All Products
Search

This Product

    Elastic Compute Service:Instance connection FAQ

    Document Center

    Elastic Compute Service:Instance connection FAQ

    Last Updated:Jul 09, 2026

    SSH remote connection issues

    Remote Desktop (RDP) connection issues

    VNC remote connection issues

    Troubleshooting remote connection issues using VNC

    FTP service connection issues

    Windows instances

    Linux instances

    Appendix

    Sshd startup error: Permission for /usr/share/empty.sshd

    • Symptom

      The sshd service on an ECS instance fails to start, and the system log reports a permission error: /usr/share/empty.sshd must be owned by root and not group or world-writable

    • Cause

      The sshd service fails to start because the /usr/share/empty.sshd file has incorrect permissions.

    • Solution

      chown -R root.root /usr/share/empty.sshd
chmod 744 /usr/share/empty.sshd
systemctl start sshd
ll -ld /usr/share/empty*

    Troubleshooting internet FTP connections on Windows

    Symptom

    An FTP service on a Windows ECS instance is unreachable from the internet.

    Cause

    Possible causes include:

    Solution

    Choose a solution based on the cause.

    Solution 1: Add security group rules for FTP

    After you set up an FTP site on an ECS instance that runs Windows, you must add an inbound rule to the security group of the instance to allow traffic on port 21 for the FTP server and on the port range 1024-65535 for passive mode. For more information, see Add a security group rule.

    Note

    For more information about security group configurations, see Security group application guide and use cases and Common ports.

    Solution 2: Configure FTP firewall support

    If the firewall is enabled, you must configure IIS Manager to allow FTP traffic on TCP port 21 and the port range 1024-65535. Follow these steps:

    Note

    • The internal firewall of a Windows ECS instance is disabled by default.

    • This topic uses IIS Manager as an example to describe how to configure FTP.

    1. Connect to the Windows instance.

      For more information, see Connect to a Windows instance by using a password or key.

    2. Open IIS Manager and double-click FTP Firewall Support to open its configuration page.

    3. Set the parameters and click Apply.

      Note

      Parameters:

      • External IP Address of Firewall: Enter the public IP address of the Windows ECS instance.

      • Data Channel Port Range: Specify the port range for passive connections. The valid port range is 1024-65535. This topic uses 1024-65535 as an example.

    4. Open the command line and run the following command to restart the FTP service. This applies the new configuration to all FTP sites.

      net stop ftpsvc&net start ftpsvc

    5. (Optional) If the FTP server is locally accessible but unreachable from other machines after configuration, the firewall might be misconfigured. Follow these steps to correctly configure the firewall:

      1. Check the inbound rules in Server Manager to make sure that the FTP server is enabled.

      2. Add the Windows service host process.

        1. Navigate to Control Panel > Windows Firewall and click Allow an App or Feature Through Windows Firewall in the left-side navigation pane.

        2. In the new window, click Allow Another App..., browse to and select C:\Windows\System32\svchost.exe to add the service host process.

        3. Select the new Windows Service Host Process item, select the Private and Public checkboxes, and then click OK.

    Troubleshooting FTP error "530 Login incorrect"

    Symptom

    When you connect to the FTP server on an ECS instance that runs Windows, the following error is reported:

    Response: 331 Please specify the password.
Command: PASS ************
Response: 530 Login incorrect.
Error: Critical error: Could not connect to server
    Cause

    Possible causes include:

    Solution

    Choose a solution based on the cause.

    Solution 1: Change the FTP password

    1. Connect to the Windows instance.

      For more information, see Connect to a Windows instance by using a password or key.

    2. On the desktop, right-click Computer > Manage to open Server Manager.

    3. In the left-side navigation pane, click Local Users and Groups > Users. Right-click the FTP account and select Set Password.

    Solution 2: Add FTP user permissions

    1. Connect to the Windows instance.

      For more information, see Connect to a Windows instance by using a password or key.

    2. Check whether the FTP user directory exists.

      1. If the directory does not exist, re-create it and add the required permissions. For more information, see Step 3: Set permissions for shared files.

      2. If the directory exists, right-click the folder and select Properties > Security. Select the FTP account and grant the required permissions.

    Troubleshooting FTP error "530 valid hostname is expected"

    Symptom

    When connecting to an FTP server on a Windows ECS instance by IP address, a "530 valid hostname is expected" or "503 Login with USER first" error occurs if the FTP site, configured in IIS 7.5, is bound to a domain name.

    Cause

    This error occurs because the username format is incorrect when you log on to an FTP service that is bound to a domain name in IIS 7.5.

    Solution

    If the domain name bound to the FTP service is www.example.com and the username is user, you must use www.example.com|user to log on.

    Note

    • The separator is a pipe character (|).

    • Alternatively, remove the domain name binding and log on with only the username.

    Troubleshooting FileZilla error "550 Permission denied"

    Symptom

    A "550 Permission denied" error is reported when you upload a file to FileZilla Server by using FTP on an ECS instance that runs Windows.

    Cause

    The corresponding FTP account in FileZilla Server does not have the write permission.

    Solution

    1. Connect to the Windows instance.

      For more information, see Connect to a Windows instance by using a password or key.

    2. Run the FileZilla Server software. On the Users page, select Shared folders.

    3. Select the corresponding user and directory, select the Write checkbox, and then click OK to grant the permission.

    FTP over TLS error: "534 Policy requires SSL"

    Symptom

    When you connect to an FTP site created by the IIS service on a Windows instance by using FTP over TLS, the message "534 Policy requires SSL" is displayed, preventing the connection.

    Cause

    The "534 Local policy on server does not allow TLS secure connections." response indicates that the FTP SSL Settings parameter of the FTP site is not correctly configured.

    Solution

    1. Connect to the Windows instance.

      For more information, see Connection methods.

    2. In the lower-left corner of the desktop, choose 开始图标 > Windows Administrative Tools > Internet Information Services (IIS) Manager.

    3. On the FTP homepage, in the FTP section, double-click FTP SSL Settings.

    4. In the FTP SSL Settings section, set SSL Policy to Allow SSL connections, and then click Apply in the Actions pane.

    5. Access the FTP site again.

    Troubleshooting FTP error "425 Security:Bad IP connection"

    Symptom

    A "425 Security:Bad IP connection" error is reported when a user uploads a file to an FTP site on an ECS instance that runs Linux.

    Cause

    This issue usually occurs because the client is in a NAT network that is associated with more than one public IP address. As a result, the source IP addresses for the control and data connections are inconsistent, causing the error.

    Note

    The FTP service uses a control connection and a data connection. By default, the FTP server verifies that the two connections have the same source IP address during data transfer. If the source IP addresses are different, a "425 Security:Bad IP connection" error is reported.

    Solution

    Perform the following steps to disable the IP security check in passive mode:

    1. Connect to the Linux instance.

      For more information, see Connect to a Linux instance by using a password or key.

    2. Run the following command to edit the FTP configuration file:

      vi /etc/vsftpd/vsftpd.conf

    3. Press i to enter edit mode and add the following content to the configuration file:

      pasv_promiscuous=yes

    4. Press Esc to exit edit mode, enter :wq, and then press Enter to save and exit.

    5. Run the following command to restart the FTP service:

      systemctl restart vsftpd

    Troubleshooting vsftp error "553 Could not create file"

    Symptom

    Uploading a file to an ECS instance that runs Linux by using vsftp fails with a "553 Could not create file" error.

    Cause

    Possible causes include:

    • The disk space of the Linux instance is full.

    • The FTP home directory does not have the write permission.

    Solution

    Follow these steps to check the instance's disk space and the FTP home directory permissions:

    1. Connect to the Linux instance.

      For more information, see Connect to a Linux instance by using a password or key.

    2. Run the following command to check whether the disk is full.

      df -h
      Note

      If a partition's disk space usage reaches 100%, it is full.

      A similar output is displayed. For example, the space usage of the /dev/xvda1 partition is 59%.

      Filesystem      Size  Used Avail Use% Mounted on
/dev/xvda1       20G   11G  7.8G  59% /
tmpfs           498M  1.6M  496M   1% /dev/shm

    3. Run the following command to check whether the FTP home directory has the write permission.

      Note

      Before you run the following command, replace /home/user with your actual FTP home directory name.

      ls -l /home/user

      If the permission string in the output does not include w, you do not have the write permission. For example:

      dr-xr-xr-x  4 xxx              xxx            4096 May 10 21:47 zhengbo

    4. Run the following command to add the write permission: 

      chmod +w /home/user

    5. Run the following command to verify the permission. If the command output contains w, the write permission is added.

      ls -l /home/user

    What to do when an ECS instance becomes unresponsive due to high CPU load, insufficient memory, or saturated disk I/O/BPS/IOPS and remote connections (SSH/VNC/Workbench) fail?

    When an ECS instance becomes unresponsive because CPU load is too high, memory is exhausted, or disk I/O/BPS/IOPS is saturated, you may be unable to connect to the instance through SSH, VNC, or Workbench. Follow these steps to perform emergency recovery and root cause analysis.

    Possible causes

    A system hang is usually caused by one or a combination of the following:

    • Insufficient memory triggers intensive page swapping: After physical memory is exhausted, the kernel kswapd0 process continuously swaps memory pages to disk (swap), saturating disk I/O and causing the system to respond extremely slowly.

    • A single process exhausts resources: A process (such as a Docker container, Java application, or MySQL database) consumes a large amount of CPU or memory resources, leaving the system unable to allocate resources for critical services such as SSH.

    • Disk space is 100% full: Disk space exhaustion causes critical system processes to malfunction. For example, SSH login requires writing to the login history file. When the disk is full, this operation is blocked, causing the SSH connection to hang.

    Emergency recovery steps

    1. Create a snapshot to back up data

      Log on to the ECS console, find the system disk and data disks of the target instance, and create snapshots as a priority to back up data.

      Note

      When the system is in a hung state, disk I/O may remain at a high level. Snapshot creation may take significantly longer than normal. Wait for the snapshots to complete.

    2. Attempt to send commands through Cloud Assistant (optional)

      If you want to stop the problematic application before restarting the instance to ensure data is flushed to disk, you can try sending a kill or stop command to the instance through Cloud Assistant in the ECS console. However, if the OS kernel is completely unresponsive, the command will time out. In that case, proceed to the next step.

      Warning

      Running kill or stop commands will forcefully terminate the target process, which may result in incomplete business data writes, file corruption, or abnormal database shutdown. Assess the business impact before proceeding.

    3. Restart the instance

      Restart the instance from the ECS console.

      • First, try a normal restart (wait for the kernel to respond to the shutdown command) and observe for 10–15 minutes.

      • If the normal restart times out and fails, perform a force restart. A force restart is equivalent to a power cycle and carries a very small risk of corrupting files that were being written. Make sure you have completed the snapshot backup before force restarting.

    Root cause analysis and long-term optimization

    • Install the atop tool: We recommend that you install atop and configure it to start on boot (systemctl enable atop). atop continuously records system resource usage.

    • Check OOM records: Run dmesg | grep -i oom or check /var/log/messages to confirm whether an out-of-memory (OOM) event has occurred.

    • Optimize memory configuration: For memory bottlenecks, you can configure a Linux swap partition as a temporary buffer. If your workload requires more memory in the long term, we recommend that you upgrade the instance type.

    • Configure CloudMonitor alerts: Configure threshold alerts for CPU usage, memory usage, disk I/O, and other metrics in CloudMonitor to receive notifications before resources are exhausted.