Login control method and device based on operation and maintenance, bastion host, system, storage medium and program product

Abstract

The embodiment of the invention provides a login control method and device based on operation and maintenance, a bastion host, a system, a storage medium and a program product. The method is applied to a bastion host, and comprises the following steps: in response to a first login request sent by an operation and maintenance terminal, verifying the operation and maintenance terminal; wherein the first login request represents login of the bastion host; after it is determined that verification of the operation and maintenance terminal succeeds, a second login request is sent to the target server, and the second login request comprises account information of the target server corresponding to the operation and maintenance terminal; in response to first login response information sent by the target server, sending the first login response information to the operation and maintenance terminal; wherein the first login response information represents that the operation and maintenance terminal successfully logs in the target server. The method is used for achieving the effects of enhancing the safety and traceability of operation and maintenance operation and improving the efficiency and compliance of operation and maintenance management.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a login control method, device, bastion host, system, storage medium and program product based on operation and maintenance. Background Art

[0002] With the advancement of technology, the security threats faced by systems are increasing, especially in server access and management. Ensuring the security and reliability of systems has become a key focus area in the industry.

[0003] Traditional bastion host operation and maintenance systems mainly maintain security by managing server passwords and user login permissions. This relies on the server's own login failure strategy to prevent unauthorized access. Once an attacker obtains the server password through cracking, they can still directly access the server and launch an attack.

[0004] Therefore, there is an urgent need for a more secure bastion host operation and maintenance system solution. Summary of the invention

[0005] The embodiments of the present application provide a login control method, device, bastion host, system, storage medium and program product based on operation and maintenance, so as to enhance the security and traceability of operation and maintenance operations and improve the efficiency and compliance of operation and maintenance management.

[0006] In a first aspect, an embodiment of the present application provides an operation and maintenance-based login control method, which is applied to a bastion host and includes:

[0007] In response to a first login request sent by an operation and maintenance terminal, the operation and maintenance terminal is verified; wherein the first login request represents a login to a bastion host.

[0008] After determining that the authentication of the operation and maintenance terminal is successful, a second login request is sent to the target server, wherein the second login request includes the account information of the target server corresponding to the operation and maintenance terminal.

[0009] In response to the first login response information sent by the target server, the first login response information is sent to the operation and maintenance terminal; wherein the first login response information indicates that the operation and maintenance terminal has successfully logged into the target server.

[0010] In a second aspect, an embodiment of the present application provides a login control device based on operation and maintenance, the method being applied to a bastion host, the method comprising:

[0011] A verification module, configured to verify the operation and maintenance terminal in response to a first login request sent by the operation and maintenance terminal; wherein the first login request represents a login to the bastion host;

[0012] A login module, configured to send a second login request to a target server after determining that the authentication of the operation and maintenance terminal is successful, wherein the second login request includes account information of the target server corresponding to the operation and maintenance terminal;

[0013] The sending module is used to send the first login response information sent by the target server to the operation and maintenance terminal in response to the first login response information sent by the target server; wherein the first login response information indicates that the operation and maintenance terminal has successfully logged into the target server.

[0014] In a third aspect, an embodiment of the present application provides a bastion server, including: a memory, a processor;

[0015] The memory stores computer-executable instructions;

[0016] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0017] In a fourth aspect, an embodiment of the present application provides a login control system based on operation and maintenance, including: an operation and maintenance terminal, a target server, and a bastion host as described in the third aspect above.

[0018] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0019] In a sixth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0020] The embodiment of the present application provides a login control method, device, bastion host, system, storage medium and program product based on operation and maintenance. The method uses the bastion host system as an intermediary, and first responds to the first login request sent by the operation and maintenance terminal, which is intended to log in to the bastion host. At this stage, the account management service will verify the identity and approval request of the operation and maintenance terminal. After successful verification, the operation and maintenance terminal will send a second login request to the account management service to log in to the target server, and the account management service and the bastion host service will complete the unlocking and login of the operation and maintenance terminal account. Finally, the bastion machine will feed back the login result to the operation and maintenance terminal in real time, so that the operation and maintenance personnel can immediately understand the login status. Through the intermediary role of the bastion host, centralized management and verification of operation and maintenance login requests are realized, unauthorized access is effectively prevented, and the security of the operation and maintenance process is significantly improved. The operation and maintenance personnel do not need to remember or manage the account passwords of multiple servers. They only need to log in once through the bastion host to automatically complete the connection with the target server, simplifying the operation and maintenance process and improving work efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0022] Figure 1 A schematic diagram of a scenario of login control based on operation and maintenance provided in an embodiment of the present application;

[0023] Figure 2 A schematic diagram of a login control method based on operation and maintenance provided in an embodiment of the present application Figure 1 ;

[0024] Figure 3 A schematic diagram of a login control method based on operation and maintenance provided in an embodiment of the present application Figure 2 ;

[0025] Figure 4 A schematic diagram of a login control device based on operation and maintenance provided in an embodiment of the present application Figure 1 ;

[0026] Figure 5 A schematic diagram of a login control device based on operation and maintenance provided in an embodiment of the present application Figure 2 ;

[0027] Figure 6 A schematic diagram of the structure of a bastion host provided in an embodiment of the present application.

[0028] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0029] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0030] Figure 1 A schematic diagram of a scenario of login control based on operation and maintenance provided in an embodiment of the present application, such as Figure 1 As shown, the operation and maintenance terminal 101 is connected to the bastion host 102, and the bastion host 102 is connected to multiple target servers 103 and target servers 104. The operation and maintenance terminal 101 is the terminal for operation and maintenance operations. Operation and maintenance personnel start from here and can perform a series of operation and maintenance tasks after passing security verification; the bastion host 102, as an operation and maintenance intermediary, plays a role in protecting internal network resources and provides additional security measures, such as multi-factor authentication and command filtering. The target server 103 receives the operation and maintenance instructions forwarded by the bastion host and completes the corresponding configuration changes, status queries, etc.

[0031] Traditional bastion host systems rely mainly on passwords to manage server access rights. However, password management itself has many problems, such as password complexity requirements, the tediousness of changing passwords regularly, and users tend to use weak passwords. These problems make passwords easy to crack, which will make the system more vulnerable to attacks. Although the server itself usually has a login failure policy (such as locking the account after a certain number of consecutive failed logins), this policy has obvious limitations. Attackers can bypass such protection measures through distributed attacks or try again after a lockout time interval.

[0032] Therefore, the operation and maintenance-based login control method, device, bastion host, system, storage medium and program product provided in the present application can solve the above problems.

[0033] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0034] Figure 2 A schematic diagram of a login control method based on operation and maintenance provided in an embodiment of the present application Figure 1 ,like Figure 2 As shown, the method includes:

[0035] S201. In response to a first login request sent by an operation and maintenance terminal, verify the operation and maintenance terminal; wherein the first login request represents a login to a bastion host.

[0036] Exemplarily, the operation and maintenance terminal refers to the device or software interface used by the operation and maintenance personnel to perform operation and maintenance operations, such as a computer, a mobile phone, or a specific operation and maintenance management software client. The operation and maintenance personnel connect to the server or other IT resources through the operation and maintenance terminal for daily maintenance, monitoring, and management. In the deployment architecture of the bastion host, the account management service and the bastion host service are two core components. The account management service is the core component in the bastion host system for storing and managing the account information of all operation and maintenance personnel; it is responsible for operations such as the creation, modification, deletion, and permission allocation of maintenance accounts; the account management service will authenticate the operation and maintenance terminal. This usually includes steps such as verifying whether the account exists and whether the password is correct. The bastion host service filters and controls the access requests of the operation and maintenance terminal based on the permission information provided by the account server. Only authorized access requests will be allowed to pass; the bastion host service also has a command filtering function that can prevent the operation and maintenance terminal from executing certain potentially dangerous or unauthorized commands. At the same time, it will record all commands and operations executed through the bastion host for subsequent auditing and monitoring.

[0037] The operation and maintenance terminal sends the first login request to the bastion host by entering the account and password of the bastion host. After receiving the login request from the operation and maintenance terminal, the account management service in the bastion host will verify the input account and password. The verification process may include checking whether the account exists, whether the password is correct, whether the account is in a valid state, etc. If the verification is successful, the operation and maintenance terminal will be allowed to enter the bastion host system; if the verification fails, the login request will be rejected and a corresponding error prompt may be given. If the operation and maintenance terminal successfully logs in to the bastion host, it will initiate an approval request to the account management service according to the operation and maintenance task requirements. The approval request includes the target server number, usage scope, usage duration, and usage purpose. After receiving the approval request, the account management service forwards it to the designated approval personnel. The approval personnel carefully review the content in the approval request according to the approval rules and business requirements. If the review is passed, the approval personnel reply to the operation and maintenance terminal through the account management service with the message "approval passed". After receiving the message "approval passed", the operation and maintenance terminal can continue to perform subsequent operations. If the review fails, the approver will reply to the operation and maintenance terminal through the account management service with the message "approval failed", and may attach the reason for the rejection. After receiving the "approval failed" message, the operation and maintenance terminal needs to make corrections based on the reason for the rejection, or re-initiate the approval request. In order to ensure the security and compliance of the operation and maintenance operations, the login request of the operation and maintenance terminal is usually combined with the approval request to form a complete verification process. Only when both requests are passed can the operation and maintenance terminal be considered to have passed the verification, and the operation and maintenance terminal can proceed to the next step.

[0038] S202: After determining that the verification of the operation and maintenance terminal is successful, send a second login request to the target server, wherein the second login request includes account information of the target server corresponding to the operation and maintenance terminal.

[0039] Exemplarily, after the operation and maintenance terminal passes the verification of the bastion host, the operation and maintenance terminal sends a second login request to the bastion host to log in to the target server. After receiving the second login request from the operation and maintenance terminal, the account management service of the bastion host will forward the request to the bastion host service according to the configuration or policy. This is because the bastion host service is responsible for the actual login authentication and session management. The bastion host service usually stores the account and password information used by the operation and maintenance personnel to log in to the target server. This information is pre-configured. After receiving the login request from the account management service, the bastion host service will retrieve the corresponding login credentials from the stored account and password information based on the identity information in the request. After retrieving the login credentials, the bastion host service will automatically fill these credentials into the login interface of the target server to complete the login process. In this way, the operation and maintenance terminal does not need to manually enter the account and password.

[0040] S203. In response to the first login response information sent by the target server, send the first login response information to the operation and maintenance terminal; wherein the first login response information indicates that the operation and maintenance terminal has successfully logged into the target server.

[0041] Exemplarily, the first login response information is a message generated by the target server, which is used to confirm that the operation and maintenance terminal has successfully logged in to the target server. The first login response information contains additional information such as confirmation of successful login, session ID, access rights, etc. The first login response information corresponds to the login request, which indicates the successful completion of the login process. Once the target server generates the first login response information, this information needs to be passed back to the operation and maintenance terminal that initiated the login request. The login process is carried out through the bastion host system (account management service, bastion host service), and the bastion host system will be responsible for forwarding the first login response information from the target server to the operation and maintenance terminal. After receiving this response information, the operation and maintenance terminal usually displays a successful login prompt, allowing the operation and maintenance personnel to start performing subsequent operations.

[0042] The embodiment of the present application provides a login control method based on operation and maintenance. The method uses a bastion host system as an intermediary, and first responds to the first login request sent by the operation and maintenance terminal, which is intended to log in to the bastion host. At this stage, the account management service will verify the identity and approval request of the operation and maintenance terminal. After successful verification, the operation and maintenance terminal will send a second login request to the account management service to log in to the target server, and the account management service and the bastion host service will complete the unlocking and login of the operation and maintenance terminal account. Finally, the bastion machine will feed back the login result to the operation and maintenance terminal in real time, so that the operation and maintenance personnel can immediately understand the login status. Through the intermediary role of the bastion host, centralized management and verification of operation and maintenance login requests are realized, unauthorized access is effectively prevented, and the security of the operation and maintenance process is significantly improved. The operation and maintenance personnel do not need to remember or manage the account passwords of multiple servers. They only need to perform a login operation through the bastion host once to automatically complete the connection with the target server, simplifying the operation and maintenance process and improving work efficiency.

[0043] Figure 3 A schematic diagram of a login control method based on operation and maintenance provided in an embodiment of the present application Figure 2 ,like Figure 3 As shown, in this embodiment Figure 2 Based on the embodiment, a login control method based on operation and maintenance is described in detail, and the method includes:

[0044] S301. In response to a first login request sent by the operation and maintenance terminal, a connection is established with the operation and maintenance terminal, and a second login response message is sent to the operation and maintenance terminal; wherein the second login response message indicates that the operation and maintenance terminal has successfully logged into the bastion host; an approval request sent by the operation and maintenance terminal is received, and the approval request is verified to verify the operation and maintenance terminal.

[0045] In one example, the approval request includes one or more of the following information: scope of use, duration of use, and purpose of use; verifying the approval request includes: verifying the information in the approval request based on pre-stored information; wherein the pre-stored information includes one or more of the following information: allowable scope of use, allowable duration of use, and allowable purpose of use. The approval request also includes information about the target server accessed by the operation and maintenance terminal.

[0046] Exemplarily, the operation and maintenance terminal sends a first login request to the account management service in the bastion host. The first login request is a request to log in to the bastion host, including the identity information of the operation and maintenance terminal logging in to the bastion host, which is used to verify the identity of the operation and maintenance terminal. After the account management service accepts the login request of the operation and maintenance terminal, it will establish a communication connection with the operation and maintenance terminal. The connection can be a TCP / IP-based network connection for subsequent information transmission. After the account management service successfully verifies the login request of the operation and maintenance terminal, it will generate a second login response message. This response message is a confirmation message indicating that the operation and maintenance terminal has successfully logged in to the bastion host. If the account management service verification fails, a login failure message will also be sent to the operation and maintenance terminal.

[0047] After successfully logging into the bastion host, the operation and maintenance terminal will send an approval request to the account management service. The approval request may contain one or more of the following information: scope of use, duration of use, and purpose of use. The scope of use specifies the specific resources or systems that the operation and maintenance terminal needs to access or operate; the duration of use specifies the duration for which the operation and maintenance terminal needs to obtain access rights; and the purpose of use specifies the purpose or reason for the operation and maintenance terminal to access or operate resources. After receiving the approval request sent by the operation and maintenance terminal, the account management service will verify the information in the request. The account server verifies whether the information in the approval request is legal and valid based on the "pre-stored information" previously stored. The pre-stored information includes the scope of use, the allowable duration of use, and the allowable purpose of use that the account server can allow. The allowable scope of use is a list of specific resources or systems that the operation and maintenance terminal can access or operate; the allowable duration of use is the maximum duration for which the operation and maintenance terminal can obtain access rights; and the allowable purpose of use is the legal purpose or reason for the operation and maintenance terminal to access or operate resources. If the information in the approval request matches the pre-stored information and meets other verification requirements, the account server will consider the verification to be successful and grant the operation and maintenance terminal the corresponding access rights. If the information in the approval request does not match the pre-stored information, or does not meet other verification requirements, the account management service will consider the verification to have failed and reject the access request of the operation and maintenance terminal. Approval means that the operation and maintenance terminal has passed the identity authentication of the bastion host and obtained access rights to the target server.

[0048] S302: After determining that the verification of the operation and maintenance terminal is successful, send a second login request to the target server, wherein the second login request includes account information of the target server corresponding to the operation and maintenance terminal.

[0049] In one example, before sending the second login request to the target server, the method further includes: sending an account unlock request to the target server; wherein the account unlock request includes the account information of the target server corresponding to the operation and maintenance terminal, and the account unlock request is used to unlock the account of the operation and maintenance terminal based on the account information in the account unlock request; and receiving the account unlock success information sent by the target server. The account information includes the account of the target server corresponding to the operation and maintenance terminal for logging in and the password of the target server corresponding to the operation and maintenance terminal for logging in.

[0050] Exemplarily, after the account management service passes the verification of the operation and maintenance terminal, the operation and maintenance terminal first initiates a second login request to the account management service, which contains the account information corresponding to the operation and maintenance terminal logging into the target server. After receiving the request, the account management service will first send an account unlock request to the target server to unlock the target server account corresponding to the operation and maintenance terminal. If the target server successfully unlocks the account, it will send a message of successful account unlocking to the account management service. This information indicates that the account is now in an available state and can receive subsequent login requests. After receiving the information of successful account unlocking, the account management service will retrieve the account information from the previously accessed account password and use it to log in to the target server. Once the login is successful, the target server will send a successful login message to the account management service. Subsequently, the account management service will send the successful login information to the operation and maintenance terminal, thereby completing the feedback of the entire login process.

[0051] S303, sending an account lock request to the target server; wherein the account lock request indicates the operation and maintenance terminal to be locked; the account lock request is used to lock the account of the operation and maintenance terminal indicated by the account lock request; receiving the account lock success information sent by the target server.

[0052] For example, when the operation and maintenance terminal successfully logs in to the target server through the account management service, the target server will send a successful login notification to the bastion server. This notification is a signal that the target server account of the operation and maintenance terminal has been successfully used on the target server and is currently active. The account management service will actively send an account lock request to the target server. This request is an instruction that requires the target server to lock the specified account. The account management service will construct a request packet containing the lock instruction and necessary information, and then send it to the target server through the network. This request packet usually contains the identifier of the locked account (such as the user name), the type of lock operation (such as immediate lock, delayed lock, etc.), and possible other related parameters. In the account lock request, a key part is to indicate the account of the operation and maintenance terminal that needs to be locked. This indication is usually achieved by specifying one or more specific account identifiers (such as user name, user ID, etc.) in the request packet. In this way, the target server can accurately identify which accounts need to be locked. When the target server receives the account lock request, it will lock the specified account according to the instructions in the request. This operation includes setting the account status to locked in the user database of the target server. The purpose of this is to ensure that during the period when the account is locked, even if someone obtains the account's login credentials, they cannot use the account to log in. After completing the account lock operation, the target server will send a notification of successful account lock to the account management service. This notification is a confirmation signal that the target server has successfully locked the specified account. After receiving this notification, the account management service can confirm that the account has been safely locked.

[0053] S304. In response to the operation and maintenance request sent by the operation and maintenance terminal, if it is determined that the operation and maintenance request is a legal request, the operation and maintenance request is sent to the target server; wherein the operation and maintenance request includes an operation and maintenance task, and the operation and maintenance task is used for the target server to execute; receiving the operation and maintenance result information sent by the target server, and sending the operation and maintenance result information to the operation and maintenance terminal.

[0054] For example, the operation and maintenance terminal will send an operation and maintenance request to the target server. This request usually contains information about the task or operation that the operation and maintenance terminal needs to perform. As an intermediary, the bastion host will perform protocol-level audit records for the operation and maintenance request sent by the operation and maintenance terminal. The bastion host will record the entire operation and maintenance request session, including screenshots, keyboard input, mouse operations, etc., and record all operation processes of the operation and maintenance terminal. The bastion host will also generate a detailed log file to record the detailed information of the operation and maintenance terminal operation, including but not limited to: operation time, operation user, operation content (such as executed commands, accessed files, etc.), and operation results. In addition, the bastion host will check the source of the operation and maintenance request, the format of the request, whether the parameters carried in the request are valid, and whether the request complies with the system's security policy. Only when the request meets all the legitimacy conditions will the bastion host consider the operation and maintenance request to be legal and continue to process the request. Once the legitimacy of the operation and maintenance request is determined, the bastion host will send it to the target server. The target server is the server specified by the operation and maintenance request that needs to perform a specific task or operation. The operation and maintenance request contains specific information about the operation and maintenance task, which will be used by the target server to perform the corresponding operation. The operation and maintenance tasks are included in the operation and maintenance request and sent to the target server. The target server will perform corresponding operations based on these task information. This is the core part of the operation and maintenance process and the ultimate purpose of the operation and maintenance request. When the target server completes the operation and maintenance task, it will send an operation and maintenance result information to the system. This information includes the results of the task execution, possible logs, error information, etc. After receiving this information, the system can analyze the execution of the operation and maintenance task. The last step is to feed back the operation and maintenance result information to the operation and maintenance terminal. In this way, the operation and maintenance personnel can understand the execution of the task in a timely manner and make further decisions or operations based on the result information.

[0055] S305. Regularly update the password of the stored operation and maintenance terminal.

[0056] For example, the bastion machine will formulate a password policy, including requirements for password length, complexity, and update frequency. The bastion machine uses encryption technologies such as symmetric encryption and asymmetric encryption to protect these passwords to ensure the security of passwords during storage and transmission. The bastion machine records operation logs for password updates. These logs include information such as the time of the update operation, the executor, and the updated password. Administrators can use the audit function of the bastion machine to view these logs. This helps ensure the compliance and traceability of password update operations.

[0057] The embodiment of the present application provides a login control method based on operation and maintenance, which realizes effective login control of the operation and maintenance terminal by establishing a connection with the operation and maintenance terminal after the bastion host responds to the first login request sent by the operation and maintenance terminal, and sending a second login response information to the operation and maintenance terminal. By receiving the approval request sent by the operation and maintenance terminal and verifying the approval request, the operation and maintenance terminal is verified to ensure the security and compliance of the operation and maintenance operation. The approval request includes information such as the scope of use, the duration of use, and the purpose of use. By comparing and verifying with the pre-stored permissible information, the accuracy and security of the operation and maintenance operation are further improved. After the verification is successful, the bastion host sends a second login request to the target server, and before that, the account unlocking operation is performed to ensure that the operation and maintenance terminal can smoothly access the target server. After the operation and maintenance operation is completed, the bastion host will also send an account lock request to the target server to ensure the account security of the operation and maintenance terminal. By regularly updating the password of the stored operation and maintenance terminal, the security of the system is further enhanced. This method can significantly enhance the security and traceability of the operation and maintenance operation, and improve the efficiency and compliance of the operation and maintenance management.

[0058] Figure 4 A schematic diagram of a login control device based on operation and maintenance provided in an embodiment of the present application Figure 1 ,like Figure 4 As shown, a login control device 40 based on operation and maintenance provided in this embodiment includes:

[0059] The verification module 401 is used to verify the operation and maintenance terminal in response to the first login request sent by the operation and maintenance terminal; wherein the first login request represents logging into the bastion host;

[0060] The login module 402 is used to send a second login request to the target server after determining that the authentication of the operation and maintenance terminal is successful, wherein the second login request includes the account information of the target server corresponding to the operation and maintenance terminal;

[0061] The sending module 403 is used to send the first login response information to the operation and maintenance terminal in response to the first login response information sent by the target server; wherein the first login response information indicates that the operation and maintenance terminal has successfully logged into the target server.

[0062] The present embodiment provides a login control device based on operation and maintenance, which can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail in this embodiment.

[0063] Figure 5 A schematic diagram of a login control device based on operation and maintenance provided in an embodiment of the present application Figure 2 ,like Figure 5 As shown, a login control device 50 based on operation and maintenance provided in this embodiment includes:

[0064] The verification module 501 is used to verify the operation and maintenance terminal in response to the first login request sent by the operation and maintenance terminal; wherein the first login request represents logging into the bastion host;

[0065] The login module 502 is used to send a second login request to the target server after determining that the authentication of the operation and maintenance terminal is successful, wherein the second login request includes the account information of the target server corresponding to the operation and maintenance terminal;

[0066] The sending module 503 is used to send the first login response information to the operation and maintenance terminal in response to the first login response information sent by the target server; wherein the first login response information indicates that the operation and maintenance terminal has successfully logged into the target server.

[0067] In one example, the verification module 501 is specifically used to:

[0068] In response to the first login request sent by the operation and maintenance terminal, a connection is established with the operation and maintenance terminal, and a second login response message is sent to the operation and maintenance terminal; wherein the second login response message indicates that the operation and maintenance terminal has successfully logged into the bastion host.

[0069] Receive the approval request sent by the operation and maintenance terminal, and verify the approval request to verify the operation and maintenance terminal.

[0070] In one example, the approval request includes one or more of the following information: scope of use, duration of use, and purpose of use; verification of the approval request is specifically used for:

[0071] The information in the approval request is verified according to the pre-stored information; wherein the pre-stored information includes one or more of the following information: the allowable scope of use, the allowable duration of use, and the allowable purpose of use.

[0072] The approval request also includes information about the target server accessed by the operation and maintenance terminal.

[0073] In one example, before sending the second login request to the target server, the method further includes:

[0074] Send an account unlock request to the target server; wherein the account unlock request includes the account information of the target server corresponding to the operation and maintenance terminal, and the account unlock request is used to unlock the account of the operation and maintenance terminal based on the account information in the account unlock request; receive the account unlock success information sent by the target server.

[0075] In one example, the device provided in the embodiment of the present application further includes:

[0076] An account lock request is sent to a target server; wherein the account lock request indicates the operation and maintenance terminal to be locked; the account lock request is used to lock the account of the operation and maintenance terminal indicated by the account lock request; and an account lock success message sent by the target server is received.

[0077] In one example, the device provided in the embodiment of the present application further includes:

[0078] In response to the operation and maintenance request sent by the operation and maintenance terminal, if it is determined that the operation and maintenance request is a legal request, the operation and maintenance request is sent to the target server; wherein the operation and maintenance request includes an operation and maintenance task, and the operation and maintenance task is used to execute the target server; the operation and maintenance result information sent by the target server is received, and the operation and maintenance result information is sent to the operation and maintenance terminal.

[0079] In one example, the device provided in the embodiment of the present application further includes:

[0080] The account information includes the account of the target server corresponding to the operation and maintenance terminal login and the password of the target server corresponding to the operation and maintenance terminal login. The stored password of the operation and maintenance terminal is updated regularly.

[0081] The present embodiment provides a login control device based on operation and maintenance, which can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail in this embodiment.

[0082] Figure 6 A schematic diagram of the structure of a bastion host provided in an embodiment of the present application. Figure 6 As shown, the electronic device 60 provided in this embodiment includes: at least one processor 601 and a memory 602. Optionally, the device 60 also includes a communication component 603. The processor 601, the memory 602 and the communication component 603 are connected via a bus 604.

[0083] In a specific implementation process, at least one processor 601 executes the computer execution instructions stored in the memory 602, so that at least one processor 601 executes the above method.

[0084] The specific implementation process of the processor 601 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0085] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0086] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0087] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0088] The embodiment of the present application also provides a login control system based on operation and maintenance, which includes: an operation and maintenance terminal, a target server and a bastion host 60.

[0089] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0090] An embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0091] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0092] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0093] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0094] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0095] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0096] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0097] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0098] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A login control method based on operation and maintenance, characterized in that: The method is applied to a bastion host, and the method includes: In response to a first login request sent by the operation and maintenance terminal, verifying the operation and maintenance terminal; wherein the first login request represents logging into the bastion host; After determining that the verification of the operation and maintenance terminal is successful, sending a second login request to the target server, wherein the second login request includes the account information of the target server corresponding to the operation and maintenance terminal; In response to the first login response information sent by the target server, the first login response information is sent to the operation and maintenance terminal; wherein the first login response information indicates that the operation and maintenance terminal has successfully logged into the target server.

2. The method according to claim 1, characterized in that In response to a first login request sent by an operation and maintenance terminal, verifying the operation and maintenance terminal includes: In response to the first login request sent by the operation and maintenance terminal, a connection is established with the operation and maintenance terminal, and a second login response message is sent to the operation and maintenance terminal; wherein the second login response message indicates that the operation and maintenance terminal has successfully logged into the bastion host; An approval request sent by the operation and maintenance terminal is received, and the approval request is verified to verify the operation and maintenance terminal.

3. The method according to claim 2, characterized in that The approval request includes one or more of the following information: scope of use, duration of use, and purpose of use; Verifying the approval request, including: Verify the information in the approval request according to the pre-stored information; wherein the pre-stored information includes one or more of the following information: allowable scope of use, allowable duration of use, and allowable purpose of use; The approval request also includes information about the target server accessed by the operation and maintenance terminal.

4. The method according to claim 1, characterized in that: Before sending the second login request to the target server, the method further includes: Sending an account unlock request to the target server; wherein the account unlock request includes the account information of the target server corresponding to the operation and maintenance terminal, and the account unlock request is used to unlock the account of the operation and maintenance terminal based on the account information in the account unlock request; Receive the account unlock success information sent by the target server.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Sending an account lock request to the target server; wherein the account lock request indicates the operation and maintenance terminal to be locked; the account lock request is used to lock the account of the operation and maintenance terminal indicated by the account lock request; Receive the account lock success information sent by the target server.

6. The method according to any one of claims 1 to 4, characterized in that The method further comprises: In response to the operation and maintenance request sent by the operation and maintenance terminal, if it is determined that the operation and maintenance request is a legitimate request, the operation and maintenance request is sent to the target server; wherein the operation and maintenance request includes an operation and maintenance task, and the operation and maintenance task is used for the target server to execute; Receive the operation and maintenance result information sent by the target server, and send the operation and maintenance result information to the operation and maintenance terminal.

7. The method according to any one of claims 1 to 4, characterized in that The account information includes an account number of the target server corresponding to the operation and maintenance terminal login and a password of the target server corresponding to the operation and maintenance terminal login; the method further includes: The stored password of the operation and maintenance terminal is updated regularly.

8. A bastion host, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 7.

9. A login control system based on operation and maintenance, characterized in that: Said include: An operation and maintenance terminal, a target server, and a bastion host as claimed in claim 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

Images