DocsICP FilingConsole
Documentation
Home Page Alibaba Cloud Linux Scenario Scheme Alibaba Cloud Linux MLPS 2.0 Level 3 Edition FAQ for Alibaba Cloud Linux MLPS 2.0 Level 3 images

FAQ for Alibaba Cloud Linux MLPS 2.0 Level 3 images

Updated at:
Copy as MD
Product
My Favorites

This topic lists frequently asked questions and their solutions for Alibaba Cloud Linux 2 and Alibaba Cloud Linux 3 Multi-Level Protection Scheme (MLPS) 2.0 Level 3 images.

What are the advantages of using Alibaba Cloud Linux MLPS 2.0 Level 3 images?

  • Cost-effective: Alibaba Cloud Linux MLPS 2.0 Level 3 images are currently free.

  • Labor-saving: Security Center provides baseline check policies. The system automatically determines whether an instance meets classified protection compliance requirements.

  • Time-saving: You can use custom images that have undergone MLPS 2.0 security hardening to create ECS instances in batches. For more information, see Create multiple instances from a custom image that is hardened for MLPS 2.0.

What are the security hardening items for Alibaba Cloud Linux MLPS 2.0 Level 3 images? What content is hardened?

The system is hardened with 19 items across five aspects: identity authentication, access control, security audit, intrusion prevention, and malicious code prevention. For a description of each hardening item, see Configure a baseline check policy for an Alibaba Cloud Linux MLPS 2.0 Level 3 image. The check items correspond to the hardening items.

What are the differences in security hardening content between Alibaba Cloud Linux 3 and Alibaba Cloud Linux 2 MLPS 2.0 Level 3 images?

Compared to Alibaba Cloud Linux 2, the Alibaba Cloud Linux 3 MLPS 2.0 Level 3 hardened image has two main differences in its hardening content:

  • For the Follow the principle of minimal installation and install only necessary components and applications check item in the Intrusion Prevention check type, you cannot uninstall NetworkManager-related packages in Alibaba Cloud Linux 3. This is because Alibaba Cloud Linux 3 uses the NetworkManager service by default, making these packages essential.

  • For the Restrict management terminals that are managed over the network by setting the connection type or address range check item in the Intrusion Prevention check type, the files to modify are different:

    • Alibaba Cloud Linux 2: Modify the /etc/hosts.allow and /etc/hosts.deny files.

    • Alibaba Cloud Linux 3: Modify the /etc/ssh/sshd_config file.

Do operations within an instance affect the MLPS 2.0 security hardening configurations of an Alibaba Cloud Linux MLPS 2.0 Level 3 image?

The MLPS 2.0 image only guarantees the security of the system's initial state. Some operations you perform in the system later may affect the MLPS 2.0 security hardening configuration items. If a hardening item has an issue, you can perform a baseline check in Security Center and then fix the issue based on the results. For more information, see Configure a baseline check policy for an Alibaba Cloud Linux MLPS 2.0 Level 3 image.

Do Alibaba Cloud Linux MLPS 2.0 Level 3 images affect system performance?

Among the MLPS 2.0 security hardening configuration items, only the manually started auditd service affects system performance. Other configuration items do not affect system performance by default.

Why can't I perform baseline checks on Alibaba Cloud Linux MLPS 2.0 Level 3 images using Security Center?

Security Center supports the baseline check service only in the Enterprise Edition. To perform a baseline check, upgrade Security Center to the Enterprise Edition first. For more information, see Upgrade and downgrade Security Center.

Why don't Alibaba Cloud Linux MLPS 2.0 Level 3 images support logon using Secure Shell (SSH) key pairs?

Most MLPS 2.0 security hardening configuration items involve password checks, such as scans and hardening for password strength, password reuse limits, password expiration dates, and failed logon policies. However, they do not include checks or hardening for SSH key pairs. To ensure the security of the MLPS 2.0 image, the system prohibits direct logon for the root user after you complete the MLPS 2.0 security hardening configuration. This includes logon using the root user's key.

How do I configure Kdump in an Alibaba Cloud Linux MLPS 2.0 Level 3 image?

Alibaba Cloud Linux MLPS 2.0 Level 3 images are hardened for classified protection according to GB/T 22239-2019 Information Security Technology - Baseline for Classified Protection of Cybersecurity. To meet the Follow the principle of minimal installation and install only necessary components and applications check item, software such as Kdump is uninstalled by default. For more information, see Check rules for Alibaba Cloud Linux MLPS 2.0 Level 3 images.

If you still want to configure Kdump in an MLPS 2.0 Level 3 image, follow these steps:

  1. Remotely connect to the ECS instance that uses the MLPS 2.0 Level 3 image.

    For more information about connection types, see Connection methods.

  2. Run the following command to install the kexec-tools tool.

    sudo yum install -y kexec-tools

  3. Configure Kdump.

    For more information, see Configure the crashkernel parameter.

What is the password expiration time for users in an Alibaba Cloud Linux MLPS 2.0 Level 3 operating system? How do I log on to an instance after a password expires?

The password for users (including the regular user admin, auditor user audit, and security administrator user security) in an Alibaba Cloud Linux MLPS 2.0 Level 3 operating system is valid for 90 days. When your password expires, you must reset it as prompted by the system when you log on to the instance using SSH or VNC. Then, log on again with the new password.

Previous：Alibaba Cloud Linux MLPS 2.0 Level 3 image check rulesNext：Alibaba Cloud Linux 4 LTS 64 bit Deb Edition