Bastionhost:Enable two-factor authentication

Prerequisites

Before you begin, make sure you have:

• Administrator access to the Bastionhost console

• Each user's mobile phone number or email address configured in their profile, if you plan to use text message, email, or DingTalk authentication. To update this information, see Modify the basic information about a local user

• For DingTalk: a DingTalk administrator who has created an internal enterprise application, activated the operation to obtain member information based on mobile phone numbers and names, and obtained the AppKey, AppSecret, and AgentId values

• For OTP app: users who have downloaded a standard time-based one-time password (TOTP) authenticator app, such as the Alibaba Cloud app

Steps

1. Log on to the Bastionhost console. In the top navigation bar, select the region where your bastion host resides.

2. In the bastion host list, find the target bastion host and click Manage.

3. In the left-side navigation pane, click System Settings.

4. On the System Settings page, click the Two-factor Authentication tab.

5. Turn on Enable Two-factor Authentication, select one or more values for Authentication Method, configure the remaining parameters, and then click Save. The following table describes the parameters.

   Parameter	Description
   Authentication Method — Text Message	Sends verification codes via SMS. The user's mobile phone number must be configured in their profile; otherwise, they cannot receive verification codes.
   Authentication Method — Email	Sends verification codes via email. The user's email address must be configured in their profile; otherwise, they cannot receive verification codes.
   Authentication Method — DingTalk	Sends verification codes via DingTalk notifications. The user's mobile phone number must be configured in their profile. The DingTalk internal enterprise application must be set up in advance (see Prerequisites).
   Authentication Method — OTP App	Requires users to authenticate using a TOTP authenticator app. After this method is enabled, users must bind an OTP app before they can log on: log on to the operations and maintenance (O&M) portal via a public endpoint, go to Security Settings > Enable OTP, and click Bind OTP App to scan the QR code. For details, see Log on to the O&M portal.
   Language	The language for two-factor notification messages. Options: Simplified Chinese or English.
   If the two-factor code is correct, you do not need to enter the code for	The trust period during which users from the same source IP address are not prompted for a verification code again. Valid values: 0–168 hours or 0–7 days. The default value of 0 hours requires a code at every logon.