Elastic Desktop Service:Security-related rules

Scenarios

By default, access to any domain name is allowed from within a cloud desktop. Domain name access control is used to allow or deny access to specified domain names and supports multi-level, fine-grained control over domain name access permissions.

For example, assume you have the domain names shown in the following table. You can configure DNS rules as shown in the table to implement fine-grained permission control.

Limits

• Domain name limits

  To ensure that end users can use cloud desktops normally, the following reserved security domain names are not subject to DNS rules. This means that cloud desktops can always access these domain names. If you set the access policy for these domain names to Deny, the rule does not take effect.

  • *.gws.aliyun

  • *.aliyun.com

  • *.alicdn.com

  • *.aliyunpds.com

  • *.aliyuncds.com

  • *.aliyuncs.com

• Operating system limits

  Domain name access control policies take effect only on cloud desktops that run the Windows operating system.

• Rule quantity limit

  You can configure a maximum of 300 DNS rules.

Configuration

In the Domain Name Access Control (formerly DNS Policy) section, click Add DNS Rule. In the Add DNS Rule dialog box, complete the following configurations and click OK.

Related operations

The domain name access control rules that you create are displayed in a list in the Domain Name Access Control (formerly DNS Policy) section. You can manage the rules in the list.

• Adjust DNS rule priority

  If you have multiple DNS rules, the rules that are higher in the list have a higher priority. To adjust the priority, click Move in the Actions column for the target rule and drag the rule to the desired position.

• Modify a DNS rule

  Find the target rule, click Edit in the Actions column, modify the configurations in the Edit Access Rule dialog box, and then click OK.

  Note

  After you modify a DNS rule, the changes take effect in real time.

• Delete a DNS rule

  Find the target rule, click Delete in the Actions column, and click OK in the confirmation dialog box.

• Import DNS rules in batches

  To add multiple DNS rules at once, you can use the batch import feature.

  1. Click Import Access Rules and click Download Template in the dialog box.

  2. Open and edit the template file using a workbook application.

     • Domain column: Enter the domain name for which you want to configure a DNS rule. Add one domain name per row. The wildcard character * is supported.

     • Policy column: Enter the access policy. allow indicates that access is allowed, and block indicates that access is denied.

     • Description column: Enter a custom description for the DNS rule.

  3. In the dialog box, click Upload Local File and select the edited template file.

  4. Preview the import result in the dialog box and click Start Import.

Scenarios

Limits

• Rule quantity limit

  You can configure a maximum of 200 security group rules.

• Limits on inbound rules

  By default, cloud desktops allow all outbound access. Inbound access is subject to the following principles:

  • In an Internet environment, cloud desktops do not support inbound access. Even if you configure an inbound security group rule to allow access, the rule does not take effect.

  • In an enterprise private network environment, cloud desktops deny all inbound access by default. However, you can configure an inbound security group rule to allow access requests that meet specific requirements.

Configuration

In the Security Group Control section, click Add Security Group Rule. In the Add Security Group Rule dialog box, complete the following configurations and click OK.

Related operations

The security group rules that you create are displayed in a list in the Security Group Control section. You can manage the rules in the list.

• Copy a security group rule

  To quickly create a rule based on an existing security group rule, click Copy in the Actions column for the target rule and then edit the copied rule.

• Modify a security group rule

  Find the target rule, click Edit in the Actions column, modify the configurations in the Add Security Group Rule dialog box, and then click OK.

• Delete a security group rule

  Find the target rule, click Delete in the Actions column, and click OK in the confirmation dialog box.

• Import a security group rule

  To quickly create rules based on multiple existing security group rules, especially when you operate across Alibaba Cloud accounts, you can export the existing rules and then import them.

  • In the Security Group Control section, click the icon in the upper-right corner to export the existing rules to an .xlsx file.

  • In the Security Group Control section, click Import Security Group Rules. In the Import Security Group Rules dialog box, select the exported .xlsx file, and then click Start Import to import the rules.

• Import security group rules in batches

  To add multiple security group rules at once, you can use the batch import feature.

  1. Click Import Security Group Rules and click Download Template in the dialog box.

  2. Open and edit the template file using a workbook application.

     • Type column: Enter the rule direction. inflow indicates inbound, and outflow indicates outbound.

     • Policy column: Enter the authorization policy. accept indicates that access is allowed, and drop indicates that access is denied.

     • Priority column: Enter the priority of the rule.

     • IpProtocol column: Enter the protocol type.

     • PortRange column: Enter the port that is opened by the application or protocol.

     • CidrIp column: Enter an IPv4 address range in CIDR format.

     • Description column: Enter a custom description for the rule.

  3. In the dialog box, click Upload Local File and select the edited template file.

  4. Preview the import result in the dialog box and click Start Import.

What to do next

By default, cloud desktops deny all inbound access and allow all outbound access. This means a default rule exists that allows all outbound access. In this case, the outbound rule that you add conflicts with the default rule. Depending on the office network to which the cloud desktop belongs, you may need to adjust the priority of the default rule so that your new rule can take effect.

• If you are using a new version of an office network (ID format: region ID+dir+10 digits), the default rule has the lowest priority. The rule that you add takes effect immediately, and no extra action is required.

• If you are using an office network that was upgraded from an older directory (ID format: region ID+dir+17 letters and digits), the default rule has the highest priority. You must manually adjust the priority of the default rule. The steps are as follows:

  1. Find the office network to which the cloud desktop belongs and click its office network ID.

  2. On the office network details page, click the security group ID.

  3. On the Security Groups page, click the security group ID.

  4. On the Security Group Rules page, click the Outbound tab and modify the priority of the corresponding rule.

     We recommend that you set the priority to 60. This ensures that any outbound rules that you manually add later take effect immediately.

Scenarios

End users can use restore points to back up and restore cloud desktop data. For example, before performing a risky operation, such as modifying critical system files, an end user can create a restore point.

To prevent resource waste from user errors or the creation of an excessive number of restore points, administrators can use this policy to control whether end users can create custom restore points.

Limits

This feature is available only when a cloud desktop is assigned to a single user.

Configuration

If the switch to the right of the End user-defined snapshots section is turned On, end users can set custom restore points on the Management page of the cloud desktop card.

If the switch to the right of the End user-defined snapshots section is Disabled, the entry for the custom restore point feature is hidden on the Management page and is invisible to end users.