Viewing Baseline Check Details

Constraints

Servers that are not protected by HSS do not support baseline-related operations.

Prerequisite

Only the servers protected by the enterprise edition or above are checked.

Detection Description

The MySQL baseline detection of Linux OS is based on the MySQL 5 security configuration specifications. If MySQL 8 is installed on your server, the following check items are not displayed in the detection results, because they are discarded in that version. The detection results are displayed only on the server whose MySQL version is 5.

• Rule: Do not set old_passwords to 1.
• Rule: Set secure_auth to 1 or ON.
• Rule: Do not set skip_secure_auth.
• Rule: Set log_warnings to 2.
• Rule: Configure the MySQL binlog clearing policy.
• Rule: The sql_mode parameter contains NO_AUTO_CREATE_USER.
• Rule: Use the MySQL audit plug-in.

Check Items

Viewing Unsafe Configurations

View the risk statistics of unsafe configurations and the corresponding suggestions.

1. Log in to the management console.
2. In the upper left corner of the page, click , select a region, and choose Security > Host Security Service.
3. In the navigation pane on the left, choose Prediction > Baseline Checks.
4. Click the Unsafe Configurations tab to view the risk items. For more information, see Table 2.
   To view the server configuration check results under a specified baseline check policy, select a policy in the Baseline Check Policy drop-down list.

   Table 2 Parameter description

   Parameter	Description
   Risk Level	Level of a detection result. High Low Medium Safe
   Baseline Name	Name of the baseline that is checked.
   Type	Policy type of the baseline that has been checked. Cloud security practices DJCP MLPS
   Check Item	Total number of configuration items that are checked.
   Risky Item	Total number of the risky configurations.
   Affected Servers	Total number of servers affected by the detected risks in a baseline.
   Last Scanned	Time when the last detection was performed.
   Description	Description of a baseline.

5. Click the target baseline name in the list to view the baseline description, affected servers, and details about all check items.
6. Click View Details in the Operation column of the target check item to view the description, audit description, and handling suggestions.

   You need to check whether a risk item is critical or need to be handled.

   If yes, modify the check item according to the handling suggestions. If no, click Ignore in the Operation column of the check item.

Viewing Password Complexity Policy Detection

View the risk statistics and handling suggestions of password complexity policy detection.

1. Log in to the management console and go to the HSS page.
2. In the navigation pane on the left, choose Prediction > Baseline Checks.
3. Click the Password Complexity Policy Detection tab to view the risk statistical items and handling suggestions. For more information, see Table 3.

   Table 3 Parameter description

   Parameter	Description
   Server	Name and IP address of the detected server.
   Password Length	Whether the password length of the target server meets the requirements. Passed Failed
   Uppercase Letters	Whether the uppercase letters used in the target server password meet the requirements. Passed Failed
   Lowercase Letters	Whether the lowercase letters used in the target server password meet the requirements. Passed Failed
   Digits	Whether the digits used in the target server password meet the requirements. Passed Failed
   Special characters	Whether the special characters used in the target server password meet the requirements. Passed Failed
   Suggestion	Suggestion for fixing unsafe passwords

Viewing Common Weak Password Detection

View the risk statistics of weak password detection and the corresponding handling suggestions.

1. Log in to the management console and go to the HSS page.
2. In the navigation pane on the left, choose Prediction > Baseline Checks.
3. Click the Common Weak Password Detection tab to view the statistics of risky weak password accounts on the server. For more information, see Table 4.

   Table 4 Parameter description

   Parameter	Description
   Server	Name and IP address of the detected server.
   Account Name	Accounts with weak passwords that are detected on the target server.
   Account Type	Type of an account.
   Usage Duration (Days)	Period for using a weak password.

   

   • To enhance server security, you are advised to modify the accounts with weak passwords for logging in to the system in a timely manner, such as SSH accounts.
   • To protect internal data of your server, you are advised to modify software accounts that use weak passwords, such as MySQL accounts and FTP accounts.

   After modifying weak passwords, you are advised to perform manual detection immediately to verify the result. If you do not perform manual verification, HSS will automatically check the settings the next day in the early morning.

   • A password should contain more than eight characters, including uppercase letters, lowercase letters, digits, and special characters.

Exporting the Baseline Check Report

On the Baseline Checks page, you can click in the upper right corner of a tab to export the check report.

• The check result of a single cloud server cannot be separately exported.
• Up to 5000 alarm records can be exported at a time.