Help Center/ Host Security Service/ User Guide/ Risk Management/ Baseline Check/ Viewing and Handling Baseline Check Results
Updated on 2025-08-26 GMT+08:00

Viewing and Handling Baseline Check Results

Scenarios

You can check for and fix unsafe baseline settings, weak passwords, and insecure password complexity policies on your servers.

Constraints

Only the HSS enterprise, premium, WTP, and container editions support baseline configuration checks.

Detection Description

The MySQL baseline detection of Linux OS is based on the MySQL 5 security configuration specifications. If MySQL 8 is installed on your server, the following check items are not displayed in the detection results, because they are discarded in that version. The detection results are displayed only on the server whose MySQL version is 5.

  • Rule: Do not set old_passwords to 1.
  • Rule: Set secure_auth to 1 or ON.
  • Rule: Do not set skip_secure_auth.
  • Rule: Set log_warnings to 2.
  • Rule: Configure the MySQL binlog clearing policy.
  • Rule: The sql_mode parameter contains NO_AUTO_CREATE_USER.
  • Rule: Use the MySQL audit plug-in.

Viewing Baseline Check Overview Information

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > Host Security Service.
  3. In the navigation pane on the left, choose Risk Management > Baseline Checks.
  4. (Optional) If you have enabled the enterprise project function, select an enterprise project from the Enterprise Project drop-down list in the upper part of the page to view its data.
  5. Click different tabs on the displayed page to check the detected unsafe settings. Table 1 lists the corresponding parameters.

    To view the check results of servers under different baseline check policies, you can switch between baseline check policies.
    Figure 1 Baseline checks
    Table 1 Baseline check overview

    Parameter

    Description

    Baseline Check Policy

    Available baseline check policies that have been added. You can select, create, edit, and delete these policies.

    Scanned Servers

    Total number of detected servers.

    Checked Baselines

    Number of baselines executed during the server detection.

    Checked Items

    Total number of checked server configuration items.

    Safe Settings Rate

    Percentage of configuration items that passed the baseline check to the total number of check items. Failed items are displayed by risk level.

    Top 5 Servers with Unsafe Settings

    Statistics on servers with server configuration risks.

    The top 5 servers with the highest risks are preferentially sorted. If no high-risk settings exist, the servers are sorted into medium-risk and low-risk ones in sequence.

    Servers with Weak Passwords

    Total number of detected servers, as well as the numbers of servers with weak passwords, those without weak passwords, and those with weak password detection disabled.

    Top 5 Servers with Weak Passwords

    Statistics on the top 5 servers with most weak password risks.

    Unsafe Settings

    Alarms generated for servers with configuration risks and the risk statistics.

    Password Complexity Policy Risks

    Statistics on the servers whose password complexity policies do not meet the baseline requirements.

    Common Weak Password Risks

    Statistics on servers with weak passwords and accounts.

Viewing and Handling Baseline Configuration Risks

  1. Click the Unsafe Settings tab to view the server baseline risks. For more information, see Table 2.

    Figure 2 Viewing baseline configuration risks
    Table 2 Baseline parameters

    Parameter

    Description

    Risk Level

    Level of a detection result.

    • High
    • Low
    • Medium
    • Secure

    Baseline Name

    Name of the baseline that is checked.

    Type

    Policy type of the baseline that has been checked.

    • Cloud security practices
    • DJCP MLPS
    • General security standard

    Check Item

    Total number of configuration items that are checked.

    Risky Item

    Total number of the risky configurations.

    Scanned Servers

    Total number of servers scanned against a baseline.

    Last Scanned

    Time when the last detection was performed.

    Description

    Description of a baseline.

  2. Click a baseline name in the list to view the baseline description, scanned servers, and details about all check items.

    Figure 3 Viewing baseline check details

  3. Handle risk items.

    • Ignoring risks

      After a risk is ignored, it will be displayed in the ignored item list. It will no longer be reported in the HSS baseline checks on servers.

      1. Click Ignore in the Operation column of a check item to ignore it. Select multiple check items and click Ignore to ignore them in batches.
        Figure 4 Ignoring risks
      2. In the displayed dialog box, click OK.

        You can click Ignored above the check item list to view the ignored items.

    • Fixing risks
      1. Click View Details in the Operation column of a risk item.
      2. View the content in the Audit Description, Suggestion, and Affected Servers. Rectify the unsafe settings.
        • Currently, one-click fixing is supported for some EulerOS baseline configurations and CentOS 8 baseline configurations. You can simply click Fix in the Operation column of the target EulerOS or CentOS check item to fix the unsafe settings. If some parameters need to be configured during restoration, retain the default values.
        • You are advised to fix the settings with high severity immediately and fix those with medium or low severity.
      3. After the repair is complete, click Verify on the Affected Servers tab page to verify the result.
        If a failed check item has been fixed, you can update its status through verification. The restrictions are as follows:
        • Currently, baseline verification is not supported for Windows OSs.
        • The agent status of the target server must be online.
        • Only one risk item can be verified at a time. Other risk items can be verified only after the risk items are verified.
        • Baseline checks are supported for the following Linux OSs: Apache 2, Docker, MongoDB, Redis, MySQL 5, Nginx, Tomcat, SSH, vsftp, CentOS 7, CentOS 8, EulerOS, Debian 9, Debian 10, Debian 11, Red Hat 6, Red Hat 7, Red Hat 8, Ubuntu 12, Ubuntu 14, Ubuntu 16, Ubuntu 18, SUSE 12, SUSE 15, HCE 1.1, and HCE 2.0.
      4. Click OK to start the verification.
      5. Return to the check item list page and view the status of the risk item.

        The status changes to Verifying. The system starts automatic verification. After the verification is complete, check the status. If a check item failed to be fixed, click View Cause to view the cause. Then, fix it again.

    • Whitelisting a risk

      Whitelisted risk items will be displayed in the whitelist. In later baseline checks, HSS will not check for them.

      1. Click Add to Whitelist in the Operation column of a check item. Select multiple check items and click Ignore to ignore them in batches.
        Figure 5 Adding an item to whitelist
      2. On the Add to Whitelist page, confirm the server information, configure Add to global whitelist as needed, and add remarks.

        To exclude the whitelisted items from checks for all servers, select Add to global whitelist.

      3. Click OK.

        To check whitelisted items, return to the Baseline Checks page and click Manage Baseline Whitelist in the upper right corner. For more information, see Managing the Baseline Whitelist.

Checking and Handling Password Complexity Policy Risks

  1. Click the Password Complexity Policy Risks tab to view the risk statistical items and handling suggestions. For more information, see Table 3.

    Figure 6 Viewing password complexity policy risks
    Table 3 Parameters for password complexity policy risks

    Parameter

    Description

    Server Name/ID

    The name and ID of a checked server.

    IP Address

    The EIP and private IP address of a checked server.

    Policy Risk

    The password complexity policy settings that do not meet security requirements.

    Last Scanned

    Last time when the password complexity policy was checked.

    Suggestion

    Suggestions for modifying the password complexity policy.

  2. Handle password complexity policy check results.

    • Modifying the password complexity policy
      1. Modify the password complexity policy on the server based on the Suggestion column in the check result.
      2. Save the modification. Click Scan in the upper part of the Baseline Checks page to verify the modification.

        If you do not perform a manual verification, HSS will automatically check the settings at 00:00:00 the next day.

    • Ignoring password complexity policy check results

      You can view the ignored detection results on the Ignored tab page.

      • Ignoring a single result

        In the Operation column of a server scan result, click Ignore.

      • Batch ignoring records

        Select scan results and click Ignore in the upper left corner of the list. Up to 200 results can be ignored at a time.

        Figure 7 Ignoring multiple results
      • Ignoring all results

        Click Ignore in the upper left corner of the list. Up to 1000 password complexity policy check results can be ignored at a time.

        Figure 8 Ignoring all results

Viewing and Handling Common Weak Password Risks

  1. Click the Common Weak Password Risks tab to view the statistics of weak passwords on the server. For more information, see Table 4.

    Figure 9 Viewing common weak password risks
    Table 4 Parameters for common weak password risks

    Parameter

    Description

    Account Type

    Type of an account.

    Account Name

    Accounts identified with weak passwords.

    Masked Weak Password

    Masking result of a weak password. The rules for displaying masked weak passwords are as follows:

    • ******** indicates that the password length is less than 8.
    • ***a**** indicates that the password contains only lowercase letters.
    • ***B*** indicates that the password contains only uppercase letters.
    • **a**B** indicates that the password contains only uppercase and lowercase letters.
    • **a**A***@**1** indicates that the password is a common weak password.

    Usage Duration (Days)

    Duration a weak password is used.

    Server Name/ID

    Name and ID of the server where a weak password is used.

    IP Address

    The EIP and private IP address of a server.

    Last Scanned

    Time when the last scan completed.

    Suggestion

    Suggestion for changing weak passwords. You can check why the password is regarded insecure and set a strong password based on the suggestion.

  2. Log in to the server and change the weak password.

    • To enhance server security, you are advised to modify the accounts with weak passwords in a timely manner, such as SSH accounts.
    • To protect internal data of your server, you are advised to modify software accounts that use weak passwords, such as MySQL accounts and FTP accounts.
    • A password should contain more than eight characters, including uppercase letters, lowercase letters, digits, and special characters.

  3. After the weak password is changed, perform a manual check in the upper part of the Baseline Checks page to verify the result.

    If you do not perform a manual verification, HSS will automatically check the settings at 00:00:00 the next day.