Variti txhim kho kev tiv thaiv bots thiab DDoS tawm tsam, thiab tseem ua rau muaj kev ntxhov siab thiab ntsuas kev thauj khoom. Ntawm lub rooj sib tham HighLoad ++ 2018 peb tau tham txog yuav ua li cas kom ruaj ntseg cov peev txheej los ntawm ntau hom kev tawm tsam. Hauv luv luv: cais qhov chaw ntawm lub kaw lus, siv cov kev pabcuam huab thiab CDNs, thiab hloov kho tsis tu ncua. Tab sis koj tseem yuav tsis tuaj yeem tiv thaiv tsis muaj tuam txhab tshwj xeeb :)
Ua ntej nyeem cov ntawv nyeem, koj tuaj yeem nyeem cov ntawv luv luv .
Thiab yog tias koj tsis nyiam nyeem lossis tsuas yog xav saib cov vis dis aus, cov ntaub ntawv kaw tseg ntawm peb daim ntawv tshaj tawm hauv qab no hauv qab tus spoiler.
Kev kaw video ntawm tsab ntawv ceeb toom
Ntau lub tuam txhab twb paub yuav ua li cas thiaj li kuaj cov load, tab sis tsis yog txhua tus ua kev ntsuas kev ntxhov siab. Ib txhia ntawm peb cov neeg muas zaub xav hais tias lawv qhov chaw yog invulnerable vim hais tias lawv muaj ib tug high load system, thiab nws tiv thaiv zoo los ntawm kev tawm tsam. Peb qhia tias qhov no tsis yog qhov tseeb kiag li.
Tau kawg, ua ntej kev sim, peb tau txais kev tso cai los ntawm cov neeg siv khoom, kos npe thiab kos npe, thiab nrog peb kev pab cuam DDoS nres tsis tuaj yeem ua rau leej twg. Kev ntsuam xyuas yog ua nyob rau lub sijhawm xaiv los ntawm cov neeg siv khoom, thaum kev khiav mus rau nws cov peev txheej tsawg, thiab cov teeb meem nkag mus yuav tsis cuam tshuam rau cov neeg siv khoom. Tsis tas li ntawd, txij li qee yam tuaj yeem ua yuam kev thaum lub sijhawm kuaj, peb muaj kev sib cuag nrog tus neeg siv khoom tas li. Qhov no tso cai rau koj tsis tsuas yog qhia cov txiaj ntsig tau ua tiav, tab sis kuj hloov qee yam thaum kuaj. Tom qab ua tiav qhov kev sim, peb ib txwm kos ib daim ntawv tshaj tawm uas peb taw qhia qhov tsis txaus ntseeg thiab muab cov lus pom zoo rau kev tshem tawm qhov tsis zoo ntawm lub xaib.
Peb ua haujlwm li cas
Thaum kuaj, peb ua raws li botnet. Txij li thaum peb ua haujlwm nrog cov neeg siv khoom uas tsis nyob hauv peb cov tes hauj lwm, txhawm rau xyuas kom meej tias qhov kev xeem tsis xaus rau thawj feeb vim muaj kev txwv lossis kev tiv thaiv raug cuam tshuam, peb muab cov khoom thauj tsis yog los ntawm ib tus IP, tab sis los ntawm peb tus kheej subnet. Ntxiv rau, txhawm rau tsim kom muaj kev thauj khoom tseem ceeb, peb muaj peb tus kheej cov neeg siv khoom zoo tshaj plaws.
Postulates
Ntau dhau tsis txhais hais tias zoo
Qhov tsawg dua peb tuaj yeem nqa cov peev txheej rau kev ua tsis tiav, qhov zoo dua. Yog tias koj tuaj yeem ua rau lub xaib tsis ua haujlwm ntawm ib qho kev thov ib ob, lossis txawm tias ib qho kev thov ib feeb, qhov ntawd zoo heev. Vim hais tias raws li txoj cai lij choj, cov neeg siv lossis cov neeg tawm tsam yuav poob rau hauv qhov tsis zoo no.
Ib feem tsis ua haujlwm zoo dua li qhov ua tsis tiav
Peb ib txwm qhia ua kom cov txheej txheem heterogeneous. Ntxiv mus, nws tsim nyog cais lawv ntawm lub cev, thiab tsis yog los ntawm kev ntim khoom xwb. Nyob rau hauv rooj plaub ntawm kev sib cais ntawm lub cev, txawm tias ib yam dab tsi ua tsis tiav ntawm lub xaib, muaj qhov tshwm sim siab tias nws yuav tsis ua haujlwm tag nrho, thiab cov neeg siv yuav tau nkag mus rau yam tsawg kawg ntawm kev ua haujlwm.
Zoo architecture yog lub hauv paus rau sustainability
Kev ua txhaum cai ntawm cov peev txheej thiab nws lub peev xwm los tiv thaiv kev tawm tsam thiab kev thauj khoom yuav tsum tau muab tso rau ntawm theem tsim, qhov tseeb, nyob rau theem ntawm kev kos duab thawj zaug hauv phau ntawv sau. Vim hais tias yog tias qhov ua tsis tiav tuag nkag mus, nws tuaj yeem kho lawv yav tom ntej, tab sis nws nyuaj heev.
Tsis tsuas yog cov cai yuav tsum zoo, tab sis kuj config
Ntau tus neeg xav tias pab pawg txhim kho zoo yog qhov lees paub ntawm qhov kev pabcuam ua txhaum. Pab pawg txhim kho zoo yog qhov tsim nyog, tab sis kuj yuav tsum muaj kev ua haujlwm zoo, DevOps zoo. Ntawd yog, peb xav tau cov kws tshaj lij uas yuav raug teeb tsa Linux thiab lub network, sau configs kom raug hauv nginx, teeb tsa, thiab lwm yam. Txwv tsis pub, cov peev txheej yuav ua haujlwm zoo tsuas yog hauv kev sim, thiab qee lub sijhawm txhua yam yuav tawg hauv kev tsim khoom.
Qhov sib txawv ntawm kev thauj khoom thiab kev ntsuas kev ntxhov siab
Load testing tso cai rau koj txheeb xyuas cov kev txwv ntawm kev ua haujlwm. Kev ntsuam xyuas kev ntxhov siab yog txhawm rau nrhiav qhov tsis muaj zog hauv lub cev thiab siv los rhuav tshem cov kab ke no thiab saib seb nws yuav coj li cas hauv cov txheej txheem tsis ua haujlwm ntawm qee qhov chaw. Hauv qhov no, qhov xwm txheej ntawm cov khoom thauj feem ntau tseem tsis paub meej rau tus neeg siv khoom ua ntej kev ntsuas kev ntxhov siab pib.
Cov yam ntxwv tshwj xeeb ntawm L7 tawm tsam
Peb feem ntau faib cov khoom thauj mus rau hauv cov khoom thauj ntawm L7 thiab L3 & 4 qib. L7 yog qhov thauj khoom ntawm qib kev thov, feem ntau nws txhais tau tias tsuas yog HTTP, tab sis peb txhais tau tias txhua qhov thauj khoom ntawm TCP raws tu qauv.
L7 tawm tsam muaj qee yam tshwj xeeb. Ua ntej, lawv tuaj ncaj qha rau daim ntawv thov, uas yog, nws tsis zoo li tias lawv yuav raug cuam tshuam los ntawm kev siv network. Xws li kev tawm tsam siv logic, thiab vim li no, lawv haus CPU, nco, disk, database thiab lwm yam kev pab cuam zoo heev thiab tsis tshua muaj tsheb khiav.
HTTP Dej nyab
Nyob rau hauv cov ntaub ntawv ntawm ib qho kev tawm tsam, lub load yog yooj yim los tsim dua li kev lis kev cai, thiab nyob rau hauv cov ntaub ntawv ntawm L7 qhov no kuj muaj tseeb. Nws tsis yog ib txwm yooj yim kom paub qhov txawv ntawm kev tawm tsam los ntawm kev khiav tsheb raug cai, thiab feem ntau qhov no tuaj yeem ua tau los ntawm ntau zaus, tab sis yog tias txhua yam tau npaj kom raug, ces nws tsis tuaj yeem nkag siab los ntawm cov cav qhov twg qhov kev tawm tsam yog thiab qhov twg qhov kev thov raug cai.
Ua piv txwv thawj zaug, xav txog HTTP Flood nres. Daim duab qhia tau hais tias qhov kev tawm tsam no feem ntau muaj zog heev; hauv qhov piv txwv hauv qab no, qhov kev thov siab tshaj 600 txhiab ib feeb.
HTTP Flood yog qhov yooj yim tshaj plaws los tsim kev thauj khoom. Feem ntau, nws yuav siv qee yam kev ntsuas qhov ntsuas, xws li ApacheBench, thiab teeb tsa qhov kev thov thiab lub hom phiaj. Nrog rau qhov yooj yim mus kom ze, muaj qhov tshwm sim siab ntawm kev khiav mus rau hauv server caching, tab sis nws yooj yim rau bypass nws. Piv txwv li, ntxiv random hlua rau qhov kev thov, uas yuav yuam kom cov neeg rau zaub mov tas li ua haujlwm tshiab nplooj ntawv.
Tsis tas li ntawd, tsis txhob hnov qab txog tus neeg siv-tus neeg sawv cev hauv cov txheej txheem ntawm kev tsim cov khoom thauj. Ntau tus neeg siv-tus neeg sawv cev ntawm cov cuab yeej ntsuas nrov yog lim los ntawm cov thawj coj hauv lub cev, thiab qhov no qhov kev thauj khoom tsuas yog tsis tuaj yeem ncav cuag lub backend. Koj tuaj yeem txhim kho qhov txiaj ntsig tau zoo los ntawm kev ntxig ntau lossis tsawg dua qhov siv tau los ntawm qhov browser rau hauv qhov kev thov.
Raws li yooj yim li HTTP Flood tawm tsam, lawv kuj muaj lawv qhov tsis zoo. Ua ntej, lub zog loj yuav tsum tau tsim kom muaj lub nra. Qhov thib ob, xws li kev tawm tsam yog qhov yooj yim heev los kuaj xyuas, tshwj xeeb tshaj yog tias lawv tuaj ntawm ib qhov chaw nyob. Raws li qhov tshwm sim, kev thov tam sim pib raug lim los ntawm cov neeg tswj hwm lub cev lossis txawm tias nyob rau theem kws kho mob.
Nrhiav dab tsi
Txhawm rau txo tus naj npawb ntawm kev thov ib ob yam tsis tau poob kev ua haujlwm, koj yuav tsum tau qhia me ntsis kev xav thiab tshawb xyuas qhov chaw. Yog li, koj tuaj yeem thauj khoom tsis tau tsuas yog cov channel lossis server, tab sis kuj tseem yog ib feem ntawm daim ntawv thov, piv txwv li, databases lossis cov ntaub ntawv kaw lus. Koj tuaj yeem nrhiav qhov chaw ntawm lub xaib uas ua cov lej loj: lub tshuab xam zauv, nplooj ntawv xaiv khoom, thiab lwm yam. Thaum kawg, nws feem ntau tshwm sim tias qhov chaw muaj qee yam ntawm PHP tsab ntawv uas tsim ib nplooj ntawv ntawm ntau pua txhiab kab. Xws li ib tsab ntawv kuj tseem loads tus neeg rau zaub mov thiab tuaj yeem dhau los ua lub hom phiaj rau kev tawm tsam.
saib qhov twg
Thaum peb luam theej duab cov peev txheej ua ntej kev sim, peb xub saib, tau kawg, ntawm qhov chaw nws tus kheej. Peb tab tom nrhiav rau txhua yam kev tawm tswv yim, cov ntaub ntawv hnyav - feem ntau, txhua yam uas tuaj yeem tsim teeb meem rau cov peev txheej thiab ua haujlwm qeeb. Cov cuab yeej tsim kho Banal hauv Google Chrome thiab Firefox pab ntawm no, qhia cov sijhawm teb nplooj ntawv.
Peb kuj luam theej duab subdomains. Piv txwv li, muaj qee lub khw hauv online, abc.com, thiab nws muaj subdomain admin.abc.com. Feem ntau yuav, qhov no yog ib tug admin vaj huam sib luag nrog kev tso cai, tab sis yog tias koj muab lub load rau nws, nws tuaj yeem tsim teeb meem rau cov peev txheej tseem ceeb.
Lub vev xaib yuav muaj subdomain api.abc.com. Feem ntau yuav, qhov no yog ib qho chaw rau kev siv mobile. Daim ntawv thov tuaj yeem pom hauv App Store lossis Google Play, nruab ib qho chaw nkag tshwj xeeb, txiav tawm API thiab sau npe xeem cov nyiaj. Qhov teeb meem yog tias tib neeg feem ntau xav tias txhua yam uas muaj kev tiv thaiv los ntawm kev tso cai yog tiv thaiv kom tsis txhob muaj kev tawm tsam kev pabcuam. Supposedly, kev tso cai yog qhov zoo tshaj plaws CAPTCHA, tab sis nws tsis yog. Nws yog ib qho yooj yim los ua 10-20 tus lej xeem, tab sis los ntawm kev tsim lawv, peb tau nkag mus rau qhov nyuaj thiab tsis pom kev ua haujlwm.
Lawm, peb saib keeb kwm, ntawm robots.txt thiab WebArchive, ViewDNS, thiab nrhiav cov ntawv qub ntawm cov peev txheej. Qee lub sij hawm nws tshwm sim tias cov neeg tsim khoom tau dov tawm, hais tias, mail2.yandex.net, tab sis cov qub version, mail.yandex.net, tseem nyob. Qhov no mail.yandex.net tsis tau txais kev txhawb nqa lawm, kev txhim kho cov peev txheej tsis tau faib rau nws, tab sis nws tseem siv cov ntaub ntawv. Raws li, siv cov ntawv qub, koj tuaj yeem siv cov peev txheej ntawm lub backend thiab txhua yam uas nyob tom qab qhov teeb tsa. Tau kawg, qhov no tsis yog ib txwm tshwm sim, tab sis peb tseem ntsib qhov no ntau zaus.
Lawm, peb txheeb xyuas tag nrho cov kev thov tsis thiab cov qauv khoom qab zib. Koj tuaj yeem hais tias, pov tseg qee tus nqi rau hauv JSON array hauv lub ncuav qab zib, tsim ntau lub zes thiab ua kom cov peev txheej ua haujlwm rau lub sijhawm ntev tsis tsim nyog.
Nrhiav load
Thawj qhov uas los rau hauv siab thaum tshawb fawb ib lub xaib yog txhawm rau thauj cov ntaub ntawv, vim tias yuav luag txhua tus muaj kev tshawb nrhiav, thiab yuav luag txhua tus, hmoov tsis zoo, nws tsis muaj kev tiv thaiv zoo. Rau qee qhov laj thawj, cov neeg tsim khoom tsis them nyiaj txaus rau kev tshawb nrhiav. Tab sis muaj ib qho kev pom zoo ntawm no - koj yuav tsum tsis txhob thov ntawm tib hom, vim tias koj yuav ntsib caching, zoo li HTTP dej nyab.
Ua random queries rau lub database kuj tsis zoo ib yam. Nws yog qhov zoo dua los tsim cov npe ntawm cov lus tseem ceeb uas cuam tshuam rau kev tshawb nrhiav. Yog tias peb rov qab mus rau qhov piv txwv ntawm lub khw hauv online: cia peb hais tias qhov chaw muag tsheb log tsheb thiab tso cai rau koj los teeb tsa lub vojvoog ntawm lub log tsheb, hom tsheb thiab lwm yam tsis. Yog li ntawd, kev sib txuas ntawm cov lus muaj feem yuav yuam kom cov ntaub ntawv ua haujlwm hauv cov xwm txheej nyuaj.
Tsis tas li ntawd, nws tsim nyog siv pagination: nws yog qhov nyuaj dua rau kev tshawb nrhiav kom rov qab nplooj ntawv kawg ntawm cov txiaj ntsig tshawb fawb dua thawj zaug. Ntawd yog, nrog kev pab los ntawm pagination koj tuaj yeem ua rau me ntsis diversify lub load.
Cov piv txwv hauv qab no qhia txog kev tshawb nrhiav load. Nws tuaj yeem pom tau tias los ntawm thawj thib ob ntawm qhov kev sim ntawm qhov nrawm ntawm kaum qhov kev thov ib ob, lub xaib tau nqis mus thiab tsis teb.
Yog tsis muaj kev tshawb nrhiav?
Yog tias tsis muaj kev tshawb nrhiav, qhov no tsis txhais tau tias lub vev xaib tsis muaj lwm qhov chaw nkag tau yooj yim. Daim teb no yuav yog kev tso cai. Niaj hnub no, cov neeg tsim khoom nyiam ua cov hashes nyuaj los tiv thaiv tus ID nkag mus database los ntawm lub rooj zaum zaj sawv. Qhov no yog qhov zoo, tab sis xws li hashes siv ntau cov peev txheej CPU. Ib qho loj txaus ntawm kev tso cai tsis raug ua rau lub processor tsis ua haujlwm, thiab vim li ntawd, lub xaib tsis ua haujlwm.
Lub xub ntiag nyob rau ntawm qhov chaw ntawm txhua hom ntawv rau cov lus pom thiab tawm tswv yim yog vim li cas thiaj xa cov ntawv loj heev nyob ntawd lossis tsuas yog tsim kom muaj dej nyab loj heev. Qee zaum cov chaw txais cov ntaub ntawv txuas, suav nrog hauv gzip hom. Hauv qhov no, peb muab 1TB cov ntaub ntawv, compress nws mus rau ob peb bytes lossis kilobytes siv gzip thiab xa mus rau qhov chaw. Tom qab ntawd nws yog unzipped thiab tau txais txiaj ntsig zoo heev.
So API
Kuv xav them me ntsis rau cov kev pabcuam nrov xws li Rest API. Kev ruaj ntseg rau So API yog qhov nyuaj dua li lub vev xaib tsis tu ncua. Txawm tias tsis tseem ceeb txoj kev tiv thaiv tus password brute quab yuam thiab lwm yam kev ua txhaum cai tsis ua haujlwm rau Rest API.
Lub Rest API yog qhov yooj yim heev rau kev tawg vim nws nkag mus rau cov ntaub ntawv ncaj qha. Nyob rau tib lub sijhawm, qhov tsis ua haujlwm ntawm qhov kev pabcuam no ua rau muaj kev cuam tshuam loj heev rau kev lag luam. Qhov tseeb yog tias Rest API feem ntau yog siv tsis yog rau lub vev xaib tseem ceeb xwb, tab sis kuj rau daim ntawv thov mobile thiab qee qhov kev lag luam sab hauv. Thiab yog hais tias tag nrho cov no ntog, ces cov nyhuv muaj zog ntau dua nyob rau hauv cov ntaub ntawv ntawm ib tug yooj yim lub website tsis ua hauj lwm.
Thauj khoom hnyav
Yog tias peb tau muab los sim qee daim ntawv thov ib nplooj ntawv ib zaug, nplooj ntawv tsaws, lossis lub vev xaib ua lag luam uas tsis muaj kev ua haujlwm nyuaj, peb nrhiav cov ntsiab lus hnyav. Piv txwv li, cov duab loj uas cov neeg rau zaub mov xa tuaj, cov ntaub ntawv binary, cov ntaub ntawv pdf - peb sim rub tawm tag nrho cov no. Cov kev ntsuam xyuas zoo li no thauj cov ntaub ntawv kaw lus zoo thiab txhaws cov channel, thiab yog li ntawd muaj txiaj ntsig zoo. Ntawd yog, txawm tias koj tsis tso cov neeg rau zaub mov, rub tawm cov ntaub ntawv loj ntawm qhov nrawm qis, koj tsuas yog txhaws cov channel ntawm lub hom phiaj server thiab tom qab ntawd qhov kev tsis lees paub yuav tshwm sim.
Ib qho piv txwv ntawm qhov kev sim no qhia tau hais tias ntawm qhov nrawm ntawm 30 RPS lub vev xaib nres teb lossis tsim 500th server yuam kev.
Tsis txhob hnov qab txog kev teeb tsa servers. Koj tuaj yeem pom tau tias ib tus neeg yuav lub tshuab virtual, nruab Apache nyob ntawd, teeb tsa txhua yam los ntawm lub neej ntawd, nruab ib daim ntawv thov PHP, thiab hauv qab no koj tuaj yeem pom qhov tshwm sim.
Ntawm no cov load tau mus rau hauv paus thiab tus nqi tsuas yog 10 RPS. Peb tos 5 feeb thiab lub server poob. Nws yog qhov tseeb tias nws tsis paub meej tias vim li cas nws poob, tab sis muaj qhov kev xav tias nws tsuas muaj ntau lub cim xeeb thiab yog li ntawd tsis teb.
Wave raws
Hauv xyoo dhau los lossis ob xyoos dhau los, yoj tawm tsam tau dhau los ua neeg nyiam heev. Qhov no yog vim qhov tseeb tias ntau lub koom haum yuav qee yam khoom siv rau kev tiv thaiv DDoS, uas yuav tsum muaj qee lub sijhawm los sau cov txheeb cais los pib lim qhov kev tawm tsam. Ntawd yog, lawv tsis lim qhov kev tawm tsam thawj 30-40 vib nas this, vim tias lawv khaws cov ntaub ntawv thiab kawm. Raws li, hauv 30-40 vib nas this koj tuaj yeem tso tawm ntau heev ntawm qhov chaw uas cov peev txheej yuav dag rau lub sijhawm ntev kom txog thaum txhua qhov kev thov raug tshem tawm.
Nyob rau hauv cov ntaub ntawv ntawm kev tawm tsam hauv qab no, muaj ib ntus ntawm 10 feeb, tom qab ntawd ib qho tshiab, hloov kho ntawm qhov kev tawm tsam tuaj txog.
Ntawd yog, kev tiv thaiv tau kawm, pib lim, tab sis qhov tshiab, sib txawv kiag li ntawm qhov kev tawm tsam tuaj txog, thiab kev tiv thaiv pib kawm dua. Qhov tseeb, kev lim dej tsis ua haujlwm, kev tiv thaiv yuav tsis ua haujlwm, thiab lub xaib tsis muaj.
Wave tawm tsam yog tus cwj pwm los ntawm cov txiaj ntsig siab heev ntawm lub ncov, nws tuaj yeem ncav cuag ib puas txhiab lossis ib lab thov ib ob, nyob rau hauv rooj plaub ntawm L7. Yog tias peb tham txog L3 & 4, ces tuaj yeem muaj ntau pua gigabits ntawm kev khiav tsheb, lossis, raws li, ntau pua mpps, yog tias koj suav hauv pob ntawv.
Qhov teeb meem nrog xws li kev tawm tsam yog synchronization. Kev tawm tsam los ntawm botnet thiab xav kom muaj kev sib koom ua ke los tsim kom muaj kev sib tw loj heev. Thiab qhov kev sib koom tes no tsis yog ib txwm ua haujlwm: qee zaum cov zis yog qee yam ntawm parabolic ncov, uas zoo li tsis zoo.
Tsis yog HTTP ib leeg
Ntxiv rau HTTP ntawm L7, peb nyiam siv lwm cov kev cai. Raws li txoj cai, lub vev xaib tsis tu ncua, tshwj xeeb tshaj yog cov hosting tsis tu ncua, muaj cov txheej txheem xa ntawv thiab MySQL tawm. Cov kev cai xa ntawv yuav raug thauj tsawg dua li cov ntaub ntawv, tab sis lawv kuj tuaj yeem thauj khoom tau zoo thiab xaus nrog lub CPU overloaded ntawm lub server.
Peb qhov tseeb tiag tau ua tiav nrog 2016 SSH qhov tsis zoo. Tam sim no qhov tsis zoo no tau raug kho rau yuav luag txhua tus, tab sis qhov no tsis tau txhais hais tias kev thauj khoom tsis tuaj yeem xa mus rau SSH. Ua tau. Muaj tsuas yog ib qho loj loj ntawm kev tso cai, SSH noj yuav luag tag nrho CPU ntawm lub server, thiab tom qab ntawd lub vev xaib poob los ntawm ib lossis ob qhov kev thov ib ob. Raws li qhov no, ib lossis ob qhov kev thov raws li lub cav tsis tuaj yeem raug cais tawm ntawm qhov raug cai.
Ntau qhov kev sib txuas uas peb qhib hauv servers kuj tseem cuam tshuam. Yav dhau los, Apache tau ua txhaum ntawm qhov no, tam sim no nginx tau ua txhaum ntawm qhov no, vim nws feem ntau teeb tsa los ntawm lub neej ntawd. Tus naj npawb ntawm cov kev sib txuas uas nginx tuaj yeem qhib tau txwv, yog li peb qhib cov kev sib txuas no, nginx tsis lees txais kev sib txuas tshiab, thiab vim li ntawd lub xaib tsis ua haujlwm.
Peb pawg xeem muaj CPU txaus los tua SSL tuav tes. Raws li txoj cai, raws li kev xyaum qhia, botnets qee zaum nyiam ua qhov no thiab. Ntawm ib sab, nws yog qhov tseeb tias koj tsis tuaj yeem ua yam tsis muaj SSL, vim tias Google cov txiaj ntsig, qeb duas, kev ruaj ntseg. Ntawm qhov tod tes, SSL hmoov tsis muaj qhov teeb meem CPU.
L3 & 4
Thaum peb tham txog kev tawm tsam ntawm qib L3 & 4, peb feem ntau hais txog kev tawm tsam ntawm qib txuas. Xws li lub nra yuav luag txhua qhov txawv ntawm qhov raug cai, tshwj tsis yog tias nws yog SYN- dej nyab. Qhov teeb meem nrog SYN-kev tawm tsam dej nyab rau cov cuab yeej ruaj ntseg yog lawv cov ntim loj. Qhov siab tshaj plaws L3 & 4 tus nqi yog 1,5-2 Tbit / s. Hom kev khiav tsheb no nyuaj heev rau kev ua haujlwm txawm tias cov tuam txhab loj, suav nrog Oracle thiab Google.
SYN thiab SYN-ACK yog pob khoom siv thaum tsim kev sib txuas. Yog li ntawd, SYN- dej nyab yog qhov nyuaj rau kev paub qhov txawv ntawm qhov raug cai thauj khoom: nws tsis paub meej tias qhov no yog SYN uas tuaj yeem tsim kev sib txuas, lossis ib feem ntawm dej nyab.
UDP- dej nyab
Feem ntau, cov neeg tawm tsam tsis muaj peev xwm uas peb muaj, yog li kev nthuav dav tuaj yeem siv los npaj kev tawm tsam. Ntawd yog, tus neeg tawm tsam scans hauv Is Taws Nem thiab pom tias muaj qhov tsis zoo lossis tsis raug teeb tsa servers uas, piv txwv li, teb rau ib pob ntawv SYN, teb nrog peb SYN-ACKs. Los ntawm spoofing qhov chaw nyob los ntawm qhov chaw nyob ntawm lub hom phiaj neeg rau zaub mov, nws muaj peev xwm nce lub zog los ntawm, hais, peb zaug nrog ib pob ntawv thiab redirect tsheb mus rau tus neeg raug tsim txom.
Qhov teeb meem nrog amplifications yog tias lawv tsis yooj yim rau kev txheeb xyuas. Cov piv txwv tsis ntev los no suav nrog cov xwm txheej zoo siab ntawm qhov yooj yim memcached. Ntxiv rau, tam sim no muaj ntau yam khoom siv IoT, IP koob yees duab, uas feem ntau yog teeb tsa los ntawm lub neej ntawd, thiab los ntawm lub neej ntawd lawv tau teeb tsa tsis raug, uas yog vim li cas cov neeg tawm tsam feem ntau ua rau muaj kev tawm tsam los ntawm cov khoom siv zoo li no.
Nyuaj SYN- dej nyab
SYN- dej nyab yog tej zaum yog hom kev tawm tsam tshaj plaws los ntawm tus tsim tawm qhov kev xav. Qhov teeb meem yog tias cov thawj tswj hwm feem ntau siv IP thaiv kev tiv thaiv. Tsis tas li ntawd, kev thaiv IP cuam tshuam tsis yog tsuas yog cov thawj coj ua haujlwm uas siv cov ntawv sau, tab sis kuj, hmoov tsis, qee qhov kev ruaj ntseg uas tau yuav nyiaj ntau.
Txoj kev no tuaj yeem ua rau muaj kev puas tsuaj, vim tias yog cov neeg tawm tsam hloov chaw nyob IP, lub tuam txhab yuav thaiv nws tus kheej subnet. Thaum Firewall thaiv nws tus kheej pawg, cov zis yuav ua tsis tiav kev cuam tshuam sab nraud thiab cov peev txheej yuav poob.
Ntxiv mus, nws tsis yooj yim rau thaiv koj tus kheej network. Yog tias tus neeg siv khoom lub chaw ua haujlwm muaj Wi-nkaus network, lossis yog tias qhov kev ua tau zoo ntawm cov peev txheej raug ntsuas los ntawm kev siv ntau yam kev saib xyuas, ces peb muab qhov chaw nyob IP ntawm qhov kev tshuaj xyuas no lossis tus neeg siv lub chaw ua haujlwm Wi-Fi thiab siv los ua qhov chaw. Thaum kawg, cov peev txheej zoo li muaj, tab sis lub hom phiaj IP chaw nyob raug thaiv. Yog li, Wi-Fi network ntawm HighLoad lub rooj sib tham, qhov twg lub tuam txhab cov khoom tshiab tau nthuav tawm, tej zaum yuav raug thaiv, thiab qhov no suav nrog qee cov nqi lag luam thiab kev lag luam.
Thaum lub sij hawm sim, peb tsis tuaj yeem siv kev nthuav dav los ntawm memcached nrog cov peev txheej sab nraud, vim tias muaj kev pom zoo xa tsheb mus rau kev tso cai IP chaw nyob nkaus xwb. Raws li, peb siv amplification los ntawm SYN thiab SYN-ACK, thaum lub kaw lus teb xa ib SYN nrog ob los yog peb SYN-ACKs, thiab ntawm qhov tso zis tawm tsam yog multiplied los ntawm ob los yog peb zaug.
Cov cuab yeej
Ib qho ntawm cov cuab yeej tseem ceeb uas peb siv rau L7 ua haujlwm yog Yandex-tank. Tshwj xeeb, phantom yog siv los ua phom, ntxiv rau muaj ntau cov ntawv sau rau kev tsim cov cartridges thiab rau kev txheeb xyuas cov txiaj ntsig.
Tcpdump yog siv los txheeb xyuas cov tsheb khiav hauv network, thiab Nmap yog siv los txheeb xyuas cov server. Txhawm rau tsim cov khoom thauj ntawm qib L3 & 4, OpenSSL thiab me ntsis ntawm peb tus kheej cov khawv koob nrog lub tsev qiv ntawv DPDK tau siv. DPDK yog lub tsev qiv ntawv los ntawm Intel uas tso cai rau koj ua haujlwm nrog lub network sib cuam tshuam hla Linux pawg, yog li ua kom muaj txiaj ntsig zoo. Lawm, peb siv DPDK tsis yog nyob rau theem L3 & 4 xwb, tab sis kuj nyob rau theem L7, vim tias nws tso cai rau peb los tsim kom muaj kev thauj khoom siab heev, nyob rau thaj tsam ntawm ntau lab thov ib ob ntawm ib lub tshuab.
Peb kuj siv qee lub tshuab hluav taws xob tsheb thiab cov cuab yeej tshwj xeeb uas peb sau rau cov kev xeem tshwj xeeb. Yog tias peb nco qab qhov tsis txaus ntseeg hauv SSH, ces cov txheej txheem saum toj no tsis tuaj yeem siv tau. Yog tias peb tawm tsam cov txheej txheem xa ntawv, peb siv cov khoom siv xa ntawv lossis tsuas yog sau ntawv rau lawv.
tshawb pom
Raws li qhov xaus kuv xav hais tias:
- Ntxiv nrog rau kev ntsuas kev thauj khoom classic, nws yog qhov yuav tsum tau ua kev ntsuas kev ntxhov siab. Peb muaj ib qho piv txwv tiag tiag uas tus khub tus neeg ua haujlwm ua haujlwm tsuas yog ua qhov kev sim thauj khoom. Nws tau pom tias cov peev txheej tuaj yeem tiv taus qhov qub load. Tab sis tom qab ntawd muaj qhov txawv txav tshwm sim, cov neeg tuaj saib hauv lub xaib pib siv cov peev txheej txawv me ntsis, thiab vim li ntawd tus neeg ua haujlwm subcontractor nteg. Yog li, nws tsim nyog nrhiav qhov tsis zoo txawm tias koj twb tau tiv thaiv los ntawm DDoS tawm tsam.
- Nws yog ib qho tsim nyog yuav tsum cais qee qhov ntawm qhov system ntawm lwm tus. Yog tias koj muaj kev tshawb nrhiav, koj yuav tsum tau txav mus rau cov tshuab cais, uas yog, tsis yog rau Docker. Vim tias yog kev tshawb nrhiav lossis kev tso cai ua tsis tiav, yam tsawg kawg ib yam yuav ua haujlwm ntxiv. Nyob rau hauv cov ntaub ntawv ntawm lub khw hauv online, cov neeg siv yuav txuas ntxiv mus nrhiav cov khoom hauv cov ntawv teev npe, mus los ntawm cov neeg sib sau ua ke, yuav yog tias lawv tau tso cai, lossis tso cai ntawm OAuth2.
- Tsis txhob tso tseg txhua yam kev pabcuam huab.
- Siv CDN tsis yog tsuas yog txhawm rau txhim kho lub network qeeb, tab sis kuj yog ib txoj hauv kev tiv thaiv kev tawm tsam ntawm cov channel qaug zog thiab tsuas yog dej nyab rau hauv kev khiav tsheb zoo li qub.
- Nws yog ib qho tsim nyog yuav tau siv cov kev pabcuam tshwj xeeb. Koj tsis tuaj yeem tiv thaiv koj tus kheej los ntawm L3 & 4 tawm tsam ntawm theem channel, vim tias koj feem ntau yuav tsis muaj channel txaus. Koj kuj tsis zoo li yuav tawm tsam L7 tawm tsam, vim lawv tuaj yeem loj heev. Ntxiv rau, kev tshawb nrhiav kev tawm tsam me me tseem yog qhov muaj txiaj ntsig ntawm cov kev pabcuam tshwj xeeb, tshwj xeeb algorithms.
- Hloov tshiab tsis tu ncua. Qhov no siv tsis tau rau cov ntsiav xwb, tab sis kuj rau SSH daemon, tshwj xeeb tshaj yog tias koj muaj lawv qhib rau sab nraud. Hauv txoj ntsiab cai, txhua yam yuav tsum tau hloov kho, vim tias koj tsis zoo li tuaj yeem taug qab qee qhov tsis zoo ntawm koj tus kheej.
Tau qhov twg los: www.hab.com