Enabling the Basic/Enterprise/Premium Edition

Check Mode

The HSS system detects all data at 00:00 every day.

If you enable server protection before the detection interval, you can view detection results only after the detection is performed at 00:00 of the next day or you perform a manual detection immediately.

Prerequisites

• In the server list on the Servers page of the HSS console, the Agent Status of the target server is Online.
• You have purchased required edition quotas in your region.
• To better protect your containers, you are advised to set security configurations.

Restrictions

• Linux OS

  On servers running the EulerOS with ARM, HSS does not block the IP addresses suspected of SSH brute-force attacks, but only generates alarms.

• Windows OS
  • Authorize the Windows firewall when you enable protection for a Windows server. Do not disable the Windows firewall during the HSS in-service period. If the Windows firewall is disabled, HSS cannot block brute-force attack IP addresses.
  • If the Windows firewall is manually enabled, HSS may also fail to block brute-force attack IP addresses.

Enabling Protection

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > Host Security Service.
3. In the navigation tree on the left, choose Servers.
   Figure 1 Server list
   
   

   The server list displays the protection status of only the following servers:

   • HUAWEI CLOUD servers purchased in the selected region
   • Non-HUAWEI CLOUD servers that have been added to the selected region

4. Select the target server and click Enable.

   You can buy HSS in pay-per-use or yearly/monthly mode.

   • Yearly/Monthly
     In the displayed dialog box, select an edition, select the yearly/monthly mode, and allocate the HSS quota. Select I have read and agree to the Host Security Service Disclaimer.

     Figure 2 Enabling yearly/monthly HSS
     
     The quotas can be allocated in the following ways:

     • Select Select a quota randomly. to let the system allocate the quota with the longest remaining validity to the server.
     • Select a quota to allocate.
     • Enable protection for servers in batches. The system will automatically allocate quota to them.
   • Pay-per-use

     In the displayed dialog box, select the pay-per-use mode and the edition. Select I have read and agree to the Host Security Service Disclaimer.

     Figure 3 Enabling pay-per-use HSS
     
     

     Only the basic and enterprise editions support the pay-per-use mode. The basic edition can be used free of charge for 30 days. The yearly/monthly mode of the basic edition can be used only after purchase. For more information, see Purchase HSS Quota.

5. Click OK. View the server protection status in the server list.

   If the Protection Status of the target server is Enabled, the basic, enterprise, or premium edition has been enabled.

   

   • Alternatively, on the Quotas tab of the Servers page, click Bind Server in the Operation column to bind a quota to a server. HSS will automatically enable protection for the server.
   • A quota can be bound to a server to protect it, on condition that the agent on the server is online.

   After HSS is enabled, it will scan your servers for security issues. Check items vary according to the edition you enabled. Figure 4 illustrates more details.

   For details about the differences between editions, see Editions.

   Figure 4 Automatic security check items
   

Viewing Detection Details

After server protection is enabled, HSS will immediately perform comprehensive detection on the server. The detection may take a long time, which needs your patience.

In the Operation column on the Servers tab, choose More > View Scan Results to view the detection result of a specified server.

Figure 5 Viewing details

The details page shows detection results and detected risks.

Figure 6 Viewing the detection result

Follow-up Operation

You can manually configure check items, as shown in Figure 7. Configurable items vary according to the edition you enabled.

For details about the differences between editions, see Editions.

Figure 7 Manual check items

Follow-Up Procedure

Disabling HSS

On the Server tab of the Servers page, click Disable in the Operation column of a server.

If HSS is disabled, HSS quota status will change from occupied to idle. You can allocate the idle quotas to other servers or unsubscribe the unnecessary quotas to prevent quota waste.

• Before disabling protection, perform a comprehensive detection on the server, handle known risks, and record operation information to prevent O&M errors and attacks on the server.
• After protection is disabled, clear important data on the server, stop important applications on the server, and disconnect the server from the external network to avoid unnecessary loss caused by attacks.