Sau da yawa, bayan gudanar da bincike, don amsa shawarwarina na ɓoye tashoshin jiragen ruwa a bayan jerin fararen fata, na gamu da bango na rashin fahimta. Hatta admins masu kyau / DevOps suna tambaya: "Me yasa?!"
Ina ba da shawarar yin la'akari da haɗari a cikin tsarin saukowa na yiwuwar faruwa da lalacewa.
- Kuskuren daidaitawa
- DDoS akan IP
- Karfin zalunci
- Lalacewar sabis
- Lalacewar tari na kernel
- Ƙara yawan hare-haren DDoS
Kuskuren daidaitawa
Halin da ya fi dacewa da haɗari. Yadda abin yake faruwa. Mai haɓakawa yana buƙatar gwada hasashen da sauri; ya kafa sabar wucin gadi tare da mysql/redis/mongodb/elastic. Kalmar sirri, ba shakka, tana da rikitarwa, yana amfani da shi a ko'ina. Yana buɗe sabis ɗin ga duniya - yana dacewa dashi don haɗawa daga PC ɗin sa ba tare da waɗannan VPNs na ku ba. Kuma na yi kasala don tunawa da iptables syntax; uwar garken na wucin gadi ne. Ma'aurata ƙarin kwanakin haɓaka - ya zama mai girma, za mu iya nuna shi ga abokin ciniki. Abokin ciniki yana son shi, babu lokacin da za a sake yin shi, mun ƙaddamar da shi a cikin PROD!
Misalin da aka wuce gona da iri da gangan domin a bi duk rake:
- Babu wani abu da ya fi na ɗan lokaci fiye da na ɗan lokaci - Ba na son wannan jumlar, amma bisa ga ji, 20-40% na irin waɗannan sabar na wucin gadi sun kasance na dogon lokaci.
- Rukunin kalmar sirri ta duniya da ake amfani da ita a yawancin ayyuka mugunta ce. Domin daya daga cikin ayyukan da aka yi amfani da wannan kalmar sirri ta yiwu an yi kutse. Wata hanya ko wata, ma'ajin bayanai na ayyukan hacked suna shiga ɗaya, wanda ake amfani da shi don [karfi]*.
Yana da daraja ƙarawa cewa bayan shigarwa, redis, mongodb da na roba gabaɗaya suna samuwa ba tare da tantancewa ba, kuma galibi ana sake cika su. . - Yana iya zama kamar babu wanda zai duba tashar jiragen ruwa na 3306 a cikin 'yan kwanaki. Yana da rudi! Masscan kyakkyawan na'urar daukar hotan takardu ne kuma yana iya dubawa a tashoshin jiragen ruwa 10M a sakan daya. Kuma akwai IPV4 biliyan 4 kawai akan Intanet. Saboda haka, duk tashoshin jiragen ruwa 3306 akan Intanet suna cikin mintuna 7. Charles!!! Minti bakwai!
"Wa ke bukatar wannan?" - kuna adawa. Don haka ina mamakin lokacin da na kalli kididdigar fakitin da aka sauke. A ina 40 dubu yunƙurin dubawa daga 3 dubu na musamman IPs zo daga kowace rana? Yanzu kowa yana dubawa, daga masu satar uwa zuwa gwamnatoci. Yana da sauƙin dubawa - ɗauki kowane VPS akan $ 3-5 daga kowane kamfanin jirgin sama mai rahusa, ba da damar shiga fakitin da aka sauke kuma duba log ɗin a rana ɗaya.
Kunna shiga
A cikin /etc/iptables/rules.v4 ƙara a ƙarshe:
-A INPUT -j LOG --log-prefix "[FW - ALL]" --log-level 4
Kuma a cikin /etc/rsyslog.d/10-iptables.conf
:msg, ya ƙunshi,"[FW - "/var/log/iptables.log
& tsayawa
DDoS akan IP
Idan maharin ya san IP ɗin ku, zai iya sace sabar ku na awanni ko kwanaki da yawa. Ba duk masu ba da sabis na rahusa ba ne ke da kariyar DDoS kuma za a cire haɗin sabar ku kawai daga hanyar sadarwar. Idan kun ɓoye uwar garken ku a bayan CDN, kar ku manta da canza IP, in ba haka ba dan gwanin kwamfuta zai yi google shi kuma DDoS uwar garken ku yana kewaye da CDN (kuskure mai shahara sosai).
Lalacewar sabis
Duk mashahuran software ba dade ko ba dade suna samun kurakurai, har ma da mafi yawan gwaji da mahimmanci. Daga cikin ƙwararrun IB, akwai rabin wargi - ana iya tantance amincin kayan aikin cikin aminci ta lokacin sabuntawar ƙarshe. Idan kayan aikin ku suna da wadata a tashoshin jiragen ruwa da ke mannewa cikin duniya, kuma ba ku sabunta shi tsawon shekara guda ba, to duk wani ƙwararren masani na tsaro zai gaya muku ba tare da duban cewa kuna leken asiri ba, kuma wataƙila an riga an yi kutse.
Har ila yau yana da kyau a ambata cewa duk raunin da aka sani an taɓa sanin su. Ka yi tunanin dan gwanin kwamfuta wanda ya sami irin wannan rauni kuma ya duba duk Intanet a cikin mintuna 7 don kasancewarsa ... Anan akwai sabon cutar kwayar cuta) Muna buƙatar sabuntawa, amma wannan na iya cutar da samfurin, ka ce. Kuma za ku yi daidai idan ba a shigar da fakitin daga wuraren ajiyar OS na hukuma ba. Daga gwaninta, sabuntawa daga ma'ajiya na hukuma ba kasafai ke karya samfurin ba.
Karfin zalunci
Kamar yadda aka bayyana a sama, akwai rumbun adana bayanai da ke ɗauke da kalmomin sirri na rabin biliyan waɗanda suka dace don bugawa daga maɓalli. Wato, idan ba ka ƙirƙiri kalmar sirri ba, amma ka buga alamomin kusa akan maballin, ka tabbata cewa za su ruɗe ka.
Lalacewar tari na kernel.
Hakanan yana faruwa **** cewa ba komai ko wane sabis ne ke buɗe tashar jiragen ruwa ba, lokacin da tari na cibiyar sadarwar kernel kanta yana da rauni. Wato, kwata-kwata duk wani soket tcp/udp akan tsarin mai shekaru biyu yana da rauni ga raunin da zai kai ga DDoS.
Ƙara yawan hare-haren DDoS
Ba zai haifar da lalacewa kai tsaye ba, amma yana iya toshe tashar ku, ƙara nauyi akan tsarin, IP ɗinku zai ƙare akan wasu jerin baƙi ***, kuma zaku karɓi zagi daga mai ɗaukar hoto.
Kuna buƙatar duk waɗannan haɗarin da gaske? Ƙara gidan ku da IP ɗin aiki zuwa jerin fari. Ko da yana da ƙarfi, shiga ta hanyar gudanarwar mai masaukin baki, ta hanyar na'ura mai ba da hanya tsakanin hanyoyin sadarwa, kuma kawai ƙara wani.
Na yi shekaru 15 ina ginawa da kare kayan aikin IT. Na samar da wata ka'ida wacce nake ba da shawarar kowa da kowa - babu tashar jiragen ruwa da yakamata ta tsaya cikin duniya ba tare da jerin fari ba.
Misali, sabar gidan yanar gizo mafi aminci *** ita ce wacce ke buɗe 80 da 443 kawai don CDN/WAF. Kuma tashoshin sabis (ssh, netdata, bacula, phpmyadmin) yakamata su kasance aƙalla a bayan jerin fari, har ma mafi kyau a bayan VPN. In ba haka ba, kuna haɗarin yin sulhu.
Abin da nake so ke nan ke nan. Rike tashoshin jiragen ruwa a rufe!
- (1) UPD1: Kuna iya duba kalmar sirri ta duniya mai sanyi (kar a yi wannan ba tare da maye gurbin wannan kalmar sirri tare da bazuwar ɗaya a cikin duk sabis ɗin ba), ko ya bayyana a cikin bayanan da aka haɗa. Kuna iya ganin ayyuka nawa aka yi kutse, inda aka haɗa imel ɗin ku, kuma, saboda haka, gano ko an lalata kalmar sirrin ku mai sanyi ta duniya.
- (2) Ga darajar Amazon, LightSail yana da ƙananan sikanin gani. A fili tace ko yaya.
- (3) Sabar gidan yanar gizo mafi aminci ita ce wacce ke bayan bangon wuta mai sadaukarwa, WAF ɗin kansa, amma muna magana ne game da VPS/Dedicated na jama'a.
- (4) Segmentsmak.
- (5) Wuta.
Masu amfani da rajista kawai za su iya shiga cikin binciken. don Allah.
Shin tashoshin jiragen ruwa naku suna tsayawa?
-
Koyaushe
-
Wasu lokuta
-
Babu
-
Ban sani ba, fuck
Masu amfani 54 sun kada kuri'a. Masu amfani 6 sun kaurace.
source: www.habr.com