After you add a host to a bastion host, you can manage its accounts in the bastion host. When you create a host account, the bastion host does not synchronize the account to the underlying host or ECS instance. You can authorize bastion host users to use these host accounts for passwordless logon. This topic describes how to create, modify, and delete host accounts.
Configure the host account for a host
Log on to the Bastionhost system. For more information, see Log on to the system.
In the navigation pane on the left, choose .
On the Hosts page, create a host account for the target host.
Create Host Account
In the Actions column for the target host, click Create Host Account.
Note Ensure the corresponding operating system account already exists on the server. The bastion host does not synchronize host accounts to ECS instances or other source hosts.
In the Create Host Account panel, configure parameters such as Protocol, Logon Name, and Authentication Type, and then click Create.
The following table describes the parameters.
Parameter | Description |
Logon Name | The logon name of the account on the server. |
Privileged Account | You can use a privileged account on the host to perform password rotation for standard accounts.
Note If you upgraded your bastion host instance from a version earlier than V3.2.47, existing host accounts with the logon name root or administrator are automatically designated as privileged accounts. If you create an account after the upgrade, you must manually specify whether it is a privileged account. To perform this operation in batches, you can call an API operation. For more information, see Create a host account for a specified host.
|
Authentication Type | The authentication method. You can select Password, Private Key, or Shared Key. Password: You can verify the password to confirm that the managed account is valid. If the verification fails, follow the on-screen prompts to troubleshoot. For more information, see Server connection issues. Private Key: Private key authentication supports only keys generated with the ssh-keygen -m PEM -t rsa command and keys in the Ed25519 format. Shared Key: Select an existing shared key.
Note You can choose to include password or key details when you export hosts. For more information, see Export a list of hosts with one click. If multiple host accounts share the same public-private key pair for authentication, you can configure them to use a shared key. For more information about how to configure a shared key, see Shared keys.
|
Enable Only SFTP Permission | When enabled, this option restricts the account to SFTP access only, preventing SSH logon. Proceed with caution. |
Use Privileged Account to Change Password | If you enable this option, a privileged account on the host performs password rotation for this account. Before you enable this option, ensure that you have added the privileged account and its password to the bastion host.
Note This feature currently supports only accounts that use the SSH protocol. |
Create Host Account
In the Hosts list, select the hosts for which you want to create accounts.
At the bottom of the list, choose .
In the Add Account dialog box, configure parameters such as Authentication Type, Protocol, and Logon Name, and then click OK.
Note If you set the Protocol parameter to SSH when you configure the host accounts for a host, you can turn on Enable Only SFTP Permission. If you turn on Enable Only SFTP Permission, SSH-based logon is disabled for the host account. Proceed with caution.
By default, Allow Access to Hosts by Using Unauthorized Host Accounts is enabled. This allows users to attempt to log on by manually entering credentials, even for host accounts they are not explicitly authorized to use. If this option is disabled, unauthorized users cannot log on. To disable this option, see O&M settings.
Modify the account settings of a host
Log on to the Bastionhost system. For more information, see Log on to the system.
In the navigation pane on the left, choose .
On the Hosts page, find the desired host and click its name.
On the Host Account tab, find the desired account and click its logon name.
In the Edit Host Account panel, modify the account information and click Save.
Delete a host account
If you no longer require a host account, perform the following steps to delete the account:
Log on to the Bastionhost system. For more information, see Log on to the system.
In the navigation pane on the left, choose .
On the Hosts page, find the relevant host and click its name.
On the Host Account tab, select the account to delete and click Delete at the bottom of the list.
In the dialog box that appears, click Delete.