Workbench allows multiple users to connect to the same Elastic Compute Service (ECS) instance at the same time. You can use Workbench to connect to instances with passwords, keys, or credentials. Workbench is more efficient and convenient than Virtual Network Computing (VNC).
Prerequisites
- A logon password or a key is configured for the Windows instance to which you want to connect. Note The ECS console cannot be used to bind key pairs to Windows instances. If you want to use a key to log on to a Windows instance, you can enable the sshd service (such as Cygwin SSHD or WinSSHD in Windows) and configure a key on the instance. For more information about how to enable the sshd service in Windows, see Get started with OpenSSH.
- The instance is in the Running state.
- Security group rules are added to allow the IP addresses related to the Workbench service to access the instance. For more information, see Add security group rules to allow Workbench access to a Windows instance.
Background information
- By default, a Workbench remote connection persists for 6 hours. If you do not perform operations for 6 hours, the remote connection is closed. You must reconnect to the instance.
- Workbench can be used to connect to Windows instances over Remote Desktop Protocol (RDP). For more information, see Connect to a Windows instance over RDP.
Connect to a Windows instance over RDP
- Log on to the ECS console.
- In the left-side navigation pane, choose .
- In the top navigation bar, select a region.
- On the Instances page, find the instance to which you want to connect, and click Connect in the Actions column.
- In the Remote connection dialog box, click Sign in now in the Workbench section.
- In the Instance Login dialog box, configure parameters. The following table describes the required parameters.
Parameter Description Instance The information about the current instance is automatically populated. You can also enter the IP address or the name of another instance. Connection - To connect to an instance that resides in a virtual private cloud (VPC), use the public or private IP address of the instance.
- To connect to an instance that resides in the classic network, use the public or internal IP address of the instance.
Authentication Select an authentication method. The following authentication methods are supported: - Password-based: Enter a username, such as Administrator, and a password.
- Credential-based: Select an existing credential or create a credential.
Credentials are used to store instance information such as usernames, passwords, and keys. You can use credentials to log on to instances in a secure manner without the need to enter usernames and passwords. For more information about credentials, see the Create a credential in Workbench section of this topic.
In the lower part of the dialog box, click More Options to show the optional parameters. The following table describes the parameters.Parameter Description Resource Group By default, All is selected. You can select a resource group from the drop-down list. Region By default, All is selected. You can select a region from the drop-down list. Protocol By default, Remote Desktop (RDP) is selected. Port When Protocol is set to Remote Desktop (RDP), this parameter is automatically set to 3389. - Click OK.
- Check whether a remote desktop service (such as Remote Desktop Services in Windows) is enabled. If not, enable a remote desktop service.
- Check whether the required remote desktop port (typically port 3389) is enabled. If not, enable the port.
- If you log on to the Windows instance as a non-administrator user, the user must belong to the Remote Desktop Users group.
Create a credential in Workbench
Perform the following operations to create a credential for an instance in Workbench. Then, you can use the credential to log on to the instance.
- Log on to the ECS console.
- In the left-side navigation pane, choose .
- In the top navigation bar, select a region.
- On the Instances page, find the instance to which you want to connect, and click Connect in the Actions column.
- In the Connection and Command dialog box, click Connect in the Workbench Connection (Default) section.
- In the Instance Login dialog box, specify parameters to log on to the instance.
- If no credentials are present for the instance in Workbench, perform the following steps:
- Specify the parameters described in the following table.
Parameter Description Instance The information of the current instance is automatically populated. You can also select another instance from the drop-down list. Connection - To connect to an instance that resides in a VPC, use the public or private IP address of the instance.
- To connect to an instance that resides in the classic network, use the public or internal IP address of the instance.
Authentication - Select Credential-based.
- Select Create Credential from the Credential drop-down list.
- In the Add Credential dialog box, specify parameters described in the following table.
Parameter Description Credential Name Enter a name for the credential. Username Enter a username, such as root or ecs-user. Credential Type Select a credential type. Valid values: - Password: If you select this value, you must continue to enter a password for the authentication material.
- PrivateKey: If you select this value, you must continue to enter or upload a private key certificate. If the certificate is encrypted, enter the key passphrase of the certificate.
Material Name Enter a name for the authentication material. Password Enter a password to use for authentication. Fingerprint Fingerprint is automatically generated based on the password or key of the authentication material. - Optional:You can click Add Material to add more authentication materials. At least one authentication material must be retained for each credential.
- Click OK.
- In the Instance Login dialog box, select the credential that you created from the Credential drop-down list and click OK.
- Specify the parameters described in the following table.
- If credentials are present for the instance in Workbench, perform the following steps:
- Specify the parameters described in the following table.
Parameter Description Instance The information of the current instance is automatically populated. You can also select another instance from the drop-down list. Connection - To connect to an instance that resides in a VPC, use the public or private IP address of the instance.
- To connect to an instance that resides in the classic network, use the public or internal IP address of the instance.
Authentication Select an existing credential. You can modify or delete credentials based on your needs.
- Click OK.
- Specify the parameters described in the following table.
- If no credentials are present for the instance in Workbench, perform the following steps:
Add security group rules to allow Workbench access to a Windows instance
- If you want to connect to a Windows instance that resides in a VPC, find a security group of the instance, go to the Security Group Rules page, and then add a rule on the Inbound tab. The following table describes the parameters that you must configure for the rule.
Network interface controller (NIC) type Rule direction Action Protocol type Port Priority Authorization type Authorized object N/A Inbound Allow - If the default port 3389 is enabled on the Windows instance, select RDP (3389).
- If you have manually enabled other ports on the Windows instance, select Custom TCP.
- If the default port 3389 is enabled on the Windows instance, 3389/3389 is automatically entered after you select the protocol type.
- If you have manually enabled other ports on the Windows instance, enter a port range.
1 IPv4 CIDR Block - If you want to connect to the instance by using its public IP address, specify 161.117.90.22. The public IP address can be the public IP address that is automatically assigned to the instance or an elastic IP address (EIP) that is associated with the instance.
- If you want to connect to the instance by using its private IP address, specify 100.104.0.0/16.
Warning You can also specify 0.0.0.0/0 as the authorization object to allow inbound access from all IP addresses. However, this imposes security risks. Proceed with caution. - If you want to connect to a Windows instance located in the classic network over the Internet, find a security group of the instance, go to the Security Group Rules page, and then add a rule on the Internet Ingress tab. The following table describes the parameters that you must configure for the rule.
NIC type Rule direction Action Protocol type Port Priority Authorization type Authorized object Public Inbound Allow - If the default port 3389 is enabled on the Windows instance, select RDP (3389).
- If you have manually enabled other ports on the Windows instance, select Custom TCP.
- If the default port 3389 is enabled on the Windows instance, 3389/3389 is automatically entered after you select the protocol type.
- If you have manually enabled other ports on the Windows instance, enter a port range.
1 IPv4 CIDR Block If you want to connect to the instance by using its public IP address, specify 161.117.90.22. The public IP address can be the public IP address that is automatically assigned to the instance or an EIP that is associated with the instance. Warning You can also specify 0.0.0.0/0 as the authorization object to allow inbound access from all IP addresses. However, this imposes security risks. Proceed with caution. - If you want to connect to a Windows instance located in the classic network over the internal network, find a security group of the instance, go to the Security Group Rules page, and then add a rule on the Internal Network Ingress tab. The following table describes the parameters that you must configure for the rule.
NIC type Rule direction Action Protocol type Port Priority Authorization type Authorized object N/A Inbound Allow - If the default port 3389 is enabled on the Windows instance, select RDP (3389).
- If you have manually enabled other ports on the Windows instance, select Custom TCP.
- If the default port 3389 is enabled on the Windows instance, 3389/3389 is automatically entered after you select the protocol type.
- If you have manually enabled other ports on the Windows instance, enter a port range.
1 IPv4 CIDR Block If you want to connect to the instance by using its internal IP address, specify 161.117.90.22. Warning High security risks may arise if you specify 0.0.0.0/0 as the authorization object. We recommend that you do not specify 0.0.0.0/0.