# Host Management

> Register and manage Linux servers in SecureBaseline Cloud - add hosts via SSH, organize inventory, monitor connection status, and configure scan targets

Source: https://opennix.org/en/docs/haas/hosts/

## Overview

Hosts are the Linux servers that you want to scan for CIS compliance and/or harden. Each host requires SSH access for the platform to connect and perform operations.

## Navigation

**Menu**: Infrastructure > Hosts

## Page Layout

### Host List

The host list displays all registered servers with the following columns:

| Column | Description |
|--------|-------------|
| Hostname | Server hostname or friendly name |
| IP Address | IP address for SSH connection |
| SSH User | Username for SSH authentication |
| Credential | Associated SSH credential name and type |
| OS | Detected operating system (auto-detected) |
| Status | Connection status (online/offline/unknown) |
| Actions | Available operations for the host |

### Sorting and Pagination

- Click column headers to sort
- Use pagination controls at bottom to navigate
- Adjust page size (20, 50, 100, 200 items per page)

## Toolbar Buttons

| Button | Description |
|--------|-------------|
| Add Host | Create a new host |
| Check All Status | Verify SSH connectivity to all hosts |
| Manage Credentials | Open credentials management modal |
| Bulk Scan (N) | Run compliance scan on N selected hosts |
| Bulk Harden (N) | Apply hardening to N selected hosts |
| Bulk Delete (N) | Delete N selected hosts |

## Adding a Host

1. Click **Add Host** button
2. Fill in the form:
   - **Hostname**: Server name (e.g., `web-server-01`)
   - **IP Address**: Server IP (e.g., `192.168.1.100`)
   - **SSH Port**: Default is 22
   - **SSH User**: Username for connection (e.g., `root` or `admin`)
   - **SSH Credential**: Select from existing credentials
3. Click **Create**

The OS will be automatically detected after the host is added.

## Editing a Host

1. Click the **...** (more) dropdown menu on the host row
2. Select **Edit**
3. Modify the fields as needed
4. Click **Update**

## Deleting a Host

1. Click the **...** (more) dropdown menu on the host row
2. Select **Delete**
3. Confirm deletion in the dialog

**Warning**: Deleting a host also removes all associated scan results and job history.

## Host Actions

### Primary Action: Harden

Click the **Harden** button on any host row to start hardening:

1. Select a hardening profile:
   - **CIS Profiles**:
     - CIS Level 1 - Server
     - CIS Level 2 - Server
     - CIS Level 1 - Workstation
     - CIS Level 2 - Workstation
   - **STIG Profiles**:
     - STIG Server
     - STIG Workstation
2. Select priority (Lowest, Low, Normal, High, Critical)
3. Click **Start Hardening**

### Dropdown Menu Actions

Click **...** to access additional actions:

| Action | Description |
|--------|-------------|
| Check | Verify SSH connectivity to this host |
| Detect OS | Re-run OS detection |
| Edit | Modify host details |
| Delete | Remove the host |

### Check All Status

Click **Check All Status** in the toolbar to verify connectivity to all hosts at once.

## Bulk Operations

Select multiple hosts using checkboxes, then use bulk action buttons:

### Bulk Scan

Run compliance scans on selected hosts:

1. Select hosts using checkboxes
2. Click **Bulk Scan (N)** button
3. Select a SCAP profile from the dropdown
4. Click **Start Scans**

Progress bar shows scan creation progress.

### Bulk Harden

Apply hardening to selected hosts:

1. Select hosts using checkboxes
2. Click **Bulk Harden (N)** button
3. Review selected hosts in the modal
4. Select hardening profile (CIS or STIG)
5. Select priority
6. Click **Start Hardening All**

### Bulk Delete

Delete multiple hosts:

1. Select hosts using checkboxes
2. Click **Bulk Delete (N)** button
3. Confirm deletion in the dialog

## Credentials Management

Click **Manage Credentials** button to open the credentials modal.

### Viewing Existing Credentials

The modal displays a table of existing credentials with:
- Name
- Type (password or ssh_key)
- Delete action

### Creating a Credential

1. Fill in the form at the bottom:
   - **Name**: Descriptive name (e.g., `production-key`)
   - **Type**: Password or SSH Key
   - **Password** or **Private Key**: Authentication data
2. Click **Create**

### Deleting a Credential

1. Click **Delete** button on the credential row
2. Confirm deletion

**Note**: Credentials used by hosts cannot be deleted until removed from those hosts.

## Status Indicators

| Status | Color | Meaning |
|--------|-------|---------|
| online | Green | SSH connection successful |
| offline | Red | SSH connection failed |
| unknown | Gray | Not yet checked |

## Auto-Refresh

Host status is automatically refreshed every 30 seconds.

## Supported Operating Systems

| Distribution | Versions |
|--------------|----------|
| Ubuntu | 18.04, 20.04, 22.04, 24.04 |
| Debian | 11, 12 |
| RHEL/CentOS/AlmaLinux/Rocky | 7, 8, 9, 10 |
| Oracle Linux | 7, 8, 9, 10 |
| Amazon Linux | 2, 2023 |
| SUSE/SLES | 15 |
| openSUSE Leap | latest |
| Fedora | 37+ |
| Astra Linux | SE (Debian-based) |
| RED OS | RHEL-based |
| ALT Linux | RHEL-based |
| Rosa Linux | RHEL-based |

## Hardening Profiles

Security profiles are automatically detected from installed SCAP content. Available profiles vary by OS.

| Profile | Description |
|---------|-------------|
| CIS Level 1 - Server | Basic security, minimal impact on functionality |
| CIS Level 2 - Server | Enhanced security, may impact some features |
| CIS Level 1 - Workstation | Basic security for desktops |
| CIS Level 2 - Workstation | Enhanced security for desktops |
| DISA STIG | Security Technical Implementation Guide |
| PCI-DSS | Payment Card Industry Data Security Standard |
| HIPAA | Health Insurance Portability and Accountability Act |
| OSPP | Operating System Protection Profile |
| ANSSI BP28 | French National Cybersecurity Agency (4 levels) |
| E8 | Australian Essential Eight |
| CCN | Spanish National Cryptologic Center |
| CUI | Controlled Unclassified Information |
| Standard | Basic security profile |

## Troubleshooting

### Host Shows Offline

1. Verify the IP address is correct
2. Check SSH port (default 22)
3. Verify credential is valid and not expired
4. Check network connectivity and firewalls
5. Try **Check** action to refresh status

### OS Not Detected

1. Ensure host is online first
2. Click **...** > **Detect OS** to re-run detection
3. Check that `/etc/os-release` exists on the target
4. Verify SSH user has read permissions

### Hardening Fails

1. Check the Jobs page for error details and Ansible output
2. Verify the host is online
3. Ensure SSH user has sudo privileges (or is root)
4. Check for conflicting services or configurations

### Cannot Create Host

1. Verify IP address format is valid
2. Ensure hostname is unique
3. Select a valid credential
4. Check for required fields

## Best Practices

1. **Use descriptive hostnames** for easy identification
2. **Use SSH keys** instead of passwords for better security
3. **Test connectivity** (Check) before running hardening
4. **Start with CIS Level 1** before applying Level 2
5. **Run compliance scan** before and after hardening to measure improvement
6. **Group operations** - Use bulk actions for efficiency

## Related Pages

- [Compliance Scanning](/en/docs/haas/compliance-scanning/) - Run compliance scans
- [Jobs](/en/docs/haas/jobs/) - View job status and Ansible output
- [Hardening](/en/docs/haas/hardening/) - Detailed hardening information
- [Credentials](/en/docs/haas/credentials/) - Detailed credential management