After you log on to the Bastionhost console by using the username-password logon method, you can enable two-factor authentication to allow users to enter dynamic verification codes that are sent by text message, email, or notification in DingTalk. You can also allow users to enter one-time passwords (OTPs) to implement two-factor authentication. This helps reduce the risk of password leaks. This topic describes how to enable two-factor authentication.
Background information
You can enable two-factor authentication for all local users, Active Directory (AD)-authenticated users, and Lightweight Directory Access Protocol (LDAP)-authenticated users. To enable two-factor authentication for a Resource Access Management (RAM) user, log on to the RAM console. For more information, see Enable an MFA device for an Alibaba Cloud account. For more information about how to configure two-factor authentication for a single user, see Manage users.
Prerequisites
If you select Text Message for the Authentication Method parameter when you enable two-factor authentication, you must specify the mobile phone number of the user who wants to perform O&M operations. If you do not specify the mobile phone number, the user cannot receive verification codes. For more information, see Modify the information about a user.
If you select Email for the Authentication Method parameter when you enable two-factor authentication, you must specify the email address of the user who wants to perform O&M operations. If you do not specify the email address, the user cannot receive verification codes. For more information, see Modify the information about a user.
If you select DingTalk for the Authentication parameter when you enable two-factor authentication, make sure that the following requirements are met:
The mobile phone number of the user who wants to perform O&M operations is specified. For more information, see Modify the information about a user.
An internal enterprise application is created by the DingTalk administrator, and the operation that is used to obtain member information based on the mobile phone numbers and names of the members is activated for the application.
The values of AppKey, AppSecret, and AgentId of the internal enterprise application are obtained.
If you select OTP App for the Authentication Method parameter when you enable two-factor authentication, you must download an app that supports time-based one-time password (TOTP). Bastionhost allows two-factor authentication from TOTP authenticator apps, such as the Alibaba Cloud app. This way, you can log on to the O&M portal by using the public O&M address of your bastion host, and use the app to scan the quick response (QR) code that is displayed to bind the app to your bastion host.
Procedure
Log on to the console of a bastion host. For more information, see Log on to the console of a bastion host.
In the left-side navigation pane, click System Settings.
On the System Settings page, click the Two-factor Authentication tab.
Turn on Enable Two-factor Authentication, set Authentication Method to Text Message, Email, DingTalk, or OTP App, and configure other parameters. Then, click Save.
If you select DingTalk for Authentication Method, you must configure AppKey, AppSecret, and AgentId of the internal enterprise application.
If you select OTP App for Authentication Method, you must download a TOTP authenticator app, such as the Alibaba Cloud app. Then, log on to the O&M portal by using the public O&M address of your bastion host. In the left-side navigation pane, click Security Settings. On the page that appears, click the Enable OTP tab. Then, click Bind OTP App. The system displays a QR code. Use the app to scan the QR code to bind the app with your bastion host. For more information about how to log on to the O&M portal, see Log on to the O&M portal.
For more information about how to obtain the O&M addresses of a bastion host, see Homepage overview of a bastion host.
Supported countries and areas
Country or area | Calling code |
Areas in China | Hong Kong (China): +852 |
Macao (China): +853 | |
Taiwan (China): +886 | |
Chinese mainland: +86 | |
Countries and areas outside China | Australia: +61 |
Poland: +48 | |
Germany: +49 | |
UAE: +971 | |
Russia: +7 | |
France: +33 | |
Philippines: +63 | |
Republic of Korea: +82 | |
Malaysia: +60 | |
United States: +1 | |
Japan: +81 | |
Sweden: +46 | |
Switzerland: +41 | |
Spain: +34 | |
Singapore: +65 | |
Israel: +972 | |
Italy: +39 | |
India: +91 | |
Indonesia: +62 | |
United Kingdom: +44 | |
Saudi Arabia: +966 | |
Thailand: +66 | |
Vietnam:+84 | |
Cambodia: +855 |