Help Center/ Cloud Bastion Host/ User Guide/ System Configuration/ Authentication Configuration/ Configuring Multifactor Verification/ Configuring USB Key Login
Updated on 2026-11-09 GMT+08:00
View PDF

Configuring USB Key Login

Scenarios

In enterprise O&M security management, a bastion host serves as a unified O&M entry point and is responsible for centralized access and management of core assets. However, relying on static password authentication alone leaves systems vulnerable to credential theft and spoofing. Under stringent compliance frameworks, such as financial audits and DJCP MLPS Level 3 or higher, O&M personnel accessing the bastion host must adhere to higher identity authentication standards, where static passwords or even dynamic tokens alone cannot meet strong authentication requirements. To enhance login security through hardware-based strong identity authentication, enterprises can configure the USB key login mode.

A USB key is a hardware authentication mode based on digital certificates. It implements identity authentication through physical media. USB keys from different vendors use different encryption technologies and certificate systems and cannot be identified by each other. Therefore, you need to configure the corresponding vendor based on the USB key you purchased. After the configuration, you can insert the USB key and enter the PIN when logging in to the bastion host system. Then, you can complete identity authentication through hardware certificate authentication.

Notes and Constraints

  • In an instance, USB keys of only one vendor can be used. Currently, the bastion host system can identify the following USB key vendors and models: Longmai (mToken GM3000), FTCX (ePass3000GM), JDZY, and BJCA.
  • A USB key can be issued to only one user.

Prerequisites

  • You have obtained a USB key and installed the USB key driver locally.
  • You have specified the USB key vendor for the bastion host system based on the purchased USB key. For details, see Configuring the USB Key Vendor.
  • Your role has the management permission for the User and USBKey modules. For details about the permissions of each role, see Role.

Step 1: Configure USB Key Authentication as the Multi-Factor Authentication Method for a User

You can issue a USB key to a user only after configuring the USBKey authentication mode for the user.

Method 1: Configure USB Key Authentication as the Multi-Factor Authentication Method for a Single User

  1. Log in to your bastion host system.
  2. In the navigation pane on the left, choose User > User. The user list page is displayed.
  3. Locate the target user and click its login name, or click Manage in the Operation column. The user details page is displayed.
  4. In the User Setting area, click Edit.
  5. In the dialog box that is displayed, select USBKey for Multifactor Verification.

    If you have configured other login verification methods and still want to use them, select them all together in this step.

    Figure 1 Selecting USBKey

  6. Click OK.

    After the configuration is complete, you can view the multi-factor verification mode of the user in the User Setting area.

Method 2: Configure USB Key Authentication as the Multi-Factor Authentication Method for Multiple Users at a Time

  1. Log in to your bastion host system.
  2. In the navigation pane on the left, choose User > User. The user list page is displayed.
  3. In the user list, select one or more target users and choose More > Edit multifactor below the list.
  4. In the dialog box that is displayed, select USBKey for Multifactor Verification.

    • If you have configured other login verification methods and still want to use them, select them all together in this step.
    • If you want to enable USB key verification for all accounts in the department that the target account belongs to or all accounts in its subordinate departments, select Modify All.

  5. Click OK.

    After the configuration is complete, choose User > User, click the login name of the target user, and view the multi-factor verification method of the user in the User Setting area.

Step 2: Issue a USB Key to a User

A USB key can be issued to only one user.

  1. Log in to your bastion host system.
  2. In the navigation pane on the left, choose User > USBKey. The USB key list page is displayed.
  3. Click Issue. The configuration window is displayed.
  4. Configure the parameters based on Table 1.

    Figure 2 Issuing a USB key
    Table 1 Parameters for issuing a USB key

    Parameter

    Description

    USBKey

    Specifies the USB key ID. Insert the purchased USB key for identification.

    Related user

    Specifies the user to which the USB key is related. USB key in multifactor verification must be enabled for such users.

    PIN

    Specifies the personal identification number (PIN) uniquely corresponding to the USB key. It is provided by the USB key vendor.

  5. Click OK. You can then view the newly issued USB key in the USB key list.

Step 3: Verify the Operation Result

After USB key authentication is configured for a user, the user must insert the corresponding USB key and enter the PIN for login verification when logging in to the bastion host. For details, see Using a USB Key for Login Authentication.

Related Operations

Revoke a USB key: If a USB key is lost or stolen, or the employee who uses the USB key has resigned, you can revoke the USB key to terminate its access permission. To revoke a USB key, choose User > USBKey. On the USB key list page, locate the row of the target USB key and click Revoke in the Operation column. Alternatively, select multiple USB keys in the USB key list and click Revoke below the list to revoke them at a time.

FAQ

If the USB key driver is accidentally uninstalled, reset the login method for user admin. For details, see Resetting Login Method for User admin.