After you configure credentials for Alibaba Cloud Client, you can connect to and manage ECS instances without a password or public IP address. You can also use port forwarding to securely access services that are deployed on your instances from your local computer.
Connect to an instance
Linux instances
You can use Session Manager to connect to instances without a public IP address through a secure channel. For instances that have a public IP address and an open port, you can connect directly with an SSH connection.
Connect using Session Manager
Before you connect to an ECS instance using Session Manager, ensure that Session Manager is enabled.
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose Start Remote Session....
Connect using an SSH connection
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose Remote Connect (SSH)....
-
In the dialog box, configure the User Name and Port. Then, select an Authentication:
-
Temp KeyPair: A temporary key pair is generated. Cloud Assistant sends the public key to the instance, allowing you to sign in using the private key. This method is simpler because you do not need to manage passwords or key files.
-
Password: Enter the password of the ECS instance.
-
key file: Sign in with an SSH private key file. You can obtain a private key file in one of the following ways:
In the Actions column for the target instance, choose to bind an SSH key to the ECS instance. This enables password-free sign-in for future connections.
-
Create a key pair (.pem file) on the ECS console and bind it to the ECS instance.
-
Manually bind a key pair to the ECS instance.
-
-
-
Click Connect to open the SSH terminal.
Windows instances
When you need a graphical user interface (GUI), use a public IP connection for instances with a public IP address, or connect using Cloud Assistant for instances without one. If you only need a command-line interface, use a Session Manager connection.
Connect using Cloud Assistant
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose Remote Desktop (via Cloud Assistant)....
-
In the dialog box that appears, configure a port forwarding rule (the local port must not be in use), and then click Start. The client launches your operating system's Remote Desktop application.
-
In the Remote Desktop connection window, enter the instance's password to complete the connection.
Connect using Session Manager
Before you connect to an ECS instance using Session Manager, ensure that Session Manager is enabled.
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose Start Remote Session....
By default, you log on to Windows instances as the system user. Session Manager connections do not support a graphical user interface (GUI) and provide command-line access only.
Connect using a public IP address
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose Remote Desktop (RDP)....
-
In the dialog box that appears, confirm the connection information and click Connect. Alibaba Cloud Client launches your operating system's Remote Desktop application.
-
In the Remote Desktop connection window, enter the instance's password to complete the connection.
Start and stop an instance
Stopping or rebooting an instance interrupts your services. Perform these operations with caution.
-
Start an instance
-
In the instance list, find the target instance, and in the corresponding Actions column, choose .
-
In the dialog box that appears, confirm the instance information and click Start Instance.
-
-
Stop an instance
-
In the instance list, find the target instance, and in the corresponding Actions column, choose .
-
In the dialog box that appears, configure the stop mode and click Stops an instance..
-
-
Reboot an instance
-
In the instance list, find the target instance, and in the corresponding Actions column, choose .
-
In the dialog box that appears, confirm the instance information and click Restart Instance.
-
Reset an instance password
The client transmits the new password over an encrypted channel and it takes effect immediately without a reboot.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose .
-
In the Reset Password dialog box, enter and confirm the new password, choose whether to enable or keep the original password sign-in method, and then click Reset Password.
Enable release protection
If a pay-as-you-go instance runs critical services, you can enable release protection for the instance to prevent its accidental release.
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose .
Manage security groups
-
In the instance list, find the target instance, and in the corresponding Actions column, choose View Security Groups.
You can view the security group ID, name, type, inbound and outbound rules, and description.
-
Manage the security group.
-
Add an inbound or outbound rule.
-
In the Actions column for the security group, click Add Inbound Rule or Add Outbound Rule.
-
Enter the rule details. For parameter information, see Security group rules.
-
-
Modify the authorization policy.
-
In the row for the security group, click the number in the Outbound Rules or Inbound Rules column.
-
In the Actions column for the security group rule, choose Modify Authorization Policy.
-
Select Allow or Deny, and then click Modify Authorization Policy.
-
-
Upload and download files
This feature is available only for Linux instances that are assigned a public IP address.
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose File Management (SFTP)....
-
In the dialog box, configure the User Name and Port. Then, select an Authentication:
-
Temp KeyPair: A temporary key pair is generated. Cloud Assistant sends the public key to the instance, allowing you to sign in using the private key. This method is simpler because you do not need to manage passwords or key files.
-
Password: Enter the password of the ECS instance.
-
key file: Sign in with an SSH private key file. You can obtain a private key file in one of the following ways:
In the Actions column for the target instance, choose to bind an SSH key to the ECS instance. This enables password-free sign-in for future connections.
-
Create a key pair (.pem file) on the ECS console and bind it to the ECS instance.
-
Manually bind a key pair to the ECS instance.
-
-
-
In the file list, find the target file or directory.
You can use the client to transfer files between an ECS instance and an OSS bucket.
-
To download files: In the corresponding Actions column, choose Download this file or Download this directory.
-
To upload files: Above the file list, choose Upload local directory or Upload Local File.
-
Port forwarding (via Cloud Assistant)
The port forwarding (via Cloud Assistant) feature lets you remotely connect to an instance port without using a public IP address. It forwards network traffic from a local port to an instance port, allowing you to access services on the instance conveniently and securely. For example, if you develop a web application on an ECS instance that does not have a public IP address, you can use port forwarding to access the web application on port 80 of the ECS instance from a browser on your local computer.
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose Port Forwarding (Cloud Assistant).... In the dialog box that appears, enter the server port (the access port for the service inside the instance) and the local port (the listening port on your local machine). Optionally, select whether to print request/response content or open the local port in a browser after startup. Then, click Start.
-
View the port forwarding logs in the client. After clicking Start, the following output in the terminal indicates that port forwarding is successfully enabled:
# Checking the running status of the instance... # Checking the SessionManager protocol status for the current user [Enabled] > localhost: start server socket : { address: '127.0.0.1', family: 'IPv4', port: 8088 } > localhost: start socket listen : { address: '127.0.0.1', family: 'IPv4', port: 8088 } > Start listening on local port localhost:8088. This listener only accepts connection requests from the local machine.
Send remote commands
To quickly perform routine maintenance, such as batch-installing or uninstalling software, resetting user passwords, or running automated O&M scripts, you can send remote commands to your ECS instances.
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose . In the Send Remote Commands dialog box, enter an automated O&M script and click Send.
Release an instance
After you release an instance, its data cannot be restored. Before you release an instance, back up your data. If you need to retain the data, you can create a snapshot to back it up.
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose .
-
In the dialog box that appears, confirm the instance information and click Release Instance.
FAQ
Why is monitoring data not displayed?
Before you can view monitoring data in the client, you must grant the AliyunCloudMonitorMetricDataReadOnlyAccess permission to the signed-in RAM user.
How to set up password-free SSH sign-in?
For an ECS instance with a bound key pair, you can add an SSH key in the client to enable password-free sign-in. This allows you to connect without entering a password or key file.
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose .
-
In the Add SSH Key dialog box, select a local SSH key file, choose whether to append or replace the key, and then click Add SSH Key.
How to download OSS files to an instance?
You must first grant the AliyunOSSFullAccess permission to the signed-in RAM user.
The client also supports downloading files from OSS to instances and uploading instance files to OSS.
-
On the Homepage page of Alibaba Cloud Client, click ECS. Above the instance list, select the region where your instance is located.
-
In the instance list, find the target instance, and in the corresponding Actions column, choose File Management (SFTP)....
-
In the dialog box, configure the User Name and Port. Then, select an Authentication:
-
Temp KeyPair: A temporary key pair is generated. Cloud Assistant sends the public key to the instance, allowing you to sign in using the private key. This method is simpler because you do not need to manage passwords or key files.
-
Password: Enter the password of the ECS instance.
-
key file: Sign in with an SSH private key file. You can obtain a private key file in one of the following ways:
In the Actions column for the target instance, choose to bind an SSH key to the ECS instance. This enables password-free sign-in for future connections.
-
Create a key pair (.pem file) on the ECS console and bind it to the ECS instance.
-
Manually bind a key pair to the ECS instance.
-
-
-
In the file list, find the target file or directory.
-
In the corresponding Actions column, choose Upload to OSS.
-
Above the file list, choose Download OSS File.
-
Why does Temp KeyPair or Cloud Assistant fail?
These features require Cloud Assistant to be running correctly on the instance. Since December 1, 2017, Cloud Assistant Agent has been pre-installed on ECS instances created from public images. If the agent is not installed on your instance, manually install Cloud Assistant Agent.