Notes and Constraints

• Cross-VPC resource management is not supported.

  A CBH instance and resources (such as ECSs and cloud databases) managed in the mapped CBH system must be in the same VPC so that the CBH system can communicate with the managed resources directly.

  If they are in different VPCs, use a VPC peering connection to connect two VPCs.

• Communication between the CBH instance security group and managed resource security group must be allowed.

  Resources managed by an instance must be accessible through the security group to which the instance belongs, and this security group must allow access from the private IP address of the instance.

  If an instance and its managed resources belong to different security groups, no communication between them is established by default. To establish a connection, add an inbound rule to the instance security group.

  Default ports for a security group: 443 and 2222, which can be accessed through a web browser or SSH client by default. To use other access methods, manually add the destination port.

• A CBH system can be logged in only through IP address and port number.
  Table 1 Inbound and outbound rule configuration reference

  Scenario Description	Direction	Protocol/Application	Port
  Accessing a bastion host through a web browser (HTTP and HTTPS) NOTE: If HTTPS is used, configure port 443 only. HTTP automatically redirects requests to HTTPS. If HTTP is used, configure both ports 80 and 443. Otherwise, the automatic redirection will not take effect.	Inbound	TCP	Ports 80 and 443
  Accessing a bastion host through Microsoft Terminal Services Client (MSTSC)	Inbound	TCP	53389
  Accessing a bastion host through an SSH client	Inbound	TCP	2222
  Accessing a bastion host through an FTP client	Inbound	TCP	2121 and 20000 to 21000
  Accessing a bastion host through an SFTP client	Inbound	TCP	2222
  Remotely accessing Linux cloud servers managed by a bastion host over SSH clients	Outbound	TCP	22
  Remotely accessing Windows cloud servers managed by a bastion host over the RDP protocol	Outbound	TCP	3389
  Accessing Oracle databases through a bastion host	Inbound	TCP	1521
  	Outbound	TCP	1521
  Accessing MySQL databases through a bastion host	Inbound	TCP	33306
  	Outbound	TCP	3306
  Accessing SQL Server databases through a bastion host	Inbound	TCP	1433
  	Outbound	TCP	1433
  Accessing DB databases through a bastion host	Inbound	TCP	50000
  	Outbound	TCP	50000
  Accessing GaussDB databases through a bastion host	Inbound	TCP	18000
  	Outbound	TCP	8000 and 18000
  License servers	Outbound	TCP	9443
  Cloud services	Outbound	TCP	443
  Accessing a bastion host system through an SSH client in the same security group	Outbound	TCP	2222
  SMS service	Outbound	TCP	10743 and 443
  Domain name resolution service	Outbound	UDP	53
  Accessing PGSQL databases through a bastion host	Inbound	TCP	15432
  	Outbound	TCP	5432
  Accessing DM databases through a bastion host	Inbound	TCP	15236
  	Outbound	TCP	5236
  Accessing Redis databases through a bastion host	Inbound	TCP	16379
  	Outbound	TCP	6379
  Accessing databases through an SSH tunnel	Inbound	TCP	62222

• Supported host types

  CBH allows you to manage Linux or Windows hosts with the SSH, RDP, VNC, Telnet, FTP, SFTP, SCP, or Rlogin protocol configured.

• Supported database types
  • Relational Database Service (RDS) DB instances
  • Databases on Elastic Cloud Servers (ECSs)
• Supported database versions
  Table 2 Supported database types, versions, and clients

  Database Type	Version	Supported Client
  MySQL	5.5, 5.6, 5.7, and 8.0	Navicat 11, 12, 15, 16 MySQL Administrator 1.2.17 MySQL CMD DBeaver 22 and 23 (supported by bastion host V3.3.48.0 and later)
  Microsoft SQL Server	2014, 2016, 2017, 2019, and 2022	Navicat 11, 12, 15, 16 SSMS 17.6, 18, and 19
  Oracle	10g, 11g, 12c, 19c, and 21c	Toad for Oracle 11.0, 12.1, 12.8, and 13.2 Navicat 11, 12, 15, 16 PL/SQL Developer 11.0.5.1790 DBeaver 22 and 23 (supported by bastion host V3.3.48.0 and later)
  DB2	DB2 Express-C	DB2 CMD command line 11.1.0
  PostgreSQL	11, 12, 13, 14, and 15	DBeaver 22 and 23
  GaussDB	2 and 3	DBeaver 22 and 23
  DM	DM8	DM management tool V8 (supported in Build 2023.12.14)
  Redis	5.0 and 6.0	redis-cli x64 5.0.9 (git:9414ab9b)

• Supported application server types and versions

  Only applications on Windows servers and Linux servers can be managed. Table 3 lists the supported operating system versions.

  Table 3 Supported application server types and versions

  OS Type	Version
  Windows	Windows Server 2008 R2 or later
  Linux	CentOS 7.9

  Note

  Currently, application operation is supported only by x86 CBH instances. Arm CBH instances do not support application operations.

To perform secure operation management through CBH, use a third-party client to log in to the CBH system.

Assets managed by a bastion host can be properly operated and maintained only when the following conditions are met:

• The asset can communicate with the bastion host system.
• The asset name must be unique.
• Different assets cannot have the same IP address, port number, and protocol type.

• The maximum number of resources that can be managed by a bastion host instance cannot exceed the number of assets allowed by the instance edition.
• The maximum number of resources that can be concurrently logged in to through a bastion host instance cannot exceed the number of concurrent requests allowed by the bastion host instance edition.