Managing a Resource Account

Constraints

• Accounts for application resources cannot be verified online.
• The administrator of a superior department can add an account in the superior department to an account group in a lower-level department.
• If you have permissions for the Account Group module, you can remove an account of superior department out of the account group. However, as a user in a low-level department, you have no permissions to add those removed accounts back to your current account group.
• A resource account can be added to multiple account groups.

Prerequisites

You have the operation permissions for the Host, AppServer, Application, and Account modules.

Searching for and Viewing Resource Account Information

1. Log in to your bastion host system.
2. Choose Resource > Account in the navigation pane.
3. View the resource account list.

   Table 1 Parameters in the resource account list

   Parameter	Description
   Account	Name of a resource account.
   Status	Status of a resource account. Normal: The resource account has been checked by clicking Test and verify, the account and password are correct, and the login is successful. Abnormal: The resource account has been checked by clicking Test and verify, but the account or password is incorrect, and the login fails. Unknown: The resource account has not been checked by clicking Test and verify after being added.
   Resource	Resource associated with the resource account. You can click the resource name to view the resource details.
   Host/App Address	IP address of the host or application resource associated with the current resource account.
   Port	Port number of the resource associated with the current resource account.
   Protocol	Protocol type of the current resource account.
   Login Type	Login mode of the current resource account.
   Department	Department that the current resource account belongs to.
   Operation	Operation that can be performed on the current resource account.

4. Search for a target resource account.
   • Quick search: Enter a keyword in the search box and select a filter criterion, such as the resource account, associated resource, and host address, to quickly search for users. You can select only one filter criterion for search at a time.
   • Advanced search: Click Advanced next to the text box and enter keywords in the corresponding attribute search boxes to search for users. You can select multiple filter criteria for search at a time.

5. View the details of a resource account.
   1. Click the name of the target resource account or click Manage in the Operation column of the account. The resource account details page is displayed.
   2. In the Basic Info area, you can view the basic information about the resource account, such as the status, creator, and last verification time.
   3. In the Joined Groups area, you can view information about the account groups to which the resource account has been added.
   4. In the Joined Equal Secret Account Group area, you can view information about the equivalent-secret account groups that the resource account has been added to.
   5. In the Authorized Account area, you can view information about the users to whom the resource account has been authorized.

      After a user is associated with a resource account, the user can view the corresponding resources after logging in to the system.

Modifying Basic Information About a Resource Account

1. Log in to your bastion host system.
2. Choose Resource > Account in the navigation pane.
3. Click the name of the target resource account or click Manage in the Operation column of the account. The resource account details page is displayed.
4. In the right pane of the Basic Information area, click Edit to modify the basic information about the resource account.

   For details, see Table 1.

Adding a Resource Account to or Removing a Resource Account from an Account Group

You can add resource accounts to different groups. Then you can manage resource accounts by group. For details about how to add multiple resource accounts to an account group or remove them from an account group in batches, see Adding a Member to or Removing a Member from an Account Group.

Verifying Managed Resource Accounts

The status of a managed resource account is used to identify whether the password of the account is valid. The password cannot be manually changed and can only be updated through account verification.

The managed resource accounts can be manually verified when they are added or automatically verified based on preset schedule.

Account verification is to verify connectivity by logging in to resources in the background. This process will not be recorded in historical sessions.

Exporting Resource Accounts

You can export resource information in batches from your bastion host so that you can have a local backup and edit basic resource information easily.

• To enhance information security of resources, you can encrypt resource information you export.
• The exported host resource file contains basic information, accounts, and plaintext passwords of managed hosts.
• The exported application server file contains basic information, path, account, and plaintext passwords of application servers.
• The exported application file contains basic information and account information, including plaintext passwords, of managed application resources.
• The exported account file contains basic account information, plaintext passwords, related resources, and related resource addresses.

1. Log in to your bastion host system.
2. Choose Resource > Account in the navigation pane.
3. (Optional) Select the target resource account. If you do not select any resource account, all resource accounts are exported by default.
4. Click in the upper right corner. The configuration window is displayed.

   Table 3 Exporting resource accounts

   Parameter	Description
   Set encryption password	Set an encryption password for the file to be exported. The file exported to the local PC can be opened only after the encryption password is entered. Password rules: The password must contain 8 to 32 characters. Only uppercase letters, lowercase letters, digits, and special characters (!@$%^-_=+[{}]:,./?~#*) are allowed. At least three of the four character types described above are used.
   User Password	Enter the login password of the current user to ensure the security of the exported data. If you use an IAM, SAML, or Azure AD account to log in to a bastion host, a local password is required. If it is not configured, configure one in the Profile center or contact the administrator. For details, see Changing Your Password/Setting a Local Password.
   Export Format	Select the format of the file to be exported. You can select csv or Excel.

5. Click OK.
6. Click Go to Download Center to go to the download task list.
7. When the Packing Progress of the download task reaches 100%, click Download in the Operation column to download the file to a local PC.

   Open the local file and enter the encryption password. After the verification is successful, you can view the exported resource account information.

Deleting One or More Resource Accounts

• If a resource has only one account configured in your bastion host, the resource cannot be accessed through the bastion host once the account is deleted. Exercise caution when performing this operation.
• Before deleting a target resource account, make sure no tasks are in progress or operated on the corresponding resources. The deletion takes effect immediately, and the ongoing operations or sessions will be interrupted immediately. Exercise caution when performing this operation.

1. Log in to your bastion host system.
2. Choose Resource > Account in the navigation pane.
3. Delete a resource account as required.
   • Deleting a single resource account
     1. In the Operation column of the target resource account, click Delete.
     2. In the displayed dialog box, click OK.
   • Deleting resource accounts in batches
     1. In the resource account list, select multiple resource accounts.
     2. Click Delete in the lower left corner of the list.
     3. In the displayed dialog box, click OK.