Bastionhost users are the accounts O&M engineers use to log on and reach their authorized host and database assets. Administrators create and maintain them on the Bastionhost management page.
User types
Select the user type that matches your identity source. O&M engineers can come from imported Alibaba Cloud Resource Access Management (RAM) users, Bastionhost local users, or imported AD, LDAP, or IDaaS authentication users.
User type | Description |
RAM user | After you create an Alibaba Cloud RAM user in the RAM console, import it on the Bastionhost management page with one click. |
Bastionhost local user | Create Bastionhost local users one by one, or import them in batches from a file. |
AD/LDAP user | Configure AD or LDAP authentication, then synchronize those users to Bastionhost. |
IDaaS user | Configure IDaaS authentication, then synchronize those users to Bastionhost. |
User list
After you create users, the user list displays the following items.
Item | Description |
Logon Name | The account name used to log on to Bastionhost. Its source, and whether it can be changed, depend on the user type. |
Authentication Source | The user type. For example, a local user is displayed as Local Authentication. |
Two-factor Authentication Methods | Secondary authentication required after the password check. Available methods depend on the user type. |
OTP App | Whether the user has Create users. Not applicable to RAM or IDaaS users. |
Status | The current status of the user. |
Actions | Authorization operations for the user. For more information, see Authorize users to manage assets and asset accounts or Authorize users to manage asset groups. |
Logon name
A user's logon name comes from their authentication source:
RAM user: the logon name set when the RAM user was created and synchronized. If you changed the username in the RAM console, go to System Settings > User Settings and configure User Sync Settings.
Local user: the username the administrator set at creation. It cannot be changed. Password complexity follows the user password security settings.
AD/LDAP user: the username synchronized from the AD or LDAP server. Change it on that server.
IDaaS user: the account synchronized from Alibaba Cloud IDaaS EIAM. It cannot be changed.
For user and password security settings, see User configuration.
Two-factor authentication methods
After password authentication, a user must also enter a dynamic verification code sent by text message, email, or DingTalk. This secondary check reduces security risks. Configure the method at the user's authentication source:
RAM user: RAM-based Authentication. To configure the two-factor authentication method for a RAM user, log on to the RAM console. For more information, see Bind an MFA device for a RAM user.
IDaaS user: IDaaS-based Authentication. To configure the two-factor authentication method for an IDaaS user, log on to the Alibaba Cloud IDaaS console. For more information, see Two-factor authentication.
Local user or AD/LDAP user:
For the global settings, see Enable two-factor authentication.
For the settings of an individual user, see Create users.
User status
The Status column shows one of these states:
Inactive: a user who does not log on within the specified period is marked as Inactive.
Password Expired: once the password validity period elapses, the user is marked as Password Expired.
Locked:
A user who exceeds the allowed number of consecutive incorrect passwords, or whom an administrator locks manually, is marked as Locked.
In System Settings, after you enable Automatically Lock Inactive User Accounts, Bastionhost automatically locks long-inactive users and marks them as Locked.
Remote Deleted: if the user cannot be found in the corresponding authentication source based on the source ID of the user, the user is marked as Remote Deleted.
Remote DN Changed: if the BaseDN of the user on the AD or LDAP server does not match the configuration on Bastionhost, the user is marked as Remote DN Changed.
For user status settings, see User configuration.
Create users
Create the accounts your O&M engineers use to log on to Bastionhost. Each tab below covers one user type.
Import RAM users
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose .
On the Users page, click Import RAM Users.
On the Import RAM Users page, find the RAM user that you want to import, and click Import in the Actions column. To import several at once, select them and click Import.
NoteTo configure two-factor authentication for a RAM user, log on to the RAM console and configure multi-factor authentication (MFA) for the RAM user. For more information, see Bind an MFA device to an Alibaba Cloud account.
Create local users
On the Users page, create a single local user, or import multiple local users from a file.
To create a single local user
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose .
In the Create User panel, configure the user information and click Create.
Set Authentication Method to Local Authentication. Beyond the basic information, the rest of this tab covers optional settings.
Optional: To notify the user of the O&M address, give the local user a mobile phone number or an email address, then select Send O&M Addresses to User.
To import multiple local users from a file
On the Users page, in the Import Other Users list, select Import Users from File.
Click Download User Template to download the template, fill in the user information, and save the file.
In the Import Local Users panel, click Upload to upload the user template file.
In the Preview dialog box, select the users to import and click Import.
In the Import Local Users panel, confirm the user information and click Import Local Users.
If you select Users must reset the password at next logon., all imported users must reset their passwords at the next logon.
NoteA user whose username duplicates another entry in the file or an existing system user is skipped. In the Import Local Users panel, click Details to view the users that were not imported.
Optional settings for a local user
Enable Users must reset the password at next logon.: the local user must change the password at the next logon. This applies only to local users; for an existing one, an administrator can toggle it from the user list.
Set Validity Period: once set, the Status column shows Expired for a user past that period, and the user cannot log on to perform O&M operations.
Configure Two-factor Authentication Methods: use the global two-factor method or one that applies only to this user.
Configure Two-factor Notification Sending Language: use the global notification language or one that applies only to this user.
Two-factor authentication methods
With two-factor authentication enabled, the user receives a verification code by text message or email at logon, so make sure the number and address you specify are correct. For supported countries and regions for text messages, see Countries and regions that support two-factor authentication by text message.
The mobile phone number and email address are used only for verification codes and alert notifications, and for nothing else.
Two-factor Authentication Methods supports two types:
Select For All Users to apply the global two-factor authentication method, which you configure in System Settings. For more information, see Enable two-factor authentication.
Select For Single User to set a two-factor method for this user only.
If you select For Single User, choose one of these methods:
Disable: two-factor authentication is not enabled.
Text Message: secondary authentication by text message to the user's mobile phone number, which you must specify.
Email: secondary authentication by email to the user's email address, which you must specify.
DingTalk: secondary authentication through the user's DingTalk, which requires a mobile phone number.
NoteDingTalk authentication has the following requirements:
A mobile phone number is associated with the user account that is used for O&M. For more information about how to add a mobile phone number for a user, see Modify the basic information of a local user.
The DingTalk administrator has created an internal enterprise application and granted it the API Access Permission To Get Member Information By Phone Number And Name.
You have obtained the AppKey, AppSecret, and AgentId of the internal enterprise application.
OTP App: authentication with the user's mobile OTP token, which the user must bind first.
NoteFirst download a standard TOTP application, such as the Alibaba Cloud app. Then log on to the Bastionhost O&M portal over the public endpoint and, in the left-side navigation pane, click Security Settings, click the Enable OTP tab, click Bind OTP App, and scan the QR code to bind the token. To find the O&M address, see Bastionhost console overview.
Two-factor notification sending language
Configure Two-factor Notification Sending Language in one of the following ways:
Select For All Users to send notifications in the language you configure in System Settings. For more information, see Enable two-factor authentication.
Select For Single User to send two-factor authentication notifications in Simplified Chinese or English.
Import AD/LDAP users
Configure AD or LDAP authentication before importing users. For more information, see Configure AD or LDAP authentication.
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose .
On the Import AD Users or Import LDAP Users page, find the user to import, and click Import in the Actions column.
Select multiple users to import them in batches.
Import IDaaS users
Configure IDaaS authentication before importing users. For more information, see Manage IDaaS authentication.
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose .
Choose Import Other Users > Import IDaaS User.
On the Import IDaaS User page, find the user to import, and click Import in the Actions column.
Select multiple users to import them in batches. If no IDaaS user appears, click Synchronize.
Modify local user information
For AD/LDAP, RAM, and IDaaS users, change basic information at the authentication source.
Update a local user's mobile phone number or email address in the console as soon as it changes. Otherwise verification codes go to the old number, and the user cannot log on to perform O&M operations.
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose .
On the Basic Info tab of the user, modify the user information, and then click Update.
Modify password reset at next logon
When you create a local user, enable Users must reset the password at next logon. To change this setting, use the batch menu below the user list.
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose .
In the user list, select the user to modify. Below the list, choose Batch > Change Configuration of Local Users Must Reset Passwords at Next Logons.
In the dialog box that appears, select Enable or Disable, and then click OK.
Manage user public keys
Host a user's public key on Bastionhost so the O&M engineer can log on from an O&M client with the matching private key. For details on the O&M process, see Perform SSH-based O&M.
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose .
In the Add SSH Public Key panel, specify the name and the content of the public key, and click Add SSH Public Key.
The user public key list shows the hosted keys, which you can also export.
User logon restrictions
Restrict the source IP addresses and time periods from which users can log on to Bastionhost.
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose .
In the user list, click the username of the user to restrict.
On the User Logon Restrictions tab, set the source IP address and time period restrictions, and then click Update.
The following IP address restriction modes are available:
(Whitelist) Only Listed IP Addresses Are Allowed: only whitelisted source IP addresses can log on to Bastionhost, and only within the specified time periods.
(Blacklist) Listed IP Addresses Are Not Allowed: blacklisted source IP addresses can never log on to Bastionhost; all others can log on only within the specified time periods.
Lock or unlock a user
When a user does not need Bastionhost for a while, an administrator can lock the account manually or set trigger conditions to lock it automatically, then unlock it when the user returns.
Automatically lock a user
Bastionhost locks a user automatically when either condition below is met. Configure both on the System Settings page.
Incorrect password attempts: by default, Bastionhost locks a user after five consecutive incorrect passwords. Set Account Lockout Threshold to change the threshold.
Inactivity: after an administrator enables Inactive User Account, Bastionhost locks any user marked as inactive.
For more information, see User configuration.
Manually lock or unlock a user
Manual locks and unlocks take effect immediately. A locked user cannot log on to servers, so proceed with caution.
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose .
Export users
Export the user list to a local CSV file.
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose .
On the Users page, click Export Users in the upper-right corner of the user list.
Delete a user
When an O&M engineer no longer needs Bastionhost, delete the user to reduce security risks.
Log on to the Bastionhost console. In the top navigation bar, select the region where your Bastionhost instance is located.
In the list of Bastionhost instances, find the target instance and click Manage.
In the navigation pane on the left, choose .
Deleting a source account does not delete the corresponding Bastionhost user. If you delete a RAM user or an AD, LDAP, or IDaaS account, the Bastionhost user imported from that account remains. The Status of the user may still be normal, and the O&M sessions that the user established may still be valid. The user can therefore still log on to Bastionhost.
To completely disable the user, log on to the Bastionhost console, and then delete the user on the Users page. Alternatively, wait until the Status of the user changes to Remote Deleted, and then delete the user manually.