Configuration in Alibaba Cloud 

Qualys virtual scanners can be launched from the Alibaba Cloud Marketplace or from a custom image that has been shared with your account.

Use only the Virtual Scanner Appliance for Alibaba images available in the Alibaba Cloud Marketplace or a shared image provided by Qualys. Images downloaded from the Qualys Enterprise TruRisk™ Platform are not recommended for use on Alibaba Cloud.

Deploy the Qualys Virtual Scanner Appliance

If you have access to the Alibaba Marketplace, follow the instructions in 'Option 1: Launch from Alibaba Marketplace'.

If you do not have access to the Alibaba Marketplace, contact Qualys Support to share the image with your account and follow the instructions in 'Option 2: Launch from a Qualys-Shared Image in Alibaba Cloud'.

Option 1: Launch from Alibaba Marketplace

1. To launch an instance from the Alibaba Cloud Marketplace, go to the Qualys Virtual Scanner Appliance page in the Alibaba Marketplace.

2. Log in to your Alibaba Cloud account and click Choose Your Plan.
   

Option 2: Launch from a Qualys-Shared Image in Alibaba Cloud

To launch from an image that Qualys has shared with your Alibaba account:

1. Log in to your Alibaba Cloud account.
2. Go to Elastic Compute Service > Instances & Images > Images > Shared Images.
3. Enter ‘qVSA’ in the search box to view all Qualys Virtual Scanner images shared with your account.
4. Select an image and click Create Instance. 

Configure Instance Settings

(Applies to Both Deployment Methods)

The qVSA image displayed in Alibaba may be identified as Red Hat; however, the actual operating system is Oracle Linux, as documented in the Qualys release notes. This is because Alibaba does not provide Oracle Linux as an available operating system option when registering image attributes.

Use the Custom Launch to enter the instance settings.

• Region - Select a region where the scanner instance resides in the same region as the scan targets

• Instance type - Select an instance type with a minimum of 2 GB of RAM. 

  Size: Select a VM size to support the workload you want to run; select a size where the ideal number of CPUs to allocated RAM ratio is either 1:4 or 1:3, for example, 4 CPUs and 16 GB RAM, or 1:3 ratio, depending on the platform’s availability. The minimum ratio would be 1:2.
  For more details on sizing, see Virtual Scanner Appliance Sizing.

• Instance Name - Specify a distinctive name for the scanner.

• Logon Credentials - The Qualys Virtual Scanner Appliance is a locked appliance; login access is disabled. You can select any Logon Credentials option; even if a password or key is provided, the Qualys Virtual Scanner Appliance will not use it, as login access is disabled.

• Metadata Access Mode - Qualys supports both Normal Mode and Security Hardening Mode (IMDSv2) : 
  • Normal Mode and Security Hardening Mode is the Default mode. After the instance is created, you can view its metadata in normal mode or in security hardening mode.
  • Security Hardening Mode: After the instance is created, you can view its metadata only in security hardening mode.

• User Data - Use this field to specify the 14-digit Personalization code and Proxy (if required), in the following format:

  Example:

  PERSCODE=123456789101234
PROXY_URL=username:password@proxyhost:port

If you use a domain account, the format is: 

domain\username:password@proxyhost:port

If authentication is not required, the format is:

proxyhost:port
Where: 

• proxyhost is the IP address or the FQDN of the proxy server

• port is the proxy port

Configuring Security Groups for your Virtual Scanner Appliance

• If the scanner has direct internet connectivity, ensure an outbound rule is created to allow port 443 to connect to the Qualys Security Operations Center (SOC) IP address range. To look up the SOC IP address range, log into the Qualys Enterprise TruRisk™ Platform and navigate to Help > About option.
• Make sure to create an outbound rule allowing communication with a proxy server on port 443 and the port used for proxy communication.
• Scanner must have connectivity access to target instances for scanning. It is recommended to configure an outbound rule that allows access to all ports and subnets of target instances.

Next Step

Step 3: Deploying Virtual Scanner in Alibaba Cloud Infrastructure with CLI