Resource Account Management

Constraints

• Accounts for application resources cannot be verified online.
• The administrator of a superior department can add an account in the superior department to an account group in a lower-level department.
• If you have permissions for the Account Group module, you can remove an account of superior department out of the account group. However, as a user in a low-level department, you have no permissions to add those removed accounts back to your current account group.
• A resource account can be added to multiple account groups.

Prerequisites

You have the operation permissions for the Host, AppServer, Application, and Account modules.

Viewing the Resource Account List

1. Log in to your bastion host.
2. Choose Resource > Account. On the displayed account list page, you can search for the target account through a quick search or an advanced search.
   • Quick search: Select a search field and enter a keyword in the search box. You can select the following search fields: resource account, associated resource, host address, sudo account, SSH key account, or passphrase.
   • Advanced search: Click Advanced next to text box and enter keywords in the corresponding attribute search boxes to search for resource accounts.

Viewing and Editing Basic Information About a Resource Account

1. In the resource account list, click the target resource account or click Manage in the Operation column. The resource account details page is displayed.
2. In the Basic Info area, view the resource account information and click Edit on the right of the Basic Info area.
3. In the displayed dialog box, modify the account information. For details about parameters, see Table 1.
4. Confirm the information and click OK.

Adding a Resource Account to an Account Group

You can add resource accounts to groups. Then you can manage resource accounts by group.

Method 1

1. In the resource account list, click the target resource account or click Manage in the Operation column. The resource account details page is displayed.
2. In the Joined Group area, view account groups the current resource account have been added to.
3. Click Edit on the right of the Joined Group area. In the displayed dialog box, add the account to or remove the account from the group.
   • Click the name of the target account group or View in the Operation column to view all information about the account group.
   • Click Remove in the Operation column of the target account group to remove the current account from the group.

Method 2

1. On the Account page, locate the row containing the target account and click Join in the Operation column.
2. In the displayed dialog box, add or remove the resource account to or from a group.

Editing Authorized Users Associated with a Resource Account

After a user is associated with a resource account, the user can view the corresponding resources after log in to the system.

1. In the resource account list, click the target resource account or click Manage in the Operation column. The resource account details page is displayed.
2. In the Authorized User area, view associated users.
3. Click a username to view the user details.

Verifying Managed Resource Accounts

The status of a managed resource account is used to identify whether the password of the account is valid. The password cannot be manually changed and can only be updated through account verification.

The managed resource accounts can be manually verified when they are added or automatically verified based on preset schedule.

NOTE:

Account verification is to verify connectivity by logging in to resources in the background. This process will not be recorded in history sessions.

Automatic verification

The system automatically verifies managed host accounts at 01:00 on the fifth, fifteenth, and twenty-fifth days of each month. After the verification is complete, the admin system administrator will receive a verification result message. No task will be generated. The message is displayed on the Messages page.

Real-time verification

1. On the Account page, select the target account and click Test and verify below the account list.
2. Configure Connect Timeout and Done notification.
   • The default Connect Timeout interval is 10 seconds. If the network condition is poor, increase the Connection Timeout interval.
   • By default, no task completion notifications will be sent.
   • To receive notifications, select Email. Additionally, you can view the verification results on the Tasks page.

3. Click OK. Refresh the Account page and view the verification results in the Status column.
   To verify all resource accounts in an account group, see Managing Resource Account Groups.

   Table 1 Resource account status description

   Status	Description
   Normal	If the system verifies that the username and password of the resource account are correct and can be used to log in to the managed resource, the account is in the Normal status.
   Abnormal	If the account username or password is incorrect, the resource account cannot be used to log in to the system. The account is in the Abnormal status.
   N/A	If a resource account is not verified after it is added, the account is in the N/A status.

Exporting Resource Accounts

You can export resource information in batches from your bastion host so that you can have a local backup and edit basic resource information easily.

• To enhance information security of resources, you can encrypt resource information you export.
• The exported host resource file contains basic information, accounts, and plaintext passwords of managed hosts.
• The exported application server file contains basic information, path, account, and plaintext passwords of application servers.
• The exported application file contains basic information and account information, including plaintext passwords, of managed application resources.
• The exported account file contains basic account information, plaintext passwords, related resources, and related resource addresses.

Procedure

1. On the Account page, select the accounts you want to export.

   If no accounts are selected, information about all accounts is exported by default.

2. Click in the upper right corner. Confirm the export in the displayed dialog box.
   • Set an encryption password to encrypt the exported file.
   • Enter your password.
   • Select the CSV or Excel format.

3. Click OK. After the task is created, click Go to Download Center. If the export progress reaches 100%, click Download in the Operation column. Then you can view the exported account information in the downloaded file.

Deleting One or More Resource Accounts

1. On the resource account list page, locate the row where the target account resides and click Delete in the Operation column.
2. In the dialog box displayed, confirm the information and click OK.
   To batch delete resource accounts, select all target accounts and click Delete below the account list.

   NOTE:

   • If a resource has only one account configured in your bastion host, the resource cannot be accessed through the bastion host once the account is deleted. Exercise caution when performing this operation.
   • Before deleting a target resource account, make sure no tasks are in progress or operated on the corresponding resources. The deletion takes effect immediately, and the ongoing operations or sessions will be interrupted immediately. Exercise caution when performing this operation.