Workbench uses temporary SSH key pairs, valid for only 60 seconds, to log on to ECS instances without static passwords or long-term keys.
Why use password-free logon with temporary key pairs
Static credentials, such as passwords and long-term SSH key pairs, remain valid indefinitely. If compromised, they grant persistent server access, and distributing, rotating, and revoking them is error-prone. Temporary key pairs eliminate these risks.
Core advantages | Description |
Reduced risk of credential leaks | Users never handle permanent passwords or keys, reducing the risk of credential leaks from human error. |
Defense against brute-force attacks | Logon credentials are generated for one-time use and expire after 60 seconds, greatly reducing the risk of brute-force attacks on ECS instances. |
Centralized permission control | Use Resource Access Management (RAM) access policies for fine-grained control over who can log on to instances. |
How it works
Temporary key pair logon still requires authentication. It replaces static credentials with a centralized authentication method managed by Alibaba Cloud.
Initiate password-free logon from the console.
Verify RAM permissions: Workbench verifies whether the current RAM user has permission to log on to the target instance.
Generate a temporary SSH key pair: After permission verification, Workbench generates a one-time SSH key pair (public key and private key) valid for 60 seconds. The private key is temporarily stored on the Workbench server.
Send the public key to the instance: Workbench sends the temporary public key to the instance through the Cloud Assistant Agent installed on the ECS instance.
Complete SSH authentication and establish a connection: Workbench uses the temporary private key stored on the server to complete public key authentication with the instance's SSH service and establish a connection.
Automatically destroy the key pair: After the 60-second validity period expires, the temporary key pair is destroyed regardless of whether the logon succeeded. The public key is removed from the ECS instance, and the private key is deleted from Workbench, ensuring each key is used only once.