Enable tamper protection

Limits

• For each server, you can add a maximum of 10 directories for protection.
• The protected directories of a Windows server must meet the following requirements: The maximum size of each directory is 20 GB. Each directory can contain a maximum of 2,000 folders. The maximum directory level is 20. The maximum size of each file is 3 MB.
• The protected directories of a Linux server must meet the following requirements: The maximum size of each directory is 20 GB. Each directory can contain a maximum of 3,000 folders. The maximum directory level is 20. The maximum size of each file is 3 MB.
• Before you add a directory for protection, make sure that the directory level, the number of folders, and the directory size meet the preceding requirements.
• We recommend that you exclude file formats that do not require protection, such as LOG, PNG, JPG, MP4, AVI, and MP3. Separate multiple file formats with semicolons (;).
• You cannot add servers for protection if no license is available. If a server does not require protection, turn off the Protection switch. After protection is disabled for the server, the license used by this server is released, and you can add another server for protection.

Procedure

1. Log on to the Security Center console.
2. In the left-side navigation pane, choose Defense > Tamper Protection.
3. On the Tamper Protection page, click the Management tab.
4. On the Tamper Protection page, click Add Server to add servers to be protected.
5. In the Add Servers for Protection page that appears on the right, select the servers that you want to protect.
   Note You cannot add servers for protection if no license is available. If a server does not require protection, turn off the Protection switch. After protection is disabled for the server, the license used by this server is released, and you can add another server for protection.
6. Click Next to go to the Add Directory tab.
7. On the Add Directory tab, set the following parameters:
   Select the protection mode. You can select Whitelist Mode or Blacklist Mode. The whitelist mode protects the specified directories and files in the specified formats. In the blacklist mode, you can specify the sub-directories, file formats, and files that do not require protection. All the other files in the specified directory are protected. By default, the whitelist mode is selected.

   • In the whitelist mode, set the following parameters:

     Parameter	Description
     Protected Directory	Enter the directory that you want to protect. Note The format of a directory varies depending on the server operating system (Linux or Windows). Enter a directory in the correct format.
     Protected File Formats	Select file formats from the drop-down list, such as JS, HTML, XML, and JPG.
     Local Backup Directory	The default path that is used to back up the protected directory is displayed. Security Center assigns the following default backup directories: /usr/local/aegis/bak for Linux servers and C:\Program Files (x86)\Alibaba\Aegis\bak for Windows servers. You can change the backup directory.

   • In the blacklist mode, set the following parameters:

     Parameter	Description
     Protected Directory	Enter the directory that you want to protect.
     Excluded Sub-Directories	Enter the sub-directories that do not require tamper protection. You can click Add Sub-Directory to enter more sub-directories. Security Center does not provide tamper protection to files under the excluded sub-directories.
     Excluded File Formats	Enter the formats of files that do not require tamper protection. Supported formats include log, txt, and ldb. Security Center does not provide tamper protection to files in the excluded formats.
     Excluded Files	Enter the path of the file that does not require tamper protection. You can click Add File to add more files. Security Center does not provide tamper protection to the excluded files.
     Local Backup Directory	The default path that is used to back up the protected directory is displayed. Security Center assigns the following default backup directories: /usr/local/aegis/bak for Linux servers and C:\Program Files (x86)\Alibaba\Aegis\bak for Windows servers. You can change the backup directory.

8. Click Enable Protection.
   After you add the server, it is displayed in the server list on the Tamper Protection page.

   Note By default, tamper protection is Disabled for newly added servers. You need to turn on the switch on the Tamper Protection page for the target server.

   
9. In the server list on the Tamper Protection page, turn on the Protection switch to enable tamper protection for the target server.
   Note By default, tamper protection is Disabled for newly added servers. You need to enable tamper protection on the Tamper Protection page for the target server.

   If this is your first time enabling tamper protection for a server, the protection status becomes Initializing and a progress bar appears. It takes a few seconds to enable tamper protection, and then the protection status becomes Running.

   Note If the protection status of a server becomes Exception, place the pointer over Exception in the Protection column. A message appears indicating the exception cause. Click Retry in the message. For more information, see Handle protection service exceptions.

What to do next

After you enable tamper protection, you can go to the Alerts page, and select Webpage Tampering from the alert type drop-down list to view the alerts generated based on tampering events.

Handle protection service exceptions