Help Center> Cloud Bastion Host> User Guide> Logging In to the CBH System> Overview
View PDF

Overview

Port Requirements

To use the CBH system for resource management, ensure that the communication between the CBH system and the managed resources is enabled. Before you start, check whether your network ACL configuration allows access to CBH and configure the security group of the mapped CBH instance by referring to Table 1.

Table 1 Inbound and outbound rule configuration reference

Scenario

Direction

Protocol/Application

Port

Accessing the CBH system through a web browser (over HTTPS)

Inbound

TCP

443

Accessing the CBH system through SSH clients

Inbound

TCP

2222

Accessing the CBH system through Microsoft Terminal Services Client (MSTSC)

Inbound

TCP

20 or 21

Remotely accessing Linux hosts from the CBH system over SSH clients

Inbound

TCP

22

Remotely accessing Windows hosts from the CBH system over the RDP client

Inbound

TCP

3389

Accessing Oracle databases from the CBH system

Inbound

TCP

1521

Accessing MySQL databases from the CBH system

Inbound

TCP

33306

Accessing SQL Server databases from the CBH system

Inbound

TCP

1433

Accessing DB2L databases from the CBH system

Inbound

TCP

50000

License servers

Outbound

TCP

9443

HUAWEI CLOUD services

Outbound

TCP

443

Accessing a CBH system through the SSH client in the same security group as the CBH system

Outbound

TCP

2222

SMS service

Outbound

TCP

8061 or 80

Domain name resolution service

Outbound

UDP

53

Authentication Methods

CBH provides remote Active Directory (AD), Remote Authentication Dial In User Service (RADIUS), Lightweight Directory Access Protocol (LDAP), and Azure AD authentication methods. You can use existing user passwords on any of those remote servers for identity verification.

Table 2 Authentication methods

Authentication Type

Authentication Description

Local authentication

Static passwords configured for the CBH system are used for identity verification.

  • Multifactor verification can be configured for users authenticated by static password.
  • You can reset or change the static passwords through CBH. If you forgot this password, you can find it back through email.

AD domain authentication

The passwords of users on the AD server are used for identity verification.

  • Multifactor verification can be configured for users authenticated by the AD server.
  • Passwords cannot be changed through the CBH system.

RADIUS authentication

The passwords of users on the RADIUS server are used for identity verification.

  • Multifactor verification can be configured for users authenticated by the RADIUS server.
  • Passwords cannot be changed through the CBH system.

LDAP authentication

The passwords of users on the LDAP server are used for identity verification.

  • Multifactor verification can be configured for users authenticated by the LDAP server.
  • Passwords cannot be changed through the CBH system.

Azure AD authentication

The passwords of Microsoft account are used for identity verification.

The login page is redirected to the Microsoft Azure login page for you to provide credentials.

  • Multifactor verification cannot be configured for users authenticated by the Azure AD server.
  • Passwords cannot be changed through the CBH system.

Login Methods

Different login methods require different credentials. If multifactor verification is enabled, the static password login method becomes invalid.

Table 3 Login method description

Login Method

Login Description

Password

Enter the username and password of your CBH system account.

SMS

Enter the username and password of your CBH system account, click Send Code, and enter the SMS verification code you will receive.

OTP

Enter the username and password first, and then enter the mobile one-time password (OTP).

USBKey

Insert your USB key into your terminal device, select the issued USB key, and enter the corresponding personal identification number (PIN).

OTP token

Enter the username and password first, and then enter the verification code displayed on your OTP token device.