Harden ACK hosts with OS baselines, Security Center, node access controls, and ECS best practices.
Perform baseline checks
Run periodic baseline checks to verify hosts meet OS Security Hardening and Multi-Level Protection Scheme (MLPS) standards.
OS Security Hardening
OS Security Hardening defines security standards for host OSs such as Alibaba Cloud Linux (Alinux), CentOS, and Ubuntu. ACK clusters default to Alinux 3.
MLPS Security Hardening
MLPS Security Hardening, based on GB/T 22239-2019, hardens Alinux across five areas: identity verification, access control, security audit, intrusion prevention, and malicious code prevention. See ACK security hardening based on MLPS.
Enable Alibaba Cloud Security Center
Detect vulnerabilities, check host configurations, and scan container images on ACK cluster nodes.
Security Center provides these features for ACK nodes:
-
Vulnerability patching: Detects and patches common vulnerabilities. View results or trigger scans on the Vulnerabilities page.
-
Baseline check: Checks OS, database, software, and container configurations. Generates reports with recommendations to reduce intrusion risks and meet compliance requirements.
-
Cloud service configuration check: Checks cloud service configurations across six dimensions: identity and permissions, network access control, data security, log audit, monitoring and alerting, and basic security. Provides mitigation recommendations for each finding.
-
Container image scan: Detects system and application vulnerabilities, malicious samples, configuration risks, and sensitive data in container images. Provides remediation suggestions.
Limit node access
Access nodes over the internal network to avoid exposing them to the Internet.
Access remote nodes from the ACK console through Workbench or Virtual Network Computing (VNC) over the internal network. No elastic IP address (EIP) is required.
If a node requires Internet access, add security group rules to restrict source access. Limit exposed ports to further reduce the attack surface.
Follow ECS security best practices
Apply ECS security best practices to instances hosting ACK cluster nodes.
ECS instances hosting ACK nodes run Alinux 3 by default. See ECS instance security.
Next steps
-
Enable MLPS Security Hardening and configure baseline check policies in ACK security hardening based on MLPS.
-
Explore Alinux 3 security capabilities in Use Alibaba Cloud Linux 3.
-
Manage Security Center vulnerabilities in Overview.