Compute
Elastic Cloud Server
Huawei Cloud Flexus
Bare Metal Server
Auto Scaling
Image Management Service
Dedicated Host
FunctionGraph
Cloud Phone Host
Huawei Cloud EulerOS
Networking
Virtual Private Cloud
Elastic IP
Elastic Load Balance
NAT Gateway
Direct Connect
Virtual Private Network
VPC Endpoint
Cloud Connect
Enterprise Router
Enterprise Switch
Global Accelerator
Management & Governance
Cloud Eye
Identity and Access Management
Cloud Trace Service
Resource Formation Service
Tag Management Service
Log Tank Service
Config
OneAccess
Resource Access Manager
Simple Message Notification
Application Performance Management
Application Operations Management
Organizations
Optimization Advisor
IAM Identity Center
Cloud Operations Center
Resource Governance Center
Migration
Server Migration Service
Object Storage Migration Service
Cloud Data Migration
Migration Center
Cloud Ecosystem
KooGallery
Partner Center
User Support
My Account
Billing Center
Cost Center
Resource Center
Enterprise Management
Service Tickets
HUAWEI CLOUD (International) FAQs
ICP Filing
Support Plans
My Credentials
Customer Operation Capabilities
Partner Support Plans
Professional Services
Analytics
MapReduce Service
Data Lake Insight
CloudTable Service
Cloud Search Service
Data Lake Visualization
Data Ingestion Service
GaussDB(DWS)
DataArts Studio
Data Lake Factory
DataArts Lake Formation
IoT
IoT Device Access
Others
Product Pricing Details
System Permissions
Console Quick Start
Common FAQs
Instructions for Associating with a HUAWEI CLOUD Partner
Message Center
Security & Compliance
Security Technologies and Applications
Web Application Firewall
Host Security Service
Cloud Firewall
SecMaster
Anti-DDoS Service
Data Encryption Workshop
Database Security Service
Cloud Bastion Host
Data Security Center
Cloud Certificate Manager
Edge Security
Situation Awareness
Managed Threat Detection
Blockchain
Blockchain Service
Web3 Node Engine Service
Media Services
Media Processing Center
Video On Demand
Live
SparkRTC
MetaStudio
Storage
Object Storage Service
Elastic Volume Service
Cloud Backup and Recovery
Storage Disaster Recovery Service
Scalable File Service Turbo
Scalable File Service
Volume Backup Service
Cloud Server Backup Service
Data Express Service
Dedicated Distributed Storage Service
Containers
Cloud Container Engine
SoftWare Repository for Container
Application Service Mesh
Ubiquitous Cloud Native Service
Cloud Container Instance
Databases
Relational Database Service
Document Database Service
Data Admin Service
Data Replication Service
GeminiDB
GaussDB
Distributed Database Middleware
Database and Application Migration UGO
TaurusDB
Middleware
Distributed Cache Service
API Gateway
Distributed Message Service for Kafka
Distributed Message Service for RabbitMQ
Distributed Message Service for RocketMQ
Cloud Service Engine
Multi-Site High Availability Service
EventGrid
Dedicated Cloud
Dedicated Computing Cluster
Business Applications
Workspace
ROMA Connect
Message & SMS
Domain Name Service
Edge Data Center Management
Meeting
AI
Face Recognition Service
Graph Engine Service
Content Moderation
Image Recognition
Optical Character Recognition
ModelArts
ImageSearch
Conversational Bot Service
Speech Interaction Service
Huawei HiLens
Video Intelligent Analysis Service
Developer Tools
SDK Developer Guide
API Request Signing Guide
Terraform
Koo Command Line Interface
Content Delivery & Edge Computing
Content Delivery Network
Intelligent EdgeFabric
CloudPond
Intelligent EdgeCloud
Solutions
SAP Cloud
High Performance Computing
Developer Services
ServiceStage
CodeArts
CodeArts PerfTest
CodeArts Req
CodeArts Pipeline
CodeArts Build
CodeArts Deploy
CodeArts Artifact
CodeArts TestPlan
CodeArts Check
CodeArts Repo
Cloud Application Engine
MacroVerse aPaaS
KooMessage
KooPhone
KooDrive

Managing SWR Private Images

Updated on 2024-07-12 GMT+08:00

Images in the private image repository come from SWR images. You can manually scan for and check reports on vulnerabilities, malicious files, software information, file information, baseline check, sensitive information.

Constraints

  • Only the HSS container edition supports this function.
  • Security scans can be performed only on Linux images.

Viewing Private Images

  1. Log in to the management console.
  2. Click in the upper left corner of the page, select a region, and choose Security > Host Security Service.
  3. In the navigation pane, choose Asset Management Container & Quota. On the displayed page.
  4. You can click Update Private Images from SWR to update self-owned images from SWR.

Scanning a Private Image

You can choose all images, multiple images, or a single image and manually start a scan. The duration of a security scan depends on the scanned image size. Generally, scanning an image takes shorter than 3 minutes. After the scan is complete, click View Report to check the report.

Scan items of private images in SWR are as follows:

Scan Item

Description

Vulnerability

Detect system and application vulnerabilities in images.

Malicious file

Detects malicious files in images.

Software information

Collects software information in an image.

File information

Collects file information in an image.

Unsafe setting

  • Configuration check:
    • Checks the images configurations of CentOS 7, Debian 10, EulerOS, and Ubuntu16.
    • Checks SSH configurations.
  • Weak password check: detects weak passwords in images.
  • Password complexity check: detects insecure password complexity policies in images.

Sensitive information

Detects files that contain sensitive information in images.

  • The paths that are not checked by default are as follows:
    • /usr/*
    • /lib/*
    • /lib32/*
    • /bin/*
    • /sbin/*
    • /var/lib/*
    • /var/log/*
    • */node_modules/*/*.md
    • */node_modules/*/test/*
    • */service/iam/examples_test.go
    • */grafana/public/build/*.js
    NOTE:

    On the View Report > Sensitive Information tab, click Configure Sensitive File Path to set the Linux path of the file that does not need to be checked. A maximum of 20 paths can be added.

  • No checks are performed in the following scenarios:
    • The file size is greater than 20 MB.
    • The file type can be binary, common process, or auto generation.

Software compliance

Detects software and tools that are not allowed to be used.

Basic image information

Detects service images that are not created using base images.

  1. Log in to the management console and go to the HSS page.
  2. In the navigation pane, choose Asset Management > Containers & Quota.
  3. Click the Container Images tab and select SWR private image. In the Operation column of an image, click Scan.
  4. In the displayed dialog box, click OK to start the scan job.
  5. Scanned in the Scan Status column indicates the target image scan completed.

Viewing the Malicious File Report of a Private Image

After images are scanned, you can view malicious files on them. This section describes how to view malicious files in an image version.

  1. Log in to the management console and go to the HSS page.
  2. In the navigation pane, choose Asset Management > Containers & Quota.
  3. Click the Container Images tab and select SWR private image. In the Operation column of an image, click View Report.
  4. Click Malicious Files to view malicious files on the image.

Viewing Software Information About a Private Image

  1. Log in to the management console and go to the HSS page.
  2. In the navigation pane, choose Asset Management > Containers & Quota.
  3. Click the Container Images tab and select SWR private image. In the Operation column of an image, click View Report.
  4. Click Software Information to view the software contained in the image version, software type, and number of vulnerabilities in the software.
  5. Click next to a software name to view the software vulnerability name, repair urgency, and solution.

Viewing File Information About a Private Image

  1. Log in to the management console and go to the HSS page.
  2. In the navigation pane, choose Asset Management > Containers & Quota.
  3. Click the Container Images tab and select SWR private image. In the Operation column of an image, click View Report.
  4. Click File Information to view the file information about the image.

    Including the number of files, total file size, and details about the top 50 files.

Viewing the Unsafe Settings of a Private Image

  1. Log in to the management console and go to the HSS page.
  2. In the navigation pane, choose Asset Management > Containers & Quota.
  3. Click the Container Images tab and select SWR private image. In the Operation column of an image, click View Report.
  4. Select Unsafe Settings to view the baseline check report.

    You can view the unsafe configurations, password complexity policy detection, and common weak password detection results of the target image.

    • Viewing unsafe configurations and modification suggestions
      1. On the Unsafe Configurations tab page, select the target baseline.
      2. In the detection item column of the target detection item, click Description to view the detection item description and modification suggestions.
    • Common weak password detection
      1. Click Common Weak Password Detection.
      2. Configure weak passwords and click OK.

Viewing the Sensitive Information Report of a Private Image

  1. Log in to the management console and go to the HSS page.
  2. In the navigation pane, choose Asset Management > Containers & Quota.
  3. Click the Container Images tab and select SWR private image. In the Operation column of an image, click View Report.
  4. Click the Sensitive Information tab to view details about sensitive image information and ignore risk alarms.
  5. Click Configure Sensitive File Path to view and edit the custom file path whitelist.

    Table 1 Custom path description

    Path Specification Item

    Description

    Example Value

    OS

    Only Linux is supported.

    -

    Requirement

    A maximum of 20 paths can be specified. One path occupies one line.

    /usr/

    /lib/test.txt

    Default whitelist path

    The following whitelist directories or file formats are supported by default and do not need to be configured:

    /usr/*

    /lib/*

    /lib32/*

    /bin/*

    /sbin/*

    /var/lib/*

    /var/log/*

    */node_modules/*/*.md

    */node_modules/*/test/*

    */service/iam/examples_test.go

    */grafana/public/build/*.js

    -

    Non-scanning scenario

    • The file size is greater than 20 MB.
    • The following file types are not scanned:
      • Common binary files
      • Common program files
      • Automatically generated files
    • jpg|png|gif|mov|avi|mpeg|pdf|mp4|mp3|svg|tar|gz|zip
    • js|jar|java||md|cpp|cxx|scala|pl
    • [0-9a-zA-Z_-]{32,64}

Viewing the Software Compliance Report About a Private Image

  1. Log in to the management console and go to the HSS page.
  1. In the navigation pane, choose Asset Management > Containers & Quota.
  2. Click the Container Images tab and click SWR private image.
  3. In the Operation column of the target image, click View Report. The security scan report page is displayed.
  4. Choose Software Compliance to view the report.

    You can view the name, path, and image layer of non-compliant software.

Viewing the Base Image Report of a Private Image

  1. Log in to the management console and go to the HSS page.
  1. In the navigation pane, choose Asset Management > Containers & Quota.
  2. Click the Container Images tab and click SWR private image.
  3. In the Operation column of the target image, click View Report. The security scan report page is displayed.
  4. Click the Base Images tab and view reports.

    You can view the name, version, and image layer path of a service image that is not created using a base image.

We use cookies to improve our site and your experience. By continuing to browse our site you accept our cookie policy. Find out more

Feedback

Feedback

Feedback

0/500

Selected Content

Submit selected content with the feedback