Compute Security

HTTPS Login to the UI

ZStack Cloud allows you to log in to the UI through the HTTPS protocol, which further improves the system security.

HTTPS login is disabled by default.
After you enable HTTPS login, you can log in to the UI via the default port 5443. You can specify another port for login if needed.
After you enable HTTPS login, your HTTP login via the port 5000 will auto-direct to HTTPS. Currently, only the HTTP logins via the port 5000 can auto-direct to HTTPS.
The system supports the certificates in the PKCS12 format by default. You can also use the certificates in the JKS format. If you use the certificates of other formats, convert the formats in advance.

VM Instance Console

VM instance consoles is a quick access for you to monitor and manage VM instances. To log into VM consoles, you need to get the corresponding permissions. ZStack Cloud provides two authorization methods, allowing you to log into VM consoles either with SSH keys, or with Username/Password.

SSH Keys
- ZStack Cloud allows you to log in to VM instances with SSH keys. This method only applies to Linux-based VM instances.
- SSH keys are a couple of keys generated through an encryption algorithm: one is a public key, which is available to the public; another one is a private key, which is kept by yourself.
- After attaching the public key to a VM instance, you can use the private key to SSH to this VM instance from another VM instance without the password.
- If you attach an SSH key during the VM creation, make sure that you have installed a cloud-init for the VM instance image in advance. We recommend that you install a cloud-init of 0.7.9, 17.1, 19.4, or later versions.
- If you attach an SSH key to an existing VM instance, make sure that the VM is running has had QGA installed. The QGA must be running. You can install QGA by installing VM GuestTools or through other methods. If through other method, use a QGA of 2.5 or a latter version.
Username/Password
- ZStack Cloud allows you to log in to a VM instance with Username/Password.
- The fixed username of Linux VM instances is root. The fixed username of Windows VM instances is administrator.
- After injecting the password into a VM instance, you can SSH to it with the Username/Password.
- Make sure that you have installed a cloud-init for the VM instance. We recommend that you install a cloud-init of 0.7.9, 17.1, 19.4, or later versions.

High Availability (HA)

VM Instance HA

ZStack Cloud allows you to enable the High Availability (HA) feature for VM instances. The VM instances with HA enabled can automatically reboot after being stopped due to the daily maintenance (planned) or burst exceptions (unplanned), which increases the VM instances availability.

NeverStop Mechanism

The system checks the VM instance states through round robin, trigger, or other mechanisms. A VM instance automatically reboots if it is detected as stopped.
The system checks the VM instance states through round robin, trigger, or other mechanisms. If it cannot decide the state of a VM instance, it takes the following steps for further detection:
1. Selects the most precise method according to the network configurations to detect the state of the host that the VM instance is running on.
2. If the host is abnormal, the VM instance with HA enabled will attempt to reboot automatically.

Load Balancing

With the load balancing service, multiple VM instances form a cluster to resolve the single point of failure and improve the application availability.

Product Security Analysis