All Products
Search
Document Center

Elastic Compute Service:Perform port forwarding by using ali-instance-cli

Last Updated:Sep 12, 2023

Session Manager is a feature provided by Cloud Assistant that allows you to connect to Elastic Compute Service (ECS) instances in a secure and convenient manner. ali-instance-cli is a CLI tool provided by Session Manager. This topic describes how to use ali-instance-cli to forward network traffic from a port on your computer to an ECS instance.

Prerequisites

  • Cloud Assistant Agent is installed on the instance to which you want to connect. If the instance is a Windows instance, the installed Cloud Assistant Agent version must be 2.1.3.256 or later. If the instance is a Linux instance, the installed Cloud Assistant Agent version must be 2.2.3.256 or later. For information about how to install Cloud Assistant Agent, see Install Cloud Assistant Agent.

  • Session Manager is enabled. For information about how to enable Session Manager, see Connect to an instance by using Session Manager.

Background information

When you use ali-instance-cli to set up port forwarding to an instance, you do not need to provide the public IP address of the instance but need to provide the ID and a port number of the instance. Then, you can use Session Manager Client to forward network traffic from a port on your computer to the specified port on the instance. This way, you can access services on the ECS instance in a secure and convenient manner. For more information about Session Manager, see Session Manager.

Linux and macOS operating systems

Note

In this example, the test user is used. The operations that you need to perform may vary based on the actual user and directories.

  1. Log on to Session Manager Client.

  2. Install ali-instance-cli on Session Manager Client.

    Run one of the following commands based on the operating system to install ali-instance-cli.

    • Linux

      curl -O https://aliyun-client-assist.oss-accelerate.aliyuncs.com/session-manager/linux/ali-instance-cli
      chmod a+x ali-instance-cli
    • macOS:

      curl -O https://aliyun-client-assist.oss-accelerate.aliyuncs.com/session-manager/mac/ali-instance-cli
      chmod a+x ali-instance-cli
  3. Configure an AccessKey pair, a Security Token Service (STS) token, or CredentialsURI.

    For information about how to obtain an AccessKey pair or STS token, see Create an AccessKey pair or What is STS?

    1. Switch to the test directory.

      cd /home/test
    2. Configure an authentication method.

      The following authentication methods are supported:

      • AccessKey pair-based authentication

        Run the following command and enter an AccessKey ID, AccessKey secret, and region ID as prompted:

        ./ali-instance-cli configure --mode AK
      • STS token-based authentication

        Note

        In the following command, replace region, ak, sk, and token with the actual region ID, AccessKey ID, AccessKey secret, and STS token.

        ./ali-instance-cli configure set --mode StsToken --region "region" --access-key-id "ak"  --access-key-secret "sk"   --sts-token "token"
      • CredentialsURI-based authentication

        Run the following command and specify CredentialsURI and RegionID as prompted.

        Note

        Set the CredentialsURI value to the IP address of the authentication server that you configure.

        ./ali-instance-cli configure --mode=CredentialsURI

      The following command output indicates that the AccessKey pair-based authentication method is configured.鉴权成功.png

  4. Run the following command to forward network traffic from a port on your computer to a port on an instance:

    ./ali-instance-cli portforward -i "instance id" -l 8080 -r 80
    Note

    This example demonstrates how to use Session Manager to perform port forwarding. In this example, port 8080 on your computer and port 80 on an instance are used. You can specify other ports based on your business requirements. Replace instance id with the actual instance ID.

    The following command output indicates that a forwarding path is established from the specified port on your computer to the specified port on the instance by Session Manager.Linux端口转发

Windows operating systems

Before you use Session Manager Client on your Windows computer to connect to an instance, make sure that OpenSSH is installed on the computer. For information about how to install OpenSSH on a Windows operating system, see Use Cloud Assistant to install OpenSSH on an ECS Windows instance.

Note

In this example, the test user is used. The operations that you need to perform may vary based on the actual user and directories.

  1. Log on to Session Manager Client.

    For more information, see Connection method overview.

  2. Download ali-instance-cli on Session Manager Client.

    Download and save ali-instance-cli.exe for Windows to a directory on your computer. In this example, the C:\Users\test directory is used.

  3. Create a file named config and add configurations to the file.

    1. In the C:\Users\<Username> directory, create a folder named .ssh.

      Note

      Replace C:\Users\<Username> with the actual directory. In this example, C:\Users\test is used.

      1. In the lower-left corner of the desktop, click the win2016 搜索.png icon and enter Windows PowerShell.

      2. Click Windows PowerShell.

      3. In the C:\Users\username directory, run the mkdir .ssh command to create a folder named .ssh.

    2. In the .ssh folder, create a file named config.

      Important

      The config file name cannot include an extension.

    3. Add content to the config file.

      Replace ali-instance-cli.exe in the following command with the absolute path of the ali-instance-cli file. In this example, C:\Users\test\ali-instance-cli.exe is used.

      host i-*
          ProxyCommand C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "ali-instance-cli.exe ssh -i '%h' --port  '%p'"
  4. Configure an AccessKey pair or an STS token.

    For information about how to obtain an AccessKey pair or STS token, see Create an AccessKey pair or What is STS?

    1. Choose Start > Run to open the Run dialog box. Enter cmd and press the Enter to open the command prompt window.

    2. Switch to the test directory.

      cd C:\Users\test
    3. Configure an authentication method.

      The following authentication methods are supported:

      • AccessKey pair-based authentication

        Run the following command and enter an AccessKey ID, AccessKey secret, and region ID as prompted:

        ali-instance-cli.exe configure --mode AK
      • STS token-based authentication

        Note

        In the following command, replace region, ak, sk, and token with the actual region ID, AccessKey ID, AccessKey secret, and STS token.

        ali-instance-cli.exe configure set --mode StsToken --region "region" --access-key-id "ak"  --access-key-secret "sk"   --sts-token "token"
      • CredentialsURI-based authentication

        Run the following command and specify CredentialsURI and RegionID as prompted:

        ali-instance-cli.exe configure --mode=CredentialsURI

      The following command output indicates that the AccessKey pair-based authentication method is configured.

      windows AK.png
  5. Run the following command to forward network traffic from a port on your computer to a port on an instance:

    ali-instance-cli.exe portforward -i "instance id" -l 8080 -r 80
    Note

    This example demonstrates how to use Session Manager to perform port forwarding. In this example, port 8080 on your computer and port 80 on an instance are used. You can specify other port based on your business requirements. Replace instance id with the actual instance ID.

    The following command output indicates that a forwarding path is established from the specified port on your computer to the specified port on the instance by Session Manager.Windows端口转发

Use case: Access the MySQL service on an instance

Assume that the MySQL service uses port 3306 on your instance. Your computer on which Session Manager Client is installed runs a Linux operating system. You can use ali-instance-cli to access services on the instance from port 33306 on your computer.

  1. Run the following command to forward network traffic from port 33306 on your computer to port 3306 on the instance:

    ./ali-instance-cli portforward -i "instance id" -l 33306 -r 3306

    The following command output indicates that a forwarding path is established from the specified port on your computer to the specified port on the instance by Session Manager.连接MySQL

  2. Run the following command to access the MySQL service on the instance from your computer:

    mysql -uroot -h127.0.0.1 -ppassword --port=33306
    Note

    Replace password with the MySQL password.

    The following command output indicates that the MySQL service on the instance is accessed.访问MySQL服务

    The ali-instance-cli log indicates that a new connection is accepted, which is the connection initiated by the MySQL client.CLI日志

  3. Run the exit command to close the connection to MySQL.

    exit

    The ali-instance-cli log indicates that the connection is closed.连接已关闭

FAQ

If an error occurs when you use Session Manager Client, you can view logs to identify and analyze the issue.

  • View the log generated at the current time for Session Manager Client. Example: /home/test/log/aliyun_ecs_session_log.2022XXXX.

  • View the logs of Cloud Assistant Agent in one of the following directories based on the operating system.

    • Linux

      /usr/local/share/aliyun-assist/<Version number of Cloud Assistant>/log/
    • Windows

      C:\ProgramData\aliyun\assist\<Version number of Cloud Assistant>\log

If Session Manager is not enabled when you use Session Manager Client to connect to an instance, the ssh_exchange_identification: Connection closed by remote host error message appears. Additionally, the session manager is disabled, please enable first entry appears in the Session Manager Client log. You can enable Session Manager in the ECS console. For more information, see Connect to an instance by using Session Manager.