This topic summarizes common configuration and usage issues and their solutions when you run third-party software on Elastic Compute Service (ECS) instances.
Remote connection issues with MySQL
What do I do if I can log on to MySQL locally on an ECS instance but fail to connect remotely with the error "1045 - Access denied for user 'root'@'****'(using password:YES)"?
Problem
After you install MySQL on an ECS instance, you can log on locally. However, when you try to connect to the MySQL database remotely using the same username and password, the connection fails. The error message "1045 - Access denied for user 'root'@'****'(using password:YES)" is returned, even though you have entered the correct username and password.

Cause
After you install MySQL on an ECS instance, it only allows local connections by default. The MySQL database is not authorized to accept remote logon attempts from other IP addresses.
Solution
Follow these steps to grant permissions to other IP addresses.
Connect to the ECS instance remotely.
For more information, see Connection methods.
Log on to the database and run the following SQL command to grant remote logon permissions to the MySQL database.
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;NoteAfter you run this command, the root user can log on to the database from any IP address and manage any object in any database.
The following table describes the SQL command parameters.
Parameter
Description
*.*
The first asterisk (*) is a placeholder for the database. An asterisk (*) indicates all databases. The second asterisk (*) is a placeholder for the database table. An asterisk (*) indicates all tables in the database.
'root'@'%'
root is the database account that is granted logon permissions. The percent sign (%) is a placeholder for the IP address. To restrict logon to a specific IP address, such as
1.1.1.1, replace%with1.1.1.1. A percent sign (%) allows logon from any IP address.Run the following SQL statement to flush the privileges.
flush privileges;Try to connect to the MySQL database remotely again. If the error message no longer appears, the issue is resolved.
What do I do if I fail to connect remotely to MySQL on a Linux ECS instance with the error "ERROR 2003 (HY000): Can't connect to MySQL server on '39.106.**.**' (110)"?
Problem
When a user connects remotely to MySQL on a Linux ECS instance, the connection fails with the error message "ERROR 2003 (HY000): Can't connect to MySQL server on '39.106.**.**' (110)".
Cause
The IP address 39.106.**.** might not have permission to access MySQL. This means that port 3306 is not listening on this IP address, which prevents remote connections to MySQL.
Solution
Log on to the Linux instance where MySQL is installed.
For more information, see Connect to a Linux instance using a password or key.
Run the following command to back up the
my.cnffile.cp my.cnf my.cnf.bakModify the
my.cnfconfiguration file.Run the following command to open the
my.cnffile.vim /etc/my.cnfPress the
ikey to enter edit mode and add the following content to themy.cnffile.bind-address = 0.0.0.0The following figure shows where to add the content.

After you add the content, press the
Esckey to exit edit mode. Then, enter:wqand press theEnterkey to save the file and exit.
Run the following command to restart the MySQL service and confirm that port 3306 is listening correctly.
/etc/init.d/mysqld restart
File upload failures
What do I do if a vsftp file upload to a Linux ECS instance fails with the error "553 Could not create file"?
Problem
A vsftp file upload to a Linux ECS instance fails with the error "553 Could not create file".
Cause
This issue may have the following causes:
The disk space on the Linux instance is full.
The FTP
homedirectory does not havewritepermissions.
Solution
Follow these steps to check the disk space on the Linux instance and the permissions of the FTP home directory.
Connect to the Linux instance remotely.
For more information, see Connect to a Linux instance using a password or key.
Run the following command to check if the disk space on the Linux instance is full, which can cause the upload to fail.
df -hNoteIf the disk space usage for a partition reaches 100%, the disk is full.
The system displays output similar to the following. For example, the usage of the
/dev/xvda1partition is 59%.
Run the following command to check if the FTP
homedirectory haswritepermissions.NoteBefore you run the following command, replace
/home/userwith the actual name of your FTPhomedirectory.ls -l /home/userIf the permissions shown in the red box in the following figure do not include
w, you do not havewritepermissions.
Run the following command to add
writepermissions.chmod +w /home/userExecute the following command. If the output contains
w, thewritepermission has been successfully added.ls -l /home/user
What do I do if an FTP upload to FileZilla Server on a Windows ECS instance fails with the error "550 Permission denied"?
Problem
When you upload a file over FTP to FileZilla Server on a Windows ECS instance, the error "550 Permission denied" is returned.

Cause
The corresponding FTP account in FileZilla Server does not have write permissions.
Solution
Connect to the Windows instance remotely.
For more information, see Connect to a Windows instance using a password or key.
Run the FileZilla Server software. On the Users page, select Shared folders.
Select the user and directory. Select the Write checkbox and click OK to complete the permission configuration.

AD domain controller installation failures
What do I do if the Active Directory Domain Services installation fails with the error "Installation of Active Directory Domain Services binaries failed"?
Problem
On a Windows ECS instance, the Active Directory (AD) domain controller installation fails with the error "Installation of Active Directory Domain Services binaries failed".

Cause
An error in Event Viewer shows that the Remote Registry service is disabled and cannot be started.
Solution
Follow these steps to start the Remote Registry service.
Connect to the Windows instance remotely.
For more information, see Connect to a Windows instance using a password or key.
Choose Start > Run, enter
services.msc, and then click OK.In the Services window, double-click
Remote Registryto open the Remote Registry Properties window and configure the following options.In the Startup type section, select Automatic.
In the Service status section, click Start to ensure the
Remote Registryservice starts correctly.
Click OK to save the settings.
What do I do if I receive the message "This computer has a dynamically assigned IP address" when installing an AD domain controller?
Problem
When you install an AD domain controller on a Windows ECS instance, the message "This computer has a dynamically assigned IP address" is returned.
Cause
At least one physical network adapter on the Windows ECS instance does not have a static IP address assigned to its IP properties.
Solution
Connect to the Windows instance remotely.
For more information, see Connect to a Windows instance using a password or key.
Install the AD domain controller. For more information, see Build a Windows AD domain on an ECS instance.
In the Static IP assignment dialog box that appears during the AD domain installation, click Yes.
The loopback adapter uses DHCP. You can continue the operation without assigning a static IP address.
What do I do if I receive the error code "0x0000232B RCODE_NAME_ERROR" when installing an AD domain controller?
Problem symptoms
When you install an AD domain controller on a Windows ECS instance, the error code "0x0000232B RCODE_NAME_ERROR" is returned.

Cause
This may be caused by an incorrect IP address configuration on the DNS server.
Solution
Follow these steps to change the DNS server for all public and private network interface controllers (NICs) on the slave server to the private endpoint of the master server.
Connect to the Windows instance remotely.
For more information, see Connect to a Windows instance using a password or key.
Open the Internet Protocol Version 4 (TCP/IPv4) Properties window, change the DNS server address, and then click OK.
NoteChange the DNS server address to the actual private endpoint of the master server.

Check if you can ping the IP address of the DNS server.

What do I do if I receive the error "The network path was not found" when installing an AD domain controller?
Problem
When you install an AD domain controller on a Windows ECS instance, the error "The network path was not found" is returned.

Cause
This issue may have the following causes:
The
TCP/IP NetBIOS HelperandRemote Registryservices are not started on the AD domain controller and the client.The DNS configuration on the client and the AD domain controller is incorrect.
There is a system ID (SID) conflict between the client and the AD domain controller.
The firewall or security software is blocking the connection.
Solution
Follow these steps to troubleshoot the issue.
Start the TCP/IP NetBIOS Helper and Remote Registry services
For more information, see the Solution section to start the TCP/IP NetBIOS Helper and Remote Registry services on the AD domain controller and the client.
Modify the client DNS configuration
For more information, see the Solution section to modify the client DNS configuration.
Modify the client SID
Follow these steps to modify the client SID.
Connect to the Windows instance remotely.
For more information, see Connect to a Windows instance using a password or key.
Download the PowerShell script to modify the client SID.
Download link: AutoSysprep.ps1
Script source: Alibaba Cloud official
Open Command Prompt and enter PowerShell to switch to the Windows PowerShell interface.
NoteIf your instance runs a 64-bit operating system, do not use the 32-bit version of PowerShell (that is, Windows PowerShell (x86)). Otherwise, an error occurs.
Switch to the directory where the script is stored and run the following command to view the script's help information.
.\AutoSysprep.ps1 -helpRun the following command to reinitialize the server's SID.
.\AutoSysprep.ps1 -ReserveHostname -ReserveNetwork -SkipRearm -PostAction "reboot"After the initialization is complete, the instance restarts. Note the following:
The method for obtaining the IP address changes from DHCP to a static IP address. Make sure this static IP address is the same as the IP address of the ECS instance before the setup. You can also change the method back to DHCP to automatically obtain the primary private IP address assigned to the ECS instance in the console.
NoteDo not change the primary private IP address of the ECS instance in the console. Otherwise, the IP address change will cause access exceptions.

After the SID is initialized, the ECS firewall configuration is changed to the Microsoft default configuration, which prevents the ECS instance from being pinged. You must turn off the firewall for guest or public networks, or allow traffic on the required ports. The following figure shows that the firewall for Guest or public networks is connected.

Open Control Panel to modify the firewall settings and turn off the firewall for guest or public networks.

After you turn it off, you can ping the server.

Allow the client through the firewall and other security software
For more information about how to allow the client to pass through, see Windows firewall policy configuration guide.
Errors when running the wget command
What do I do if I receive the error "command not found" when I run the wget command on a Linux ECS instance?
Problem
When you run the wget command on a Linux instance, the error "command not found" is returned. When you run the yum install wget command, the message "already installed and latest version" is returned.
Cause
A check of the /usr/bin directory shows that the wget command file does not exist, but a file named wge does. The error may be caused by the command file being renamed.
Solution
Follow these steps to resolve the issue.
Connect to the Linux instance remotely.
For more information, see Connect to a Linux instance using a password or key.
Run the following command to query the path of the
wgecommand.whereis wgeThe command returns the following output, which indicates that the path of the
wgecommand is/usr/bin/wge.wge: /usr/bin/wgeBased on the path, run the following command to rename the file.
cp /usr/bin/wge /usr/bin/wgetRun the
wgetcommand again. If the error message no longer appears, the issue is resolved.
What do I do if I receive the error "Permission denied" when using the wget command to download a file on a Linux ECS instance?
Symptoms
When you use the wget command to download a file on a Linux ECS instance, the following message is returned.
wget bash: /usr/bin/wget: Permission deniedCause
On the Linux ECS instance, the permissions for the wget command are set to 000, which means it has no read, write, or execute permissions.
Solution
Complete the following steps.
Connect to the Linux instance remotely.
For more information, see Connect to a Linux instance using a password or key.
Run the following command to view the permissions of the
wgetcommand.ls -l /usr/bin/wgetThe command returns the following output, which indicates that the permissions for the
wgetcommand are 000, with no read, write, or execute permissions.-------- 1 root root 366800 Oct 31 2014 /usr/bin/wgetRun the following command to view the attributes of the
/usr/bin/wgetdirectory.lsattr /usr/bin/wgetThe command returns the following output, which indicates that the
/usr/bin/wgetdirectory has theiattribute (files cannot be created or deleted in this directory).----i--------e- /usr/bin/wgetRun the following command to remove the
iattribute from the/usr/bin/wgetdirectory.chattr -i /usr/bin/wgetRun the following command to grant permissions to the
/usr/bin/wgetdirectory.chmod 755 /usr/bin/wgetRun the
wgetcommand again. If the error message no longer appears, the issue is resolved.
Issues connecting to the FTP service on an ECS instance
Windows instances
What do I do if I cannot connect to or access the FTP service on a Windows ECS instance from the Internet?
Problem
The FTP service that is set up on a Windows ECS instance cannot be connected to or accessed from the Internet.
Cause
This issue may have the following causes:
The security group rules do not allow FTP traffic: For more information, see Solution 1: Add security group rules for FTP.
The firewall is blocking the FTP process: For more information, see Solution 2: Configure FTP firewall support.
Solution
Choose one of the following solutions based on your needs.
Solution 1: Add security group rules for FTP
After you set up an FTP site on a Windows ECS instance, you must add inbound rules to the security group of the instance. These rules must allow traffic on port 21, which is required by the FTP server, and on ports in the range of 1024 to 65535, which may be used by the FTP server in passive mode. For more information, see Add a security group rule.
NoteFor more information about security group configurations, see Security group application guide and examples and Common ports.
Solution 2: Configure FTP firewall support
If your firewall is enabled, you must configure Internet Information Services (IIS) Manager to allow traffic on TCP port 21 and ports 1024 to 65535 for the FTP service. Follow these steps to configure the firewall.
NoteThe internal firewall of a Windows ECS instance is disabled by default.
This topic uses IIS Manager as an example to show how to configure FTP.
Connect to the Windows instance remotely.
For more information, see Connect to a Windows instance using a password or key.
Open IIS Manager, and then double-click FTP Firewall Support to open the configuration page.

Configure the parameters and click Apply.
NoteThe following table describes the parameters.
External IP Address of Firewall: Enter the public IP address of the Windows ECS instance.
Data Channel Port Range: Specify the port range for passive connections. The valid port range is 1025-65535. Set the range as needed. This topic uses ports 1024 to 65535 as an example.
Open the command line and run the following command to restart the FTP service. This ensures that the configuration of each FTP site is overwritten.
net stop ftpsvc&net start ftpsvc(Optional) If you can access the FTP server locally but not from another machine after configuration, the issue is caused by an incorrect firewall configuration. Follow these steps to configure the firewall:
First, check the inbound rules in Server Manager to make sure the FTP server is enabled.

Add the Windows Service host process.
Go to Control Panel > Windows Firewall, and then click Allow an app or feature through Windows Firewall in the pane on the left.
In the new window, click Allow another app. Browse to and open
C:\Windows\System32\svchost.exeto add the service host process.A new item named Windows Service Host Process appears. Select the checkboxes for Private and Public, and then click OK.

What do I do if I receive the error "530 Login incorrect" when connecting to an FTP server on a Windows ECS instance?
Problem
When you connect to an FTP server on a Windows ECS instance, the following error is returned.
Response: 331 Please specify the password. Command: PASS ************ Response: 530 Login incorrect. Error: Critical error: Could not connect to serverCause
This issue may have the following causes:
Incorrect FTP password: For more information, see Solution 1: Change the FTP password.
Incorrect FTP user permissions: For more information, see Solution 2: Add FTP user permissions.
Solution
Choose one of the following solutions based on your needs.
Solution 1: Change the FTP password
Connect to the Windows instance remotely.
For more information, see Connect to a Windows instance using a password or key.
Right-click Computer > Manage on the desktop to open Server Manager.
In the navigation pane on the left, choose Local Users and Groups > Users. Right-click the FTP account and choose Set Password.

Solution 2: Add FTP user permissions
Connect to the Windows instance remotely.
For more information, see Connect to a Windows instance using a password or key.
Check if the directory file for the FTP account exists.
If it does not exist: For more information, see Step 3: Set permissions for shared files to re-create the FTP file and add the required permissions.
If it exists: Right-click the folder, choose Properties > Security, and select the FTP account to add the required permissions.

What do I do if I receive the error "530 valid hostname is expected" when connecting to an FTP server on a Windows ECS instance?
Symptoms
After you bind a domain name to an FTP site configured with IIS 7.5, connecting to the FTP server on the Windows ECS instance using an IP address or other methods returns the error "530 valid hostname is expected" or "503 Login with USER first".
Cause
After you bind a domain name to an FTP site configured with IIS 7.5, the domain name format entered during FTP logon is incorrect.
Solution
If the domain name bound to the FTP site is
www.example.comand the username isuser, you must usewww.example.com|userto log on.NoteUse a vertical bar (|) as the separator.
You can also remove the domain name binding and log on directly with the username. The following figure shows how to do this.

What do I do if an FTP upload to FileZilla Server on a Windows ECS instance fails with the error "550 Permission denied"?
Problem
When you upload a file over FTP to FileZilla Server on a Windows ECS instance, the error "550 Permission denied" is returned.

Cause
The corresponding FTP account in FileZilla Server does not have
writepermissions.Solution
Connect to the Windows instance remotely.
For more information, see Connect to a Windows instance using a password or key.
Run the FileZilla Server software. On the Users page, select Shared folders.
Select the user and directory. Select the Write checkbox and click OK to complete the permission configuration.

How do I handle the "534 Policy requires SSL" message when connecting to an FTP site created by the IIS service on a Windows instance using FTP over TLS?
Problem description
When you connect to an FTP site created by the IIS service on a Windows instance using FTP over TLS, the message "534 Policy requires SSL" is returned, and you cannot connect to the FTP site.
The following is an example of the error:

Cause
The response message "534 Local policy on server does not allow TLS secure connections." indicates that the FTP SSL Settings parameter for the FTP site is incorrect.
Solution
Connect to the Windows instance remotely.
For more information, see Connection methods.
In the lower-left corner of the desktop, choose
> Windows Administrative Tools > Internet Information Services (IIS) Manager.
On the FTP homepage, in the FTP section, double-click FTP SSL Settings.

In the FTP SSL Settings section, set SSL Policy to Allow SSL connections. Then, in the Actions column, click Apply.

Access the FTP site again.
Linux instances
What do I do if I receive the error "425 Security:Bad IP connection" when uploading a file to an FTP site on a Linux ECS instance?
Symptoms
When a user uploads a file to an FTP site on a Linux ECS instance, the error "425 Security:Bad IP connection" is returned.
Cause
This issue usually occurs because the client is in a NAT network that is associated with more than one public IP address. This causes the source IP address to be different for the two connections, resulting in an error.
NoteThe FTP service has two connections: a control connection and a data connection. By default, the FTP server checks if the source IP addresses of the two connections are the same during data transfer. If they are not the same, the error "425 Security:Bad IP connection" is returned.
Solution
Follow these steps to disable the IP security check in passive mode.
Connect to the Linux instance remotely.
For more information, see Connect to a Linux instance using a password or key.
Run the following command to edit the FTP configuration file.
vi /etc/vsftpd/vsftpd.confPress the
ikey to enter edit mode and add the following content to the configuration file.pasv_promiscuous=yesAfter editing, press the
Esckey to exit edit mode. Then, enter:wqand press the Enter key to save and exit.Run the following command to restart the FTP service.
systemctl restart vsftpd
What do I do if a vsftp file upload to a Linux ECS instance fails with the error "553 Could not create file"?
Symptoms
A vsftp file upload to a Linux ECS instance fails with the error "553 Could not create file".
Cause
This issue may have the following causes:
The disk space on the Linux instance is full.
The FTP
homedirectory does not havewritepermissions.
Solution
Follow these steps to check the disk space on the Linux instance and the permissions of the FTP
homedirectory.Connect to the Linux instance remotely.
For more information, see Connect to a Linux instance using a password or key.
Run the following command to check if the disk space on the Linux instance is full, which can cause the upload to fail.
df -hNoteIf the disk space usage for a partition reaches 100%, the disk is full.
The system displays output similar to the following. For example, the usage of the
/dev/xvda1partition is 59%.
Run the following command to check if the FTP
homedirectory haswritepermissions.NoteBefore you run the following command, replace
/home/userwith the actual name of your FTPhomedirectory.ls -l /home/userIf the permissions shown in the red box in the following figure do not include
w, you do not havewritepermissions.
Run the following command to add
writepermissions.chmod +w /home/userRun the following command. If
wappears in the command output, write permissions were added successfully.ls -l /home/user
Other issues
What do I do if the WeChat Official Accounts Platform token verification fails on an ECS instance?
Problem
The WeChat Official Accounts Platform token verification fails on an ECS instance.

Cause
Common causes are as follows:
Editing a file with certain applications, such as Notepad or an online editor, can add a UTF-8 BOM signature to the file.
If security software such as Safedog or Security Center is installed on the ECS instance, it may block requests from Tencent's servers.
Using a temporary domain name for verification on a virtual host causes the system to block the request. This applies to HiChina virtual hosts.
The PHP file contains a line break or other characters after the closing tag.
Other debugging and verification methods were used.
There is an exception with the program's Gzip encryption.
Solution
The following are the recommended solutions for the common causes:
Unsupported file editors, such as Notepad or online editors
Use an advanced editor to remove the BOM.
Safedog or Security Center is installed on the ECS instance
We recommend uninstalling Safedog or adding Security Center to the whitelist.
A temporary domain name is used for verification on a virtual host
Use a formal domain name that has completed its ICP filing with Alibaba Cloud for the verification.
The PHP file contains a line break or other characters after the closing tag
Remove the extra characters.
Other debugging and verification methods were used
Run the
curl http://xxx/index.php/api/xxcommand to debug and verify. This simulates a WeChat API request for analysis.Program Gzip encryption anomaly
Temporarily disable the program's Gzip feature for testing and troubleshooting.
What do I do if Chinese characters are garbled on a Linux ECS instance?
Problem
When you connect remotely to a Linux ECS instance from Alibaba Cloud using a third-party Secure Shell Protocol (SSH) client, Chinese characters are garbled.

Cause
This issue may have the following causes:
The Linux system does not have Chinese fonts installed: By default, the Linux system language does not support Chinese characters. You must install a Chinese language pack to enable support. To fix this, see Solution 1: Install the Chinese language pack on the Linux system.
There is an issue with the character set settings of the third-party SSH client tool. To fix this, see Solution 2: Modify the character set settings of the third-party SSH client tool.
Solution
Choose the appropriate solution based on your needs.
Solution 1: Install the Chinese language pack on the Linux ECS instance
The following steps use CentOS 7.8 as an example. For other versions of CentOS or other distributions such as Red Hat, Debian, or Ubuntu, see their official documentation for the corresponding configurations and commands.
Connect to the Linux instance remotely.
For more information, see Connect to a Windows instance using a password or key.
Run the following command to check the current system language.
echo $LANGNoteIf the language is English, proceed to step 3.
If the language is Chinese, the Chinese language pack is already installed on the Linux ECS instance. This means the garbled text is not caused by missing Chinese fonts. In this case, see Solution 2: Modify the character set settings of the third-party SSH client tool.
Run the following command to check if the Chinese language pack is installed on the system.
locale -a | grep "zh_CN"The system displays output similar to the following. zh stands for Chinese, CN stands for China, and gb18030, gb2312, gbk, and utf8 are character sets.
zh_CN zh_CN.gb18030 zh_CN.gb2312 zh_CN.gbk zh_CN.utf8If the Chinese language pack is not installed, run the following command to install it.
sudo yum groupinstall "fonts"Run the following command to edit the
/etc/locale.confconfiguration file.vim /etc/locale.confPress the
ikey to switch to edit mode. ChangeLANG=en_US.UTF-8toLANG=zh_CN.UTF-8to set the current system language to Chinese.After you make the change, press the
Esckey, enter:wq, and press Enter to save and close the configuration file.
Run the following command to apply the configuration.
source /etc/locale.confRun the following command to restart the server.
reboot(Optional) If the system language is still English after the server restarts, run the following command to edit the
/etc/profile.d/lang.shconfiguration file.vim /etc/profile.d/lang.shPress the
ikey to switch to edit mode. Changezh*) LANG=en_US.UTF-8tozh*) LANG=zh_CN.UTF-8. The modified content is shown in the following figure.
After you make the change, press the
Esckey, enter:wq, and press Enter to save and close the configuration file.Run the following command to restart the server.
reboot
Solution 2: Modify the character set settings of the third-party SSH client tool
The following steps use the XShell client as an example to show how to modify the client's character set settings.
Open the XShell client.
On the XShell client page, set Default Language to Unicode (UTF-8).

Log on to the instance again. If the error no longer appears, the issue is resolved.




















