Use an Alibaba Cloud Linux MLPS 2.0 Level 3 image-Alibaba Cloud Linux(Alinux)-阿里云帮助中心

When you select an Alibaba Cloud Linux 2 or Alibaba Cloud Linux 3 MLPS 2.0 Level 3 image to create an ECS instance, you must complete the classified protection hardening configuration immediately the first time you remotely connect to the instance. This topic uses Alibaba Cloud Linux 2 as an example to describe how to use an Alibaba Cloud Linux MLPS 2.0 Level 3 image.

Procedure

Create an ECS instance.
For more information, see Create a custom instance. During the creation process, note the following configurations:
- In the Image section, select the Alibaba Cloud Linux 2.1903 LTS 64-bit MLPS 2.0 Level 3 image.
- To meet classified protection compliance requirements, MLPS-compliant images support only username and password logon. Therefore, set Logon Credentials to Custom Password.
Remotely connect to the ECS instance and manually configure classified protection hardening.
In compliance with GB/T 22239-2019 Information Security Technology - Baseline for Classified Protection of Cybersecurity, you must manually run commands to apply some configurations after you log on to the ECS instance. This ensures that you can log on to and use the ECS instance as expected. After you remotely connect to the ECS instance by using a username and password, first run the /root/cybersecurity.sh script to apply the classified protection hardening.
1. Remotely connect to the ECS instance by following Connect to a Linux instance by using a password.
2. Run the following command to complete the classified protection hardening of the image.
```
sh cybersecurity.sh
```
  Follow the on-screen prompts to create a regular user, an auditor user, and a security administrator user in sequence, and set a password for each user.

What to do next

The classified protection hardening configuration prevents the root user from directly logging on to the ECS instance, and prevents regular users such as ecs-user from switching to the root user. You must log on to the ECS instance by using the regular user, auditor, or security administrator account that you created.

After you log on to the ECS instance, you can run the su command to switch to the root user if you need to perform operations as root. The following example uses the regular user admin to log on to the ECS instance.

Remotely connect to the ECS instance as the regular user admin.
Run the following command to switch to the root user.
```
su root
```
At the command line, enter the password of the root user to switch users.
Note
An example of a successful user switch.