Bastionhost:Questions about use cases

Managing hosts from other clouds or on-premises IDCs

• You can import assets from a third-party cloud or an on-premises IDC into Bastionhost if the assets can connect to Bastionhost (for example, by using the public network for O&M). To import assets, create hosts in Bastionhost. For more information, see Add a host.

• If your assets are in different VPCs or accounts and are not connected using Express Connect, you can use the network domain feature of Bastionhost. For more information, see Best practices for hybrid O&M scenarios.

Managing assets across different accounts and VPCs

Managing assets in a classic network

If your ECS instance is in a classic network, you must use ClassicLink to connect the classic network to the VPC that contains your Bastionhost instance. For more information about the ClassicLink feature, see ClassicLink overview.

Managing databases

Supported asset types

You can use Bastionhost to manage host assets that run Linux or Windows, and database assets such as MySQL, SQL Server, and PostgreSQL. You can import Alibaba Cloud ECS instances and RDS database assets with one click. You can also import assets from on-premises IDCs or other clouds in batches. For more information, see O&M overview.

Data encryption for transmission and storage

Yes. Bastionhost encrypts data during transmission and at rest. Bastionhost uses multiple mainstream encryption protocols, including HTTPS (TLS), RDP, and SSH, to ensure data security.

Public IPs in private networks

Yes. If your network environment is configured to use public IP addresses for private communication, you can configure this setting on the Bastionhost console. For more information, see Configure Bastionhost.

Configuring an HTTP and SOCKS5 proxy server

This section describes how to configure a server as an HTTP and SOCKS5 proxy server. This example uses an Alibaba Cloud server that runs CentOS 8.3.

1. Log on to the Alibaba Cloud server.

2. Run the yum install 3proxy command to install the 3proxy tool.

3. Run the vim /etc/3proxy.cfg command to modify the configuration file.

   • Configure the host account and password for the proxy server.

     users 3APA3A:CL:3apa3a "test:CR:$1$qwer$CHFTUFGqkjue9HyhcMHEe1" ceshi:CL:1qaz@WSX
     # note that "" required, overvise $... is treated as include file name.
     # $1$qwer$CHFTUFGqkjue9HyhcMHEe1 is 'test' in MD5 crypt format.
     #users $/usr/local/etc/3proxy/passwd
     # this example shows you how to include passwd file. For included files
     # <CR> and <LF> are treated as field separators.

   • Configure access control parameters.

     # for different clients.
     allow ceshi
     # sharing access to internet

   • Enable the HTTP and SOCKS5 proxies, and specify the listening ports and the source IP address for accessing the proxy server.

     auth strong
     # We want to protect internal interface
     deny * * 127.0.xxx.,192.168.xxx xxx
     # and allow HTTP and HTTPS traffic.
     allow * * * 80-88,8080-8088 HTTP
     allow * * * 443,8443 HTTPS
     proxy -i0.0.0.0 -p8080
     socks -i0.0.0.0 -p1080
     flush

4. Run the systemctl start 3proxy.service command to start the proxy service.

5. Run the iptables -F command to flush the firewall rules on the server to ensure the server is accessible.

6. Add a rule to the security group of the server. For more information, see Add a security group rule.

   Important

   When you configure the security group rule, set Instances to the listening port that you configured in Step 3. Set Instances to the egress IP of your Bastionhost instance. You can obtain the egress IP on the Instances page on the Bastionhost console.

   After the security group rule is added, the proxy server is configured.

Configuring an HTTPS proxy server

This section explains how to configure an ECS instance that runs CentOS 8.3 as an HTTPS proxy server by using the GOST tool.

1. Prepare a server certificate (server.crt), its private key (server.key), and a CA root certificate (ca.crt). You can obtain the certificates in one of the following ways:

   • Use a tool such as OpenSSL to generate a self-signed certificate.

   • Use a free individual test SSL certificate provided by Alibaba Cloud or purchase a commercial SSL certificate. For more information, see SSL certificate selection guide.

2. Install GOST on your ECS instance. For more information, see Install GOST.

3. Upload the certificate files to the GOST installation directory, and then configure and start the GOST proxy server.

   • Command-line mode: Modify the parameters and run the following command to start GOST.

     gost -L="https://admin:123456@:8843?cert=./server.crt&key=./server.key"

     • admin:123456 is a custom username and password for GOST. Use these values for the host account and password for the HTTPS proxy in the Bastionhost network domain settings.

     • The 8443 is a custom proxy port. This value corresponds to the server port for the HTTPS proxy in the Bastionhost network domain settings.

       You must add an inbound rule to the security group of the ECS instance for this port. Set Port Range to 8443 and Authorization Object to the egress IP of your Bastionhost instance. You can obtain the egress IP on the Instances page on the Bastionhost console. For more information about how to add a security group rule, see Add a security group rule.

     • The ./server.crt is the server certificate.

     • The ./server.key is the private key for the server certificate.

   • JSON file mode: Modify the parameters in the configuration file and then start GOST.

     • JSON configuration file (for this example, create a file named gost.json):

       {
         "ServeNodes": [
           "https://admin:123456@:8843?cert=./server.crt&key=./server.key"
         ]
       }

       • admin:123456 is a custom username and password for GOST. Use these values for the host account and password for the HTTPS proxy in the Bastionhost network domain settings.

       • The 8443 is a custom proxy port. This value corresponds to the server port for the HTTPS proxy in the Bastionhost network domain settings.

         You must add an inbound rule to the security group of the ECS instance for this port. Set Port Range to 8443 and Authorization Object to the egress IP of your Bastionhost instance. You can obtain the egress IP on the Instances page on the Bastionhost console. For more information about how to add a security group rule, see Add a security group rule.

       • The ./server.crt is the server certificate.

       • The ./server.key is the private key for the server certificate.

     • Start GOST:

       gost -C gost.json