Bastionhost:Password change task

Limits

• Editions: This feature is available only in Bastionhost Enterprise and SM Edition. For more information about how to purchase or upgrade an instance, see Purchase a bastion host and Upgrade a bastion host.

• Limits on password change tasks:

  • The password change tasks do not support the rotation of shared keys.

  • A host account can be associated with only one password change task.

Prerequisites

Hosts are imported to a bastion host and a host account is hosted in the console of a bastion host. For more information, see Add hosts and Manage a host account.

Create a password change task

1. Log on to the Bastionhost system. For more information, see Log on to the system.

2. In the navigation pane on the left, choose Assets > Password Change.

3. On the Password Change page, click Create Password Change Task.

4. In the Password Change panel, configure the following parameters and click Create.

   Parameter	Description
   Task Name	The name of the password change task.
   Task Type	Valid values: Key Rotation and Password Rotation.
   Execution Method	The execution method of the password change task. Valid values: Periodic: Bastionhost automatically runs the task based on the specified execution time and interval. You must set Executed At to a point in time that is at least 5 minutes later than the current time. The maximum value of Period is 365. Scheduled: Bastionhost automatically runs the task at the specified execution time. The execution time must be at least five minutes from the current time.
   Password Rules	If you set Task Type to Password Rotation, you can configure the password strength and length. Password Strength: You can select character types such as digits, lowercase letters, uppercase letters, and special characters. Bastionhost generates a new password based on your selections. We recommend that you select at least two character types. Password Length: Set a minimum and maximum password length, from 8 to 32 characters. Bastionhost will generate a password of a random length within your specified range. Password Policies: Set the minimum number of required characters, character repetition limits, and excluded characters. The sum of the minimums for all character types cannot exceed the minimum password length. Valid values for the minimum numbers of digits, lowercase letters, uppercase letters, and other characters that the new password must contain: 0 to 32. Valid values for the maximum number of times a character can appear in the new password: 1 to 32. A set of characters that the new password cannot contain.
   Key Rule	If you set Task Type to Key Rotation, you can configure the key algorithm, key length, and encryption password. Encryption Algorithm: Supported algorithms are RSA and ED25519. Key Length: If you select RSA as the key algorithm, you can set the key length to 2048, 3072, or 4096 bits. Encryption Password: Set the password for key encryption.
   Remarks	The remarks of the password change task.

5. Click Associate Account. On the Managed Accounts tab, click Add Host Account.

6. In the Add Host Account dialog box, select the host accounts and click Add.

   After the accounts are added successfully, you will receive a message that the The password change task is associated with host accounts.. You can view the created password change tasks on the Password Change page.

   Note

   • A host account can be associated with only one password change task.

   • If the task type is Password Rotation, you can only add accounts with managed passwords. If the task type is Key Rotation, you can only add accounts with managed SSH private keys. Rotating a Shared Key is not supported.

Related operations

Supported operating systems