Viewing the Assets and Risks of a Server

The asset fingerprint page displays server and container fingerprints. For more information, see Server Fingerprints and Container Fingerprints.

To view asset fingerprints, perform the following steps:

1. Choose a fingerprint page as needed.

   To check server fingerprints, choose the Server Fingerprints page. To check container fingerprints, choose the Container Fingerprints page.

2. In the fingerprint list, select a fingerprint type to view its details.
   Server and container fingerprints include:

   • Server fingerprints: accounts, open ports, processes, software, auto-started items, web applications, web services, web frameworks, websites, middleware, databases, and kernel modules
   • Container fingerprints: accounts, open ports, processes, software, auto-started items, web applications, web services, web frameworks, websites, middleware, and databases
   Figure 1 Asset fingerprints
   
3. (Optional) If you find unsafe assets after counting, remove them in a timely manner.
   If you receive a dangerous port alarm, in the the search box above the list in the Open Ports area, set Dangerous Port to Yes to filter dangerous ports. You are advised to handle dangerous ports as follows:

   • If HSS detects open dangerous ports or unused ports, check whether they are really used by your services. If they are not, disable them. For dangerous ports, you are advised to further check their program files, and delete or isolate their source files if necessary.
   • If a detected dangerous port is actually a normal port used for services, you can ignore it. Ignored alarms will neither be recorded as unsafe items and nor trigger alarms.

The vulnerability management page displays Linux vulnerabilities, Windows vulnerabilities, Web-CMS vulnerabilities, application vulnerabilities, and emergency vulnerabilities. For more information, see Vulnerability Management Overview.

To view vulnerability information, perform the following steps:

1. Select a vulnerability type to view corresponding vulnerabilities.
   Figure 2 Vulnerability management
   

2. In the upper left corner of the page, click Scan to scan for vulnerabilities immediately.
   Figure 3 Manual scan
   
3. For details about how to handle vulnerabilities (add to whitelist, fix, or ignore), see Handling Vulnerabilities.

   For details about how to fix a vulnerability, see "Automatically Fixing Vulnerabilities (Vulnerability View)" and "Manually Fixing Vulnerabilities" in "Handling Vulnerabilities".

Baseline checks show the results of unsafe configuration checks, password complexity policy checks, and common weak password checks. For details about the baseline check function, see Baseline Inspection Overview.

To view baseline check information, perform the following steps:

1. Select a check type.
   Figure 4 Baseline checks
   
2. View check results.
   • Configuration check
     1. Click in the Risk Level column to expand baseline details.
        Figure 5 Unsafe configurations
        
     2. On the Failed tab page, view the baseline items that failed the check.
     3. In the row of a baseline item, click View Details in the Operation column to view the check item description, audit description, and suggestions.

        You can fix the baseline items that failed to pass the check based on the suggestions. For details, see Viewing and Processing Configuration Check Results.

   • Password complexity policy check
     Figure 6 Password complexity policy check
     

     If the password complexity policy of a server does not meet related standards, log in to the server and modify the password complexity policy.

     • To monitor the password complexity policy on a Linux server, install the Pluggable Authentication Modules (PAM) on the server. For details, see How Do I Install a PAM in a Linux OS?
     • For details about how to modify the password complexity policy on a Linux server, see How Do I Install a PAM and Set a Proper Password Complexity Policy in a Linux OS?
     • For details about how to modify the password complexity policy on a Windows server, see How Do I Set a Secure Password Complexity Policy in a Windows OS?
   • Common weak password check

     To view the latest weak password detection data, click Scan in the upper left corner of the page to scan for weak passwords on the server.

     You are advised to log in to the server and change the weak passwords as soon as possible.

The detection and response page displays intrusion detection alarms, including server security alarms and container security alarms. For more information, see Server Alarms and Container Alarm Events.

To view intrusion detection information, perform the following steps:

1. Select an alarm type and view the alarm event list.

   To view server alarms, choose Server Alarms. To view container alarms, choose Container Alarms.

   Figure 7 Server alarms
   

2. Click an alarm name to view the alarm details, forensics, and similar alarms.
3. In the Operation column of an alarm, click Handle to handle the alarm.

   For details, see Handling Server Alarms and Handling Container Alarms.

To view the application of all the policies in the policy group associated with the current server or container node, choose Security Operations > Policies. For more information, see Policy Management Overview.

Figure 8 Policy management

• Basic Information: In the Basic Information area, you can view basic information about the policy group.
• Status: In the row of a policy, view its status in the Status column.
  • Disabled: The policy is disabled.
  • Enabled: The policy is enabled.
  • Enabling: The policy is being enabled. This state lasts for 2 to 3 minutes.
  • Enabling failed: The protection capabilities of the agent are degraded due to some exceptions. As a result, some policies failed to be enabled. For details about the cause and solution of agent protection degradation, see Protection Degradation.

  To enable or disable a policy, perform the following steps:

  1. On the home page of the HSS console, choose Security Operations > Policies.
  2. Click the name of the target policy group. The policy list page is displayed.
  3. In the row containing the target self-protection policy, click Enable or Disable in the Operation column.
• Policy Details: In the row containing the target policy, click View Details in the Operation column to view the policy details.