Creating a Password Rule

Scenarios

With password rules, you can let the bastion host periodically change the passwords of multiple managed resources accounts at a time, enhancing the managed resource account security.

With password rules, you can:

• Change passwords of managed resource accounts manually, periodically, or at a scheduled time.
• Change the passwords of multiple managed resource accounts to different passwords randomly generated by the system, the same password generated by the system, or the same password you specify.

Notes and Constraints

• Password rules apply only to hosts or databases configured with SSH, MySQL, SQL Server, Oracle, MongoDB, RDP, or Telnet protocols.
• To enable a password change rule for Windows hosts, enable the SMB service and open port 445 in the security group.
• Windows 10 does not support password change in SMB mode. Before associating a Windows 10 resource account, you need to configure WinRM and create a password rule. For details about how to configure server parameters, see (Optional) Configuring Parameters for a Windows 10 Server.
• Windows domain accounts do not support password change.

Prerequisites

• Your role has the management permission for the Password Rules module. For details about the permissions of each role, see Role.
• The configured OS type of the resource whose account password you want to change must be the same as the actual OS type of the resource.
• The login mode for resource accounts in a password rule must be automatic login or privilege escalation login. Otherwise, the corresponding account cannot be selected during policy creation.

Creating a Password Rule

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose Policy > Password Rules > Password Rule.
3. Click New in the upper right corner of the page to switch to the New ChangePassword Rule dialog box.
4. Configure the basic information.

   Table 1 Parameter for password rules

   Parameter	Description
   Rule Name	Name of a password rule. The rule name must be unique in a bastion host. Naming rules: The value can contain 1 to 64 characters. Only letters, digits, and hyphens (-) are allowed.
   Timing	Select an execution method for the password rule. Manual: Manually trigger the password rule to change the password of the managed resource account. Fixed-Time: The password change rule is triggered by the bastion host to change the password of the managed resource account at a fixed time. This type of rule is executed only once. Cycle: The password rule is periodically triggered by the bastion host to change the passwords of the managed resource accounts. This type of password change rule is triggered periodically.
   Execute Time	Date when the password rule is executed. The default execution time is at 00:00 every day.
   Cycle	The cycle for password changes. Then, you can preview when the latest five password changes happened in Time Preview. NOTE: The unit is day. If a positive integer containing more than eight digits is entered, the execution time cannot be previewed. You need to set the End Time for this type of rules. Otherwise, the rule will be executed indefinitely.
   Method	How the password is changed. The options are Generate different passwords, Generate the same password, and Specify the same password. Generating a different password: The system randomly generates different passwords for managed resource accounts in compliance with password requirements. Generating the same password: Randomly generate the same password for managed resource accounts in compliance with password requirements. Specifying the same password: You need to manually enter a preset password. Enter the password as prompted. NOTE: A password randomly generated by a bastion host contains 20 characters, including uppercase letters, lowercase letters, digits, and the following special characters %, -, _, and? A random password must contain at least an uppercase letter, a lowercase letter, and a special character.
   Options	The following options are supported: Allow to change the sudo account password: To change the password of sudo account, select this option, or the password of the sudo account cannot be changed. This option is not selected by default. Priority use of the sudo account to change password: To let the system automatically search for the corresponding sudo account and use it to change the account password, select this option. If no sudo account is available, the password can be changed using the current account. This option is selected by default. Allow to change the SSH Key: To let the system automatically change SSH public keys, select this option. NOTE: The Allow to change the SSH Key option is supported in version 3.3.36.0 and later only. To use this function, upgrade your bastion host instance to the latest version by referring to Upgrading the Instance Version. If you select the key pair automatic login mode when managing host resources, enable Allow to change the SSH Key, or manual password change may fail.

5. Click Next and start to relate the rule to one or more accounts or account groups.
   • You can associate a rule with multiple managed resource accounts or account groups at once.
     • Select a resource account or account group: On the Relate Account or Relate Account Group tab, select the target resource account or account group in the Selectable accounts or Selectable account groups box, and click to move it to the Selected accounts or Selected account groups box.
     • Remove a resource account or account group: On the Relate Account or Relate Account Group tab, select the target resource account or account group in the Selected accounts or Selected account groups box, and click to remove it back to the Selectable accounts or Selectable account groups box.
   • After an account group is associated with a rule, accounts automatically obtain the permissions of the rule the instant they are added to the account group.
   • If you skip this step, you can associate resource accounts or account groups with the rule later on the password rule list page or details page.

6. Click OK.

   You can return to the password rule list page and view the new password rule.

(Optional) Configuring Parameters for a Windows 10 Server

1. Log in to a Windows 10 server.
2. Start the Windows Remote Management (WinRM) service.
   1. Search for Windows Components.
   2. In the navigation pane on the left, choose the local service. In the window displayed on the right, locate Windows Remote Management(WS-Management).
   3. Right-click Windows Remote Management(WS-Management) and choose Start from the shortcut menu.

3. Configure WinRM.
   1. Run PowerShell as the administrator and run the following command:

      winrm qc

   2. Perform twice. After the command output is displayed, enter y as prompted.
   3. Run the following commands:

      winrm set winrm/config/service '@{AllowUnencrypted="true"}'

   4. Run the following commands:

      winrm set winrm/config/service/auth '@{Basic="true"}'

4. (Skip this step if you are already an administrator.) Run the following command to add a user to the user group:

   For example, run the following command to add appuser01 to the user group:

   net localgroup "Remote Management Users"  appuser01  /add

5. In the PowerShell dialog box, run the following command to add a firewall:

   New-NetFirewallRule -DisplayName "WinRM-5985" -Direction Inbound -LocalPort 5985 -Protocol TCP -Action Allow

Related Operations

To obtain the new password of the managed resource accounts, export host resource details by referring to Batch Exporting Host Resources.