{"id":91364,"date":"2020-08-12T07:42:33","date_gmt":"2020-08-12T05:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes"},"modified":"2020-08-12T07:42:33","modified_gmt":"2020-08-12T05:42:33","slug":"izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","title":{"rendered":"Uurime (puuduvat) Docker ja Kubernetes t\u00fc\u00fcpiliste seadistuste turvalisust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Uurime
\nOlen t\u00f6\u00f6tanud IT-sektoris \u00fcle 20 aasta, kuid kuidagi ei olnud ma varem konteineritega tegelenud. Teoorias m\u00f5istsin, kuidas need t\u00f6\u00f6tavad ja kuidas need on seadistatud. Kuid kuna ma ei olnud nendega praktikas silmitsi seisnud, ei olnud ma kindel, kuidas nende mehhanismid t\u00e4pselt t\u00f6\u00f6tavad. <\/p>\n

<\/p>\n

Lisaks ei teadnud ma midagi ka nende turvalisusest. Taas kord, teooria k\u00f5lab h\u00e4sti, kuid vana laul \u201eturvalisuse t\u00f5ustes langeb kasutatavus\u201c k\u00e4is mul peas. Nii et m\u00f5tlesin, et kuna konteineritega on k\u00f5ike nii lihtne teha, on seal turvalisus madal. Selgus, et olin \u00f5ige.<\/p>\n

<\/a><\/noindex><\/p>\n

Kiireks alguseks registreerisin end kursustele Black Hat<\/a><\/noindex> 2020 pealkirjaga \u201eLuhtunud lootustest hiilguseni: sissetung ja kaitse Docker Swarm ja Kubernetes keskkondades<\/a><\/noindex>\u00bb. <\/p>\n

<\/p>\n

Kursus, mida viisid l\u00e4bi Sheila A. Berta ja Sol Ozzan, algas kohe Docker konteinerite toimimise kirjeldamisega ning sellest, milline on nende deployimise tee Kubernetesis. See oli t\u00e4ielikult praktiline klass \u2014 \u00f5pilased pidid enne tunde oma masinatele Docker ja microk8s installima \u2014 suurep\u00e4rane v\u00f5imalus n\u00e4ha t\u00f6\u00f6riistade omavahelist koost\u00f6\u00f6d, leida n\u00f5rgad kohad ja, mis k\u00f5ige t\u00e4htsam, proovida neid blokeerida.<\/p>\n

<\/p>\n

Kahjuks, kuigi kursused lubasid kahe p\u00e4eva p\u00e4rast \u201eprintsiks\u201c saada, tundsin ma, et k\u00f5ik on alles algamas ja mul on veel palju \u00f5ppida.<\/p>\n

<\/p>\n

\"Uurime<\/p>\n

<\/p>\n

Enne kui sukelduda minu k\u00f5rgetesse t\u00e4helepanekutesse, on oluline selgitada, mis on konteiner. Arendamise maailmas peetakse normaalseks olukorda, kus teie isiklikul masinal kirjutatud kood t\u00f6\u00f6tab ideaalselt, kuid kui proovite seda kuskil serveris k\u00e4ivitada \u2014 see lihtsalt ei toimi. Konteinerid \u00fcritavad seda probleemi \u00fcletada, pakkudes iseseisvaid masin\u00acn\u00f5isi, mida saate h\u00f5lpsasti \u00fchest serverist teise kanda, teades, et need t\u00f6\u00f6tavad alati. Nagu nimi \u00fctleb, sisaldavad nad koodi, teeke ja muud tarkvara, mis on t\u00f6\u00f6tamiseks vajalik. Kubernetes, omakorda, on konteinerite orkestreerimise platvorm<\/a><\/noindex>. P\u00f5him\u00f5tteliselt on selle abil v\u00f5imalik sujuvalt hallata sadu v\u00f5i tuhandeid erinevaid konteinerid.<\/p>\n

<\/p>\n

Allpool on m\u00f5ned minu j\u00e4reldused punase ja sinise meeskonna vaatenurgast.<\/p>\n

<\/p>\n

Punane meeskond<\/h2>\n

<\/p>\n

Enamik konteinerite sisu k\u00e4ivitatakse root-kasutajana<\/strong>: see t\u00e4hendab, et kui kompromiteerite konteineri, saate t\u00e4ieliku ligip\u00e4\u00e4su konteinerile. See muudab j\u00e4rgmised sammud oluliselt lihtsamaks.<\/p>\n

<\/p>\n

docker.sock-i monteerimine konteineris on ohtlik<\/strong>: kui olete saanud root-privileegid konteineris ja olete ka paigaldanud Docker'i konteinerisse, millel on Docker-soket (\/var\/run\/docker.sock), siis on teil potentsiaalne v\u00f5imalus uurida kogu klastrit, sealhulgas p\u00e4\u00e4seda juurde igale teisele konteinerile. Sellist ligip\u00e4\u00e4su ei saa v\u00e4ltida ei v\u00f5rgus isolatsiooni ega muude meetoditega.<\/p>\n

<\/p>\n

Keskkonnamuutujad sisaldavad sageli salajasi andmeid<\/strong>: enamasti saadavad inimesed paroolid konteinerisse tavaliste keskkonnamuutujate kaudu. Niisiis, kui teil on juurdep\u00e4\u00e4s kontole, saate need keskkonnamuutujad silmas pidades oma \u00f5igusi hiljem laiendada.<\/p>\n

<\/p>\n

Docker API v\u00f5ib anda palju teavet<\/strong>: vaikeseadistustes t\u00f6\u00f6tab Docker API ilma autentimiseta ja v\u00f5ib anda palju teavet. Kasutades Shodan'i, on lihtne leida avatud sadamate loendit, seej\u00e4rel saada \u00fcksikasjalikku teavet klastri kohta \u2014 ja liikuda selle t\u00e4ieliku \u00fcle v\u00f5tmise suunas. TrendMicro kirjutas sellest huvitava artikli<\/a><\/noindex>.<\/p>\n

<\/p>\n

Sinine meeskond<\/h2>\n

<\/p>\n

\u00c4rge k\u00e4ivitage konteinerite sisu root-kasutajana<\/strong>: kuigi root-kontoga k\u00e4ivitamine on lihtsam, ei tohiks te seda teha. Selle asemel k\u00e4ivitage rakendusi \u00f5igusteta, kuvades uid v\u00f5i kasutades CLI abil parameetrit \u2014user, v\u00f5i m\u00e4\u00e4rates USER Dockerfile'is.<\/p>\n

<\/p>\n

\u00c4rge lubage programmide installimist konteinerites<\/strong>: peaaegu iga r\u00fcnnak algab millegi installimisest. Alustades nmap'ist ja l\u00f5petades ifconfig'iga ning Docker'iga (konteineris), oli konteineris millegi installimine tavaline asi. Samuti tuleb alati blokeerida k\u00f5ik mittekasutatavad sadamad. See aitab ka v\u00e4ltida juhtimisk\u00e4skude edastamist teie masina nakatumisel. Lisaks programmide installimise v\u00e4ltimisele tuleks veenduda, et konteineris on minimaalne hulk rakendusi, mis on vajalik \u00fclesande t\u00e4itmiseks.<\/p>\n

<\/p>\n

Kaitske docker.sock'i<\/strong>: seda tuleb kaitsta, kuna selle soketi kaudu toimub suhtlus konteineri ja klastri vahel. Kuna ma ei soovi selles artiklis detailselt s\u00fcveneda, lugege Docker'i m\u00e4rkust<\/a><\/noindex>, mis v\u00f5ib juhtuda, ning kuidas seda k\u00f5ike blokeerida.<\/p>\n

<\/p>\n

Kasutage Docker'i salajasi muutujaid keskkonnaparametrite asemel<\/strong>: Salajased muutujaid on olemas umbes 2017. aastast<\/a><\/noindex>. Kuigi see ei ole ohutu, on see siiski parem kui keskkonnaparametrite kasutamine salajaste andmete edastamiseks konteineris.<\/p>\n

<\/p>\n

Kui artikkel tekitas teie huvi konteinerite vastu, siis on Docker'i v\u00f5i microk8s'i (v\u00e4iksem Kubernetes'i versioon) paigaldamine suhteliselt lihtne. Siin<\/a><\/noindex> on olemas juhised Docker'i installimiseks Linuxile ja MacOS-le, samas siin<\/a><\/noindex> \u2014 juhised microk8s'i installimiseks Windowsile, Linuxile ja MacOS-le.<\/p>\n

<\/p>\n

P\u00e4rast installimist v\u00f5ite minna selle kiirjuhendi juurde<\/a><\/noindex> Docker'ilt, sarnane variant pakutakse<\/a><\/noindex> ka microk8s'ile.<\/p>\n

<\/p>\n

Kui soovite v\u00f5i on teil vajadus l\u00e4bida p\u00f5hjalik kursus Docker'ist, kus kogenud esinejad k\u00e4sitlevad k\u00f5iki selle t\u00f6\u00f6riistu: alates p\u00f5hiabstraktsioonidest kuni v\u00f5rguvalikute, erinevate operatsioonis\u00fcsteemide ja programmeerimiskeelte n\u00fcanssideni, proovige \"Videokursuse Dockerist<\/a><\/noindex>\". Sa tutvud tehnoloogiaga ja m\u00f5istad, kus ja kuidas Dockerit parim viis kasutada. Samuti saad parimaid praktikaid \u2014 \u00f5ppida on parem ohutult ja kogenud praktikute toetusel t\u00f5rkedest, kui omal nahal sorkima kui ise teravate k\u00e4epidemetega.<\/p>\n

Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f \u0440\u0430\u0431\u043e\u0442\u0430\u044e \u0432 IT \u0431\u043e\u043b\u044c\u0448\u0435 20 \u043b\u0435\u0442, \u043d\u043e \u043a\u0430\u043a-\u0442\u043e \u0440\u0443\u043a\u0438 \u043d\u0435 \u0434\u043e\u0445\u043e\u0434\u0438\u043b\u0438 \u0434\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0412 \u0442\u0435\u043e\u0440\u0438\u0438 \u044f \u043f\u043e\u043d\u0438\u043c\u0430\u043b, \u043a\u0430\u043a \u043e\u043d\u0438 \u0443\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u0438 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442. \u041d\u043e \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044f \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u0441 \u043d\u0438\u043c\u0438 \u043d\u0435 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0441\u044f \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u2014 \u044f \u043d\u0435 \u0431\u044b\u043b \u0443\u0432\u0435\u0440\u0435\u043d \u0432 \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u043a\u0440\u0443\u0442\u044f\u0442\u0441\u044f-\u0432\u0435\u0440\u0442\u044f\u0442\u0441\u044f \u0443 \u043d\u0438\u0445 \u0448\u0435\u0441\u0442\u0435\u0440\u0451\u043d\u043a\u0438 \u043f\u043e\u0434 \u043a\u0430\u043f\u043e\u0442\u043e\u043c. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u044f \u0431\u044b\u043b \u0431\u0435\u0437 \u043f\u043e\u043d\u044f\u0442\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91365,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91364","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uurime (puuduvat) t\u00fc\u00fcpiliste Docker'i ja Kubernetes'i seadistuste turvalisust | ProHoster","description":"Ma t\u00f6\u00f6tan IT-sektoris.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437\u0443\u0447\u0430\u0435\u043c (\u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0443\u044e) \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0442\u0438\u043f\u0438\u0447\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a Docker \u0438 Kubernetes | ProHoster","og:description":"\u042f \u0440\u0430\u0431\u043e\u0442\u0430\u044e \u0432 IT.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-12T05:42:33+00:00","article:modified_time":"2020-08-12T05:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91364","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:29:22","updated":"2022-09-28 18:39:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=91364"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/91364\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/91365"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=91364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=91364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=91364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}