connection port, enter the port number.
NoteIf you set Protocol to Terminal Connection (SSH), this parameter is automatically set to 22.
Click OK.
If all the prerequisites are met but the instance cannot be connected, perform the following operations on the instance:
Check whether a remote desktop service (such as Remote Desktop Services in Windows) is enabled. If not, enable a remote desktop service.
Check whether the required remote desktop port is enabled. If not, enable the port. The default remote desktop port is port 3389.
If you log on to the Windows instance as a non-administrator user, the user must belong to the Remote Desktop Users group.
Create a credential in Workbench
This section describes how to create a credential for an instance in Workbench. After the credential is created, you can use the credential for authentication when you log on to the instance.
Log on to the ECS console.
In the left-side navigation pane, choose .
In the top navigation bar, select the region and resource group to which the resource belongs.
On the Actions page, find the Windows instance to which you want to connect, and click Remote connection in the Actions column.
In the Remote connection dialog box, click Sign in now in the Workbench section.
In the Instance Login dialog box, configure parameters.
Create a credential.
Configure the required parameters that are described in the following table.
Parameter
Description
Instance
The information of the current instance is automatically populated. You can select another instance from the drop-down list.
Connection
To connect to a Windows instance that resides in a VPC, use the public or private IP address of the instance.
To connect to a Windows that resides in the classic network, you can use the public or internal IP address of the instance.
Authentication
Select Credential-based.
Select Create Credential from the Credential drop-down list.
In the Add Credential dialog box, configure the parameters that are described in the following table.
Parameter
Description
Credential Name
Enter a name for the credential.
Username
Enter a username. Example: Administrator.
Credential Type
Only Password is available for Windows instances.
Material Name
Enter a name for the authentication material.
Password
Enter the logon password of the instance.
Fingerprint
The fingerprint is automatically generated based on the authentication material.
Click OK.
In the Instance Login dialog box, select the credential that you created from the Credential drop-down list and click OK.