Remote connection: ProxyClient - Platform For AI - Alibaba Cloud Documentation Center

Connect to a Data Science Workshop (DSW) instance over SSH from your local tools — VS Code or a terminal — using the ProxyClient tool. Unlike the Direct SSH method, ProxyClient routes all traffic through a PAI proxy server, so no Virtual Private Cloud (VPC) or NAT Gateway setup is required.

ProxyClient supports all DSW instance types, but the connection may be slower or less stable than Direct SSH, and may experience issues such as frequent reconnections and low speeds. If your instance supports Direct SSH (pay-as-you-go instances in a public resource group, or Lingjun instances), consider using Remote connection: Direct SSH instead.

Prerequisites

Before you begin, make sure you have:

A running DSW instance
An Alibaba Cloud AccessKey ID and AccessKey secret — see Create an AccessKey pair
The region ID of your DSW instance (for example, cn-shanghai for China (Shanghai)) — see Regions and zones
(If using a RAM user) The paidsw:GetToken permission granted to the RAM user — see Why does ProxyClient fail when using a RAM user's AccessKey? (see the FAQ section below) in the FAQ

Step 1: Download and install ProxyClient

Download the ProxyClient binary for your operating system and save it to your user home directory. Replace <username> with your actual username.

Operating system	Save to	Download
Linux (x86-64)	`/root` (root user) or `/home/<username>`	Download
macOS (x86-64)	`/Users/<username>`	Download
macOS (ARM64)	`/Users/<username>`	Download
Windows (x86-64)	`C:\Users\<username>\`	Download

On macOS or Linux, make the binary executable:
Important
On macOS, the first time you run ./proxyclient, you may see: "proxyclient" cannot be opened because the developer cannot be verified. To allow it, go to System Preferences > Security & Privacy and allow the application to run.
```
chmod 755 <proxyclient>
```
Replace <proxyclient> with the downloaded filename.

Generate the ProxyClient configuration file. Run the config command:

# macOS, Linux
./proxyclient config

# Windows
proxyclient.exe config

Follow the prompts to set the configuration file path. Press Enter to use the default path ~/.proxyclientconfig. To use a custom path, enter it now — for example, C:/Users/<username>/xxx/.proxyclientconfig on Windows. If you use a custom path, you must pass it with the -c or --config-file flag in Step 3.

Follow the prompts to set the required parameters.

Parameter	Description
`RegionId`	The region ID of your DSW instance, for example `cn-shanghai`. This must match the region where your instance is located.
`AccessKey ID`	Your Alibaba Cloud AccessKey ID.
`AccessKey Secret`	Your Alibaba Cloud AccessKey secret.
`STSToken`	Leave blank if you are using an Alibaba Cloud account or a RAM user. If you log in as a RAM role, enter a valid Security Token Service (STS) token. Make sure the token is not expired. To generate one, see Obtain an STS token.

Step 2: Configure SSH authentication

Choose one of the following authentication methods.

Important

For DSW instances in a dedicated resource group, click Save Image in the Actions column after completing authentication setup. This saves the public key or password to the instance image so it persists across restarts.

Method 1: SSH key pair (recommended)

On your local machine, generate an SSH key pair:
- Private key: ~/.ssh/id_rsa
- Public key: ~/.ssh/id_rsa.pub
```
ssh-keygen
```
Press Enter to accept the defaults. This creates: To use a custom filename (for example, example_id_rsa), enter it at the prompt. If you do, you must add an IdentityFile directive to ~/.ssh/config in Step 3.
Follow the prompts to set a passphrase and save it. You will need it when connecting.
In the DSW instance terminal, run:
```
wget https://dsw-resource.oss-cn-beijing.aliyuncs.com/tools/setup_ssh.sh
bash setup_ssh.sh
```
The setup_ssh.sh script downloads and installs the SSH server, then prompts you to configure your public key and start the server.

Method 2: Username and password

In the DSW instance terminal, set the root password:
```
passwd root
```
Open the SSH configuration file:
```
vi /etc/ssh/sshd_config
```
Change #PermitRootLogin prohibit-password to PermitRootLogin yes and save the file.
Restart the SSH server:
```
service ssh stop
service ssh start
```

Step 3: Add the DSW instance proxy

On the Instances page, find your instance and copy its instance ID.

Add the instance as an SSH proxy target:

# macOS, Linux
./proxyclient add -i=<instance ID>

# Windows
proxyclient.exe add -i=<instance ID>

Replace <instance ID> with the instance ID you copied.

Verify the SSH config was written:

# macOS, Linux
cat .ssh/config

# Windows — run from your user home directory, or double-click the file
explorer .ssh\config

(Optional) If you used a custom key filename in Step 2, add the IdentityFile directive to ~/.ssh/config:

Host dsw-b7a2765b267e****
    HostName dsw-b7a2765b267e****
    User root
    ProxyCommand ~/proxyclient connect --region-id=cn-hangzhou --instance-id=dsw-b7a2765b267e**** --config-file=***
    ServerAliveInterval 30
    IdentityFile ~/.ssh/example_id_rsa

Step 4: Connect to the DSW instance

Connect from a terminal

Run the following command to open an SSH session:

ssh <instance ID>

To transfer files between your local machine and the instance, use scp:

# Copy a local file to the instance
scp local_file_path root@<instance ID>:<remote_file_path>

# Copy a local directory to the instance
scp -r local_dir root@<instance ID>:<remote_dir>

# Copy a file from the instance to your local machine
scp root@<instance ID>:<remote_file_path> <local_file_path>

# Copy a directory from the instance to your local machine
scp -r root@<instance ID>:<remote_dir> <local_dir>

Connect from VS Code

Steps may vary by VS Code version. For more information, see the Visual Studio Code documentation.

Open VS Code and install the Remote - SSH extension.
In the left navigation pane, click .
Click the icon next to Remote Connection. Enter the DSW instance ID in the text box and press Enter.
Select the SSH config file to update.
In the Host added dialog in the bottom-right corner, click Connect.
Select Linux as the operating platform.
Enter your passphrase and press Enter. When VS Code displays a welcome page, the connection is established. Open a remote folder to start developing.
For subsequent connections, right-click the instance in the Remote explorer and choose your preferred connection method.

Tip: Your project files are in /mnt/workspace, not in /root (the default SSH landing directory). After connecting, go to File > Open Folder..., enter /mnt/workspace, and click OK.

FAQ

Why does ProxyClient fail when using a RAM user's AccessKey?

The RAM user must have the paidsw:GetToken permission. To grant it:

Create a custom policy with the following content:

{
   "Version": "1",
   "Statement": [
     {
       "Effect": "Allow",
       "Action": "paidsw:GetToken",
       "Resource": "*"
     }
   ]
}

On the RAM authorization page, attach the policy to the RAM user.

Why does my connection time out?

A timeout usually means the RegionId in your ProxyClient configuration file does not match the region of your DSW instance. Open ~/.proxyclientconfig and verify that RegionId exactly matches your instance's region (for example, cn-shanghai).

Can I create multiple users on a DSW instance for separate SSH logins?

No. DSW provides only the root user for SSH access by default. While you can create additional OS users manually, this is not an officially supported configuration.

How do I access my project files in VS Code after connecting?

Your project files are in /mnt/workspace. After connecting, go to File > Open Folder..., enter /mnt/workspace, and click OK.

What is the difference between Direct SSH and ProxyClient?

	Method A: Direct SSH (Recommended)	Method B: ProxyClient
Network requirements	Requires a VPC and a NAT Gateway	No additional network components required
Speed and stability	Faster, more stable connection	The connection may be slower or less stable
Supported instances	Pay-as-you-go DSW instances in a public resource group (spec cannot start with `ecs.ebm`), and Lingjun Intelligent Computing instances	All instance types
Authentication	Single-step authentication using an SSH key	Two-step: first authenticate with Alibaba Cloud AccessKey, then with an SSH key or password
Access path	Public internet (requires NAT Gateway + EIP) or internal VPC	Public internet only
Billing	The NAT Gateway and EIP incur charges as long as they exist, even if the DSW instance is stopped. Delete them if no longer needed.	No additional costs
Configuration guide	Remote connection: Direct SSH	Remote connection: ProxyClient

What's next

Remote connection: Direct SSH — a faster, more stable alternative for supported instance types that uses a NAT Gateway instead of a proxy server