Enabling and Disabling Agent Self-Protection

Scenario

Agent self-protection can protect HSS software, processes, and files from malicious programs. The protection capabilities vary depending on the OS.

• Self-protection in Windows: Prevents malicious programs from uninstalling the agent, tampering with HSS files, or stopping HSS processes.
• Self-protection in Linux: Prevent malicious programs from stopping HSS processes or uninstalling HSS agents.

This section describes how to enable or disable agent self-protection for servers in a specified enterprise project.

Comparison Between Agent Self-Protection and the Self-Protection Policy

Agent self-protection and the self-protection policy are the same function, but their application scopes are different. For details, see Table 1.

Constraints

• Agent self-protection is supported only if the Linux agent version is 3.2.12 or later, or the Windows agent version is 4.0.18 or later.
• Agent self-protection in Windows depends on antivirus detection, HIPS detection, and ransomware protection. It takes effect only when more than one of the three functions are enabled. For details about how to check or enable these functions, see:
  • Ransomware protection: Enabling Ransomware Prevention
  • AV detection and HIPS detection: Configuring Policies
• Enabling the self-protection policy has the following impacts:
  • Windows
    • The agent cannot be uninstalled through the control panel. It can be uninstalled on the HSS console.
    • In the agent installation path C:\Program Files\HostGuard, you can only access the log and data directories (and the upgrade directory, if your agent has been upgraded).
    • HSS-related processes cannot be forcibly stopped.
  • Linux
    • The agent cannot be uninstalled using commands. It can be uninstalled on the HSS console.
    • If you run a command to stop or restart HSS, you need to enter a verification code, which is displayed in the command output after you run the stop or restart command.
    • HSS-related process information is hidden.

Enabling Agent Self-protection

1. Log in to the HSS console.
2. Click in the upper left corner and select a region or project.
3. In the navigation pane, choose Installation & Configuration > Server Install & Config.
4. Click the Security Configuration tab. Click Agent Self-Protection.
5. In the upper part of the page, select a project from the Enterprise Project drop-down list.

   All projects indicates all enterprise projects.

6. Click . The Enable Agent Self-protection? dialog box is displayed.
   Figure 1 Agent self-protection
   

7. Click OK.

   indicates that agent self-protection is enabled.

Disabling Agent Self-protection

1. Log in to the HSS console.
2. Click in the upper left corner and select a region or project.
3. In the navigation pane, choose Installation & Configuration > Server Install & Config.
4. Click the Security Configuration tab. Click Agent Self-Protection.
5. In the upper part of the page, select a project from the Enterprise Project drop-down list.

   All projects indicates all enterprise projects.

6. Click . The Disable Agent Self-protection? dialog box is displayed.
   Figure 2 Agent self-protection
   

7. Click OK.

   indicates that agent self-protection is disabled.