Best practices for auditing SCP command operations - Bastionhost

Bastionhost does not support auditing SCP commands. To audit SCP command operations through Bastionhost, configure ProxyJump on your local client before performing file transfers. This enables Bastionhost to audit SCP command operations.

Background information

ProxyJump is a feature introduced in OpenSSH version 7.3. After configuring ProxyJump on your personal computer, the SSH client first establishes a secure connection with Bastionhost when you use the SCP command to upload or download files. It then communicates with the target host through Bastionhost, enabling Bastionhost to audit SCP commands.

Prerequisites

Ensure that network connectivity between your local client and Bastionhost is normal and that you can log on to Bastionhost. For troubleshooting steps, see Client connection issues.
You have registered O&M hosts and host accounts in Bastionhost. For more information, see Create a host and Manage host accounts.
You have granted Bastionhost users access to the hosts. For more information, see Grant users access to assets and asset accounts or Grant users access to asset groups and asset group accounts.
Your client must use OpenSSH version 7.3 or later.

Configure ProxyJump

Log on to your local Linux system.

Run the following command to create and configure a config file in the .ssh directory.

vim ~/.ssh/config

Use the following configuration:

#-------Bastionhost configuration---------#
# Bastionhost alias
Host bastion
    # Bastionhost O&M address
    HostName ****-public.bastionhost.aliyuncs.com 
    # Default Bastionhost port 60022
    Port 60022 
    # Bastionhost user
    User bastion-user
#-------Host configuration---------#
# Host alias
Host target-host-A 
    # IP address of the host registered in Bastionhost
    HostName 192.168.XX.XX 
    # Host username
    User tagert-user
    # Configure ProxyJump. When you run an SCP command, the client first connects to bastion, then connects to target-host-A through bastion
    ProxyJump bastion 
#--------You can configure multiple hosts--------#
#Host target-host-B
#    HostName 192.168.XX.XX 
#    User tagert-user
#    ProxyJump bastion

Use the SCP command to upload files to the target host or download files to your local machine. Examples follow:
- Example: Upload a file to the target host
  
  This uploads the local file file-name.txt to the home directory on the target host (target-host-A).
```
scp /file-name.txt target-host-A:/home/
```
- Example: Download a file to your local machine
  
  This downloads the file file-name.txt from the target host (target-host-A) to the local home directory.
```
scp target-host-A:/file-name.txt /home/
```

View Bastionhost audit records

Log on to Bastionhost to view audit records for SCP command operations. For more information, see Search for and view sessions.

On the session audit page, click the File transfer tab to view SCP command audit records. The records include fields such as time, host IP or hostname, user, source IP, type (such as Upload file or Download file), and content (file name). You can search by time, keyword, host IP, username, or other criteria.