Frequently asked questions about remote connections to Simple Application Server instances-Simple Application Server(SAS)-阿里云帮助中心

Troubleshooting

If you cannot remotely connect to a Simple Application Server instance, use the following troubleshooting steps. The potential causes are listed by probability from high to low. If one step does not resolve the issue, proceed to the next one. asdasd

Possible cause	Solution
Abnormal instance status	You can log on to a Simple Application Server instance only when it is Running. If the instance is Stopped, restart it. Warning The restart operation stops the instance for a short period of time and may interrupt services that are running on the instance. We recommend that you restart the instance during off-peak hours. If the instance status is Disabled: Check if the instance has expired. If it has, renew it. For more information, see Renewal policy. Check whether you have an overdue payment. If so, top up your account. Online payment: On the Expenses and Costs page, click Top-up. After you add funds, payments are deducted from your account balance and processed immediately. For corporate bank transfers, see How do I make an offline remittance or a corporate bank transfer?. To view the status of a Simple Application Server instance, see View information about a Simple Application Server.
Incorrect credentials	Make sure that you use the correct username, password, or key pair. If you forgot the password, you can reset it. You must then restart the Simple Application Server instance for the new password to take effect. For more information, see Set or reset server passwords. Important On Windows, if an account is locked due to multiple incorrect password attempts, perform one of the following actions before you reset the password and log on: The default lockout duration is 10 minutes. You can wait for 10 minutes, reset the password, and then try to log on again. Use rescue mode (VNC) to change the account lockout threshold, reset the password, and then try to log on again. For more information, see What do I do if I receive the "The referenced account is currently locked out and may not be logged on to" error when I connect to a Windows instance by using Remote Desktop?. If you receive the error message "Password login is disabled by the operating system", see What do I do if Workbench prompts "Password login is disabled by the operating system, which prevents login even with correct credentials"?. If the issue is related to a key pair, replace the key pair. For more information, see Manage key pairs (Linux). If you cannot remotely log on to the instance from the console, submit a ticket to check if the key file was accidentally deleted.
Incorrect port configuration	Check whether the firewall allows traffic on the remote connection port. The default port is 22 for Linux instances and 3389 for Windows instances. If you need to open the port, see Manage firewalls.
Firewall check	For a Windows instance, check if you can connect to it after you disable the firewall.
Cross-border connection	When you access a Simple Application Server instance in a region outside the Chinese mainland from within the Chinese mainland, you may experience high latency and packet loss, which can cause connection failures. This issue is due to international carrier networks and cannot be fixed on the instance itself. For more information, see What do I do if a connection times out when I remotely connect to an instance outside the Chinese mainland?.
Local network issue	Try connecting from a different network, such as a mobile hotspot, to determine whether the issue is caused by your local network. If it is, contact your carrier for assistance.
High instance load	High disk usage, disk BPS, bandwidth, or CPU load on the Simple Application Server instance can prevent remote connections. Try the following: Stop non-essential processes and try to connect again. Restart the Simple Application Server instance. Upgrade the instance configuration. For more information, see Upgrade instance configurations. Reset the system. Before you reset the system, make sure that you back up important data. For more information, see Reset the system.
Antivirus software interference	Third-party antivirus software may prevent remote connections to your instance. If you are running third-party antivirus software, check if it is blocking the remote connection. Add the public IP address of the Simple Application Server instance to the software's allowlist and try to connect again. Alternatively, disable or uninstall the antivirus software and try connecting again.
Malware or virus infection	If your instance is attacked, its public IP address may be routed to a blackhole. Remove the IP address from the blackhole and try to log on again. For more information, see Alibaba Cloud blackhole policy.
RDP settings	Check whether RDP is enabled on your Windows instance. If not, enable it. For instructions, see How do I troubleshoot a remote connection failure to a Windows instance when no error message is reported?.
Specific error message	Find a solution based on the specific error message you receive. For more information, see FAQ navigation.

If the issue persists after these troubleshooting steps, submit a ticket for technical support.

FAQ navigation

General remote connection issues
Issues with connecting to Linux instances
- What do I do if a remote connection to a Linux instance fails because SELinux is enabled?
- What do I do if I cannot log on to an instance with the correct username and password?
- You can also refer to the troubleshooting solutions for remote connections to ECS instances. For more information, see Unable to connect to Linux instances
Issues with connecting to Windows instances

Workbench: Password login disabled by OS

Possible causes:

Insufficient memory can cause the system and applications to become unresponsive. Restart the instance and try again. If you can log on after the restart, consider upgrading the instance configuration. For more information, see Upgrade instance configurations.
The instance uses a key pair for logon, and the operating system has disabled password logon for the root user. Modify the configuration file to allow password logon. For more information, see I previously used a key pair to log on. How do I switch to password-based logon?.

Connection timeout to instances outside the Chinese mainland

When you access an instance outside the Chinese mainland from within the Chinese mainland, high latency and packet loss may occur due to international carrier networks, potentially causing connection failures. This cannot be fixed on the instance itself. For more information about the regions of Simple Application Server, see Regions and network connectivity. You can try one of the following solutions:

Network issues are not always persistent. Try connecting from a different local network or try again later.
If your business does not require the instance to be outside the Chinese mainland, request a self-service refund and purchase a new instance in a Chinese mainland region. For information about how to request a refund, see How do I unsubscribe from an Alibaba Cloud service?.

Note
If you cannot get a self-service refund for the instance, submit a ticket to apply for a refund.

Unblocking a locked public IP address

An instance may be locked due to crypto-mining viruses or cyberattacks. To request unblocking, go to the Penalties page.

Note

You can request self-service unblocking only once.
After an instance is unblocked, it is automatically monitored for three days. If mining activity is detected again, the instance is locked again and cannot be unblocked.
After the instance is unblocked, back up your data promptly.

"Connection refused" error

Check the following:

The remote service, such as SSH or RDP, must be enabled on the instance.
The connection port must be open on the instance. The default port is 22 for SSH and 3389 for RDP.

"Incorrect username or password" error

Check the following:

Enter the correct username. The default username is typically root for Linux instances and Administrator for Windows instances.
Enter the correct password. If you forgot the password, you can reset it. For more information, see Set or reset server passwords.
If you use a non-administrator user to log on to a Windows instance, make sure the user belongs to the Remote Desktop Users group.

VNC/Workbench: "Operation failed" error

When you remotely connect to the instance from the instance card in the console, you may receive the "Operation failed. Please try again later" error.

To troubleshoot this issue:

Connect to the instance by using a third-party tool, such as PuTTY.
Run the following commands to check whether the SSH public key file authorized_keys exists.
```
cd /home/admin/.ssh/
ll
```
- If the SSH public key file does not exist, submit a ticket to obtain the SSH public key information, and then use the following steps to restore the file:
  1. Run the following commands to restore the SSH public key file.
```
mkdir -p /home/admin/.ssh
vim /home/admin/.ssh/authorized_keys
```
    Paste the public key information into the authorized_keys file and save the file.
  2. Run the following command to change the owner and group.
```
chown -R admin:admin /home/admin
```
- If the SSH public key file authorized_keys exists, run the command cat /home/admin/.ssh/authorized_keys, copy the public key information, and submit a ticket with the key information for further analysis.
Check whether the /etc/sudoers file contains the admin ALL=(ALL) NOPASSWD:ALL entry.
```
vim /etc/sudoers
```
If the entry does not exist, add admin ALL=(ALL) NOPASSWD:ALL to the file.
Check whether the permissions of the /home/admin/.ssh/authorized_keys file are set to 644.
```
cd /home/admin/.ssh
ll
```
The following output is expected:
```
[root@iZd3ru25weg**** .ssh]# ll
total 0
-rw-r--r-- 1 admin admin 272 Nov  3 10:52 authorized_keys
```
If the permissions are not 644, run the chmod 644 authorized_keys command to change the permissions.

Cannot log on after online password change

If third-party antivirus software is running on the instance, it may block the Change Online operation, which causes the operation to fail. Select the Change Offline option or call the UpdateInstanceAttribute API operation to reset the instance password. Then, restart the instance and log on.

Instance login password changed automatically

If the login password for an instance is changed automatically on a regular basis, the instance may contain malicious scripts or crypto-mining programs. Go to the Security Center console to view and handle the issue.

Linux connection failure due to SELinux

For the solution, see An SSH remote connection to a Linux instance is abnormal because the SELinux service is enabled.

Enabling SELinux enhances system security but may also corrupt OS files and cause startup failures. Follow the proper procedure to enable or disable SELinux. For more information, see Enable or disable SELinux.

Cannot log on with correct credentials

If the operating system has disabled password-based logon, you cannot log on even with correct credentials. To enable password-based logon, see What do I do if Workbench prompts "Password login is disabled by the operating system, which prevents login even with correct credentials"?.

Windows: Remote connection authentication error

A Windows update patch may cause this issue. For solutions, see the following topics:

Cannot log on to a Windows instance as Administrator

If you have set a local security policy on your Windows host to deny logon through terminal services, you cannot use the Administrator user to log on through Remote Desktop. For the solution, see What do I do if the "To sign in remotely, you need the right to sign in through Remote Desktop Services" error is returned when I connect to a Windows instance by using Remote Desktop?.

Windows: Remote connection failure with no error

This issue may occur when remote connections are disabled on the Windows instance. The following steps use Windows Server 2012 R2 64-bit as an example.

Connect to the Windows instance from the management console.

For more information, see Connect to a Windows instance.
Open This PC. In the left-side navigation pane, right-click This PC and select Properties.
On the System page, click Remote settings in the left-side navigation pane.
In the System Properties dialog box, go to the Remote Desktop section and select Allow remote connections to this computer.
Click Apply and then click OK.

After the configuration is complete, you can try to remotely connect to the instance again.

Windows: "Network Level Authentication required" error

This error may occur when the Remote Desktop client on your local Windows host is outdated. The following steps use Windows Server 2012 R2 64-bit as an example.

Connect to the Windows instance from the management console.

For more information, see Connect to a Windows instance.
Open This PC. In the left-side navigation pane, right-click This PC and select Properties.
On the System page, click Remote settings in the left-side navigation pane.
In the System Properties dialog box, go to the Remote Desktop section and clear the Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended) checkbox.
Click Apply and then click OK.

After the configuration is complete, you can try to remotely connect to the instance again.

Windows: "No Remote Desktop license servers" error

For the solution, see What do I do if the "No Remote Desktop license servers are available to provide a license" error is returned when I connect to a Windows instance by using Remote Desktop?.

Windows: Remote connection failure with no public network access

This issue may be caused by a disabled Network Interface Controller (NIC) on the Windows instance. The following steps use Windows Server 2012 R2 64-bit as an example.

Connect to the Windows instance from the management console.

For more information, see Connect to a Windows instance.
In the lower-right corner of the desktop, right-click the network icon and select Open Network and Sharing Center.
In the left-side navigation pane, click Change adapter settings.
Find the disabled network connection, right-click it, and then select Enable.
After the network is enabled, right-click it and select Properties.
In the This connection uses the following items: section, click Internet Protocol Version 4 (TCP/IPv4), and then click Properties.
On the General tab, select Obtain an IP address automatically and Obtain DNS server address automatically, and then click OK.

After the configuration is complete, you can try to remotely connect to the instance again.

Troubleshooting ping failures

Cause

If cross-border access involves the China (Hong Kong) region, it may be affected by international link congestion and carrier outbound routing restrictions, leading to network congestion, unstable access, and high latency. These cross-border links are public carrier networks whose quality depends on many factors beyond a carrier's immediate control. Alibaba Cloud has reported these issues to the relevant carriers for assistance.
Ping failures can also be caused by network link anomalies, abnormal instance status, or issues with the instance's operating system or network configuration.

Scope of impact

Instances involved in cross-border access may experience network congestion, unstable access, and high latency.

Solution

For cross-border access issues:
- If your business primarily targets the Chinese mainland, we recommend that you unsubscribe from your current instance and purchase an instance in a Chinese mainland region.
  
  Important
  If you need to migrate important data from your instance, you can first create a custom image. Then, use the custom image to create a new instance. After you verify that the new instance is working correctly, you can unsubscribe from the original instance.
- Simple Application Server does not support changing the public IP address to alter the network path. If you are using an instance in the China (Hong Kong) region, consider using an ECS instance with a Premium EIP. Premium EIPs provide a more direct network path to the Chinese mainland and can offer a better experience when bound to an ECS instance. However, cross-border issues may still occur.
For other ping failure scenarios, perform the following troubleshooting steps:
1. First, investigate network link issues. If ping commands result in packet loss or failure, perform a link test using an MTR tool and analyze the results.
2. Log on to the console to check if the Simple Application Server instance status is normal. If the status is Stopped, start the instance and test again.
3. If both ping and port checks fail, use rescue mode to log on to the instance and check if its system and network are working correctly.

If the issue persists after troubleshooting, submit a ticket for technical support.

Remote connection FAQ