Connect to an instance by using ali-instance-cli in a secure and convenient manner - Elastic Compute Service

Session Manager is a feature provided by Cloud Assistant that allows you to connect to Elastic Compute Service (ECS) instances in a secure and convenient manner. ali-instance-cli is a CLI tool provided by Session Manager. This topic describes how to use ali-instance-cli to connect to an ECS instance.

Prerequisites

Cloud Assistant Agent is installed on the instance to which you want to connect. If the instance is a Windows instance, the installed Cloud Assistant Agent version must be 2.1.3.256 or later. If the instance is a Linux instance, the installed Cloud Assistant Agent version must be 2.2.3.256 or later. For information about how to install Cloud Assistant Agent, see Install Cloud Assistant Agent.
Session Manager is enabled. For information about how to enable Session Manager, see Connect to an instance by using Session Manager.

Background information

When you use ali-instance-cli to connect to an ECS instance, you need to only provide the ID and password of the instance. You do not need to provide the public IP address or the port number of the instance. Compared with SSH or Virtual Network Computing (VNC), Session Manager allows you to connect to instances in a more secure and convenient manner. For more information about Session Manager, see Session Manager.

Linux and macOS operating systems

Note

In this example, the test user is used. The operations that you need to perform may vary based on the actual user and directories.

Log on to Session Manager Client.

Install ali-instance-cli on Session Manager Client.

Run one of the following commands based on the operating system to install ali-instance-cli.

Linux

curl -O https://aliyun-client-assist.oss-accelerate.aliyuncs.com/session-manager/linux/ali-instance-cli
chmod a+x ali-instance-cli

macOS:

curl -O https://aliyun-client-assist.oss-accelerate.aliyuncs.com/session-manager/mac/ali-instance-cli
chmod a+x ali-instance-cli

Configure an AccessKey pair, a Security Token Service (STS) token, or CredentialsURI.
For information about how to obtain an AccessKey pair or STS token, see Create an AccessKey pair or What is STS?
1. Switch to the test directory.
```
cd /home/test
```
2. Configure an authentication method.
  The following authentication methods are supported:
  - AccessKey pair-based authentication
    Run the following command and enter an AccessKey ID, AccessKey secret, and region ID as prompted:
    ./ali-instance-cli configure --mode AK
  - STS token-based authentication
    Note
    In the following command, replace region, ak, sk, and token with the actual region ID, AccessKey ID, AccessKey secret, and STS token.
```
./ali-instance-cli configure set --mode StsToken --region "region" --access-key-id "ak"  --access-key-secret "sk"   --sts-token "token"
```
  - CredentialsURI-based authentication
    Run the following command and specify CredentialsURI and RegionID as prompted.
    Note
    Set the CredentialsURI value to the IP address of the authentication server that you configure.
    ./ali-instance-cli configure --mode=CredentialsURI
  The following command output indicates that the AccessKey pair-based authentication method is configured.
Run the following command to connect to an ECS instance:
```
./ali-instance-cli session --instance instance-id
```
Note
Replace instance-id with the ID of the ECS instance to which you want to connect.
The following command output indicates that you are connected to the instance by using Session Manager.

Windows operating systems

Before you use Session Manager Client on your Windows computer to connect to an instance, make sure that OpenSSH is installed on the computer. For information about how to install OpenSSH on a Windows operating system, see Use Cloud Assistant Agent to install OpenSSH on a Windows ECS instance.

Note

In this example, the test user is used. The operations that you need to perform may vary based on the actual user and directories.

Log on to Session Manager Client.
For more information, see Connection method overview.
Download ali-instance-cli on Session Manager Client.
Download and save ali-instance-cli.exe for Windows to a directory on your computer. In this example, the C:\Users\test directory is used.
Configure an AccessKey pair or an STS token.
For information about how to obtain an AccessKey pair or STS token, see Create an AccessKey pair or What is STS?
1. Choose Start > Run to open the Run dialog box. Enter cmd and press the Enter to open the command prompt window.
2. Switch to the test directory.
```
cd C:\Users\test
```
3. Configure an authentication method.
  The following authentication methods are supported:
  - AccessKey pair-based authentication
    Run the following command and enter an AccessKey ID, AccessKey secret, and region ID as prompted:
    ali-instance-cli.exe configure --mode AK
  - STS token-based authentication
    Note
    In the following command, replace region, ak, sk, and token with the actual region ID, AccessKey ID, AccessKey secret, and STS token.
```
ali-instance-cli.exe configure set --mode StsToken --region "region" --access-key-id "ak"  --access-key-secret "sk"   --sts-token "token"
```
  - CredentialsURI-based authentication
    Run the following command and specify CredentialsURI and RegionID as prompted:
    ali-instance-cli.exe configure --mode=CredentialsURI
  The following command output indicates that the AccessKey pair-based authentication method is configured.
Run the following command to connect to an instance:
```
.\ali-instance-cli.exe session --instance instance-id
```
Note
Replace instance-id with the ID of the ECS instance to which you want to connect.
The following command output indicates that you are connected to the instance by using Session Manager.

FAQ

If an error occurs when you use Session Manager Client, you can view logs to identify and troubleshoot the issue.

View the logs of Session Manager Client. Example log file: /home/test/log/aliyun_ecs_session_log.2022XXXX.

View the logs of Cloud Assistant Agent in one of the following directories based on the operating system.

Linux

/usr/local/share/aliyun-assist/<Version number of Cloud Assistant Agent>/log/

Windows

C:\ProgramData\aliyun\assist\<Version number of Cloud Assistant Agent>\log

Session Manager is disabled

If Session Manager is disabled when you use Session Manager Client to connect to an instance, the ssh_exchange_identification: Connection closed by remote host error message appears. Additionally, the session manager is disabled, please enable first entry appears in the Session Manager Client log. You can enable Session Manager in the ECS console. For more information, see Connect to an instance by using Session Manager.

A connection established by using Session Manager is automatically disconnected

After you connect to an ECS instance by using Session Manager, the connection is automatically disconnected if you do not perform any operation for an extended period of time. By default, the idle timeout period for a connection is 3 minutes. You can use the --idle-timeout parameter to specify a custom idle timeout period. For example, run the following command to connect to an ECS instance and configure the connection to be automatically disconnected after the connection remains idle for 10 minutes.

Make sure that the version of ali-instance-cli is not earlier than the following versions:

Linux: 1.2.0.48
Windows: 1.1.0.48

macOS: 1.3.0.48

./ali-instance-cli session --instance instance-id --idle-timeout 600