Viewing Baseline Check Details

Constraints

Baseline inspections are not supported if your servers are not protected by HSS.

Prerequisite

Only the servers protected by the enterprise edition or above are checked.

Check Items

Viewing Unsafe Configurations

View the risk statistics of unsafe configurations and the corresponding suggestions.

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > Host Security Service.
   Figure 1 Accessing HSS
   

3. In the displayed dialog box, click Try the new edition to switch to the HSS (New) console.
   

   • Currently, HSS is available in the following regions: CN South-Guangzhou, CN-Hong Kong, AP-Bangkok, and AP-Singapore.
   • On the HSS (New) console, you can click Back to Old Console in the upper left corner to switch to the HSS (Old) console.
   • If cloud scan is not enabled or you access the HSS (New) console for the first time, the Enable Cloud Scan? dialog box is displayed. You are advised to select Enable cloud scan.
     

     • The cloud scan function is free of charge.
     • After the cloud scan function is enabled, all HSS servers will be scanned. Some HSS quota editions can support only limited scanning capabilities. Therefore, you are advised to purchase the enterprise edition or higher to enjoy all capabilities of the cloud scan function.
     Figure 2 Enabling cloud scan
     

4. In the navigation pane on the left, choose Prediction > Baseline Checks.
   

   If your servers are managed by enterprise projects, you can select an enterprise project to view or operate the asset and scan information.

5. Click the Unsafe Configurations tab to view the risk items. For more information, see Table 2.
   Figure 3 Viewing unsafe configuration details
   

   Table 2 Parameter description

   Parameter	Description
   Risk Level	Level of a detection result. High Low Medium Safe
   Baseline Name	Name of the baseline that is checked.
   Type	Policy type of the baseline that has been checked. Huawei Cloud security practices DJCP MLPS
   Check Item	Total number of configuration items that are checked.
   Risky Item	Total number of the risky configurations.
   Affected Servers	Total number of servers affected by the detected risks in a baseline.
   Last Scanned	Time when the last detection was performed.
   Description	Description of a baseline.

6. Click the target baseline name in the list to view the baseline description, affected servers, and details about all check items.
   Figure 4 Viewing baseline check details
   

7. Click View Details in the Operation column of the target check item to view the description, audit description, and handling suggestions.

   You need to check whether a risk item is critical or need to be handled.

   If yes, modify the check item according to the handling suggestions. If no, click Ignore in the Operation column of the check item.

   Figure 5 Viewing check item details
   

Viewing Password Complexity Policy Detection

View the risk statistics and handling suggestions of password complexity policy detection.

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > Host Security Service.
   Figure 6 Accessing HSS
   

3. In the displayed dialog box, click Try the new edition to switch to the HSS (New) console.
   

   • Currently, HSS is available in the following regions: CN South-Guangzhou, CN-Hong Kong, AP-Bangkok, and AP-Singapore.
   • On the HSS (New) console, you can click Back to Old Console in the upper left corner to switch to the HSS (Old) console.
   • If cloud scan is not enabled or you access the HSS (New) console for the first time, the Enable Cloud Scan? dialog box is displayed. You are advised to select Enable cloud scan.
     

     • The cloud scan function is free of charge.
     • After the cloud scan function is enabled, all HSS servers will be scanned. Some HSS quota editions can support only limited scanning capabilities. Therefore, you are advised to purchase the enterprise edition or higher to enjoy all capabilities of the cloud scan function.
     Figure 7 Enabling cloud scan
     

4. In the navigation pane on the left, choose Prediction > Baseline Checks.
5. Click the Password Complexity Policy Detection tab to view the risk statistical items and handling suggestions. For more information, see Table 3.
   Figure 8 Viewing password complexity policy detection details
   

   Table 3 Parameter description

   Parameter	Description
   Server	Name and IP address of the detected server.
   Password Length	Whether the password length of the target server meets the requirements. Passed Failed
   Uppercase Letters	Whether the uppercase letters used in the target server password meet the requirements. Passed Failed
   Lowercase Letters	Whether the lowercase letters used in the target server password meet the requirements. Passed Failed
   Digits	Whether the digits used in the target server password meet the requirements. Passed Failed
   Special characters	Whether the special characters used in the target server password meet the requirements. Passed Failed
   Suggestion	Suggestion for fixing unsafe passwords

Viewing Common Weak Password Detection

View the risk statistics of weak password detection and the corresponding handling suggestions.

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > Host Security Service.
   Figure 9 Accessing HSS
   

3. In the displayed dialog box, click Try the new edition to switch to the HSS (New) console.
   

   • Currently, HSS is available in the following regions: CN South-Guangzhou, CN-Hong Kong, AP-Bangkok, and AP-Singapore.
   • On the HSS (New) console, you can click Back to Old Console in the upper left corner to switch to the HSS (Old) console.
   • If cloud scan is not enabled or you access the HSS (New) console for the first time, the Enable Cloud Scan? dialog box is displayed. You are advised to select Enable cloud scan.
     

     • The cloud scan function is free of charge.
     • After the cloud scan function is enabled, all HSS servers will be scanned. Some HSS quota editions can support only limited scanning capabilities. Therefore, you are advised to purchase the enterprise edition or higher to enjoy all capabilities of the cloud scan function.
     Figure 10 Enabling cloud scan
     

4. In the navigation pane on the left, choose Prediction > Baseline Checks.
5. Click the Common Weak Password Detection tab to view the statistics of risky weak password accounts on the server. For more information, see Table 4.
   Figure 11 Viewing common weak password detection
   

   Table 4 Parameter description

   Parameter	Description
   Server	Name and IP address of the detected server.
   Account Name	Accounts with weak passwords that are detected on the target server.
   Account Type	Type of an account.
   Usage Duration (Days)	Period for using a weak password.

   

   • To enhance server security, you are advised to modify the accounts with weak passwords for logging in to the system in a timely manner, such as SSH accounts.
   • To protect internal data of your server, you are advised to modify software accounts that use weak passwords, such as MySQL accounts and FTP accounts.

   After modifying weak passwords, you are advised to perform manual detection immediately to verify the result. If you do not perform manual verification, HSS will automatically check the settings the next day in the early morning.

   • A password should contain more than eight characters, including at least three types of the following characters: uppercase letters, lowercase letters, digits, and special characters.

Exporting the Baseline Check Report

On the Baseline Checks page, you can click in the upper right corner of a tab to export the check report.

• The check result of a single cloud server cannot be separately exported.
• Up to 5000 alarm records can be exported at a time.

Figure 12 Exporting the baseline check report