Perform O&M on assets over SSH from a Windows client - Bastionhost

To manage host assets using a client, connect to a Bastionhost instance using a terminal or remote client, and then select the asset to manage.

Prerequisites

You have imported assets and users to your Bastionhost instance and authorized the users to manage the assets. For more information, see Add hosts, Manage users, and Authorize users or user groups to manage assets and asset accounts.
Note
- To enable password-free logon for a server, you must authorize the corresponding asset account to the user. For more information, see Authorize a user to manage assets and asset accounts.
- If you do not host a specific account, you can enable the Unauthorized Asset Accounts Are Allowed option in the Special Asset Accounts section. With this option enabled, the user must manually enter the asset account password. For more information about how to enable this feature, see Configure O&M settings.
You have obtained the O&M address of the bastion host instance. You can find the O&M address in the Bastion Host Information section on the Overview page. For more information, see Overview of the Bastionhost console.
Note
Bastionhost provides a fixed O&M address as a domain name and uses dynamic IP addresses to prevent attacks. The IP address that is resolved from the O&M address may change. To prevent O&M failures caused by IP address changes, you must use the domain name provided by Bastionhost for O&M.
For users who connect with public key authentication, you must first host their public key in Bastionhost. For more information, see Host the public key of a user.
If you use a client tool to manage assets, ensure that an SSH-compatible O&M tool, such as Xshell, SecureCRT, or PuTTY, is installed on your local computer.

For more information about compatible remote connection client tools and their versions, see Database O&M tools and versions.

Command-line tool

Password authentication

Open a command-line tool and run the following command: ssh <Bastionhost_username>@<Bastionhost_O&M_address> -p 60022.

The default SSH port number is 60022. If you need to change the O&M port of the Bastionhost instance, see Configure the bastion host port number.
Enter the password of the Bastionhost user.
If the Bastionhost user has enabled two-factor authentication (2FA), enter the verification code.

For more information about how to configure 2FA for a Bastionhost user, see Enable two-factor authentication.
```
PS C:\Users\admin> ssh demo@uww****wux-public.bastionhost.aliyuncs.com -p 60022
demo@uww****wux-public.bastionhost.aliyuncs.com's password:
Two-Step Verification required
Please Input Mfa Code (SMS):
```
On the asset management page, use the arrow keys to select the host to manage, and then press Enter to log on.

Token authentication

Open a command-line tool and run the following command: ssh <Bastionhost_username>@<Bastionhost_O&M_address> -p 60022.

The default SSH port number is 60022. If you need to change the O&M port of the Bastionhost instance, see Configure the bastion host port number.
At the password prompt, enter the O&M token. For more information about how to obtain an O&M token, see Manage an O&M token.
Perform O&M operations on the target server.

Public key authentication

Open a command-line tool and run the following command: ssh -i <path_to_private_key_file> <Bastionhost_username>@<Bastionhost_O&M_address> -p 60022.

The default SSH port number is 60022. If you need to change the O&M port of the Bastionhost instance, see Configure the bastion host port number.

If 2FA is enabled for the user, enter the verification code. For more information about how to configure 2FA for a Bastionhost user, see Enable two-factor authentication.

PS C:\Users\admin> ssh -i C:\Users\admin\Desktop\id_rsa demo@uwxxx-xxxiwux-public.bastionhost.aliyuncs.com -p 60022
Two-Step Verification required
Please Input Mfa Code (SMS):

On the asset management page, use the arrow keys to select the host to manage, and then press Enter to log on.

Client tool

Password authentication

Open Xshell. In the Connection settings, enter the O&M address of the Bastionhost instance and the SSH port number.

The default SSH port number is 60022. If you need to change the O&M port of the Bastionhost instance, see Configure the bastion host port number.
In the Authentication settings, enter the username and password of the Bastionhost user, and click OK.
If 2FA is enabled for the user, enter the verification code and click OK.

For more information about how to configure 2FA for a Bastionhost user, see Enable two-factor authentication.

If two-factor authentication fails, the Two-Step Verification failure, please try again dialog box appears. You must re-enter the verification code. The dialog box also contains a Remember password checkbox.
On the asset management page, use the arrow keys to select the host to manage, and then press Enter to log on.

Token authentication

Open Xshell. In the Connection settings, enter the O&M address of the Bastionhost instance and the SSH port number.

The default SSH port number is 60022. If you need to change the O&M port of the Bastionhost instance, see Configure the bastion host port number.
In the Authentication settings, enter the username of the Bastionhost user and the O&M token, and then click OK. For more information about how to obtain an O&M token, see Manage an O&M token.
Perform O&M operations on the target server.

Public key authentication

Open Xshell. In the Connection settings, enter the O&M address of the Bastionhost instance and the SSH port number.

The default SSH port number is 60022. If you need to change the O&M port of the Bastionhost instance, see Configure the bastion host port number.
On the Authentication settings page, select Public Key from the Method drop-down list.
Click Setup. In the Setup Public Key dialog box, upload the private key file that corresponds to the public key hosted in Bastionhost, and then click OK.
Optional: If 2FA is enabled for the user, enter the verification code and click OK.

For more information about how to configure 2FA, see Enable two-factor authentication.
On the asset management page, use the arrow keys to select the host to manage, and then press Enter to log on.

Asset search

You can search for a target asset in one of the following ways:

Use /+search content. The search results are highlighted. The following figure shows an example:
Use the Search feature that is provided by Bastionhost to filter assets by keyword.
For example, to filter assets by the keyword "key", click [Search]. On the [Search] page, enter "ls key", and press Enter. The assets that meet the filter condition are displayed in the asset list. The following figure shows an example:
Note
For more information about the [Search] command, enter help or help ls.