Constraints and Limitations

Server Protection Restrictions

HSS can protect Huawei Cloud servers, third-party cloud servers, and IDCs. The following types of servers can be protected:

• Huawei Cloud
  • Huawei Cloud Elastic Cloud Server (ECS)
  • Huawei Cloud Bare Metal Server (BMS)
  • Workspace
• Third parties
  • Third-party cloud servers
  • On-premises IDCs

Container Protection Restrictions

HSS can protect Huawei Cloud cluster containers, third-party cloud cluster containers, and on-premises IDC cluster containers. For details about the supported container types, see Table 1.

Protection Quota Limit

A server or container node can be protected by HSS only after a quota is allocated to it. Each server or container needs a quota.

The restrictions on the quotas are as follows:

• A protection quota can be bound to only one server or container node.
• A maximum of 50,000 protection quotas can be purchased in a region.
• After a protection quota is purchased, your server or container is not protected yet. You need to go to the HSS console and install an agent for the server or container and enable protection as prompted.

OS Restrictions

Currently, the HSS agent and system vulnerability scan functions are not supported in certain OSs.

For details about the OS restrictions of HSS, see:

• HSS restrictions on Windows (x86)
• HSS restrictions on Linux (x86)
• HSS restrictions on Linux (Arm)

• CentOS 6.x is no longer updated or maintained on the Linux official website, and HSS no longer supports CentOS 6.x or earlier.
• The meanings of the symbols in the table are as follows:
  • √: supported
  • ×: not supported

Agent Restrictions

• If third-party security software, such as 360 Total Security, Tencent Manager, and McAfee, is installed on the server, uninstall the software before installing the HSS agent. If the third-party security software is incompatible with the HSS agent, the HSS protection functions will be affected.
• After the agent is installed on the server or container node, the agent may modify the following system files or configurations:
  • Linux system files:
    • /etc/hosts.deny
    • /etc/hosts.allow
    • /etc/rc.local
    • /etc/ssh/sshd_config
    • /etc/pam.d/sshd
    • /etc/docker/daemon.json
    • /etc/sysctl.conf
    • /sys/fs/cgroup/cpu/ (A subdirectory will be created for the HSS process in this directory.)
    • /sys/kernel/debug/tracing/instances (A CSA instance will be created in this directory.)
  • Linux system configurations: iptables rules
  • Windows system configurations:
    • Firewall rules
    • System login event audit policy
    • Windows Remote Management trusted server list

Restrictions on Brute-force Attack Defense

Authorize the Windows firewall when you enable protection for a Windows server. Do not disable the Windows firewall while you use HSS.

If the Windows firewall is disabled, HSS cannot block the source IP addresses of brute-force attacks. This problem may persist even if the Windows firewall is enabled after being disabled.