Bastionhost (Basic Edition, Enterprise Dual-Engine Edition, and Agentic Edition) is an O&M and security audit management platform provided by Alibaba Cloud. Bastionhost is a standalone managed Software as a Service (SaaS) offering. To use Bastionhost, you must purchase it separately and activate an instance in the Alibaba Cloud Management Console. Bastionhost is not affiliated with ECS instances or their security groups. Bastionhost centrally manages O&M permissions, controls operations end to end, and reconstructs O&M scenarios in real time. This ensures that O&M identities are verifiable, permissions are controllable, and operations are auditable. Bastionhost addresses challenges such as managing a large number of assets, unclear O&M responsibilities and permissions, and untraceable O&M events, and it helps enterprises meet classified protection compliance requirements.
Why choose Bastionhost?
With Bastionhost, you can build a management platform for core system O&M and security audits that offers the following benefits:
Natural language-driven O&M
Bastionhost lets you issue O&M commands in natural language, without memorizing complex commands or consulting operation manuals. Even users with no prior experience can get started quickly.
Unified O&M portal
Bastionhost consolidates asset access into a single entry point and reduces the attack surface of your assets. You can access extensive backend server resources in one place through Bastionhost alone. This supports efficient O&M while helping administrators organize asset access permissions and reduce management costs.
Two-factor identity authentication
For secondary authentication, Bastionhost lets you configure two-factor authentication methods such as text messages, emails, DingTalk work notifications, OTP tokens, and SM USB keys. Secondary authentication prevents users from using stolen account credentials to log on to assets by impersonation or access assets illegally. This effectively reduces the security risks caused by password leakage and brute-force attacks.
Fine-grained permission assignment
Bastionhost supports centralized management of the permissions on users, assets, and asset accounts. After you grant a user the permissions on an asset and its accounts, the user can use only the authorized accounts to access the authorized assets. This effectively prevents unauthorized access.
Security protection for asset credentials
Bastionhost protects asset security through automatic password rotation and enables passwordless logon to assets through credential hosting. This reduces the exposure of passwords to O&M engineers and lowers the risk of password leakage, achieving efficient O&M while protecting asset credentials.
Full-process monitoring of O&M operations
Bastionhost intercepts high-risk operations in real time, such as database deletion (
rm -rf /*) and disk formatting. Bastionhost can also restrict operations such as file uploads and downloads. For business-sensitive assets, you can enable secondary approval for O&M operations. This maximizes control over O&M operations and prevents O&M risk events.Tracing and audit visualization
Bastionhost supports session recordings and text-based audit records that provide detailed audit trails of O&M events. Bastionhost can also present real O&M scenarios as videos, which enables visual tracking and tracing of O&M events.