Other ECS issues

更新时间:
复制 MD 格式

This topic summarizes common configuration and usage issues and their solutions when you run third-party software on Elastic Compute Service (ECS) instances.

Remote connection issues with MySQL

What do I do if I can log on to MySQL locally on an ECS instance but fail to connect remotely with the error "1045 - Access denied for user 'root'@'****'(using password:YES)"?

Problem

After you install MySQL on an ECS instance, you can log on locally. However, when you try to connect to the MySQL database remotely using the same username and password, the connection fails. The error message "1045 - Access denied for user 'root'@'****'(using password:YES)" is returned, even though you have entered the correct username and password.

Cause

After you install MySQL on an ECS instance, it only allows local connections by default. The MySQL database is not authorized to accept remote logon attempts from other IP addresses.

Solution

Follow these steps to grant permissions to other IP addresses.

  1. Connect to the ECS instance remotely.

    For more information, see Connection methods.

  2. Log on to the database and run the following SQL command to grant remote logon permissions to the MySQL database.

    GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION;
    Note

    After you run this command, the root user can log on to the database from any IP address and manage any object in any database.

    The following table describes the SQL command parameters.

    Parameter

    Description

    *.*

    The first asterisk (*) is a placeholder for the database. An asterisk (*) indicates all databases. The second asterisk (*) is a placeholder for the database table. An asterisk (*) indicates all tables in the database.

    'root'@'%'

    root is the database account that is granted logon permissions. The percent sign (%) is a placeholder for the IP address. To restrict logon to a specific IP address, such as 1.1.1.1, replace % with 1.1.1.1. A percent sign (%) allows logon from any IP address.

  3. Run the following SQL statement to flush the privileges.

    flush privileges;
  4. Try to connect to the MySQL database remotely again. If the error message no longer appears, the issue is resolved.

What do I do if I fail to connect remotely to MySQL on a Linux ECS instance with the error "ERROR 2003 (HY000): Can't connect to MySQL server on '39.106.**.**' (110)"?

Problem

When a user connects remotely to MySQL on a Linux ECS instance, the connection fails with the error message "ERROR 2003 (HY000): Can't connect to MySQL server on '39.106.**.**' (110)".

Cause

The IP address 39.106.**.** might not have permission to access MySQL. This means that port 3306 is not listening on this IP address, which prevents remote connections to MySQL.

Solution

  1. Log on to the Linux instance where MySQL is installed.

    For more information, see Connect to a Linux instance using a password or key.

  2. Run the following command to back up the my.cnf file.

    cp my.cnf my.cnf.bak
  3. Modify the my.cnf configuration file.

    1. Run the following command to open the my.cnf file.

      vim /etc/my.cnf
    2. Press the i key to enter edit mode and add the following content to the my.cnf file.

      bind-address = 0.0.0.0

      The following figure shows where to add the content.

    3. After you add the content, press the Esc key to exit edit mode. Then, enter :wq and press the Enter key to save the file and exit.

  4. Run the following command to restart the MySQL service and confirm that port 3306 is listening correctly.

    /etc/init.d/mysqld restart

File upload failures

What do I do if a vsftp file upload to a Linux ECS instance fails with the error "553 Could not create file"?

Problem

A vsftp file upload to a Linux ECS instance fails with the error "553 Could not create file".

Cause

This issue may have the following causes:

  • The disk space on the Linux instance is full.

  • The FTP home directory does not have write permissions.

Solution

Follow these steps to check the disk space on the Linux instance and the permissions of the FTP home directory.

  1. Connect to the Linux instance remotely.

    For more information, see Connect to a Linux instance using a password or key.

  2. Run the following command to check if the disk space on the Linux instance is full, which can cause the upload to fail.

    df -h
    Note

    If the disk space usage for a partition reaches 100%, the disk is full.

    The system displays output similar to the following. For example, the usage of the /dev/xvda1 partition is 59%.

  3. Run the following command to check if the FTP home directory has write permissions.

    Note

    Before you run the following command, replace /home/user with the actual name of your FTP home directory.

    ls -l /home/user

    If the permissions shown in the red box in the following figure do not include w, you do not have write permissions.

    1111

  4. Run the following command to add write permissions.

    chmod +w /home/user
  5. Execute the following command. If the output contains w, the write permission has been successfully added.

    ls -l /home/user

What do I do if an FTP upload to FileZilla Server on a Windows ECS instance fails with the error "550 Permission denied"?

Problem

When you upload a file over FTP to FileZilla Server on a Windows ECS instance, the error "550 Permission denied" is returned.

Cause

The corresponding FTP account in FileZilla Server does not have write permissions.

Solution

  1. Connect to the Windows instance remotely.

    For more information, see Connect to a Windows instance using a password or key.

  2. Run the FileZilla Server software. On the Users page, select Shared folders.

  3. Select the user and directory. Select the Write checkbox and click OK to complete the permission configuration.

AD domain controller installation failures

What do I do if the Active Directory Domain Services installation fails with the error "Installation of Active Directory Domain Services binaries failed"?

Problem

On a Windows ECS instance, the Active Directory (AD) domain controller installation fails with the error "Installation of Active Directory Domain Services binaries failed".

1.png

Cause

An error in Event Viewer shows that the Remote Registry service is disabled and cannot be started.

Solution

Follow these steps to start the Remote Registry service.

  1. Connect to the Windows instance remotely.

    For more information, see Connect to a Windows instance using a password or key.

  2. Choose Start > Run, enter services.msc, and then click OK.

  3. In the Services window, double-click Remote Registry to open the Remote Registry Properties window and configure the following options.

    • In the Startup type section, select Automatic.

    • In the Service status section, click Start to ensure the Remote Registry service starts correctly.

      2023-03-15_11-32-02

  4. Click OK to save the settings.

What do I do if I receive the message "This computer has a dynamically assigned IP address" when installing an AD domain controller?

Problem

When you install an AD domain controller on a Windows ECS instance, the message "This computer has a dynamically assigned IP address" is returned.

1.png

Cause

At least one physical network adapter on the Windows ECS instance does not have a static IP address assigned to its IP properties.

Solution

  1. Connect to the Windows instance remotely.

    For more information, see Connect to a Windows instance using a password or key.

  2. Install the AD domain controller. For more information, see Build a Windows AD domain on an ECS instance.

  3. In the Static IP assignment dialog box that appears during the AD domain installation, click Yes.

Note

The loopback adapter uses DHCP. You can continue the operation without assigning a static IP address.

What do I do if I receive the error code "0x0000232B RCODE_NAME_ERROR" when installing an AD domain controller?

Problem symptoms

When you install an AD domain controller on a Windows ECS instance, the error code "0x0000232B RCODE_NAME_ERROR" is returned.

Cause

This may be caused by an incorrect IP address configuration on the DNS server.

Solution

Follow these steps to change the DNS server for all public and private network interface controllers (NICs) on the slave server to the private endpoint of the master server.

  1. Connect to the Windows instance remotely.

    For more information, see Connect to a Windows instance using a password or key.

  2. Open the Internet Protocol Version 4 (TCP/IPv4) Properties window, change the DNS server address, and then click OK.

    Note

    Change the DNS server address to the actual private endpoint of the master server.

    p13294

  3. Check if you can ping the IP address of the DNS server.

    adda

What do I do if I receive the error "The network path was not found" when installing an AD domain controller?

Problem

When you install an AD domain controller on a Windows ECS instance, the error "The network path was not found" is returned.

Cause

This issue may have the following causes:

  • The TCP/IP NetBIOS Helper and Remote Registry services are not started on the AD domain controller and the client.

  • The DNS configuration on the client and the AD domain controller is incorrect.

  • There is a system ID (SID) conflict between the client and the AD domain controller.

  • The firewall or security software is blocking the connection.

Solution

Follow these steps to troubleshoot the issue.

  • Start the TCP/IP NetBIOS Helper and Remote Registry services

    For more information, see the Solution section to start the TCP/IP NetBIOS Helper and Remote Registry services on the AD domain controller and the client.

  • Modify the client DNS configuration

    For more information, see the Solution section to modify the client DNS configuration.

  • Modify the client SID

    Follow these steps to modify the client SID.

    1. Connect to the Windows instance remotely.

      For more information, see Connect to a Windows instance using a password or key.

    2. Download the PowerShell script to modify the client SID.

    3. Open Command Prompt and enter PowerShell to switch to the Windows PowerShell interface.

      Note

      If your instance runs a 64-bit operating system, do not use the 32-bit version of PowerShell (that is, Windows PowerShell (x86)). Otherwise, an error occurs.

    4. Switch to the directory where the script is stored and run the following command to view the script's help information.

      .\AutoSysprep.ps1 -help
    5. Run the following command to reinitialize the server's SID.

      .\AutoSysprep.ps1 -ReserveHostname -ReserveNetwork -SkipRearm -PostAction "reboot"

      After the initialization is complete, the instance restarts. Note the following:

      • The method for obtaining the IP address changes from DHCP to a static IP address. Make sure this static IP address is the same as the IP address of the ECS instance before the setup. You can also change the method back to DHCP to automatically obtain the primary private IP address assigned to the ECS instance in the console.

        Note

        Do not change the primary private IP address of the ECS instance in the console. Otherwise, the IP address change will cause access exceptions.

        重新改成DHCP

      • After the SID is initialized, the ECS firewall configuration is changed to the Microsoft default configuration, which prevents the ECS instance from being pinged. You must turn off the firewall for guest or public networks, or allow traffic on the required ports. The following figure shows that the firewall for Guest or public networks is connected.来宾或公用网络

    6. Open Control Panel to modify the firewall settings and turn off the firewall for guest or public networks.

      关闭来宾或公用网络防火墙

      After you turn it off, you can ping the server.PING通服务器示意图

  • Allow the client through the firewall and other security software

    For more information about how to allow the client to pass through, see Windows firewall policy configuration guide.

Errors when running the wget command

What do I do if I receive the error "command not found" when I run the wget command on a Linux ECS instance?

Problem

When you run the wget command on a Linux instance, the error "command not found" is returned. When you run the yum install wget command, the message "already installed and latest version" is returned.

Cause

A check of the /usr/bin directory shows that the wget command file does not exist, but a file named wge does. The error may be caused by the command file being renamed.

Solution

Follow these steps to resolve the issue.

  1. Connect to the Linux instance remotely.

    For more information, see Connect to a Linux instance using a password or key.

  2. Run the following command to query the path of the wge command.

    whereis wge

    The command returns the following output, which indicates that the path of the wge command is /usr/bin/wge.

    wge: /usr/bin/wge
  3. Based on the path, run the following command to rename the file.

    cp /usr/bin/wge /usr/bin/wget
  4. Run the wget command again. If the error message no longer appears, the issue is resolved.

What do I do if I receive the error "Permission denied" when using the wget command to download a file on a Linux ECS instance?

Symptoms

When you use the wget command to download a file on a Linux ECS instance, the following message is returned.

wget bash: /usr/bin/wget: Permission denied

Cause

On the Linux ECS instance, the permissions for the wget command are set to 000, which means it has no read, write, or execute permissions.

Solution

Complete the following steps.

  1. Connect to the Linux instance remotely.

    For more information, see Connect to a Linux instance using a password or key.

  2. Run the following command to view the permissions of the wget command.

    ls -l /usr/bin/wget

    The command returns the following output, which indicates that the permissions for the wget command are 000, with no read, write, or execute permissions.

    -------- 1 root root 366800 Oct 31 2014 /usr/bin/wget
  3. Run the following command to view the attributes of the /usr/bin/wget directory.

    lsattr /usr/bin/wget

    The command returns the following output, which indicates that the /usr/bin/wget directory has the i attribute (files cannot be created or deleted in this directory).

    ----i--------e- /usr/bin/wget
  4. Run the following command to remove the i attribute from the /usr/bin/wget directory.

    chattr -i /usr/bin/wget
  5. Run the following command to grant permissions to the /usr/bin/wget directory.

    chmod 755 /usr/bin/wget 
  6. Run the wget command again. If the error message no longer appears, the issue is resolved.

Issues connecting to the FTP service on an ECS instance

  • Windows instances

    What do I do if I cannot connect to or access the FTP service on a Windows ECS instance from the Internet?

    Problem

    The FTP service that is set up on a Windows ECS instance cannot be connected to or accessed from the Internet.

    Cause

    This issue may have the following causes:

    Solution

    Choose one of the following solutions based on your needs.

    Solution 1: Add security group rules for FTP

    After you set up an FTP site on a Windows ECS instance, you must add inbound rules to the security group of the instance. These rules must allow traffic on port 21, which is required by the FTP server, and on ports in the range of 1024 to 65535, which may be used by the FTP server in passive mode. For more information, see Add a security group rule.

    Note

    For more information about security group configurations, see Security group application guide and examples and Common ports.

    Solution 2: Configure FTP firewall support

    If your firewall is enabled, you must configure Internet Information Services (IIS) Manager to allow traffic on TCP port 21 and ports 1024 to 65535 for the FTP service. Follow these steps to configure the firewall.

    Note
    • The internal firewall of a Windows ECS instance is disabled by default.

    • This topic uses IIS Manager as an example to show how to configure FTP.

    1. Connect to the Windows instance remotely.

      For more information, see Connect to a Windows instance using a password or key.

    2. Open IIS Manager, and then double-click FTP Firewall Support to open the configuration page.

      image

    3. Configure the parameters and click Apply.

      image

      Note

      The following table describes the parameters.

      • External IP Address of Firewall: Enter the public IP address of the Windows ECS instance.

      • Data Channel Port Range: Specify the port range for passive connections. The valid port range is 1025-65535. Set the range as needed. This topic uses ports 1024 to 65535 as an example.

    4. Open the command line and run the following command to restart the FTP service. This ensures that the configuration of each FTP site is overwritten.

      net stop ftpsvc&net start ftpsvc
    5. (Optional) If you can access the FTP server locally but not from another machine after configuration, the issue is caused by an incorrect firewall configuration. Follow these steps to configure the firewall:

      1. First, check the inbound rules in Server Manager to make sure the FTP server is enabled.

      2. Add the Windows Service host process.

        1. Go to Control Panel > Windows Firewall, and then click Allow an app or feature through Windows Firewall in the pane on the left.

        2. In the new window, click Allow another app. Browse to and open C:\Windows\System32\svchost.exe to add the service host process.

        3. A new item named Windows Service Host Process appears. Select the checkboxes for Private and Public, and then click OK.

    What do I do if I receive the error "530 Login incorrect" when connecting to an FTP server on a Windows ECS instance?

    Problem

    When you connect to an FTP server on a Windows ECS instance, the following error is returned.

    Response: 331 Please specify the password.
    Command: PASS ************
    Response: 530 Login incorrect.
    Error: Critical error: Could not connect to server

    Cause

    This issue may have the following causes:

    Solution

    Choose one of the following solutions based on your needs.

    Solution 1: Change the FTP password

    1. Connect to the Windows instance remotely.

      For more information, see Connect to a Windows instance using a password or key.

    2. Right-click Computer > Manage on the desktop to open Server Manager.

    3. In the navigation pane on the left, choose Local Users and Groups > Users. Right-click the FTP account and choose Set Password.

      image

    Solution 2: Add FTP user permissions

    1. Connect to the Windows instance remotely.

      For more information, see Connect to a Windows instance using a password or key.

    2. Check if the directory file for the FTP account exists.

      1. If it does not exist: For more information, see Step 3: Set permissions for shared files to re-create the FTP file and add the required permissions.

      2. If it exists: Right-click the folder, choose Properties > Security, and select the FTP account to add the required permissions.

        image

    What do I do if I receive the error "530 valid hostname is expected" when connecting to an FTP server on a Windows ECS instance?

    Symptoms

    After you bind a domain name to an FTP site configured with IIS 7.5, connecting to the FTP server on the Windows ECS instance using an IP address or other methods returns the error "530 valid hostname is expected" or "503 Login with USER first".

    Cause

    After you bind a domain name to an FTP site configured with IIS 7.5, the domain name format entered during FTP logon is incorrect.

    Solution

    If the domain name bound to the FTP site is www.example.com and the username is user, you must use www.example.com|user to log on.

    Note
    • Use a vertical bar (|) as the separator.

    • You can also remove the domain name binding and log on directly with the username. The following figure shows how to do this.

    image

    What do I do if an FTP upload to FileZilla Server on a Windows ECS instance fails with the error "550 Permission denied"?

    Problem

    When you upload a file over FTP to FileZilla Server on a Windows ECS instance, the error "550 Permission denied" is returned.

    Cause

    The corresponding FTP account in FileZilla Server does not have write permissions.

    Solution

    1. Connect to the Windows instance remotely.

      For more information, see Connect to a Windows instance using a password or key.

    2. Run the FileZilla Server software. On the Users page, select Shared folders.

    3. Select the user and directory. Select the Write checkbox and click OK to complete the permission configuration.

    How do I handle the "534 Policy requires SSL" message when connecting to an FTP site created by the IIS service on a Windows instance using FTP over TLS?

    Problem description

    When you connect to an FTP site created by the IIS service on a Windows instance using FTP over TLS, the message "534 Policy requires SSL" is returned, and you cannot connect to the FTP site.

    The following is an example of the error:

    报错信息原图新

    Cause

    The response message "534 Local policy on server does not allow TLS secure connections." indicates that the FTP SSL Settings parameter for the FTP site is incorrect.

    Solution

    1. Connect to the Windows instance remotely.

      For more information, see Connection methods.

    2. In the lower-left corner of the desktop, choose 开始图标 > Windows Administrative Tools > Internet Information Services (IIS) Manager.打开IIS新

    3. On the FTP homepage, in the FTP section, double-click FTP SSL Settings. FTP主页新图

    4. In the FTP SSL Settings section, set SSL Policy to Allow SSL connections. Then, in the Actions column, click Apply. 勾选SSL连接新图

    5. Access the FTP site again.

  • Linux instances

    What do I do if I receive the error "425 Security:Bad IP connection" when uploading a file to an FTP site on a Linux ECS instance?

    Symptoms

    When a user uploads a file to an FTP site on a Linux ECS instance, the error "425 Security:Bad IP connection" is returned.

    Cause

    This issue usually occurs because the client is in a NAT network that is associated with more than one public IP address. This causes the source IP address to be different for the two connections, resulting in an error.

    Note

    The FTP service has two connections: a control connection and a data connection. By default, the FTP server checks if the source IP addresses of the two connections are the same during data transfer. If they are not the same, the error "425 Security:Bad IP connection" is returned.

    Solution

    Follow these steps to disable the IP security check in passive mode.

    1. Connect to the Linux instance remotely.

      For more information, see Connect to a Linux instance using a password or key.

    2. Run the following command to edit the FTP configuration file.

      vi /etc/vsftpd/vsftpd.conf
    3. Press the i key to enter edit mode and add the following content to the configuration file.

      pasv_promiscuous=yes
    4. After editing, press the Esc key to exit edit mode. Then, enter :wq and press the Enter key to save and exit.

    5. Run the following command to restart the FTP service.

      systemctl restart vsftpd

    What do I do if a vsftp file upload to a Linux ECS instance fails with the error "553 Could not create file"?

    Symptoms

    A vsftp file upload to a Linux ECS instance fails with the error "553 Could not create file".

    Cause

    This issue may have the following causes:

    • The disk space on the Linux instance is full.

    • The FTP home directory does not have write permissions.

    Solution

    Follow these steps to check the disk space on the Linux instance and the permissions of the FTP home directory.

    1. Connect to the Linux instance remotely.

      For more information, see Connect to a Linux instance using a password or key.

    2. Run the following command to check if the disk space on the Linux instance is full, which can cause the upload to fail.

      df -h
      Note

      If the disk space usage for a partition reaches 100%, the disk is full.

      The system displays output similar to the following. For example, the usage of the /dev/xvda1 partition is 59%.

    3. Run the following command to check if the FTP home directory has write permissions.

      Note

      Before you run the following command, replace /home/user with the actual name of your FTP home directory.

      ls -l /home/user

      If the permissions shown in the red box in the following figure do not include w, you do not have write permissions.

      1111

    4. Run the following command to add write permissions.

      chmod +w /home/user
    5. Run the following command. If w appears in the command output, write permissions were added successfully.

      ls -l /home/user

Other issues

What do I do if the WeChat Official Accounts Platform token verification fails on an ECS instance?

Problem

The WeChat Official Accounts Platform token verification fails on an ECS instance.

Cause

Common causes are as follows:

  • Editing a file with certain applications, such as Notepad or an online editor, can add a UTF-8 BOM signature to the file.

  • If security software such as Safedog or Security Center is installed on the ECS instance, it may block requests from Tencent's servers.

  • Using a temporary domain name for verification on a virtual host causes the system to block the request. This applies to HiChina virtual hosts.

  • The PHP file contains a line break or other characters after the closing tag.

  • Other debugging and verification methods were used.

  • There is an exception with the program's Gzip encryption.

Solution

The following are the recommended solutions for the common causes:

  • Unsupported file editors, such as Notepad or online editors

    Use an advanced editor to remove the BOM.

  • Safedog or Security Center is installed on the ECS instance

    We recommend uninstalling Safedog or adding Security Center to the whitelist.

  • A temporary domain name is used for verification on a virtual host

    Use a formal domain name that has completed its ICP filing with Alibaba Cloud for the verification.

  • The PHP file contains a line break or other characters after the closing tag

    Remove the extra characters.

  • Other debugging and verification methods were used

    Run the curl http://xxx/index.php/api/xx command to debug and verify. This simulates a WeChat API request for analysis.

  • Program Gzip encryption anomaly

    Temporarily disable the program's Gzip feature for testing and troubleshooting.

What do I do if Chinese characters are garbled on a Linux ECS instance?

Problem

When you connect remotely to a Linux ECS instance from Alibaba Cloud using a third-party Secure Shell Protocol (SSH) client, Chinese characters are garbled.

Cause

This issue may have the following causes:

Solution

Choose the appropriate solution based on your needs.

Solution 1: Install the Chinese language pack on the Linux ECS instance

The following steps use CentOS 7.8 as an example. For other versions of CentOS or other distributions such as Red Hat, Debian, or Ubuntu, see their official documentation for the corresponding configurations and commands.

  1. Connect to the Linux instance remotely.

    For more information, see Connect to a Windows instance using a password or key.

  2. Run the following command to check the current system language.

    echo $LANG
    Note
  3. Run the following command to check if the Chinese language pack is installed on the system.

    locale -a | grep "zh_CN"

    The system displays output similar to the following. zh stands for Chinese, CN stands for China, and gb18030, gb2312, gbk, and utf8 are character sets.

    zh_CN
    zh_CN.gb18030
    zh_CN.gb2312
    zh_CN.gbk
    zh_CN.utf8

    If the Chinese language pack is not installed, run the following command to install it.

    sudo yum groupinstall "fonts"
  4. Run the following command to edit the /etc/locale.conf configuration file.

    vim /etc/locale.conf
    1. Press the i key to switch to edit mode. Change LANG=en_US.UTF-8 to LANG=zh_CN.UTF-8 to set the current system language to Chinese.

    2. After you make the change, press the Esc key, enter :wq, and press Enter to save and close the configuration file.

  5. Run the following command to apply the configuration.

    source /etc/locale.conf
  6. Run the following command to restart the server.

    reboot
  7. (Optional) If the system language is still English after the server restarts, run the following command to edit the /etc/profile.d/lang.sh configuration file.

    vim /etc/profile.d/lang.sh
    1. Press the i key to switch to edit mode. Change zh*) LANG=en_US.UTF-8 to zh*) LANG=zh_CN.UTF-8. The modified content is shown in the following figure.Dingtalk_20210709104253.jpg

    2. After you make the change, press the Esc key, enter :wq, and press Enter to save and close the configuration file.

    3. Run the following command to restart the server.

      reboot

Solution 2: Modify the character set settings of the third-party SSH client tool

The following steps use the XShell client as an example to show how to modify the client's character set settings.

  1. Open the XShell client.

  2. On the XShell client page, set Default Language to Unicode (UTF-8).

  3. Log on to the instance again. If the error no longer appears, the issue is resolved.