Bastionhost:Password change tasks

Conditions

• Version requirements: This feature is available only in Bastionhost Enterprise Edition and SM-compliant Edition. To purchase or upgrade a Bastionhost instance, see Purchase an instance and Upgrade an instance type.

• Task limits:

  • Password change tasks do not support shared key rotation.

  • A host account can be associated with only one password change task.

Prerequisites

You must import host assets and escrow the host accounts in Bastionhost. For more information, see Create a host and Manage host accounts.

Create a password change task

1. Log on to the Bastionhost system. For more information, see Log on to the system.

2. In the navigation pane on the left, choose Assets > Password Change.

3. On the Password Change page, click Create Password Change Task.

4. In the Password Change Task panel, configure the parameters for the task as described in the following table and then click Create.

   

   Parameter	Description
   Task Name	Enter a name for the password change task.
   Task Type	The options are Key Rotation and Password Rotation.
   Execution Mode	Select an execution mode for the task. The following modes are available: Periodic Execution: Bastionhost automatically runs the task at the specified time and interval. The execution time must be at least five minutes after the current time. The maximum period is 365 days. Scheduled Execution: Bastionhost automatically starts the task at the scheduled time. The execution time must be at least five minutes after the current time.
   Password Rule	When you set Task Type to Password Rotation, you can configure the password complexity and length. Password Complexity: Select the character types to include, such as digits, lowercase letters, uppercase letters, and other characters. Bastionhost randomly generates a new password based on the selected types. Select at least two character types. Password Length: Set the minimum and maximum password length. The value must be between 8 and 32. For example, if you set the minimum value to 8 and the maximum value to 32, a password with a random length from 8 to 32 characters is generated. Password Policy: Set the minimum number of characters, character repetition limit, and excluded characters. The total number of minimum letters and other characters cannot exceed the password length. The value for digits, lowercase letters, uppercase letters, and other characters must be between 0 and 32. The value for the number of times a character can be repeated must be between 1 and 32. Excluded character set: The generated password will not contain any characters from this set.
   Key Rule	When you set Task Type to Key Rotation, you can configure the key algorithm, key length, and encryption password. Key Algorithm: The options are RSA and ED25519. Key Length: If you select RSA as the key algorithm, you can set the key length to 2048, 3072, or 4096 bits. Encryption Password: Set the encryption password for the key. A key encryption password is a security mechanism used to protect the encryption key.
   Remarks	Enter supplementary information about the password change task.

5. Click Associate Accounts. On the Escrowed Accounts tab, click Add Host Account.

6. In the Add Host Account dialog box, select the host accounts that you want to add and click Add.

   After the account is added, a message appears indicating that the Password Change Task Is Successfully Associated With The Host Account. You can view the created password change task on the Password Change Tasks page.

   Note

   • A host account can be associated with only one password change task.

   • If the task type is Password Rotation, you can add only accounts whose passwords have been escrowed. If the task type is Key Rotation, you can add only accounts whose Secure Shell (SSH) private keys have been escrowed. Shared keys cannot be rotated.

Related operations

Operating system versions that support password change tasks