Managing Host Account Passwords

Constraints

COC connects only to DEW deployed in the AP-Singapore region. The key of this region is used to encrypt and decrypt data on hosts in all regions.

Binding a Key

1. Log in to COC.
2. In the navigation pane, choose Resource O&M > Automated O&M.
3. In the Routine O&M area, click Account Management. The Account Management page is displayed.
4. On the displayed page, click Keys.
   Figure 1 Accessing the key management page
   

5. Click Bind Key.
6. In the key list, select the key to be bound and click OK.

   If no key is available, click Create Key to switch to the DEW service page. For details, see Creating a Key. After the key is created, go to the Bind Key or Update Key page and click on the right to update the key list.

7. Click OK. The key is bound.

   After a key is bound, you can click Update to select another key for update.

Importing an Account

Account management supports online hosting of host accounts and passwords. You can import the initial passwords of host accounts using an Excel file.

• Imported accounts for ECSs, RDS for MySQL DB instances, and GaussDB instances will not be managed, and their passwords will be excluded from any automatic password changes. To automatically manage imported accounts, you can modify the global baseline or create an account baseline to add the accounts. Then, the system will manage the accounts immediately.
• The imported accounts for DCS and DMS instances are not managed for password change. That is, these accounts' passwords cannot be automatically changed.

1. Log in to COC.
2. In the navigation pane, choose Resource O&M > Automated O&M.
3. In the Routine O&M area, click Account Management. The Account Management page is displayed.
4. Access the Accounts > By Resource or Accounts > By Application tab page.
   • By Resource applies to all purchased host instances.
   • By Application applies to purchased hosts that have been bound to an application. If you select By Application, you need to select the target application or component.

5. Select a resource type.

   By default, Elastic Cloud Server (ECS) is selected.

6. Click Import Account. The dialog box for importing accounts is displayed.
7. Add the host account and password information using an Excel file.
   Figure 2 Importing accounts
   
   1. Click download template and configure information in the downloaded template.
   2. Edit the template by referring to Table 1 and click Upload File to upload the completed template.

      You can only upload Excel files. The number of accounts cannot exceed 500, and the file size cannot exceed 1 MB.

      Table 1 Account template parameters

      Parameter	Description	Example Value
      Host resource ID	Enter the resource ID. You can obtain the resource ID from the Name/ID column in the resource list.	-
      Account Type	Select an account type based on the type of the imported resource.	Linux
      Account	Enter the name of the account you want to import. The account name can contain 1 to 64 characters.	root
      Account Class	There are two options: Normal and Privileged. The details are as follows: Normal: Read-only account. Such accounts only have the permission to view related resources or data, and cannot perform write operations like modifying, deleting, or adding resources. Privileged: non-read-only account. Such accounts have operation permissions beyond the read-only scope, and can modify resource configurations, add or delete data, and perform other write operations.	Normal
      Account Password	Enter a password of the account. The password can contain 8 to 64 characters.	-

   3. Click Import and wait until the account is imported.

8. After the accounts are imported successfully, you can locate one of the imported accounts and click View Account Password in the Operation column to view the account password.
   Figure 3 Viewing account information
   

Synchronizing an Account

If you have added a host account on the operating system, you can select the corresponding host on the account management page and click Synchronize Account to synchronize the new account. After the new account is synchronized, the password is changed immediately.

Currently, only ECS, RDS, and GaussDB host resources support one-click account synchronization.

Note: The prerequisites for synchronizing a new account are as follows: 1. The account has been configured in the account baseline. 2. If the host to which the account belongs is bound to a component, you need to associate the component with the component baseline.

1. Log in to COC.
2. In the navigation pane, choose Resource O&M > Automated O&M.
3. In the Routine O&M area, click Account Management. The Account Management page is displayed.
4. Access the Accounts > By Resource or Accounts > By Application tab page.
   • By Resource applies to all purchased host instances.
   • By Application applies to purchased hosts that have been bound to an application. If you select By Application, you need to select the target application or component.

5. Select a resource type.

   By default, Elastic Cloud Server (ECS) is selected.

6. Select the resources whose accounts need to be synchronized and click Synchronize Account.

   After the synchronization is complete, you can click View Account Password in the Operation column to view the account and password online.

Resetting a Password

Resetting a password will reset the passwords of all accounts (except imported accounts) whose password change status is successful on the host. The operation is irreversible.

1. Log in to COC.
2. In the navigation pane, choose Resource O&M > Automated O&M.
3. In the Routine O&M area, click Account Management. The Account Management page is displayed.
4. Access the Accounts > By Resource or Accounts > By Application tab page.
   • By Resource applies to all purchased host instances.
   • By Application applies to purchased hosts that have been bound to an application. If you select By Application, you need to select the target application or component.

5. Select a resource type.

   By default, Elastic Cloud Server (ECS) is selected.

6. Locate the target resource and choose More > Reset Password in the Operation column.
7. Click OK. The password is reset.
   After the password reset, you can view the password reset result by clicking View Account Password.

   Figure 4 Password reset confirmation
   

Viewing the Account Password

You can only query the account and password for one host at a time. Ensure that the password change status of the target host account is Succeeded, or that the password change failure cause is that the target account is not managed for password change. Otherwise, the password may fail to be obtained. If password change status is Failed, rectify the fault based on the failure cause.

• Conditions for changing the passwords of RDS for MySQL and GaussDB instances: The account on the host OS is the same as that in the bound account baseline.
• Conditions for changing the password of an ECS that runs the Linux OS:
  • The resources status of the host is Running.
  • The UniAgent status of the host is Running and the UniAgent version is 1.1.5 or later.
  • The account on the host OS is the same as that in the bound account baseline.
• Conditions for changing the password of an added host: The password change policy has been enabled.
• Conditions for scheduled password change of a managed host: The password change task has been bound to the host.

The procedure is as follows:

1. Log in to COC.
2. In the navigation pane, choose Resource O&M > Automated O&M.
3. In the Routine O&M area, click Account Management. The Account Management page is displayed.
4. Access the Accounts > By Resource or Accounts > By Application tab page.
   • By Resource applies to all purchased host instances.
   • By Application applies to purchased hosts that have been bound to an application. If you select By Application, you need to select the target application or component.

5. Select a resource type.

   By default, Elastic Cloud Server (ECS) is selected.

6. Locate the target resource and click View Account Password in the Operation column.
   Figure 5 Viewing account information
   

7. Locate the target resource and click Obtain Account Password in the Operation column.
   Figure 6 Viewing the Account Password
   
   • If you select By Resource on the account management page and no data is displayed on the Password Change Details page, check whether any component has been mounted to the host.
   • If a component has been mounted to the host, check whether the corresponding component baseline has been bound to the host or whether the automatic management policy for components is enabled.
   • If no components are mounted to the host, check whether the global automatic management policy is enabled.