{"id":91364,"date":"2020-08-12T07:42:33","date_gmt":"2020-08-12T05:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes"},"modified":"2020-08-12T07:42:33","modified_gmt":"2020-08-12T05:42:33","slug":"izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","title":{"rendered":"Uurime (puuduvat) t\u00fc\u00fcpiliste Docker ja Kubernetes seadistuste turvalisust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Uurime
\nOlen t\u00f6\u00f6tanud IT-valdkonnas \u00fcle 20 aasta, kuid kuidagi ei olnud aega konteinerite juurde j\u00f5uda. Teoorias m\u00f5istsin, kuidas need toimivad ja millised nad on. Kuid kuna ma ei olnud kunagi nendega praktikas kokku puutunud, polnud ma kindel, kuidas k\u00f5ik nende sees tegelikult toimib. <\/p>\n

<\/p>\n

Lisaks ei olnud mul aimugi, kuidas neil on k\u00fcberturvalisus. Teooria k\u00f5lab ilusasti, kuid vana laul \"mida rohkem turvalisust, seda madalam mugavus\" kummitas mind. Nii et arvasin, et kuna konteineritega on k\u00f5ik nii lihtne, on sealne turvalisus v\u00e4ga kehv. Selgub, et mul oli \u00f5igus.<\/p>\n

<\/a><\/noindex><\/p>\n

Kiireks alguseks registreerusin kursustele Black Hat<\/a><\/noindex> 2020 nimega \"K\u00fcnnakult kuningaks: Docker Swarmi ja Kubernetes'e keskkondade testimine ja kaitsmine<\/a><\/noindex>\u00bb. <\/p>\n

<\/p>\n

Kursus, mille viisid l\u00e4bi Sheila A. Berta ja Sol Ozzan, algas kohe Docker konteinerite toimimisest ning sellest, kuidas need paigaldatakse Kubernetesesse. See oli t\u00e4ielikult praktiline \u00f5ppetund \u2014 tudengitel tuli enne tundide algust oma arvutitele installeerida Docker ja microk8s \u2014 suurep\u00e4rane viis n\u00e4ha, kuidas t\u00f6\u00f6riistad omavahel suhtlevad, tuvastada n\u00f5rkusi ja, mis k\u00f5ige t\u00e4htsam, proovida neid kinni panna.<\/p>\n

<\/p>\n

Kahjuks, kuigi kursused lubasid kahe p\u00e4eva jooksul saada 'printsiks', tundsin, et k\u00f5ik alles algab ja mul on veel palju \u00f5ppida.<\/p>\n

<\/p>\n

\"Uurime<\/p>\n

<\/p>\n

Enne kui sukeldume minu s\u00fcgavamatesse t\u00e4helepanekutesse, on oluline selgitada, mis on konteiner. Arengumaailmas peetakse normaalseks olukorda, kus teie isiklikul arvutil kirjutatud kood t\u00f6\u00f6tab ideaalselt, kuid kui proovite seda serveris k\u00e4ivitada, siis see lihtsalt ei t\u00f6\u00f6ta. Konteinerid \u00fcritavad seda probleemi \u00fcletada, pakkudes iseseisvaid masinateid, mida saate h\u00f5lpsasti \u00fchest serverist teise viia, teades, et nad t\u00f6\u00f6tavad alati. Nagu nimigi \u00fctleb, sisaldavad need koodi, raamatukogusid ja muud vajalikku tarkvara. Kubernetes on konteinerite orkestreerimise platvorm.<\/a><\/noindex>P\u00f5him\u00f5tteliselt saab selle abil sujuvalt hallata sadu v\u00f5i isegi tuhandeid erinevaid konteineriteid.<\/p>\n

<\/p>\n

Allpool on toodud m\u00f5ned minu j\u00e4reldused punase ja sinise meeskonna vaatepunktist.<\/p>\n

<\/p>\n

Punane meeskond<\/h2>\n

<\/p>\n

Enamus konteinerite sisu t\u00f6\u00f6tab root'i all:<\/strong>see t\u00e4hendab, et kui konteinerit kompromiteerida, saate t\u00e4ieliku juurdep\u00e4\u00e4su konteinerile. See teeb j\u00e4rgnevad sammud oluliselt lihtsamaks.<\/p>\n

<\/p>\n

docker.sock'i mountimine konteineris on ohtlik.<\/strong>: kui olete saanud root-\u00f5igused konteineris ja seadnud Docker'i konteineri sees, kus on Docker'i sokkel (\/var\/run\/docker.sock), on teil potentsiaalne v\u00f5imalus uurida kogu klastrit, sealhulgas juurdep\u00e4\u00e4s igale teisele konteinerile. Sellist juurdep\u00e4\u00e4su ei saa takistada ei v\u00f5rgu isolatsiooniga ega muude meetoditega.<\/p>\n

<\/p>\n

Keskkonnamuutujad sisaldavad sageli salajasi andmeid.<\/strong>: enamikel juhtudel saadavad inimesed paroolid konteinerisse, kasutades tavalisi keskkonnamuutujaid. Nii et kui teil on juurdep\u00e4\u00e4s kontole, saate neid keskkonnamuutujaid pealt n\u00e4ha, et seej\u00e4rel oma \u00f5iguseid laiendada.<\/p>\n

<\/p>\n

Docker API v\u00f5ib anda palju teavet.<\/strong>: Docker API, vaike seadistustega, t\u00f6\u00f6tab ilma autoriseerimiseta ja v\u00f5ib anda palju teavet. Shodan'i kasutades on lihtne leida avatud porte, seej\u00e4rel saada \u00fcksikasjalikku teavet klastrist \u2014 ja minna selle t\u00e4ieliku h\u00f5ivamise juurde. TrendMicro on sellest kirjutanud huvitava artikli.<\/a><\/noindex>.<\/p>\n

<\/p>\n

Sinine meeskond.<\/h2>\n

<\/p>\n

\u00c4rge k\u00e4itage konteinerite sisu root-\u00f5igustega.<\/strong>: \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u043e\u0434 root \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043f\u0440\u043e\u0449\u0435, \u0432\u044b \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u044d\u0442\u043e\u0433\u043e \u0434\u0435\u043b\u0430\u0442\u044c. \u0412\u043c\u0435\u0441\u0442\u043e \u044d\u0442\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0439\u0442\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u0441 \u0441\u0431\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043e\u0442\u043e\u0431\u0440\u0430\u0437\u0438\u0432 uid \u043b\u0438\u0431\u043e \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 —user \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 CLI, \u043b\u0438\u0431\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044f USER \u0432 Dockerfile.<\/p>\n

<\/p>\n

\u00c4rge lubage programmide installimist konteinerites<\/strong>: peaaegu iga r\u00fcnnak algab millegi installimisest. Alates nmap'ist kuni ifconfig'ini ja isegi Dockerini (konteineris) on millegi installimine konteinerisse olnud tavaline. Seet\u00f5ttu tuleks alati blokeerida k\u00f5ik mittekasutatavad pordid. See aitab ka v\u00e4ltida k\u00e4skude edastamist teie masinasse sisenemise korral. Lisaks programmide installimise peatamisele tuleks veenduda, et konteineris oleks minimaalne arv rakendusi, mis on vajalik \u00fclesande t\u00e4itmiseks.<\/p>\n

<\/p>\n

Kaitske docker.sock<\/strong>: seda tuleb kaitsta, kuna selle kaudu toimub side konteineri ja klastrite vahel. Kuna ma ei soovi selle artikli raames \u00fcksikasjadesse minna, lugege Docker'i m\u00e4rkust<\/a><\/noindex>, mis v\u00f5ib juhtuda, ja kuidas seda k\u00f5ike blokeerida.<\/p>\n

<\/p>\n

Kasutage Docker'i salajasi muutujate asemel<\/strong>: Salajased muutujad on umbes alates 2017. aastast<\/a><\/noindex>. Kuigi see ei ole ohutu, on see siiski parem kui keskkonnamuutujate kasutamine saladuste edastamiseks konteinerites.<\/p>\n

<\/p>\n

Kui artikkel on \u00e4ratanud teie huvi konteinerite vastu, on Docker'i v\u00f5i microk8s'i (v\u00e4ike versioon Kubernetesest) installimine piisavalt lihtne. Siit<\/a><\/noindex> on saadaval Docker'i installimise juhised Linuxile ja MacOS-ile, ning siit<\/a><\/noindex> \u2014 microk8s'i installimise juhised Windowsile, Linuxile ja MacOS-ile.<\/p>\n

<\/p>\n

P\u00e4rast installimist saate minna sellele Docker'i kiire alguse juhendile<\/a><\/noindex> , mis on sarnane variant pakutakse<\/a><\/noindex> ja microk8s'i jaoks.<\/p>\n

<\/p>\n

Kui soovite v\u00f5i peate l\u00e4bima p\u00f5hjaliku kursuse Docker'ist, kus praktikute lektorid k\u00e4sitlevad k\u00f5iki selle t\u00f6\u00f6riistu: alates p\u00f5hialustest kuni v\u00f5rgu parameetrite, erinevate operatsioonis\u00fcsteemide ja programmeerimiskeelte n\u00fcanssideni, proovigeDocker'i videokursus<\/a><\/noindex>. Tutvute tehnoloogiaga ja m\u00f5istate, kus ja kuidas on k\u00f5ige parem Docker'it kasutada. Samuti saate parimaid tavasid \u2014 parem on \u00f5ppida ohutult ja praktikutelt, r\u00e4\u00e4kides kogemustest, kui \u00f5ppida iseseisvalt eksimuste pealt.<\/p>\n

Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f \u0440\u0430\u0431\u043e\u0442\u0430\u044e \u0432 IT \u0431\u043e\u043b\u044c\u0448\u0435 20 \u043b\u0435\u0442, \u043d\u043e \u043a\u0430\u043a-\u0442\u043e \u0440\u0443\u043a\u0438 \u043d\u0435 \u0434\u043e\u0445\u043e\u0434\u0438\u043b\u0438 \u0434\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0412 \u0442\u0435\u043e\u0440\u0438\u0438 \u044f \u043f\u043e\u043d\u0438\u043c\u0430\u043b, \u043a\u0430\u043a \u043e\u043d\u0438 \u0443\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u0438 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442. \u041d\u043e \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044f \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u0441 \u043d\u0438\u043c\u0438 \u043d\u0435 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0441\u044f \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u2014 \u044f \u043d\u0435 \u0431\u044b\u043b \u0443\u0432\u0435\u0440\u0435\u043d \u0432 \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u043a\u0440\u0443\u0442\u044f\u0442\u0441\u044f-\u0432\u0435\u0440\u0442\u044f\u0442\u0441\u044f \u0443 \u043d\u0438\u0445 \u0448\u0435\u0441\u0442\u0435\u0440\u0451\u043d\u043a\u0438 \u043f\u043e\u0434 \u043a\u0430\u043f\u043e\u0442\u043e\u043c. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u044f \u0431\u044b\u043b \u0431\u0435\u0437 \u043f\u043e\u043d\u044f\u0442\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91365,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91364","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uurime (puuduvat) t\u00fc\u00fcpiliste Docker ja Kubernetes installatsioonide turvalisust | ProHoster","description":"Olen t\u00f6\u00f6tanud IT-sektoris \u00fcle 20 aasta, kuid kuidagi ei olnud ma j\u00f5udnud konteinerite juurde. Teoreetiliselt m\u00f5istsin, kuidas need t\u00f6\u00f6tavad ja kuidas nad \u00fcles ehitatud on. Kuid kuna ma pole neid kunagi praktiliselt kasutanud, ei olnud ma kindel, kuidas nende all k\u00f5ik t\u00f6\u00f6tab. Lisaks ei teadnud ma \u00fcldse.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437\u0443\u0447\u0430\u0435\u043c (\u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0443\u044e) \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0442\u0438\u043f\u0438\u0447\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a Docker \u0438 Kubernetes | ProHoster","og:description":"\u042f \u0440\u0430\u0431\u043e\u0442\u0430\u044e \u0432 IT \u0431\u043e\u043b\u044c\u0448\u0435 20 \u043b\u0435\u0442, \u043d\u043e \u043a\u0430\u043a-\u0442\u043e \u0440\u0443\u043a\u0438 \u043d\u0435 \u0434\u043e\u0445\u043e\u0434\u0438\u043b\u0438 \u0434\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0412 \u0442\u0435\u043e\u0440\u0438\u0438 \u044f \u043f\u043e\u043d\u0438\u043c\u0430\u043b, \u043a\u0430\u043a \u043e\u043d\u0438 \u0443\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u0438 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442. \u041d\u043e \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044f \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u0441 \u043d\u0438\u043c\u0438 \u043d\u0435 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0441\u044f \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u2014 \u044f \u043d\u0435 \u0431\u044b\u043b \u0443\u0432\u0435\u0440\u0435\u043d \u0432 \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u043a\u0440\u0443\u0442\u044f\u0442\u0441\u044f-\u0432\u0435\u0440\u0442\u044f\u0442\u0441\u044f \u0443 \u043d\u0438\u0445 \u0448\u0435\u0441\u0442\u0435\u0440\u0451\u043d\u043a\u0438 \u043f\u043e\u0434 \u043a\u0430\u043f\u043e\u0442\u043e\u043c. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u044f \u0431\u044b\u043b \u0431\u0435\u0437 \u043f\u043e\u043d\u044f\u0442\u0438\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-12T05:42:33+00:00","article:modified_time":"2020-08-12T05:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91364","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:29:22","updated":"2022-09-28 18:39:15"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=91364"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91364\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/91365"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=91364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=91364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=91364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}