Workbench is a browser-based SSH tool that lets you connect to an Elastic Compute Service (ECS) instance without installing any local software. Use Workbench when you need a zero-setup SSH connection from any browser, using the public or private IP address of your instance.
Workbench is one of several ways to connect to a Linux instance. For alternatives—such as a local SSH client—see Connect to a Linux instance.
Prerequisites
Before you begin, make sure you have:
An ECS instance in the Running state
Workbench permissions granted by your Alibaba Cloud account owner or administrator. If you encounter permission issues, see the Workbench service-linked role section in "Connect to an instance through Workbench"
Security group rules configured to allow Workbench IP addresses to access the instance. Rules differ by network type. See the Security group settings related to Workbench section in "Connect to an instance through Workbench." If no security group is assigned, you can specify one directly in the Instance Login dialog box
(Required for temporary SSH key-based authentication only) Cloud Assistant Agent installed on the instance. See Install Cloud Assistant Agent
Session behavior
A Workbench session lasts up to 6 hours. If no operation is performed for more than 6 hours, the session closes and you must reconnect.
Choose an authentication method
Workbench supports four authentication methods. Choose the one that fits your setup.
| Method | When to use | What you need |
|---|---|---|
| Password-based | Quick access with a username and password | Username (e.g., root or ecs-user) and logon password |
| SSH key authentication | Instance has an SSH key pair bound to it | Username and the private key content; passphrase if the key is protected |
| Credential-based | Frequent connections to the same instance | A saved credential (username + password or username + key pair) |
| Temporary SSH key-based | Passwordless, short-lived access | Username (default: root); Cloud Assistant Agent must be installed |
If your instance has an SSH key pair bound to it, use SSH key authentication instead of password-based authentication.
Connect to an instance
The following steps use an ECS instance running Alibaba Cloud Linux 3 as an example. By default, port 22 is used for the SSH connection. To use a different port, see Specify the SSH port.
Go to ECS consoleECS console - Instance.
In the top navigation bar, select the region and resource group of the instance.
Click the ID of the instance you want to connect to. On the Instance Details page, click Connect in the upper-right corner.
In the Remote connection dialog box, click Sign in now in the Workbench section.
In the Instance Login dialog box, configure the following parameters.
Parameter Description Instance Automatically populated with the current instance. Enter a different IP address or instance name to connect to another instance. Connection For a virtual private cloud (VPC) instance: use the public or private IP address. For a classic network instance with a public IP assigned: use the public IP only. For a classic network instance without a public IP: use the internal IP address. Authentication Select an authentication method. Enter the required credentials based on your selection. Click OK.
A successful connection opens a terminal in your browser.
If the connection fails, see Troubleshooting.
Specify the SSH port
To use a port other than 22, click More Options in the Instance Login dialog box.
 |  |
|---|
Create a credential for credential-based authentication
Credential-based authentication lets you save a username + password or username + key pair as a reusable credential, so you don't need to enter credentials on each connection. You cannot share the credential with other accounts. Only the credential creator can use the credential to connect to the instance.
In the Instance Login dialog box, set Connection to a public or private IP address, then select Credential-based for Authentication.
Click Create Credential in the Credential field to open the Add Credential dialog box.
In the Add Credential dialog box, fill in the following fields. For other fields, follow the on-screen instructions.
Parameter Description Username The logon username Credential type Select Password or Private Key Password The logon password for the username Private key The private key content for the username Passphrase for private key Required if the private key is protected by a passphrase Click OK. |
How temporary SSH key-based authentication works
Temporary SSH key-based authentication uses Cloud Assistant common commands to establish a short-lived, passwordless SSH session.
When you initiate a connection, Workbench generates a temporary SSH key pair with a 1-minute validity period.
Cloud Assistant calls the InvokeCommand operation to run
ACS-ECS-EnableSshPublicKey-linux.shandACS-ECS-SendSshPublicKey-linux.sh, which send the public key to the target instance via Cloud Assistant Agent.Workbench uses the temporary key pair to connect to the instance over SSH.
Workbench does not store the temporary SSH key pair. When the temporary SSH key pair expires 1 minute after being generated, you must reuse Workbench to generate another temporary SSH key pair to maintain the logon connection.
Troubleshooting
If you cannot connect to a Linux instance, see SSH connection issues.