Apply Latest OS Patches

01 Sign in to your Alibaba Cloud account.

02 Navigate to Security Center console available at https://yundun.console.aliyun.com/?p=sas#/overview/home.

03 In the top navigation bar, select the region where your servers reside (China or Outside China).

04 In the left navigation panel, under Risk Governance, choose Vulnerabilities.

05 In the Vulnerability Scan section, choose Scan now. You can also follow the steps outlined on this page to ensure that the vulnerability scanning feature is enabled for Linux and Windows vulnerability types.

06 In the Vulnerability Scan box, ensure that the Linux Software Vulnerability and Windows System Vulnerability checkboxes are selected, then choose OK to start the scanning process. The scan requires 30 minutes to complete.

07 After the scanning process is completed, check the Vul Servers attribute value to identity the number of servers on which vulnerabilities are detected. If the number displayed for Vul Servers is greater than 0 (zero), there are ECS virtual machines (VM) instances that requires OS patching within your Alibaba Cloud account.

01 Run ModifyStartVulScan command (OSX/Linux/UNIX) to enable the quick scan feature. You can also follow the steps outlined on this page to ensure that the vulnerability scanning feature is enabled for Linux and Windows vulnerability types:

aliyun sas ModifyStartVulScan

02 If successful, the output should return the command request ID:

{"RequestId":"ABCDABCD-1234-ABCD-1234-ABCD1234ABCD"}

03 Run DescribeVulList command (OSX/Linux/UNIX) to describe the Linux software vulnerabilities found for the ECS virtual machine (VM) instances provisioned in your Alibaba Cloud account. Change the --Type command parameter to sys to describe the Windows system vulnerabilities found your ECS instances:

aliyun sas DescribeVulList --Type cve

04 The command output should return the requested configuration information:

{
	"CurrentPage": 1,
	"TotalCount": 2,
	"PageSize": 80,
	"VulRecords": [
		{
			"RaspStatus": 1,
			"Type": "cve",
			"InstanceName": "tm-project-prod-server",
			"Online": true,
			"OsVersion": "linux",

			...

			"Name": "alilinux2:2.1903:ALINUX2-SA-2022:0007",
			"InstanceId": "i-1234abcd1234abcd1234",
			"RegionId": "eu-west-1",
			"Necessity": "asap",
			"Uuid": "abcd1234-abcd-1234-abcd-1234abcd1234"
		},
		{
			"RaspStatus": 1,
			"Type": "cve",
			"InstanceName": "tm-project-llm-server",
			"Online": true,
			"OsVersion": "linux",

			...

			"Name": "oval:com.redhat.rhsa:def:20170574",
			"InstanceId": "i-abcd1234abcd1234abcd",
			"RegionId": "eu-west-1",
			"Necessity": "asap",
			"Uuid": "1234abcd-1234-abcd-1234-abcd1234abcd"
		}
	],
	"NextToken": "ABCDABCDABCDABCDABCDABCDABCDABCD",
	"RequestId": "1234ABCD-1234-ABCD-1234-ABCD1234ABCD"
}

01 Sign in to your Alibaba Cloud account.

02 Navigate to Security Center console available at https://yundun.console.aliyun.com/?p=sas#/overview/home.

03 In the top navigation bar, select the region where your servers reside (China or Outside China).

04 In the left navigation panel, under Risk Governance, choose Vulnerabilities.

05 Choose the Linux Software Vulnerability/Windows System Vulnerability tab, select the vulnerability that you want to fix and choose Fix in the Actions column. In the Fix box, select an option to determine whether to create a snapshot of the server and choose Fix Now to apply the latest OS patches.

06 After you fix a Linux/Windows software vulnerability in the Security Center console, you may need to restart the system for the vulnerability fix to take effect. If the vulnerability fix is marked with Restart Required, choose Restart in the Actions column to restart the system.

01 Run ModifyOperateVul command (OSX/Linux/UNIX) to fix Linux/Windows software vulnerabilities detected by Security Center. The following command request fixes a software vulnerability named "alilinux2:2.1903:ALINUX2-SA-2022:0007", for a Linux server identified by the UUID "abcd1234-abcd-1234-abcd-1234abcd1234". To fix Windows software vulnerabilities, set the --Info "tag" parameter value to "system" and the --Type parameter value to sys:

aliyun sas ModifyOperateVul 
  --Info '[{"name":"alilinux2:2.1903:ALINUX2-SA-2022:0007","uuid":"abcd1234-abcd-1234-abcd-1234abcd1234","tag":"oval","isFront":0}]' 
  --OperateType vul_fix 
  --Type cve

02 If successful, the output should return the command request ID:

{"RequestId":"1234ABCD-1234-ABCD-1234-ABCD1234ABCD"}