Security Center:FAQ about system baseline risks

Which edition of Security Center do I need to purchase to use the system baseline risk feature?

• Purchase the Advanced, Enterprise, or Ultimate edition of Security Center (you can purchase the subscription-based Advanced, Enterprise, or Ultimate edition, or enable host and container security on a pay-as-you-go basis and bind the edition to the Advanced, Enterprise, or Ultimate edition) to obtain the baseline risk check feature at no additional cost.

  The Advanced, Enterprise, and Ultimate editions support different baseline check items:

  • Advanced edition: only the default policy can be used, and only weak password check items are supported.

  • Enterprise edition and Ultimate edition: all check policies can be used. The Enterprise edition does not support container security check items, and the Ultimate edition supports all check items of baseline check. One-click fix is supported for check items related to the Alibaba Cloud baseline standards and Multi-Level Protection Scheme (MLPS) baseline standards on Linux systems.

• If you are using the Anti-virus edition or have purchased only value-added services, you can purchase the paid version of Cloud Security Posture Management (CSPM). After you complete the purchase, you can obtain the baseline risk check feature and access all check items.

For more information, see Enable the baseline risk check feature.

What do I do if baseline check verification fails?

If the system baseline risk feature of Security Center fails to verify fixed risk items, the Security Center agent on your server may be offline.

If the Security Center agent on your server is offline, the system baseline risk check of Security Center cannot run. We recommend that you troubleshoot the offline agent issue to ensure that the Security Center agent on your server is online. For more information about how to troubleshoot offline agents, see Troubleshoot offline agents.

What are the differences between baselines and vulnerabilities?

• A baseline is a detailed description of how to configure and manage a system, or the minimum security requirements. Baselines include service and application settings, operating system component configurations, permission assignments, and management rules. The system baseline risk feature of Security Center detects insecure configurations such as weak passwords, account permissions, identity authentication, password policies, access control, security audit, and intrusion prevention on operating systems and services (such as databases, server software, and containers), and provides hardening suggestions for the detected risks. For more information about the specific check items, see Baseline check content.

• A vulnerability is a defect in the implementation of an operating system or in security policies, such as a logic design defect or a coding error in operating system or application software. Attackers can exploit these defects or errors to access and steal system data or damage systems without authorization. System administrators must handle and fix system vulnerabilities in a timely manner. Otherwise, serious security risks may occur. For more information, see Vulnerability management.

Why does the check item "Perform identity identification and authentication for users who log on to the system. Identity identification must be unique, and identity authentication information must meet complexity requirements and be changed on a regular basis | Identity authentication" still fail after one-click fix and verification?

Cause: When you perform one-click fix on target assets, two sub-items that match actual application scenarios are not selected as fix items. After the one-click fix task is delivered, the two sub-items are not fixed, and the check item still fails.

The two unselected sub-items are Set password expiration to 30 to 90 days (value: 90) and Set root password expiration to 30 to 90 days (value: 60). You can confirm that the sub-items are not selected in the Fix Method panel on the right.

Solution: If the assets use only non-password logon methods, the one-click fix feature of Security Center is not supported. After you make sure that the other configuration items are fixed, you can fix this check item by configuring an allowlist policy for the check item on the assets.

In the Risk Handling area at the bottom of the check item details page, find the target asset whose status is Not Passed, and click Add to Allowlist in the Actions column.

Why does the check item "Assign accounts and permissions to users who log on to the system" fail?

• Problem description: The Status of the check item "Assign accounts and permissions to users who log on to the system" is Not Passed.

  The Fixing Suggestions for this check item contain the following three items:

  1. Assign three users: a regular user, an auditor, and a security officer.

  2. Check whether the umask value in /etc/bashrc and /etc/profile is 027, and run source /etc/profile to apply the configuration.

  3. Make sure that the permissions on the home directory of each user are set to 750 or stricter.

  Check the host configurations (home directory permissions, number of users, and umask value) shown as follows. The server configurations appear to meet the fixing suggestions of the check item "Assign accounts and permissions to users who log on to the system".

  $ ll /home
  total 24
  drwxr-xr-x  6 root       root           4096 Jan 12  2024 ./
  drwxr-xr-x 20 root       root           4096 Apr 26 12:53 ../
  drwxr-x--- 11 xxx        xxx            4096 Sep 11 12:25 xxx/
  drwxr-x---  2       1002        1002 4096 Oct 25  2023 xxx2/
  drwxr-x---  2       1002        1002 4096 Jan 12  2024 xxx
  drwxr-x---  4 xxx xxx 4096 Mar 26  2024 xxx/

  # /etc/profile: system-wide .profile file for the Bourne shell (sh(1))
  # and Bourne compatible shells (bash(1), ksh(1), ash(1), ...).
  
  if [ "${PS1-}" ]; then
    if [ "${BASH-}" ] && [ "$BASH" != "/bin/sh" ]; then
      # The file bash.bashrc already sets the default PS1.
      # PS1='\h:\w\$ '
      if [ -f /etc/bash.bashrc ]; then
        . /etc/bash.bashrc
      fi
    else
      if [ "$(id -u)" -eq 0 ]; then
        PS1='# '
      else
        PS1='$ '
      fi
    fi
  fi
  
  if [ -d /etc/profile.d ]; then
    for i in /etc/profile.d/*.sh; do
      if [ -r $i ]; then
        . $i
      fi
    done
    unset i
  fi
  
  umask 027
  TMOUT=900

• Solution: Run the following commands to further confirm the umask value and the number of accounts other than the system administrator account that are detected by the baseline risk check.

  grep umask /etc/bashrc |grep -v '#'|awk -F ' ' '{print $2}'|sort -r|head -1
  grep umask /etc/profile |grep -v '#'|awk -F ' ' '{print $2}'|sort -r|head -1
  
  cat /etc/passwd | egrep -v '(root|halt|sync|shutdown)' | awk -F: '($7!="/bin/false"&&$7!="/sbin/nologin"&&$7!="/usr/sbin/nologin"&&$6!="/var/lib/libuuid"&&$6!="") { print $6 }' |wc -l

  The following output shows that the baseline risk check detects two accounts other than the system administrator account, which does not meet the fixing suggestions of the check item.

  xxx:~$ umask
  0027
  xxx:~$ grep umask /etc/bashrc |grep -v '#'|awk -F ' ' '{print $2}'|sort -r|head -1
  grep: /etc/bashrc: No such file or directory
  xxx:~$ grep umask /etc/profile |grep -v '#'|awk -F ' ' '{print $2}'|sort -r|head -1
  0027
  xxx:~$ cat /etc/passwd | egrep -v '(root|halt|sync|shutdown)' | awk -F: '($7!="/bin/false"&&$7!="/sbin/nologin"&&$7!="/usr/sbin/nologin"&&$6!="/var/lib/libuuid"&&$6!="") { print $6 }' |wc -l
  2

  Compliant ranges of the baseline check:

  • umask compliant range: 27 to 67 (You can run the preceding grep umask /etc/bashrc or grep umask /etc/profile command to obtain the current value.)

  • Account quantity compliant range: 3 to 100 (excluding the system administrator account. You can run the preceding cat /etc/passwd command to obtain the current value.)

  The account quantity check excludes system accounts such as root, halt, sync, and shutdown, as well as non-logon accounts whose shell is /bin/false or /sbin/nologin. If the number of accounts obtained after the preceding accounts are excluded falls within the compliant range, the check item meets the requirements.

  Add a user that does not have system administrator permissions on the server based on the fixing suggestions, and then verify the check item in Security Center again.

Why am I seeing the "illegal auth" error when I create a baseline check policy?

The following table describes the possible causes and solutions.

[MLPS compliance] The message "Unneeded system services, default sharing, and high-risk ports must be disabled" appears in the Windows compliance baseline check for MLPS Level 2

• Problem description: After some users block specific ports by configuring firewalls or security groups, the message "Unneeded system services, default sharing, and high-risk ports must be disabled" appears in the Windows compliance baseline check for MLPS Level 2.

• Cause: The services that correspond to the specified ports are not stopped. As a result, the baseline risk check scan task still detects these ports and the services.

• Solution: Log on to your server instance and stop the services on the following ports. The following steps use Windows 10 (64-bit) as an example.

  Disable port 135

  1. Press Windows+R, enter dcomcnfg, and then click OK to open the Component Services dialog box.

  2. In the left-side navigation pane, click Component Services > Computers > My Computer, right-click, and then click Properties.

  3. In the dialog box that appears, click the Default Properties tab, and then clear the Enable Distributed COM on this computer (E) check box.

  4. Click the Default Protocols tab, select Connection-oriented TCP/IP, and then click Remove.

  5. Click OK.

  Disable ports 136, 137, and 138

  1. Press Windows+S, enter Control Panel in the search box, and then click Control Panel.

  2. In the Control Panel dialog box, click Network and Internet.

  3. Click Network and Sharing Center, and then click the connected network.

  4. In the dialog box that appears, click Properties.

  5. In the dialog box that appears, clear the File and Printer Sharing for Microsoft Networks and Client for Microsoft Networks check boxes.

  6. Click OK, and then close the open dialog boxes one by one.

  Disable port 139

  1. Press Windows+S, enter Control Panel in the search box, and then click Control Panel.

  2. In the Control Panel dialog box, click Network and Internet.

  3. Click Network and Sharing Center, and then click Change adapter settings on the left.

  4. In the dialog box that appears, right-click the network in use (for example, Ethernet), and then click Properties.

  5. In the dialog box that appears, double-click Internet Protocol Version 4 (TCP/IPv4).

  6. In the dialog box that appears, click Advanced, and then go to the WINS tab.

  7. Select Disable NetBIOS over TCP/IP, and then click OK.

  8. Click OK again one by one, and then close all dialog boxes.

  Disable port 445

  1. Press Windows+R, enter regedit, and then click OK to open the Registry Editor dialog box.

  2. In the left-side navigation pane, click Computer > HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > NetBT > Parameters, and then right-click Parameters.

  3. Click New > String Value, enter SMBDeviceEnabled in the Value name field, and then double-click the new value name.

  4. In the dialog box that appears, enter 0 in the Value data field, click OK, and then close Registry Editor.

  5. Press Windows+R, enter services.msc, and then go to the Services dialog box.

  6. Find and double-click the server service. In the dialog box that appears, set Startup type to Disabled, set Service status to Stopped, click Apply, and then close the Services dialog box.

What do I do if the baseline risk item "Make sure that the `Devices: Allowed to format and eject removable media` policy is set to `Administrators`" fails?