Updated on 2024-07-12 GMT+08:00

Viewing Baseline Check Details

HSS checks your software for weak password complexity policies and other unsafe settings, and provides suggestions for fixing detected risks.

Prerequisite

Only the servers protected by the enterprise edition or above are checked.

Check Items

Table 1 Check items

Item

Description

Unsafe configurations

Currently, the following check standards and types are supported:

  • For Linux,
    • The cloud security practice baseline can check Apache2, Docker, MongoDB, Redis, MySQL5, Nginx, Tomcat, SSH, vsftp, CentOS7, EulerOS, EulerOS_ext.
  • For Windows:
    • The cloud security practice baseline can check MongoDB, Apache2, MySQL, Nginx, Redis, Tomcat, Windows_2008, Windows_2012, Windows_2016, and Windows_2019.

Password complexity policies

Password complexity policies on system accounts.

Common weak passwords

Weak passwords defined in the common weak password library.

Common weak passwords of MySQL, FTP, and system accounts.

Viewing Unsafe Configurations

View the risk statistics of unsafe configurations and the corresponding suggestions.

  1. Log in to the management console.
  2. Click in the upper left corner of the page, select a region, and choose Security > Host Security Service.
  3. In the navigation pane on the left, choose Prediction > Baseline Checks.
  4. Click the Unsafe Configurations tab to view the risk items. For more information, see Table 2.

    To view the server configuration check results under a specified baseline check policy, select a policy in the Baseline Check Policy drop-down list.
    Table 2 Parameter description

    Parameter

    Description

    Risk Level

    Level of a detection result.

    • High
    • Low
    • Medium
    • Safe

    Baseline Name

    Name of the baseline that is checked.

    Type

    Policy type of the baseline that has been checked.

    • Cloud security practices

    Check Item

    Total number of configuration items that are checked.

    Risky Item

    Total number of the risky configurations.

    Affected Servers

    Total number of servers affected by the detected risks in a baseline.

    Last Scanned

    Time when the last detection was performed.

    Description

    Description of a baseline.

  5. Click the target baseline name in the list to view the baseline description, affected servers, and details about all check items.
  6. Click View Details in the Operation column of the target check item to view the description, audit description, and handling suggestions.

    You need to check whether a risk item is critical or need to be handled.

    If yes, modify the check item according to the handling suggestions. If no, click Ignore in the Operation column of the check item.

Viewing Password Complexity Policy Detection

View the risk statistics and handling suggestions of password complexity policy detection.

  1. Log in to the management console and go to the HSS page.
  2. In the navigation pane on the left, choose Prediction > Baseline Checks.
  3. Click the Password Complexity Policy Detection tab to view the risk statistical items and handling suggestions. For more information, see Table 3.

    Table 3 Parameter description

    Parameter

    Description

    Server

    Name and IP address of the detected server.

    Password Length

    Whether the password length of the target server meets the requirements.

    • Passed
    • Failed

    Uppercase Letters

    Whether the uppercase letters used in the target server password meet the requirements.

    • Passed
    • Failed

    Lowercase Letters

    Whether the lowercase letters used in the target server password meet the requirements.

    • Passed
    • Failed

    Digits

    Whether the digits used in the target server password meet the requirements.

    • Passed
    • Failed

    Special characters

    Whether the special characters used in the target server password meet the requirements.

    • Passed
    • Failed

    Suggestion

    Suggestion for fixing unsafe passwords

Viewing Common Weak Password Detection

View the risk statistics of weak password detection and the corresponding handling suggestions.

  1. Log in to the management console and go to the HSS page.
  2. In the navigation pane on the left, choose Prediction > Baseline Checks.
  3. Click the Common Weak Password Detection tab to view the statistics of risky weak password accounts on the server. For more information, see Table 4.

    Table 4 Parameter description

    Parameter

    Description

    Server

    Name and IP address of the detected server.

    Account Name

    Accounts with weak passwords that are detected on the target server.

    Account Type

    Type of an account.

    Usage Duration (Days)

    Period for using a weak password.

    • To enhance server security, you are advised to modify the accounts with weak passwords for logging in to the system in a timely manner, such as SSH accounts.
    • To protect internal data of your server, you are advised to modify software accounts that use weak passwords, such as MySQL accounts and FTP accounts.

    After modifying weak passwords, you are advised to perform manual detection immediately to verify the result. If you do not perform manual verification, HSS will automatically check the settings the next day in the early morning.

    • A password should contain more than eight characters, including uppercase letters, lowercase letters, digits, and special characters.

Exporting the Baseline Check Report

On the Baseline Checks page, you can click in the upper right corner of a tab to export the check report.
  • The check result of a single cloud server cannot be separately exported.
  • Up to 5000 alarm records can be exported at a time.