Help Center/ Cloud Operations Center/ User Guide/ Automated O&M/ Account Management/ Automatically Changing the Password of a Host Account
Updated on 2026-07-09 GMT+08:00
View PDF
Share

Automatically Changing the Password of a Host Account

In an enterprise IT environment, you need to perform scheduled password changes of a host account to ensure the security of the host account. However, manually changing a large number of host account passwords is time-consuming, labor-intensive, and error-prone. To address this challenge, you can use the account baseline function to change the passwords of specified accounts on all hosts associated with the baseline, simplifying the password management process and improving work efficiency.

You can complete automatic password change configurations.
  1. To automatically change passwords for existing resources, you can create an account baseline or modify an account baseline on the account baseline tab page.

    Account baselines are classified into global baselines and component baselines.

    • Global baseline: It is a built-in baseline of the system. It cannot be deleted for hosts with no components bound. To use the global baseline, you need to add a baseline account by referring to Modifying an Account Baseline. After the password change policy of the global baseline is enabled, the passwords will be changed periodically based on the accounts created in the baseline.
    • Component baselines: are created instead when you create account baselines. You can create a component baseline as needed. You can add baseline accounts and components to component baselines. After the password change policy of a component baseline is enabled, the system will periodically change the passwords of the accounts created in the baseline for hosts associated with the component.

    In the application and resource management module, you can organize your applications, components, and groups in a hierarchical tree structure, starting from the highest level down. You can add a batch of hosts to the same group. You can use the account baseline function to automatically manage host account passwords and perform scheduled password updates. This function improves work efficiency, reduces human errors, and ensures system security.

  2. To automatically change the password for a new resource, set a password change policy on the Password Change Policies tab page.
  3. To perform scheduled account password changes by region, set the regions where account password changes are required on the Password Change Tasks tab page.

Prerequisites

A key has been bound to your account.

Precautions

  • Component baselines must be associated with components. If no proper component is available, create one. For details, see Creating a Component.
  • To ensure that new host instances of a component can be automatically managed, you need to enable Password Change Policy of Component Baseline. This can be done in the Component Baseline Dimension area on the Change Account Password > Password Change Policies tab page.

Constraints

  • Currently, automatic password change is supported only in some regions. For details about these regions, see Overview.
  • For RDS for MySQL and GaussDB instance resources, the accounts to be managed must have been created on the corresponding host and have the login permission.
  • An account on the ECS host that runs the Linux OS can be managed only if the following three conditions are met:
    • UniAgent 1.1.5 or later is installed and UniAgent is running.
    • The host is in the running state.
    • The host account to be managed has been created and can be used to log in to the host.

Creating an Account Baseline

You can create an account baseline based on service requirements. The created account baseline is a component baseline. You can add baseline accounts and components to the component baseline.

Exercise caution when specifying the account name. Once an account name is submitted, the system automates its scheduled password changes. Note: The account used for connecting the service code to the database cannot be specified in this module. If you do so, the service cannot connect to the database.

  1. Log in to COC.
  2. In the navigation pane, choose Resource O&M > Automated O&M.
  3. In the Routine O&M area, click Account Management. The Account Management page is displayed.
  4. Click Change Account Password. The Account Password Change tab page is displayed.
  5. Click Create Account Baseline. The Create Account Baseline page is displayed.
  6. Set account baseline information by referring to Table 1.

    Table 1 Parameters for creating an account baseline

    Parameter

    Description

    Example Value

    Baseline

    Specify a baseline name based on naming rules.

    After a baseline is created, its name cannot be changed.

    Test baseline

    Baseline Type

    Account baseline type. This parameter cannot be changed.

    Component Baseline

    Baseline Accounts

    Account Type

    Enter an account type.

    Currently, Linux, MySQL, and GaussDB accounts are supported.

    Linux

    Account

    Enter an account name.

    The account name is the server account of the resource. This account is required for subsequent operations such as password change.

    root

    Account Class

    Available options are Read-only account and Non-read-only account.

    This parameter is used only to distinguish accounts and does not affect actual functions.

    Read-only account

    Associated Components

    Select the required application or component. If you select an application, all components of the application are automatically selected.

    You can delete the associated components.

    -

  7. Click OK. The account baseline is created.

    After the account baseline is created, you can view it in the account baseline list.

    Figure 1 Viewing a baseline

Modifying an Account Baseline

To use the global baseline, you need to add a baseline account by modifying the account baseline. A created component baseline can be modified.

Exercise caution when specifying the account name. Once an account name is submitted, the system automates its scheduled password changes. Note: The account used for connecting the service code to the database cannot be specified in this module. If you do so, the service cannot connect to the database.

  1. Log in to COC.
  2. In the navigation pane, choose Resource O&M > Automated O&M.
  3. In the Routine O&M area, click Account Management. The Account Management page is displayed.
  4. Click Change Account Password. The Account Password Change tab page is displayed.
  5. In the account baseline list, locate the account baseline you want to modify and click Modify in the Operation column.
  6. Modify account baseline information by referring to Table 2.

    Table 2 Parameters for modifying an account baseline

    Parameter

    Description

    Example Value

    Baseline

    Account Type

    Enter an account type.

    Currently, Linux, MySQL, and GaussDB accounts are supported.

    Linux

    Account

    Enter an account name.

    The account name is the server account of the resource. This account is required for subsequent operations such as password change.

    root

    Account Class

    Available options are Read-only account and Non-read-only account.

    This parameter is used only to distinguish accounts and does not affect actual functions.

    Read-only account

    Associated Components

    This parameter can be set only when Baseline Type is set to Component Baseline.

    Select the required application or component. If you select an application, all components of the application are automatically selected.

    You can delete the associated components.

    -

  7. Click OK. The account baseline is modified.

Setting a Password Change Policy

You can set policies based on service requirements to ensure that the passwords of specified accounts for new host instances can be updated at a scheduled time.

Password change policies are categorized into the global baseline policies and component baseline policies.

  • Global baseline password change policy: You can enable the password change policy for Linux, MySQL, and GaussDB separately. Once you enable a global baseline-based password change policy, the policy will only apply to accounts for any newly added host instances that are not bound to components.
  • Component baseline password change policy: You can enable the password change policy for Linux, MySQL, and GaussDB separately. Once you enable a component baseline-based password change policy, the policy will only apply to the accounts for selected components on any newly added instances.

To exclude some ECS accounts from automatic password change, go to the Resources > Application and Resource Management page. Set the tag key to COCAccountPasswordAutoManagement and the tag value to NotManagePassword by referring to Managing Resource Tags. The settings take effect within one hour.

The procedure is as follows:

  1. Log in to COC.
  2. In the navigation pane, choose Resource O&M > Automated O&M.
  3. In the Routine O&M area, click Account Management. The Account Management page is displayed.
  4. Click Account Password Change and click Password Change Policies. The Password Change Policies tab page is displayed.
  5. Set a password change policy based on service requirements.

    Figure 2 Setting a Password Change Policy
    • Global baseline-based password change policies: After a global password change policy is enabled, the system updates login account passwords of accounts regularly on all the new hosts with no components bound.
    • Component baseline-based password change policies: After a component password change policy is enabled, the system updates login account passwords of accounts regularly on the new hosts to which the selected components are bound.
    • Component selection: Select the required application or component. If you select an application, all components of the application are automatically selected.

Creating a Scheduled Password Change Task

Based on service requirements, you can configure the regions where scheduled password change needs to be enabled in COC. The default Cron expression for the password change period is 0 0 0 1 * ?, indicating that the task is triggered at 00:00 on the first day of each month. The system executes the task between 00:00 and 06:00 on that day. The entire process runs automatically without manual intervention. Please wait patiently for the task to complete.

After you configure the regions where scheduled password change needs to be enabled, the system will create a scheduled password change task for each region. You can view and modify the task by referring to Managing Scheduled Tasks. The scheduled password change function of COC can automatically execute password change tasks, reducing manual intervention and improving security.

Currently, account password change can only be performed on Linux accounts.

  1. Log in to COC.
  2. In the navigation pane, choose Resource O&M > Automated O&M.
  3. In the Routine O&M area, click Account Management. The Account Management page is displayed.
  4. Click Account Password Change and click the Password Change Tasks tab.
  5. Click Select Region to configure regions for scheduled password change.
  6. Select Account Type.

    Currently, only Linux is supported.

  7. Select the regions where the passwords need to be changed and click the right arrow to move them to the right box.
  8. Click OK. The regions for executing the password change task are set.

    After the configuration, the system creates a scheduled password change task for each selected region. Click View Details in the Operation column to view the password change task in the configured regions.

More Operations

After the automatic password change task is executed, you can perform the following operations based on service requirements.

Table 3 More operations

Function

Scenario

Operation

Viewing password change records

After the automatic password change task is executed, you can view the historical password change records.
  1. On the Account Management page, access the Accounts tab page, and select the corresponding resource type.
  2. In the resource list, select the resources whose password change records need to be viewed and click More and choose Password Change History in the Operation column.

    In the Password Change History drawer, you can view the password change status, time, and failure cause.

Deleting an account baseline

If a created account baseline is no longer needed, you can delete it.

  • The global baseline cannot be deleted.
  • Before deleting a component baseline, you need to unbind all associated components from it.
  1. On the Account Management page, click Account Password Change. Access the Account Baselines tab page.
  2. In the account baseline list, locate the baseline you want to delete and click Delete in the Operation column.
  3. In the dialog box that is displayed, click OK to delete the account baseline.

    After the baseline is deleted, it will no longer be displayed in the account baseline list.

Deleting a scheduled password change task

If a scheduled change password task is no longer required in a region, you can delete the task from the region.

WARNING:

After the task is deleted from the region, the system will not automate the scheduled password changes of Linux accounts in the region. Exercise caution when performing this operation.
  1. On the Account Management page, click Account Password Change. Access the Password Change Tasks tab page.
  2. On the Password Change Tasks tab page, select the regions on which you want to perform operations and click Delete in the Operation column.
  3. In the dialog box that is displayed, click OK. The scheduled password change task is deleted from the region.

    After the deletion, the system will not change the passwords of Linux accounts in the corresponding regions regularly.

Helpful Links

The COC account management function offers a robust account baseline capability designed to automate batch password change for existing resources, ensuring unified management, security compliance, and O&M efficiency. For details, see Changing Passwords in Batches Using the COC Account Baselines.

Parent Topic: Account Management