Service Overview1 What Is CBH? CBH is an O&M security management and audit service that integrates...

Cloud Bastion Host

Service Overview

Issue 09

Date 2020-04-03

HUAWEI TECHNOLOGIES CO., LTD.

Copyright © Huawei Technologies Co., Ltd. 2020. All rights reserved.

No part of this document may be reproduced or transmitted in any form or by any means without priorwritten consent of Huawei Technologies Co., Ltd. Trademarks and Permissions

and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.All other trademarks and trade names mentioned in this document are the property of their respectiveholders. NoticeThe purchased products, services and features are stipulated by the contract made between Huawei andthe customer. All or part of the products, services and features described in this document may not bewithin the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements,information, and recommendations in this document are provided "AS IS" without warranties, guaranteesor representations of any kind, either express or implied.

The information in this document is subject to change without notice. Every effort has been made in thepreparation of this document to ensure accuracy of the contents, but all statements, information, andrecommendations in this document do not constitute a warranty of any kind, express or implied.

Issue 09 (2020-04-03) Copyright © Huawei Technologies Co., Ltd. i

Contents

1 What Is CBH?............................................................................................................................ 1

2 Functions................................................................................................................................... 2

3 Application Scenarios............................................................................................................. 4

4 Product Advantages................................................................................................................ 5

5 Editions...................................................................................................................................... 6

6 Basic Concepts........................................................................................................................11

7 Regions and AZs.................................................................................................................... 12

8 CBH and Other Services....................................................................................................... 14

9 Personal Data Protection Mechanism.............................................................................. 15

10 Security Statement............................................................................................................. 19

A Change History...................................................................................................................... 21

Cloud Bastion HostService Overview Contents

Issue 09 (2020-04-03) Copyright © Huawei Technologies Co., Ltd. ii

1 What Is CBH?

CBH is an O&M security management and audit service that integrates unifiedasset management, single sign-on (SSO), multiple terminal access protocols, andfile transmission functions. It also provides professional online O&M expertconsulting. CBH servers as a system and competent that provides 4A securitymanagement and control for Windows and Linux cloud hosts managed in CBH. ACBH system includes several functional modules such as user management,resource management, policy configuration, audit, and service ticket processing.

CBH offers CBH instances and O&M expert service.

● The O&M expert service offers real-time O&M consultation service providedby Huawei based on years of O&M experience.

● Each CBH instance connects to an independent CBH system. The CBH systemworks as a unified O&M management platform, providing core system O&Mand security audit management functions that comply with securitycompliance requirements.

– One-stop management: O&M personnel can manage multiple assetsupon one login.

– Audit with ease: All operations are logged in real time.

– Legal compliance: CBH complies with security compliance requirements,such as China's Cybersecurity Law and more.

How Can I Use CBH?

If you have registered with HUAWEI CLOUD, log in to the management consoledirectly. On the home page, choose Cloud Bastion Host under Security to accessthe CBH console and purchase CBH instances or O&M expert services. Afterpurchasing a CBH instance, you can access the CBH system through the CBHconsole.

● Log in to the CBH management console and configure security audit for CBHinstances to monitor system security.

● You can use the username and password of your CBH instance to log in to aCBH system and configure resources to implement real-time, remote, andefficient O&M.

Cloud Bastion HostService Overview 1 What Is CBH?

Issue 09 (2020-04-03) Copyright © Huawei Technologies Co., Ltd. 1

2 Functions

CBH InstancesA CBH instance corresponds to an independent CBH system. You can create users,add resources, and configure policies in a CBH system to implement securitymanagement and audit for managed resources.

● Security management capabilities for enterprises– Asset management: manages hosts, administrator accounts, O&M

accounts and permission changes.– Identity management: provides functions such as SSO, multi-factor

authentication, access control, and authorization management.– O&M management: supports SSH, Telnet, RDP, VNC, SFTP, and FTP

protocols that allow remote logins to and O&M operations on hosts.– Operation audit: provides command audit (for Linux OS) and operation

recording (for Windows OS) to identify risks.● Compliance with audit laws and regulations

– Meets the technical audit requirements in the Sarbanes-Oxley Act andClassified Information Security Protection standard.

– Meets the technical audit requirements of the financial supervisiondepartments.

– Meets O&M audit requirements of relevant laws and regulations, such asPCI, ISO/IEC 27001, and other internal compliance regulations.

● Fined-grained permission management for different roles Controls theadministrator's access to servers. Provides intelligent audit based on big datato audit, monitor, control, and trace all O&M operations.

Cloud Bastion HostService Overview 2 Functions


Expert O&M Service

Table 2-1 O&M services in Expert O&M Service

ServiceContent

Description

7 x 24technicalsupport

24/7 technical support by service ticket, telephone, or WeChatand remote assistance for troubleshooting

Installation andconfigurationtraining

5 person-days for professional services such as configuration,training, help seeking, and troubleshooting

Emergencytechnicalsupport

Technical support for emergency and major events

Expert O&Mconsultation

O&M consulting service tailored to your cloud service situation

Cloud Bastion HostService Overview 2 Functions


3 Application Scenarios

CBH is usually used in the O&M scenarios of enterprise users. It provides thefollowing O&M services for enterprise users:

● Managing numerous O&M accountsA company often has multiple hosts managed by a limited number of O&Mpersonnel. Each of them has to maintain multiple hosts and systems. Thismeans the O&M personnel not only needs to manage numerous machineaccounts and passwords, but also switch between multiple systems. As aresult, with such increase of workload, O&M is inefficient and error prone,affecting the running of IT systems.

● Absence of fine-grained permission controlCompanies usually use the built-in authorization of operating systems tocontrol O&M permissions. Such authorization is scattered in different devicesand systems, without a unified O&M authorization policy. Also, theauthorization granularity is coarse, and permissions are not controlled basedon the least-privilege principle. In this case, the O&M personnel is oftengranted with more than enough permissions and abuse of internal operationpermissions is common.

● Lack of effective monitoring over O&MAbsence of monitoring over O&M processes results in difficulties in locatingfaults and tracking responsibilities in case of network security events. Manycompanies choose to outsource system O&M work to system suppliers orthird-party O&M providers due to insufficient manpower. However, this ofteninvolves more than one supplier or agent, and the personnel mobility is high.Therefore, risks are increasingly prominent due to lack of monitoring overO&M.

Cloud Bastion HostService Overview 3 Application Scenarios


4 Product Advantages

● 24/7 technical support and real-time online guidance by O&M experts● Free of installation of clients for resource logging, real-time resource

monitoring, and file uploading and downloading● Centralized account management and unified host, network device, and

application release management● Playback of historical access records and search of operation instructions,

allowing users to view the access status of hosts and network devices at anytime

● Fine-grained permission control and dynamic permission authorization● Real-time command interception and control of sensitive commands on

managed hosts● Cooperative O&M on the same session by inviting other O&M personnel or

experts

Cloud Bastion HostService Overview 4 Product Advantages


5 Editions

Currently, CBH has six editions available, including Basic 100, Enhanced 100,Basic 200, Enhanced 200, Basic 5000, and Enhanced 5000. All basic editionsprovide identity authentication, permission control, account management, andsecurity audit. In addition to the functions of the basic editions, enhanced editionsoffer automatic O&M, database audit, and expert O&M consultation service.

Currently, CBH does not support custom specifications. However, you can upgradea basic edition to another basic edition having higher specifications or anenhanced edition as needed.

Features in Different Editions

Table 5-1 Features in different editions

Function

Description BasicEdition

EnhancedEdition

Identityauthentication

Offer two-factor authentication (including mobile phonetoken, mobile phone SMS, USB key, and dynamic token)and remote authentication (including AD domain andRADIUS) to ensure account login security and meet theidentity authentication requirements of classifiedinformation security protection.

√ √

Permissioncontrol

Grant different permissions based on users, user groups,accounts, and account groups and restrict the accesspermission of a single user or to a single resource.

√ √

Assign different roles to users and configure differentpermissions for different roles.

√ √

Configure two-person authorization for permissionapproval, ensuring absolute security of core sensitiveresources.

√ √

Cloud Bastion HostService Overview 5 Editions


Function


EnhancedEdition

Configure command control policies to accurately controlor dynamically authorize key instructions executed onmanaged resources.

√ √

Configure database control policies to precisely restrictsensitive instructions and perform dynamicauthorization.

N/A √

Accountmanagement

Manage accounts by group and department and specifydifferent levels of a department to manage account bylevel.

√ √

Manage SSH, RDP, VNC, Telnet, FTP, SFTP, SCP, andRlogin protocols run on managed hosts as well asbrowsers or client applications, including Chrome,Internet Explorer, Firefox, SecBrowser, Oracle Tool,MySQL, SQL Server Tool, dbisql, VNC Client, vSphereClient, and Radmin.

√ √

Manage DB2, MySQL, SQL Server, and Oracle databaseprotocols run on managed hosts.

N/A √

Manage accounts and passwords for logging in tomanaged hosts and configure password change policiesto allow users to periodically change managedpasswords.

√ √

Configure account synchronization policies to detectzombie accounts or unmanaged accounts in a timelymanner.

N/A √

Security audit

Record entire O&M process and support video and textaudit.

√ √

Configure OCR to recognize image files to be audited astext files, improving the audit efficiency of image O&M.

N/A √

EfficientO&M

Use HTML5 for remote login and enable users toimplement O&M such as real-time operation monitoringand file upload and download without having to install aclient.

√ √

Publish managed resources as applications for O&Mpurposes and use the remote browser isolation (RBI)model to access to applications and data.

√ √

Allow a user to invite multiple users to participate in areal-time O&M session to improve O&M efficiency.

√ √



Function


EnhancedEdition

Use the wss-based file management technology toupload, download, and manage files online.

√ √

Configure command execution, script execution, and filetransfer O&M tasks for automated O&M.

N/A √

Support single sign-on (SSO) O&M and one-click loginto target resources.

N/A √

Edition Details

Table 5-2 Description of each edition

Edition ConcurrentRequests

HardwareConfiguration

BasicFunction

EnhancedFunction

Service Support

Basic 100 100 4-core CPU | 8 GBmemory100 GB system disk1,000 GB data diskEIPs on demand

IdentityauthenticationPermissioncontrolAccountmanagementSecurityaudit

- Available duringregular businesshours

Enhanced100

100 4-core CPU | 8 GBmemory100 GB system disk1,000 GB data diskEIPs on demand


AutomaticO&MDatabaseO&M audit

● 24/7 service● 24/7 online

technical support● 5 installation and

configurationtraining courses

● Emergency service● Expert O&M

consultation



Edition ConcurrentRequests

HardwareConfiguration

BasicFunction

EnhancedFunction

Service Support

Basic 200 200 4-core CPU | 8 GBmemory100 GB system disk1,000 GB data diskEIPs on demand



Enhanced200

200 4-core CPU | 8 GBmemory100 GB system disk1,000 GB data diskEIPs on demand







consultation

Basic 5000 2,000 8-core CPU | 16 GBmemory100 GB system disk2,000 GB data diskEIPs on demand



Enhanced5000

2,000 8-core CPU | 16 GBmemory100 GB system disk2,000 GB data diskEIPs on demand







consultation



For more historical specifications, see What Are the Editions Available in CBH?



https://support.huaweicloud.com/en-us/cbh_faq/cbh_03_0025.html

6 Basic Concepts

Cloud Bastion HostCloud Bastion Host (CBH) is a system and component that provides 4A securitymanagement and control for cloud hosts and applications run on them. A CBHsystem has function modules for user management, resource management, policyconfiguration, audit, and service ticket processing. It provides securitymanagement and control for hosts running Windows or Linux OSs. CBH is anO&M security management and audit service that integrates unified assetmanagement and single sign-on (SSO), multiple terminal access protocols, andfile transmission functions.

CBH InstanceA CBH instance corresponds to a CBH system that runs independently. Users canlog in to the CBH console to purchase and manage CBH instances. A user can login to a CBH system to perform O&M security management and auditing only afterthe user has purchased a CBH instance.

Identity Access ManagementIdentity access management provides functions such as Single Sign-On (SSO),authentication management, policy-based centralized authorization and audit,dynamic authorization, and enterprise manageability.

Single Sign-OnSSO is to map the login status of a user in one application to other applications.In this way, a user logs in with a single ID and password to gain access to any ofseveral related systems.

Cloud Bastion HostService Overview 6 Basic Concepts


7 Regions and AZs

A region and availability zone (AZ) identify the location of a data center. You cancreate resources in a specific region and AZ.

● A region is a physical data center, which is completely isolated, improvingfault tolerance and stability. The region that is selected during resourcecreation cannot be changed after the resource is created.

● An AZ is a physical location where power and networks are physically isolatedwithin a region. Each AZ provides cost-effective and low-latency networkconnections that are unaffected by faults that may occur in other AZs. Aregion contains one or more AZs that are physically isolated butinterconnected through internal networks. Because AZs are isolated from eachother, any fault that occurs in an AZ will not affect other AZs.

The following figure shows the relationship between regions and AZs.

Figure 7-1 Regions and AZs

HUAWEI CLOUD provides services in many regions around the world. Select aregion and AZ based on requirements.

Selecting a Region

A region is a geographic area. Huawei has deployed data centers in multipleregions to provide services nationwide. A nation can have different regions.

Cloud Bastion HostService Overview 7 Regions and AZs


It is recommended that you select the nearest region. For example, if you or yourcustomers are located in Beijing, select a CN North region for low network latencyand high service access rate.

VPCs in different regions cannot communicate with one another through aninternal network. Therefore, you are advised to configure a CBH instance and theselected VPC to be in the same region when purchasing the CBH instance.

Currently, CBH is available in CN North-Beijing1, CN North-Beijing4, CN East-Shanghai1, CN East-Shanghai2, CN Southwest-Guiyang1, CN South-Guangzhou, and CN South-Shenzhen regions for users in Chinese mainland.

Selecting an AZWhen deploying resources, consider your applications' requirements on disasterrecovery (DR) and network latency.

● If your applications require high DR capability, you are advised to deployresources in different AZs in the same region.

● If your applications require low latency between instances, you are advised todeploy resources in the same AZ.

To reduce network latency, you are advised to set a CBH instance and the selectedVPC to be in the same AZ when purchasing CBH.

Cloud Bastion HostService Overview 7 Regions and AZs


8 CBH and Other Services

Virtual Private Cloud (VPC)Virtual Private Cloud (VPC) provides a virtual network environment for you toconfigure security groups and subnets for your CBH instance. This allows you tomanage and configure internal networks. You can also customize access rules forsecurity groups to enhance security.

Elastic Cloud Server (ECS)A CBH instance is created on an ECS. You can use the CBH instance to manageassets, identities, and operations running on your hosts.

Bare Metal Server (BMS)CBH supports asset management, identity management, and operations audit ofBMSs.

Cloud Trace Service (CTS)You can enable CTS on HUAWEI CLOUD to record operations on your CBHinstances, facilitating future query, audit, and backtracking. For details, see theCloud Trace Service User Guide.

Cloud Bastion HostService Overview 8 CBH and Other Services


9 Personal Data Protection Mechanism

CBH offers CBH instances and O&M expert service.

● No personal data is collected during creation of a CBH instance. After aninstance is created, you need to create a user account for logging in to theCBH system. Creating a user account for logging in to the system requirespersonal data.

● Information about the enterprise or user company and O&M contact of a CBHinstance is required for the O&M expert service for quick O&M responses.

To ensure that your personal data, such as the username, password, and mobilephone number for logging in to a CBH system, will not be obtained byunauthorized or unauthenticated entities or people and to prevent data leakage,CBH encrypts your personnel data before storing it to control access to the dataand records logs for operations performed on the data.

Personal Data to Be CollectedTable 9-1 lists the personal data generated or collected by CBH.

Table 9-1 Personal data

Item Type Collection Method CanBeModified

Mandatory

CBHinstances

Loginname

Login name configuredby the systemadministrator during usercreation

No YesLogin names are used toidentify users.

Cloud Bastion HostService Overview 9 Personal Data Protection Mechanism



Mandatory

Password

● Password configuredby the systemadministrator duringuser creation orpassword resetting

● Password reset by auser when they log into a CBH system forthe first time orpassword changed bya user after the userlogs in to the CBHsystem

Yes YesThis password is used bythe user to log in to aCBH system.

Email ● Email addressconfigured by theadministrator duringuser creation

● Email address enteredby a user after theuser logs in to theCBH system

Yes YesThis email address isused to receivenotifications sent by theCBH system.

Mobilenumber

● Mobile phone numberconfigured by theadministrator duringuser creation

● Mobile phone numberentered by a userafter the user logs into the CBH system

Yes Yes● This mobile phone

number is used toreceive SMSnotifications from theCBH system.

● This mobile phonenumber is also used toreceive verificationcodes sent by the CBHsystem duringpassword resetting.

ExpertO&MService

Company

Company name enteredduring purchase of theExpert O&M Serviceinstance

No YesThe company name ismandatory in the manualverification phase.

Contact

Contact entered duringpurchase of the ExpertO&M Service instance

No YesThe contact is mandatoryin the manualverification phase.




Mandatory

Phone Mobile phone numberentered during purchaseof the Expert O&MService instance

No YesThe phone number ismandatory in the manualverification phase.

Storage ModeCBH uses encryption algorithms to encrypt users' sensitive data and storesencrypted data.

● Login names are not sensitive data and stored in plaintext.● Passwords, email addresses, and mobile numbers are encrypted for storage.● Company name, contacts, and phone numbers are encrypted for storage in

the background

Access Permission Control● Personal data of the CBH system users is encrypted for storage. A security

code is required for the system administrators and upper-level administratorsto view users' mobile numbers and email addresses. However, passwords ofall users are invisible to all.

● After an expert O&M service instance is purchased, users' personal data isencrypted and stored in the CBH databases. Token authentication is requiredfor accessing personal data.

Two-factor AuthenticationAfter multi-factor authentication is configured for a user, the user needs to beauthenticated again when logging in to the CBH system. The secondaryauthentication includes SMS message, mobile OTP, USB key, and dynamic tokenmodes. This effectively protects sensitive information of the users.

Logging● The CBH system records audit logs for all operations on users' personal data,

including adding, modifying, querying, and deleting data. The logs can bebacked up to a remote server or local computer. Users with the auditpermission can view and manage logs of user accounts in lower-leveldepartments. The system administrator admin has the highest permission andcan view and manage operation records of all user accounts used to log in tothe CBH system.

● After an expert O&M service instance is purchased, users' personal data isstored in the CBH databases. For operations except adding, modifying,querying, or deleting data, only the logs that are recorded in the backgroundfor the first is retained. Users cannot directly view those logs. They need to



obtain service permission authentication through the service code to querythose logs.



10 Security Statement

Before using CBH, read this security statement carefully and perform accordinglyto avoid network security issues.

Managing AccountsThe default account admin is the default administrator of a CBH system. Thepassword is the password you set during purchase of the CBH instance.

Change the password as prompted upon your first login to the CBH system.Otherwise, the CBH system page cannot be reached.

Managing PasswordsTo ensure security, you are advised to set passwords according to the followingrules:

● Change the password and configure phone number as prompted after you login to the CBH system. Otherwise, the requested CBH system cannot bereached.

● The complexity of a password must meet the following security policies:– Contain 8 to 32 characters.– Contain at least three of the following character types: uppercase letters

(A to Z), lowercase letters (a to z), digits (0 to 9), and special characters.– Cannot contain the username or the username spelled backwards.

● It is recommended that you periodically change your password for accountsecurity.

Feature Statement● The purchased products, services and features are stipulated by the contract

made between Huawei and the customer. All or part of the products, servicesand features described in this document may not be within the purchasescope or the usage scope.

● The information in this document is subject to change without notice. Everyeffort has been made in the preparation of this document to ensure accuracyof the contents, but all statements, information, and recommendations in thisdocument do not constitute a warranty of any kind, express or implied.

Cloud Bastion HostService Overview 10 Security Statement


● CBH supports the HTTPS protocol but not the HTTP protocol.● Make sure CBH is used in compliance with laws and regulations.

Third-Party SoftwareCBH uses the following third-party software:

● Password package decryption tool: used to view passwords in the WindowsOS.

● Browsers and versions for logging in to a CBH system. For details, see Table10-1.

Table 10-1 Recommended browsers and versions

Browser Version Description

IE 11 or later Upload restriction: On the H5 O&M page, themaximum size of a single uploaded file is 4GB.

Chrome 52.0 or later None

Safari 10 or later None

Firefox 50.0 or later None

Such software can be downloaded in either of the following ways:

● Log in to the CBH system as a system administrator. On the page that isdisplayed, click the download icon in the upper right corner. On the displayedDownload Center page, download the required software.

● Log in to the CBH system as an O&M user. On the page that is displayed, clickthe download icon in the upper right corner. On the displayed DownloadCenter page, download the required software.

Cloud Bastion HostService Overview 10 Security Statement


A Change History

Released On Change History

2020-01-17 This issue is the eighth official release.The updates are as follows:● Modified the password management description in the

Security Statement.

2019-12-10 This issue is the seventh official release.The updates are as follows:● Added Editions.

2019-10-28 This issue is the sixth official release.The updates are as follows:● Added Personal Data Protection Mechanism.

2019-09-06 This issue is the fifth official release.The updates are as follows:● Added descriptions of the O&M expert service and CBH

instances in What Is CBH?.● Added descriptions of the O&M expert service and CBH

instances in Functions.● Added Regions and AZs.

2018-09-18 This issue is the fourth official release.

2018-07-27 This issue is the third official release.

2018-06-04 This issue is the second official release.

2018-05-15 This issue is the first official release.

Cloud Bastion HostService Overview A Change History


Service Overview1 What Is CBH? CBH is an O&M security management and audit service that integrates...

Documents

Transcript of Service Overview1 What Is CBH? CBH is an O&M security management and audit service that integrates...