Before you use Bastionhost, review the following limits to help ensure service stability and security.
Use the Bastionhost-assigned domain name
Bastionhost provides a fixed public or private domain name for O&M connections. Use this domain name instead of the underlying IP address because the IP address can change and interrupt O&M connections.
Concurrency limits
Each TCP connection in a session consumes one concurrency slot. Bastionhost operates reliably only when usage remains within the concurrency quota. Exceeding the quota may interrupt the service. To view the quota for your instance, see Billing methods.
To maintain system stability, Bastionhost provides overload protection. If resource-intensive operations overload the system, Bastionhost may reject new session connections or terminate active sessions. If overload protection is triggered, join the DingTalk group (ID: 33797269) and contact a product technical expert for assistance.
ImportantOther resource-intensive operations that may trigger overload protection include complex graphics operations in remote desktop sessions, video playback in browsers on remote desktops, and table exports during database O&M.
For a Basic Edition instance that supports 50 assets, the following scenarios may trigger overload protection:
Windows RDP over a private network (1080p): 20 concurrent RDP sessions may trigger overload protection if they display an animated GIF that changes every 5 seconds for 30 minutes.
Linux SSH over a private network: 50 concurrent Secure Shell (SSH) sessions may trigger overload protection if each session sends one command every 5 seconds for 30 minutes.
Database sessions: 50 concurrent database sessions that run simple queries may trigger overload protection if each session contains more than 10 connections.
O&M client tool and version limits
Use a compatible client tool and version to avoid connection failures and maintain system stability. For supported options, see Client remote connection tools and versions.
To maintain system stability and security, use only the recommended client tools and versions. Connections made by using other tools are not covered by the SLA.
For example, iShell, Dartshell, and FinalShell can create a large number of exec sessions within a short period. These sessions consume excessive system resources and may disrupt other sessions and features.
Two-factor authentication for RAM users
For RAM users, MFA is the only supported two-factor authentication method.
To enable MFA, log on to the RAM console and bind an MFA device to the RAM user. For instructions, see Bind an MFA device to an Alibaba Cloud account.
For non-RAM users, such as local users and Active Directory (AD)/LDAP users, two-factor authentication can use dynamic verification codes delivered by text message, email, DingTalk work notification, or an OTP token.
Username length limit for RDP
Because of client limitations, Bastionhost usernames for RDP O&M can contain up to 63 characters. If a username exceeds this limit, use web-based O&M instead.
O&M address SMS delivery to the Chinese mainland
Carriers may block SMS messages that contain the Bastionhost O&M address when Alibaba Cloud International sends them to Chinese mainland (+86) mobile numbers. If a message is blocked, use email authentication.
Other SMS-based features, such as two-factor authentication and message notifications, are not affected.
SSH O&M audit: supported shell environments
Bastionhost can audit SSH O&M sessions on assets that use bash, zsh, ksh, or dash. Assets that use other shells may experience compatibility issues during O&M or when commands are retrieved for auditing.
FAQ
Does the Bastionhost public IP address whitelist support IPv6 addresses?
No, it does not. The Bastionhost public IP address whitelist supports only IPv4 addresses. The WhiteList parameter accepts only addresses in the IPv4 format.
Can Bastionhost audit traffic or operations from self-managed VPNs on ECS instances?
No, it cannot. Bastionhost cannot audit traffic or operations from self-managed VPNs on ECS instances. To ensure that all O&M activities are recorded and audited, use an ECS security group to restrict SSH and RDP port access to the Bastionhost egress IP address and prohibit direct connections to ECS instances from other sources.
How is the number of assets counted when connecting through a jump server?
The Number of assets value in the console includes only the target servers that are directly managed by Bastionhost. The jump server itself is not included in this count.