Log on to a cluster using SSH - E-MapReduce - Alibaba Cloud Documentation Center

Prerequisites

Your local machine must be able to connect to the cluster's master node. You can turn on the Assign Public Network IP switch when you create a cluster. Alternatively, after creating the cluster, you can assign a static public IP address or an elastic IP address (EIP) to the master node in the ECS console. For more information, see How do I assign a public IP address after a cluster is created?.
Ensure the security group for the cluster allows inbound traffic on TCP port 22. For more information, see Add a security group rule.

Find a node's public IP and name

Follow these steps to find the public IP address or name of a node.

Go to the Nodes page.
1. Log on to the E-MapReduce console.
2. In the top navigation bar, select a region and a resource group.
3. In the Actions column of the target cluster, click Nodes.
On the Nodes page, click the icon next to the target node group to view its public IP address and node name.
- Public IP Address: The public IP address of the node.
  
  Note
  If the public IP address of a node is not displayed, this indicates the Assign Public Network IP option was not enabled when the cluster was created. To assign a public IP address, see How do I assign a public IP address after a cluster is created?.
- Node Name: The name of the node, such as master-1-1, core-1-1, or task-1-1.

Log on to the master node

SSH key pair

After you create a key pair, the private key is automatically downloaded and saved as a .pem file.

Follow the steps for your operating system.

Linux

This example demonstrates how to log on to a master node by using the ecs.pem private key file.

Run the following command to change the permissions on the private key file.
```
chmod 400 ~/.ssh/ecs.pem
```
In this example, ~/.ssh/ecs.pem is the path to the ecs.pem private key file on your local machine.
Run the following command to connect to the master node.
```
ssh -i ~/.ssh/ecs.pem emr-user@<public_ip_address_of_the_master_node>
```
To obtain the public IP address of the master node, see Find a node's public IP and name.

Windows

On a Windows machine, you can log on to a master node with Command Prompt or PuTTY.

Command Prompt

Open Command Prompt and run the following command to log on to the master node.

ssh -i <path_to_your_.pem_private_key_file> emr-user@<public_ip_address_of_the_master_node>

To obtain the public IP address of the master node, see Find a node's public IP and name.

PuTTY

Download PuTTY and PuTTYgen.
Use PuTTYgen to convert the .pem private key file to a .ppk file.
1. Run PuTTYgen. This example uses PuTTYgen 0.82.
2. In the Actions section, click Load to import the private key file that you downloaded when creating the cluster.
  
  When importing the file, set the file type to All files (*.*).
3. Select the .pem private key file that you want to convert and click Enable.
4. Click Save private key.
5. In the dialog box that appears, click Yes. Enter a name for the .ppk private key file and click Save.
  
  Save the converted private key to your local machine. For example: kp-123.ppk.
Log on to the master node by using PuTTY.
1. Run PuTTY.
2. In the navigation pane, choose Connection > SSH > Auth > Credentials. For the Private key file for authentication option, click Browse and select the converted key file.
3. Click Session. In the Host Name (or IP address) field, enter the logon username and the public IP address of the master node.
  
  Use the format emr-user@<public_ip_address_of_the_master_node>, for example, emr-user@10.10.xx.xx. To obtain the public IP address of the master node, see Find a node's public IP and name.
  
  Ensure the Port is set to 22 and the Connection type is SSH.
4. Click Open. In the dialog box that appears, click Accept to log on to the master node.

SSH password

Note

These steps assume you are using the root username and the password set during cluster creation.

Follow the steps for your operating system.

Linux

Run the following command in your local terminal to connect to the master node.

ssh root@<public_ip_address_of_the_master_node>

To obtain the public IP address of the master node, see Find a node's public IP and name.

Windows

Download and install PuTTY. Download link: PuTTY.
Start PuTTY.
Configure the information required to connect to the cluster.
- Host Name (or IP address): Enter the static public IP address or EIP of the master node. To obtain the public IP address of the master node, see Find a node's public IP and name.
- Port: Enter 22.
- Connection type: Select SSH.
- (Optional) To save these settings for future use, enter a name for the session in the Saved Sessions field and click Save.
Click Open.
Enter your username (root by default) and password to log on to the cluster.

ECS connection method

Go to the Nodes page.
1. Log on to the E-MapReduce console.
2. In the top navigation bar, select a region and a resource group as required.
3. In the Actions column of the target cluster, click Nodes.
On the Nodes page, click the ECS ID under the target node name to open the ECS console.
On the Instances page, click Remote connection next to the instance ID.

You can also select a suitable tool to connect to the node's ECS instance. For more information, see Connection methods.

Note
If a permission issue occurs when you connect to an instance by using Workbench, see What do I do if a permission error occurs when I use Workbench to connect to an ECS instance?.

Log on to other cluster nodes

Password-free login to other nodes

Follow these steps to log on to a core or task node.

Log on to the master node of the cluster. For more information, see Log on to the master node.
On the master node, switch to the emr-user account.
```
su emr-user
```
Log on to the target core or task node without a password.
```
ssh <node_name_of_the_core_or_task_node>
```
To obtain the name of the core or task node, see Find a node's public IP and name. Example node names include core-1-1 and task-1-1.

ECS connection method

Go to the Nodes page.
1. Log on to the E-MapReduce console.
2. In the top navigation bar, select a region and a resource group as required.
3. In the Actions column of the target cluster, click Nodes.
On the Nodes page, click the ECS ID under the target node name to open the ECS console.
On the Instances page, click Reset Instance Password. For more information, see Reset the logon password for an instance.

Important
By default, core and task nodes do not have an ECS logon password. To log on with a password, you must first reset it in the ECS console.
After you reset your password, select an appropriate tool to connect to the node ECS instance. For more information, see Select an ECS remote connection method.

Note
If a permission issue occurs when you connect to an instance by using Workbench, see What do I do if a permission error occurs when I use Workbench to connect to an ECS instance?.

FAQ

Assign a public IP address

After creating the cluster, follow these steps to assign a public IP address.

Go to the Nodes page.
1. Log on to the E-MapReduce console.
2. In the top navigation bar, select a region and a resource group.
3. In the Actions column of the target cluster, click Nodes.
On the Nodes page, click the icon in the row of the target node group, and then click the node ID to open the Instance Details page.
In the Configuration Information > Public IP Address section, click Associate EIP or Assign Public IP Address as required.
- Associate EIP: Create and associate an elastic IP address. For more information, see Elastic IP Address.
- Assign Public IP Address: Set a bandwidth value greater than 0 Mbit/s. The system automatically assigns a public IP address. For more information, see Static public IP address.
After the configuration is successful, go to the Nodes page, click the icon in the row of the target node group, and view the public IP address.

Password-free login

Follow these steps to use password-free login to connect to the cluster from your local machine.

Open Command Prompt and run the following command to generate a key pair.
```
ssh-keygen
```
The command generates two files in a directory on your local machine: id_rsa (the private key) and id_rsa.pub (the public key).
Add the generated public key to the master node of the cluster.
1. Go to the ~/.ssh directory of the cluster.
```
cd ~/.ssh
```
2. Configure the key of the master node.
```
vim authorized_keys
```
3. Copy the content of the local id_rsa.pub public key file to the authorized_keys file.
Add the IP address of your local machine to the security group rules.
1. Obtain the public IP address of your machine.
  
  To securely access cluster components, we recommend that you allow access only from your current public IP address when you configure security group policies. To find your current public IP address, visit MyIP.
2. Add a security group rule and allow inbound traffic on TCP port 22.
  
  For more information about how to add a security group rule, see Add a security group rule. On the Inbound tab, set Protocol Type to Custom TCP and enter your client's IP address in the Source field.
In Command Prompt, run the following command to log on to the cluster without a password.
```
ssh root@<public_ip_address_of_the_master_node>
```

Cluster creation password

Yes, you can use the password set during cluster creation to log on to the master node. For information about how to log on to other nodes, see Log on to other cluster nodes.

Reset cluster password

To reset the password, go to the ECS console and follow these steps:

On the Nodes page of the E-MapReduce console, find the node whose password you want to reset.
Click the instance ID to open its details page in the ECS console.
On the Instances page, click Reset Password.

For more information, see Reset the logon password for an instance.

Workbench permission error

If a permission error occurs when you connect to an ECS instance with Workbench, the solution depends on the account type you are using:

Alibaba Cloud account: The first time you connect, a dialog box prompts you to create a service-linked role for Workbench. Click OK to have the role created automatically.
RAM account: You need to contact the primary account or an administrator to grant you the AliyunECSWorkbenchFullAccess system permission policy. Only users with this permission can create the service-linked role for Workbench and use Workbench to log in to instances. For more information, see the service-linked role for Workbench.

References

For security reasons, the web UIs for open-source components like Hadoop, Spark, and Flink are not publicly accessible. Use one of the following methods to access them: