{"id":81884,"date":"2020-05-17T13:42:18","date_gmt":"2020-05-17T11:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity"},"modified":"2020-05-17T13:42:18","modified_gmt":"2020-05-17T11:42:18","slug":"bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","title":{"rendered":"Bezpe\u010dnost a SGBD: na co si d\u00e1t pozor p\u0159i v\u00fdb\u011bru ochrann\u00fdch prost\u0159edk\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h1><img decoding=\"async\" alt=\"Bezpe\u010dnost a SGBD: na co si d\u00e1t pozor p\u0159i v\u00fdb\u011bru ochrann\u00fdch prost\u0159edk\u016f\" src=\"\/wp-content\/uploads\/2020\/05\/ac49253838e36336af127d71394139d8.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/h1>\n<p>\nJmenuji se Denis Ro\u017ekov, jsem vedouc\u00ed v\u00fdvoje software ve spole\u010dnosti \u201eGazinformservis\u201c, v produktov\u00e9m t\u00fdmu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\">Jatoba<\/a><\/noindex>. Legislativn\u00ed a korpor\u00e1tn\u00ed normy ukl\u00e1daj\u00ed ur\u010dit\u00e9 po\u017eadavky na bezpe\u010dnost uchov\u00e1v\u00e1n\u00ed dat. Nikdo si nep\u0159eje, aby t\u0159et\u00ed strany z\u00edskaly p\u0159\u00edstup k d\u016fv\u011brn\u00fdm informac\u00edm, proto jsou pro ka\u017ed\u00fd projekt d\u016fle\u017eit\u00e9 n\u00e1sleduj\u00edc\u00ed ot\u00e1zky: identifikace a autentifikace, \u0159\u00edzen\u00ed p\u0159\u00edstupu k dat\u016fm, zaji\u0161t\u011bn\u00ed integrity informac\u00ed v syst\u00e9mu, registrace bezpe\u010dnostn\u00edch ud\u00e1lost\u00ed. Proto bych cht\u011bl hovo\u0159it o n\u011bkter\u00fdch zaj\u00edmav\u00fdch aspektech t\u00fdkaj\u00edc\u00edch se bezpe\u010dnosti datab\u00e1zov\u00fdch syst\u00e9m\u016f. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n\u010cl\u00e1nek byl p\u0159ipraven podle vystoupen\u00ed na <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup,<\/a><\/noindex> organizovan\u00e9m <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/\">Mail.ru Cloud Solutions<\/a><\/noindex>. Pokud nechcete \u010d\u00edst, m\u016f\u017eete se pod\u00edvat na:<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"n-54j9FHaMU\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/n-54j9FHaMU\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\nV \u010dl\u00e1nku budou t\u0159i \u010d\u00e1sti:<\/p>\n<ul>\n<li>Jak chr\u00e1nit p\u0159ipojen\u00ed.<\/li>\n<li>Co je audit akc\u00ed a jak zaznamen\u00e1vat, co se d\u011bje z pohledu datab\u00e1ze a p\u0159ipojen\u00ed k n\u00ed.<\/li>\n<li>Jak chr\u00e1nit data v samotn\u00e9 datab\u00e1zi a jak\u00e9 technologie k tomu existuj\u00ed.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Bezpe\u010dnost a SGBD: na co si d\u00e1t pozor p\u0159i v\u00fdb\u011bru ochrann\u00fdch prost\u0159edk\u016f\" src=\"\/wp-content\/uploads\/2020\/05\/fbdca7f4a925b9ceb78de06c6e245b23.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>T\u0159i slo\u017eky bezpe\u010dnosti datab\u00e1zov\u00fdch syst\u00e9m\u016f: ochrana p\u0159ipojen\u00ed, audit akc\u00ed a ochrana dat<\/i><\/p>\n<h2>Ochrana p\u0159ipojen\u00ed<\/h2>\n<p>\nK datab\u00e1zi se lze p\u0159ipojit bu\u010f p\u0159\u00edmo, nebo nep\u0159\u00edmo p\u0159es webov\u00e9 aplikace. Obvykle u\u017eivatel z obchodn\u00ed sf\u00e9ry, tedy osoba, kter\u00e1 pracuje s datab\u00e1z\u00ed, s n\u00ed nekomunikuje p\u0159\u00edmo.<\/p>\n<p>Ne\u017e budeme mluvit o ochran\u011b spojen\u00ed, je nezbytn\u00e9 zodpov\u011bd\u011bt na d\u016fle\u017eit\u00e9 ot\u00e1zky, od nich\u017e z\u00e1vis\u00ed, jak budou bezpe\u010dnostn\u00ed opat\u0159en\u00ed nastavena:<\/p>\n<ul>\n<li>je ekvivalentn\u00ed jeden business u\u017eivatel jednomu u\u017eivateli datab\u00e1ze;<\/li>\n<li>je zaji\u0161t\u011bn p\u0159\u00edstup k dat\u016fm datab\u00e1ze pouze p\u0159es API, kter\u00e9 ovl\u00e1d\u00e1te, nebo je mo\u017en\u00e9 p\u0159istupovat k tabulk\u00e1m p\u0159\u00edmo;<\/li>\n<li>je datab\u00e1ze um\u00edst\u011bna v samostatn\u00e9m zabezpe\u010den\u00e9m segmentu, kdo a jak s n\u00ed interaguje;<\/li>\n<li>je pou\u017e\u00edv\u00e1n pooling\/proxy a mezi\u010dl\u00e1nky, kter\u00e9 mohou m\u011bnit informace o tom, jak je p\u0159ipojen\u00ed uspo\u0159\u00e1d\u00e1no a kdo pou\u017e\u00edv\u00e1 datab\u00e1zi.<\/li>\n<\/ul>\n<p>\nNyn\u00ed se pod\u00edvejme na n\u00e1stroje, kter\u00e9 lze pou\u017e\u00edt k ochran\u011b p\u0159ipojen\u00ed:<\/p>\n<ol>\n<li>Pou\u017eijte \u0159e\u0161en\u00ed t\u0159\u00eddy database firewall. Dodate\u010dn\u00e1 ochrann\u00e1 vrstva alespo\u0148 zv\u00fd\u0161\u00ed pr\u016fhlednost toho, co se d\u011bje v datab\u00e1zi, v nejlep\u0161\u00edm p\u0159\u00edpad\u011b pak budete moci zajistit dodate\u010dnou ochranu dat.<\/li>\n<li>Pou\u017e\u00edvejte politiky hesel. Jejich pou\u017eit\u00ed z\u00e1vis\u00ed na tom, jak je navr\u017eena va\u0161e architektura. V ka\u017ed\u00e9m p\u0159\u00edpad\u011b \u2014 jedno heslo v konfigura\u010dn\u00edm souboru webov\u00e9 aplikace, kter\u00e1 se p\u0159ipojuje k DBMS, nesta\u010d\u00ed na ochranu. Existuje \u0159ada n\u00e1stroj\u016f DBMS, kter\u00e9 umo\u017e\u0148uj\u00ed kontrolovat, \u017ee u\u017eivatel a heslo vy\u017eaduj\u00ed aktualizaci.\n<p>V\u00edce informac\u00ed o funkc\u00edch hodnocen\u00ed u\u017eivatel\u016f si m\u016f\u017eete p\u0159e\u010d\u00edst <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.cloud.oracle.com\/en-us\/iaas\/data-safe\/doc\/user-assessment-reports.html\">zde<\/a><\/noindex>, tak\u00e9 o MS SQL Vulnerability Assessment se m\u016f\u017eete dozv\u011bd\u011bt <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.microsoft.com\/en-us\/sql\/relational-databases\/security\/sql-vulnerability-assessment?view=sql-server-ver15\">tady<\/a><\/noindex>.\u00a0<\/li>\n<li>Obohacujte kontext relace pot\u0159ebn\u00fdmi informacemi. Pokud je relace nepr\u016fhledn\u00e1, nem\u00e1te p\u0159ehled o tom, kdo pracuje v r\u00e1mci DBMS, je mo\u017en\u00e9 v r\u00e1mci prov\u00e1d\u011bn\u00e9 operace doplnit informace o tom, kdo, co a pro\u010d d\u011bl\u00e1. Tyto informace lze vid\u011bt v auditu.<\/li>\n<li>Nastavte SSL, pokud nem\u00e1te s\u00ed\u0165ov\u00e9 odd\u011blen\u00ed DBMS od koncov\u00fdch u\u017eivatel\u016f, nen\u00ed v samostatn\u00e9m VLAN. V takov\u00fdch p\u0159\u00edpadech je nutn\u00e9 chr\u00e1nit kan\u00e1l mezi spot\u0159ebitelem a samotn\u00fdm DBMS. Ochrann\u00e9 n\u00e1stroje existuj\u00ed i mezi open source.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Jak to ovlivn\u00ed v\u00fdkon DBMS?<\/h3>\n<p>\nPod\u00edv\u00e1me se na p\u0159\u00edklad PostgreSQL, jak SSL ovliv\u0148uje zat\u00ed\u017een\u00ed CPU, zv\u00fd\u0161en\u00ed \u010dasov\u00e1n\u00ed a sn\u00ed\u017een\u00ed TPS, nebude se p\u0159\u00edli\u0161 mnoho prost\u0159edk\u016f pl\u00fdtvat, pokud jej zapneme.<\/p>\n<p>Zat\u011b\u017eujeme PostgreSQL pomoc\u00ed pgbench \u2014 je to jednoduch\u00fd program pro spu\u0161t\u011bn\u00ed test\u016f v\u00fdkonu. Opakovan\u011b prov\u00e1d\u00ed jednu sekvenci p\u0159\u00edkaz\u016f, mo\u017en\u00e1 v paraleln\u00edch relac\u00edch datab\u00e1ze, a pot\u00e9 vypo\u010d\u00edt\u00e1v\u00e1 pr\u016fm\u011brnou rychlost transakc\u00ed.<\/p>\n<p><strong>Test 1 bez SSL a s pou\u017eit\u00edm SSL<\/strong> \u2014 p\u0159ipojen\u00ed se vytv\u00e1\u0159\u00ed p\u0159i ka\u017ed\u00e9 transakci:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require \nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Test 2 bez SSL a s pou\u017eit\u00edm SSL<\/strong> \u2014 v\u0161echny transakce se prov\u00e1d\u011bj\u00ed v jednom p\u0159ipojen\u00ed:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require\nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Ostatn\u00ed nastaven\u00ed<\/strong>:<\/p>\n<pre><code class=\"plaintext\">scaling factor: 1\nquery mode: simple\nnumber of clients: 10\nnumber of threads: 1\nnumber of transactions per client: 5000\nnumber of transactions actually processed: 50000\/50000<\/code><\/pre>\n<p>\n<strong>V\u00fdsledky testov\u00e1n\u00ed<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>BEZ SSL<\/strong><br \/>\n<strong>SSL<\/strong><\/p>\n<p><strong>P\u0159ipojen\u00ed se vytv\u00e1\u0159\u00ed p\u0159i ka\u017ed\u00e9 transakci<\/strong><\/p>\n<p>pr\u016fm\u011brn\u00e1 latence<br \/>\n171.915 ms<br \/>\n187.695 ms<\/p>\n<p>tps v\u010detn\u011b vytv\u00e1\u0159en\u00ed p\u0159ipojen\u00ed<br \/>\n58.168112<br \/>\n53.278062<\/p>\n<p>tps bez vytv\u00e1\u0159en\u00ed p\u0159ipojen\u00ed<br \/>\n64.084546<br \/>\n58.725846<\/p>\n<p>CPU<br \/>\n24%<br \/>\n28%<\/p>\n<p><strong>V\u0161echny transakce se prov\u00e1d\u011bj\u00ed v jednom p\u0159ipojen\u00ed<\/strong><\/p>\n<p>pr\u016fm\u011brn\u00e1 latence<br \/>\n6.722 ms<br \/>\n6.342 ms<\/p>\n<p>tps v\u010detn\u011b vytv\u00e1\u0159en\u00ed p\u0159ipojen\u00ed<br \/>\n1587.657278<br \/>\n1576.792883<\/p>\n<p>tps bez vytv\u00e1\u0159en\u00ed p\u0159ipojen\u00ed<br \/>\n1588.380574<br \/>\n1577.694766<\/p>\n<p>CPU<br \/>\n17%<br \/>\n21%<\/p>\n<p>\nP\u0159i n\u00edzk\u00e9m zat\u00ed\u017een\u00ed je vliv SSL srovnateln\u00fd s chybou m\u011b\u0159en\u00ed. Pokud je objem p\u0159en\u00e1\u0161en\u00fdch dat velmi velk\u00fd, situace m\u016f\u017ee b\u00fdt jin\u00e1. Pokud navazujeme jedno spojen\u00ed na ka\u017edou transakci (co\u017e se st\u00e1v\u00e1 z\u0159\u00eddka, obvykle se spojen\u00ed d\u011bl\u00ed mezi u\u017eivateli), m\u00e1te velk\u00e9 mno\u017estv\u00ed p\u0159ipojen\u00ed\/odpojen\u00ed, vliv m\u016f\u017ee b\u00fdt o n\u011bco v\u011bt\u0161\u00ed. To znamen\u00e1, \u017ee rizika sn\u00ed\u017een\u00ed v\u00fdkonu mohou existovat, nicm\u00e9n\u011b rozd\u00edl nen\u00ed natolik velk\u00fd, abyste se vyh\u00fdbali pou\u017e\u00edv\u00e1n\u00ed zabezpe\u010den\u00ed.<\/p>\n<p>V\u0161imn\u011bte si \u2014 siln\u00fd rozd\u00edl existuje, pokud porovn\u00e1v\u00e1te re\u017eimy pr\u00e1ce: v r\u00e1mci jedn\u00e9 relace pracujete nebo v r\u016fzn\u00fdch. Je to jasn\u00e9: na vytvo\u0159en\u00ed ka\u017ed\u00e9ho spojen\u00ed se vynakl\u00e1daj\u00ed zdroje.<\/p>\n<p>M\u011bli jsme p\u0159\u00edpad, kdy jsme p\u0159ipojili Zabbix v re\u017eimu trust, tedy jsme neprov\u00e1d\u011bli kontrolu md5, autentizace nebyla nutn\u00e1. Pot\u00e9 klient po\u017e\u00e1dal o zapnut\u00ed re\u017eimu md5-autentizace. To zv\u00fd\u0161ilo z\u00e1t\u011b\u017e na CPU a v\u00fdkon klesl. Za\u010dali jsme hledat cesty optimalizace. Jedno z mo\u017en\u00fdch \u0159e\u0161en\u00ed probl\u00e9mu \u2014 realizovat s\u00ed\u0165ov\u00e9 omezen\u00ed, vytvo\u0159it pro DB odd\u011blen\u00e9 VLAN, p\u0159idat nastaven\u00ed, aby bylo jasn\u00e9, kdo a odkud se p\u0159ipojuje, a odstranit autentizaci. Tak\u00e9 je mo\u017en\u00e9 optimalizovat nastaven\u00ed autentizace, aby se sn\u00ed\u017eily n\u00e1klady p\u0159i zapnut\u00ed autentizace, ale celkov\u011b aplikace r\u016fzn\u00fdch metod autentizace m\u00e1 vliv na v\u00fdkon a je t\u0159eba tyto faktory zohlednit p\u0159i n\u00e1vrhu v\u00fdpo\u010detn\u00edch kapacit server\u016f (hardware) pro DB.<\/p>\n<p>Z\u00e1v\u011br: v n\u011bkter\u00fdch \u0159e\u0161en\u00edch mohou i mal\u00e9 detaily v autentizaci v\u00fdrazn\u011b ovlivnit projekt a je \u0161patn\u00e9, kdy\u017e se to stane jasn\u00fdm pouze p\u0159i implementaci do produkce.<\/p>\n<h2>Audit \u010dinnosti<\/h2>\n<p>\nAudit nemus\u00ed b\u00fdt pouze na DB. Audit \u2014 to je z\u00edsk\u00e1v\u00e1n\u00ed informac\u00ed o tom, co se d\u011bje v r\u016fzn\u00fdch segmentech. M\u016f\u017ee to b\u00fdt i datab\u00e1zov\u00fd firewall, i opera\u010dn\u00ed syst\u00e9m, na kter\u00e9m je DB postavena.<\/p>\n<p>V komer\u010dn\u00edch DB \u00farovn\u011b Enterprise je audit v po\u0159\u00e1dku, v open source \u2014 ne v\u017edy. Zde je to, co existuje v PostgreSQL:<\/p>\n<ul>\n<li>default log \u2014 vestav\u011bn\u00e9 logov\u00e1n\u00ed;<\/li>\n<li>extensions: pgaudit \u2014 pokud v\u00e1m chyb\u00ed defaultn\u00ed logov\u00e1n\u00ed, m\u016f\u017eete vyu\u017e\u00edt samostatn\u00e1 nastaven\u00ed, kter\u00e1 \u0159e\u0161\u00ed \u010d\u00e1st \u00fakol\u016f.<\/li>\n<\/ul>\n<p>\n<b>Dopl\u0148ky k p\u0159edn\u00e1\u0161ce ve videu:<\/b><\/p>\n<p>Z\u00e1kladn\u00ed registrace oper\u00e1tor\u016f m\u016f\u017ee b\u00fdt zaji\u0161t\u011bna standardn\u00edm sledovac\u00edm n\u00e1strojem s log_statement = all.<\/p>\n<p>To je p\u0159ijateln\u00e9 pro monitorov\u00e1n\u00ed a jin\u00e9 \u00fa\u010dely pou\u017eit\u00ed, av\u0161ak neposkytuje \u00farove\u0148 podrobnost\u00ed, kter\u00e1 je b\u011b\u017en\u011b pot\u0159ebn\u00e1 pro audit.<\/p>\n<p>Nen\u00ed dostate\u010dn\u00e9 m\u00edt pouze seznam v\u0161ech operac\u00ed prov\u00e1d\u011bn\u00fdch s datab\u00e1z\u00ed.<\/p>\n<p>Mus\u00ed b\u00fdt rovn\u011b\u017e mo\u017en\u00e9 naj\u00edt konkr\u00e9tn\u00ed tvrzen\u00ed, kter\u00e1 jsou pro auditora zaj\u00edmav\u00e1.<\/p>\n<p>Standardn\u00ed sledovac\u00ed n\u00e1stroj ukazuje to, co u\u017eivatel po\u017eadoval, zat\u00edmco pgAudit se soust\u0159ed\u00ed na detaily toho, co se odehr\u00e1lo, kdy\u017e datab\u00e1ze prov\u00e1d\u011bla dotaz.<\/p>\n<p>Nap\u0159\u00edklad auditor m\u016f\u017ee cht\u00edt zajistit, \u017ee konkr\u00e9tn\u00ed tabulka byla vytvo\u0159ena v zdokumentovan\u00e9m okn\u011b \u00fadr\u017eby.<\/p>\n<p>To se m\u016f\u017ee zd\u00e1t jako jednoduch\u00fd \u00fakol pro z\u00e1kladn\u00ed audit a grep, ale co kdy\u017e naraz\u00edte na n\u011bco jako tento (\u00famysln\u011b zmaten\u00fd) p\u0159\u00edklad:<\/p>\n<p>DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>Standardn\u00ed sledov\u00e1n\u00ed v\u00e1m poskytne toto:<\/p>\n<p>LOG:\u00a0 p\u0159\u00edkaz: DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>Zd\u00e1 se, \u017ee pro nalezen\u00ed zaj\u00edmav\u00e9 tabulky m\u016f\u017ee b\u00fdt pot\u0159eba ur\u010dit\u00e9 znalosti k\u00f3du v p\u0159\u00edpadech, kdy jsou tabulky vytv\u00e1\u0159eny dynamicky.<\/p>\n<p>To nen\u00ed ide\u00e1ln\u00ed, proto\u017ee by bylo lep\u0161\u00ed hledat jednodu\u0161e podle n\u00e1zvu tabulky.<\/p>\n<p>Zde bude pgAudit u\u017eite\u010dn\u00fd.<\/p>\n<p>Pro stejn\u00fd vstup vygeneruje tento v\u00fdstup do logu:<\/p>\n<p>AUDIT: SESSION,33,1,FUNCTION,DO,,,\u201eDO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;\"<br \/>\nAUDIT: SESSION,33,2,DDL,CREATE TABLE,TABLE,public.important_table,CREATE TABLE important_table (id INT)<\/p>\n<p>Registrov\u00e1no nen\u00ed jen blok DO, ale i pln\u00fd text CREATE TABLE s typem operace, typem objektu a pln\u00fdm jm\u00e9nem, co\u017e usnad\u0148uje hled\u00e1n\u00ed.<\/p>\n<p>P\u0159i sledov\u00e1n\u00ed oper\u00e1tor\u016f SELECT a DML lze pgAudit nakonfigurovat k registraci jednotliv\u00e9ho z\u00e1znamu pro ka\u017edou tabulku, na kterou se v operaci odkazuje.<\/p>\n<p>Nen\u00ed zapot\u0159eb\u00ed syntaktick\u00e9 anal\u00fdzy pro nalezen\u00ed v\u0161ech operac\u00ed, kter\u00e9 se t\u00fdkaj\u00ed konkr\u00e9tn\u00ed tabulky (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/pgaudit\/pgaudit\/blob\/master\/README.md\">*<\/a><\/noindex>)\u00bb.<\/p>\n<h3>Jak to ovlivn\u00ed v\u00fdkon DBMS?<\/h3>\n<p>\nPoj\u010fme prov\u00e9st testy s aktivac\u00ed \u00fapln\u00e9ho auditu a pod\u00edvat se, co se stane s v\u00fdkonem PostgreSQL. Aktivujme maxim\u00e1ln\u00ed logov\u00e1n\u00ed DB ve v\u0161ech parametrech.<\/p>\n<p>V konfigura\u010dn\u00edm souboru prakticky nic nem\u011bn\u00edme, z d\u016fle\u017eit\u00fdch v\u011bc\u00ed aktivujeme re\u017eim debug5, abychom z\u00edskali co nejv\u00edce informac\u00ed.<\/p>\n<p>postgresql.conf<\/p>\n<p>log_destination = 'stderr'<br \/>\nlogging_collector = on<br \/>\nlog_truncate_on_rotation = on<br \/>\nlog_rotation_age = 1d<br \/>\nlog_rotation_size = 10MB<br \/>\nlog_min_messages = <strong>debug5<\/strong><br \/>\nlog_min_error_statement = <strong>debug5<\/strong><br \/>\nlog_min_duration_statement = 0<br \/>\ndebug_print_parse = on<br \/>\ndebug_print_rewritten = on<br \/>\ndebug_print_plan = on<br \/>\ndebug_pretty_print = zapnuto<br \/>\nlog_checkpoints = zapnuto<br \/>\nlog_connections = zapnuto<br \/>\nlog_disconnections = zapnuto<br \/>\nlog_duration = zapnuto<br \/>\nlog_hostname = zapnuto<br \/>\nlog_lock_waits = zapnuto<br \/>\nlog_replication_commands = zapnuto<br \/>\nlog_temp_files = 0<br \/>\nlog_timezone = 'Europe\/Moscow'<\/p>\n<p>\nNa datab\u00e1zov\u00e9m syst\u00e9mu PostgreSQL s parametry 1 CPU, 2,8 GHz, 2 GB RAM, 40 GB HDD prov\u00e1d\u00edme t\u0159i z\u00e1t\u011b\u017eov\u00e9 testy pomoc\u00ed p\u0159\u00edkaz\u016f:<\/p>\n<pre><code class=\"plaintext\">$ pgbench -p 3389 -U postgres -i -s 150 benchmark\n$ pgbench -p 3389 -U postgres -c 50 -j 2 -P 60 -T 600 benchmark\n$ pgbench -p 3389 -U postgres -c 150 -j 2 -P 60 -T 600 benchmark<\/code><\/pre>\n<p>\n<strong>V\u00fdsledky testov\u00e1n\u00ed:<\/strong><\/p>\n<p><strong>Bez logov\u00e1n\u00ed<\/strong><br \/>\n<strong>S logov\u00e1n\u00edm<\/strong><\/p>\n<p>Celkov\u00fd \u010das napln\u011bn\u00ed datab\u00e1ze<br \/>\n43,74 sek<br \/>\n53,23 sek<\/p>\n<p>RAM<br \/>\n24%<br \/>\n40%<\/p>\n<p>CPU<br \/>\n72%<br \/>\n91%<\/p>\n<p><strong>Test 1 (50 p\u0159ipojen\u00ed)<\/strong><\/p>\n<p>Po\u010det transakc\u00ed za 10 min<br \/>\n74169<br \/>\n32445<\/p>\n<p>Transakc\u00ed\/s<br \/>\n123<br \/>\n54<\/p>\n<p>Pr\u016fm\u011brn\u00e9 zpo\u017ed\u011bn\u00ed<br \/>\n405 ms<br \/>\n925 ms<\/p>\n<p><strong>Test 2 (150 p\u0159ipojen\u00ed p\u0159i 100 mo\u017en\u00fdch)<\/strong><\/p>\n<p>Po\u010det transakc\u00ed za 10 min<br \/>\n81727<br \/>\n31429<\/p>\n<p>Transakc\u00ed\/s<br \/>\n136<br \/>\n52<\/p>\n<p>Pr\u016fm\u011brn\u00e9 zpo\u017ed\u011bn\u00ed<br \/>\n550 ms<br \/>\n1432 ms<\/p>\n<p><strong>O velikostech<\/strong><\/p>\n<p>Velikost datab\u00e1ze<br \/>\n2251 MB<br \/>\n2262 MB<\/p>\n<p>Velikost log\u016f datab\u00e1ze<br \/>\n0 MB<br \/>\n4587 MB<\/p>\n<p>\nV d\u016fsledku: \u00fapln\u00fd audit nen\u00ed p\u0159\u00edli\u0161 dobr\u00fd. Podle objemu vznikne dat od auditu stejn\u011b tolik, jako je dat v samotn\u00e9 datab\u00e1zi, ba i v\u00edce. Takov\u00fd objem logov\u00e1n\u00ed, kter\u00fd se generuje p\u0159i pr\u00e1ci s datab\u00e1zov\u00fdm syst\u00e9mem, je b\u011b\u017en\u00fd probl\u00e9m v produkci.<\/p>\n<p>Pod\u00edv\u00e1me se na dal\u0161\u00ed parametry:<\/p>\n<ul>\n<li>Rychlost se p\u0159\u00edli\u0161 nem\u011bn\u00ed: bez logov\u00e1n\u00ed \u2014 43,74 sek, s logov\u00e1n\u00edm \u2014 53,23 sek.<\/li>\n<li>V\u00fdkon RAM a CPU bude klesat, proto\u017ee je t\u0159eba vytvo\u0159it soubor s auditem. To je tak\u00e9 znateln\u00e9 v produkci.<\/li>\n<\/ul>\n<p>\nP\u0159i zv\u00fd\u0161en\u00ed po\u010dtu p\u0159ipojen\u00ed se samoz\u0159ejm\u011b ukazatele m\u00edrn\u011b zhor\u0161\u00ed.<\/p>\n<p>Ve firm\u00e1ch s auditem je to je\u0161t\u011b slo\u017eit\u011bj\u0161\u00ed:<\/p>\n<ul>\n<li>dat je hodn\u011b;<\/li>\n<li>audit je pot\u0159ebn\u00fd nejen p\u0159es syslog do SIEM, ale i do soubor\u016f: kdyby s syslog do\u0161lo k n\u011b\u010demu, mus\u00ed b\u00fdt bl\u00edzko k datab\u00e1zi soubor, ve kter\u00e9m se ukl\u00e1daj\u00ed data;<\/li>\n<li>pro audit je pot\u0159eba samostatn\u00e1 police, aby nedo\u0161lo k poklesu I\/O disk\u016f, proto\u017ee zab\u00edr\u00e1 hodn\u011b m\u00edsta;<\/li>\n<li>n\u011bkdy je t\u0159eba, aby zam\u011bstnanci IT pot\u0159ebovali v\u0161ude normy, po\u017eaduj\u00ed identifikaci podle norem.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Omezen\u00ed p\u0159\u00edstupu k dat\u016fm<\/h2>\n<p>\nPod\u00edv\u00e1me se na technologie, kter\u00e9 se pou\u017e\u00edvaj\u00ed k ochran\u011b dat a p\u0159\u00edstupu k nim v komer\u010dn\u00edch datab\u00e1zov\u00fdch syst\u00e9mech a open source.<\/p>\n<p>Co lze obecn\u011b pou\u017e\u00edt:<\/p>\n<ol>\n<li>\u0160ifrov\u00e1n\u00ed a obfuskace procedur a funkc\u00ed (Wrapping) \u2014 to znamen\u00e1 odd\u011blen\u00e9 n\u00e1stroje a utility, kter\u00e9 z \u010diteln\u00e9ho k\u00f3du d\u011blaj\u00ed ne\u010diteln\u00fd. Pr\u00e1va ho pak nelze m\u011bnit, ani refaktorovat zp\u011bt. Takov\u00fd p\u0159\u00edstup je n\u011bkdy vy\u017eadov\u00e1n alespo\u0148 na stran\u011b datab\u00e1zov\u00e9ho syst\u00e9mu \u2014 logika licen\u010dn\u00edch omezen\u00ed nebo logika autorizace je \u0161ifrov\u00e1na pr\u00e1v\u011b na \u00farovni procedury a funkce.<\/li>\n<li>Omezen\u00ed viditelnosti dat na \u00farovni \u0159\u00e1dk\u016f (RLS) znamen\u00e1, \u017ee r\u016fzn\u00ed u\u017eivatel\u00e9 vid\u00ed jednu tabulku, ale r\u016fzn\u00e9 \u0159\u00e1dky v n\u00ed, co\u017e znamen\u00e1, \u017ee n\u011bkomu n\u011bco nelze uk\u00e1zat na \u00farovni \u0159\u00e1dk\u016f.<\/li>\n<li>\u00daprava zobrazen\u00fdch dat (Masking) je situace, kdy u\u017eivatel\u00e9 ve sloupci tabulky vid\u00ed bu\u010f data, nebo pouze hv\u011bzdi\u010dky, co\u017e znamen\u00e1, \u017ee pro n\u011bkter\u00e9 u\u017eivatele bude informace skryta. Technologie ur\u010duje, co se kter\u00e9mu u\u017eivateli zobraz\u00ed s ohledem na \u00farove\u0148 p\u0159\u00edstupu.<\/li>\n<li>Odd\u011blen\u00ed p\u0159\u00edstupu Security DBA\/Application DBA\/DBA se sp\u00ed\u0161e t\u00fdk\u00e1 omezen\u00ed p\u0159\u00edstupu k samotn\u00e9 DBMS, tedy zam\u011bstnance bezpe\u010dnostn\u00ed slo\u017eky lze odd\u011blit od datab\u00e1zov\u00fdch administr\u00e1tor\u016f a administr\u00e1tor\u016f aplikac\u00ed. V open source technologi\u00edch je jich m\u00e1lo, v komer\u010dn\u00edch DBMS jich je dostatek. Tyto technologie jsou nezbytn\u00e9, kdy\u017e je mnoho u\u017eivatel\u016f s p\u0159\u00edstupem k samotn\u00fdm server\u016fm.<\/li>\n<li>Omezen\u00ed p\u0159\u00edstupu k soubor\u016fm na \u00farovni souborov\u00e9ho syst\u00e9mu. M\u016f\u017eete ud\u011blovat pr\u00e1va, privilegium p\u0159\u00edstupu k adres\u00e1\u0159\u016fm tak, aby ka\u017ed\u00fd administr\u00e1tor m\u011bl p\u0159\u00edstup pouze k pot\u0159ebn\u00fdm dat\u016fm.<\/li>\n<li>Mand\u00e1tov\u00fd p\u0159\u00edstup a vymaz\u00e1n\u00ed pam\u011bti jsou technologie, kter\u00e9 se pou\u017e\u00edvaj\u00ed z\u0159\u00eddka.<\/li>\n<li>End-to-end \u0161ifrov\u00e1n\u00ed p\u0159\u00edmo v DBMS znamen\u00e1 \u0161ifrov\u00e1n\u00ed na stran\u011b klienta s \u0159\u00edzen\u00edm kl\u00ed\u010d\u016f na serveru.<\/li>\n<li>\u0160ifrov\u00e1n\u00ed dat. Nap\u0159\u00edklad sloupcov\u00e9 \u0161ifrov\u00e1n\u00ed znamen\u00e1, \u017ee pou\u017e\u00edv\u00e1te mechanismus, kter\u00fd \u0161ifruje jednotliv\u00fd sloupec datab\u00e1ze.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Jak to ovliv\u0148uje v\u00fdkon DBMS?<\/h3>\n<p>\nPod\u00edvejme se na p\u0159\u00edklad sloupcov\u00e9ho \u0161ifrov\u00e1n\u00ed v PostgreSQL. Je tam modul pgcrypto, kter\u00fd umo\u017e\u0148uje ukl\u00e1dat vybran\u00e1 pole v za\u0161ifrovan\u00e9 podob\u011b. To je u\u017eite\u010dn\u00e9, kdy\u017e m\u00e1 hodnotu pouze n\u011bkter\u00e1 data. Aby bylo mo\u017en\u00e9 p\u0159e\u010d\u00edst za\u0161ifrovan\u00e1 pole, klient p\u0159ed\u00e1v\u00e1 de\u0161ifrovac\u00ed kl\u00ed\u010d, server data de\u0161ifruje a vrac\u00ed je klientovi. Bez kl\u00ed\u010de si s va\u0161imi daty nikdo nic nepo\u010d\u00edn\u00e1.<\/p>\n<p><strong>Provedeme test s pgcrypto<\/strong>. Vytvo\u0159\u00edme tabulku se za\u0161ifrovan\u00fdmi daty a s b\u011b\u017en\u00fdmi daty. N\u00ed\u017ee jsou p\u0159\u00edkazy pro vytvo\u0159en\u00ed tabulek, v prvn\u00ed \u0159ad\u011b u\u017eite\u010dn\u00fd p\u0159\u00edkaz \u2013 vytvo\u0159en\u00ed samotn\u00e9 extension s registrac\u00ed DBMS:<\/p>\n<pre><code class=\"plaintext\">CREATE EXTENSION pgcrypto;\nCREATE TABLE t1 (id integer, text1 text, text2 text);\nCREATE TABLE t2 (id integer, text1 bytea, text2 bytea);\nINSERT INTO t1 (id, text1, text2)\nVALUES (generate_series(1,10000000), generate_series(1,10000000)::text, generate_series(1,10000000)::text);\nINSERT INTO t2 (id, text1, text2) VALUES (\ngenerate_series(1,10000000),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'));<\/code><\/pre>\n<p>\nD\u00e1le se pokus\u00edme prov\u00e9st v\u00fdb\u011br dat z ka\u017ed\u00e9 tabulky a pod\u00edv\u00e1me se na \u010dasy prov\u00e1d\u011bn\u00ed.<\/p>\n<p><strong>V\u00fdb\u011br z tabulky bez \u0161ifrovac\u00ed funkce<\/strong>:<\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select * from t1 limit 1000;\" \"host=192.168.220.129 dbname=taskdb\nuser=postgres sslmode=disable\" &gt; 1.txt<\/code><\/pre>\n<p>\nStopky byly zapnuty.<\/p>\n<p>\u00a0\u00a0id | text1 | text2<br \/>\n--------+--------+--------<br \/>\n 1 | 1 \u00a0 \u00a0 | 1<br \/>\n 2 | 2 \u00a0 \u00a0 | 2<br \/>\n 3 | 3 \u00a0 \u00a0 | 3<br \/>\n\u2026<br \/>\n997 | 997 \u00a0 | 997<br \/>\n998 | 998 \u00a0 | 998<br \/>\n999 | 999 \u00a0 | 999<br \/>\n1000 | 1000\u00a0 | 1000<br \/>\n(1000 \u0159\u00e1dk\u016f)<\/p>\n<p>\u010cas: 1,386 ms<\/p>\n<p><strong>V\u00fdb\u011br z tabulky se \u0161ifrovac\u00ed funkc\u00ed:<\/strong><\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select id, decrypt(text1, 'key'::bytea, 'bf'),\ndecrypt(text2, 'key'::bytea, 'bf') from t2 limit 1000;\"\n\"host=192.168.220.129 dbname=taskdb user=postgres sslmode=disable\" &gt; 2.txt<\/code><\/pre>\n<p>\nStopky byly zapnuty.<\/p>\n<p>\u00a0\u00a0id | decrypt | decrypt<br \/>\n--------+----------+--------<br \/>\n 1 | x31 | x31<br \/>\n 2 | x32 | x32<br \/>\n 3 | x33 | x33<br \/>\n\u2026<br \/>\n999 | x393939 | x393939<br \/>\n1000 | x31303030 | x31303030<br \/>\n(1000 \u0159\u00e1dk\u016f)<\/p>\n<p>\u010cas: 50,203 ms<\/p>\n<p><strong>V\u00fdsledky testov\u00e1n\u00ed<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>Bez \u0161ifrov\u00e1n\u00ed<\/strong><br \/>\n<strong>Pgcrypto (decrypt)<\/strong><\/p>\n<p>V\u00fdb\u011br 1000 \u0159\u00e1dk\u016f<br \/>\n1,386 ms<br \/>\n50,203 ms<\/p>\n<p>CPU<br \/>\n15%<br \/>\n35%<\/p>\n<p>RAM<br \/>\n\u00a0<br \/>\n+5%<\/p>\n<p>\n\u0160ifrov\u00e1n\u00ed m\u00e1 v\u00fdrazn\u00fd dopad na v\u00fdkon. Je vid\u011bt, \u017ee doba b\u011bhu vzrostla, proto\u017ee operace de\u0161ifrov\u00e1n\u00ed za\u0161ifrovan\u00fdch dat (a de\u0161ifrov\u00e1n\u00ed je obvykle je\u0161t\u011b obaleno ve va\u0161\u00ed logice) vy\u017eaduj\u00ed zna\u010dn\u00e9 prost\u0159edky. To znamen\u00e1, \u017ee my\u0161lenka za\u0161ifrovat v\u0161echny sloupce obsahuj\u00edc\u00ed n\u011bjak\u00e1 data m\u016f\u017ee b\u00fdt spojena se sn\u00ed\u017een\u00edm v\u00fdkonu.<\/p>\n<p>\u0160ifrov\u00e1n\u00ed v\u0161ak nen\u00ed st\u0159\u00edbrn\u00e1 kulka, kter\u00e1 by vy\u0159e\u0161ila v\u0161echny probl\u00e9my. De\u0161ifrovan\u00e1 data a de\u0161ifrovac\u00ed kl\u00ed\u010d jsou b\u011bhem de\u0161ifrov\u00e1n\u00ed a p\u0159enosu dat na serveru. Kl\u00ed\u010de tedy mohou b\u00fdt odcizeny t\u011bmi, kdo maj\u00ed pln\u00fd p\u0159\u00edstup k datab\u00e1zov\u00e9mu serveru, nap\u0159\u00edklad administr\u00e1torem syst\u00e9mu.<\/p>\n<p>Kdy\u017e m\u00e1 celou kolonku pro v\u0161echny u\u017eivatele jeden kl\u00ed\u010d (i kdy\u017e ne pro v\u0161echny, ale pro klienty omezen\u00e9 skupiny), nen\u00ed to v\u017edy dobr\u00e9 a spr\u00e1vn\u00e9. Pr\u00e1v\u011b proto za\u010dali zav\u00e1d\u011bt end-to-end \u0161ifrov\u00e1n\u00ed, v datab\u00e1zov\u00fdch syst\u00e9mem se za\u010daly zva\u017eovat mo\u017enosti \u0161ifrov\u00e1n\u00ed dat ze strany klienta a serveru, objevily se tzv. \u00falo\u017ei\u0161t\u011b kl\u00ed\u010d\u016f - samostatn\u00e9 produkty, kter\u00e9 zaji\u0161\u0165uj\u00ed spr\u00e1vu kl\u00ed\u010d\u016f na stran\u011b datab\u00e1zov\u00e9ho syst\u00e9mu.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnost a SGBD: na co si d\u00e1t pozor p\u0159i v\u00fdb\u011bru ochrann\u00fdch prost\u0159edk\u016f\" src=\"\/wp-content\/uploads\/2020\/05\/cbaa7b9579a65963518ba3cec6114842.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/docs.mongodb.com\/manual\/core\/security-client-side-encryption\/\"><i>P\u0159\u00edklad takov\u00e9ho \u0161ifrov\u00e1n\u00ed v MongoDB<\/i><\/a><\/noindex><\/p>\n<h2>Bezpe\u010dnostn\u00ed n\u00e1stroje v komer\u010dn\u00edch a open source datab\u00e1zov\u00fdch syst\u00e9mech<\/h2>\n<p><\/p>\n<p><strong>Funkce<\/strong><br \/>\n<strong>Typ<\/strong><br \/>\n<strong>Politika hesel<\/strong><br \/>\n<strong>Audit<\/strong><br \/>\n<strong>Ochrana zdrojov\u00e9ho k\u00f3du procedur a funkc\u00ed<\/strong><br \/>\n<strong>RLS<\/strong><br \/>\n<strong>\u0160ifrov\u00e1n\u00ed<\/strong><\/p>\n<p><strong>Oracle<\/strong><br \/>\nKomer\u010dn\u00ed<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><strong>MsSql<\/strong><br \/>\nKomer\u010dn\u00ed<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\"><strong>Jatoba<\/strong><\/a><\/noindex><br \/>\nKomer\u010dn\u00ed<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\nroz\u0161\u00ed\u0159en\u00ed<\/p>\n<p><strong>PostgreSQL<\/strong><br \/>\nFree<br \/>\nroz\u0161\u00ed\u0159en\u00ed<br \/>\nroz\u0161\u00ed\u0159en\u00ed<br \/>\n&#8212;<br \/>\n+<br \/>\nroz\u0161\u00ed\u0159en\u00ed<\/p>\n<p><strong>MongoDb<\/strong><br \/>\nFree<br \/>\n&#8212;<br \/>\n+<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nDostupn\u00e9 pouze v MongoDB Enterprise<\/p>\n<p>\nTabulka rozhodn\u011b nen\u00ed \u00fapln\u00e1, ale situace je takov\u00e1: v komer\u010dn\u00edch produktech se \u00fakoly bezpe\u010dnosti \u0159e\u0161\u00ed d\u00e1vno, v open source se obvykle pro bezpe\u010dnost vyu\u017e\u00edvaj\u00ed n\u011bjak\u00e9 nadstavby, mnoha funkc\u00edm chyb\u00ed, n\u011bkdy je nutn\u00e9 n\u011bco dopisovat. Nap\u0159\u00edklad politiky hesel - v PostgreSQL je mnoho r\u016fzn\u00fdch roz\u0161\u00ed\u0159en\u00ed.<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/postgres\/postgres\/tree\/master\/contrib\/passwordcheck\">1<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ykrysko\/passwordcheck\">2<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michaelpq\/pg_plugins\/tree\/master\/passwordcheck_extra\">3<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/devrimgunduz\/passwordcheck_cracklib\">4<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/asio\/password\">5<\/a><\/noindex>), kter\u00e9 implementuj\u00ed politiky hesel, ale podle m\u00e9ho n\u00e1zoru \u017e\u00e1dn\u00fd z nich nepokr\u00fdv\u00e1 ve\u0161ker\u00e9 pot\u0159eby dom\u00e1c\u00edho firemn\u00edho segmentu.<\/p>\n<p><strong>Co d\u011blat, pokud nikde nen\u00ed to, co pot\u0159ebuji<\/strong>? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u0421\u0423\u0411\u0414, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a.<\/p>\n<p>V takov\u00e9m p\u0159\u00edpad\u011b je mo\u017en\u00e9 pou\u017e\u00edt extern\u00ed \u0159e\u0161en\u00ed, kter\u00e1 pracuj\u00ed s r\u016fzn\u00fdmi S\u0158BD, nap\u0159\u00edklad \u201eKrypto DB\u201c nebo \u201eGarda DB\u201c. Pokud jde o \u0159e\u0161en\u00ed z dom\u00e1c\u00edho segmentu, znaj\u00ed l\u00e9pe normy GOST ne\u017e v open source.<\/p>\n<p>Druhou mo\u017enost\u00ed je napsat si to, co pot\u0159ebujete, a prov\u00e9st na \u00farovni procedur p\u0159\u00edstup k dat\u016fm a \u0161ifrov\u00e1n\u00ed v aplikaci. Pravda, s GOST to bude slo\u017eit\u011bj\u0161\u00ed. Ale celkov\u011b m\u016f\u017eete skr\u00fdt data, jak pot\u0159ebujete, ulo\u017eit je do S\u0158BD a pot\u00e9 je vyt\u00e1hnout a de\u0161ifrovat, jak je t\u0159eba, p\u0159\u00edmo na \u00farovni aplikace. P\u0159itom myslete na to, jak tyto algoritmy zabezpe\u010d\u00edte na \u00farovni aplikace. Podle na\u0161eho n\u00e1zoru by to m\u011blo b\u00fdt provedeno na \u00farovni S\u0158BD, proto\u017ee to tak bude fungovat rychleji.<\/p>\n<p>Tento refer\u00e1t byl poprv\u00e9 p\u0159edstaven na <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup<\/a><\/noindex> by Mail.ru Cloud Solutions. Pod\u00edvejte se<noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/redirect?q=https%3A%2F%2Fbit.ly%2F2U57FAd&amp;redir_token=XNWSBN1AKQA2sjhdReDAv6VnkOV8MTU4OTAxNjMwMEAxNTg4OTI5OTAw&amp;v=wigSv2_zWBU&amp;event=video_description\"> video <\/a><\/noindex>dal\u0161\u00ed vystoupen\u00ed a p\u0159ihlaste se k ozn\u00e1men\u00edm akc\u00ed na Telegramu <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/k8s_mail\">Kolem Kubernetes v Mail.ru Group<\/a><\/noindex>.<\/p>\n<p><strong>Co dal\u0161\u00edho si p\u0159e\u010d\u00edst na toto t\u00e9ma<\/strong>:<\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/472694\/\">V\u00edce ne\u017e Ceph: blokov\u00e9 \u00falo\u017ei\u0161t\u011b cloudu MCS<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/kakuyu-bazu-dannyh-vybrat-dlya-proekta-chtoby-ne-oshibitsya\">Jak vybrat datab\u00e1zi pro projekt, abyste se nemuseli znovu rozhodovat<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/500708\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441 \u0420\u043e\u0436\u043a\u043e\u0432, \u044f \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u00ab\u0413\u0430\u0437\u0438\u043d\u0444\u043e\u0440\u043c\u0441\u0435\u0440\u0432\u0438\u0441\u00bb, \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 Jatoba. \u0417\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043d\u043e\u0440\u043c\u044b \u043d\u0430\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445. \u041d\u0438\u043a\u0442\u043e \u043d\u0435 \u0445\u043e\u0447\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0442\u0440\u0435\u0442\u044c\u0438 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432\u0430\u0436\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b: \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430\u043c\u0438 \u043a \u0434\u0430\u043d\u043d\u044b\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81885,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81884","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bezpe\u010dnost a S\u0158BD: na co si d\u00e1t pozor p\u0159i v\u00fdb\u011bru ochrann\u00fdch prost\u0159edk\u016f | ProHoster","description":"Jmenuji se Denis.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster","og:description":"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-17T11:42:18+00:00","article:modified_time":"2020-05-17T11:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81884","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:48:24","updated":"2022-10-05 02:01:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/81884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=81884"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/81884\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/81885"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=81884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=81884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=81884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}