Zindikirani. transl.: Nkhaniyi ikupitirizabe mndandanda waukulu wa nkhani kuchokera kwa mlaliki waukadaulo wa AWS Adrian Hornsby, yemwe amafotokoza m'njira yosavuta komanso yomveka bwino kufunika koyesera kuchepetsa zotsatira za kulephera kwa machitidwe a IT.
"Ngati mukulephera kukonzekera pulani, ndiye kuti mukufuna kulephera." - Benjamin Franklin
В gawo loyamba M'nkhani zotsatizanazi, ndidayambitsa lingaliro la uinjiniya wa chipwirikiti ndikufotokozera momwe zimathandizire kupeza ndikuwongolera zolakwika m'dongosolo zisanachitike kulephera kupanga. Idakambirananso momwe uinjiniya wachisokonezo umathandizira kusintha kwachikhalidwe m'mabungwe.
Kumapeto kwa gawo loyamba, ndinalonjeza kuti ndidzalankhula za "zida ndi njira zobweretsera zolephera mu machitidwe." Tsoka, mutu wanga unali ndi zolinga zake pankhaniyi, ndipo m'nkhaniyi ndiyesera kuyankha funso lodziwika kwambiri lomwe limakhalapo pakati pa anthu omwe akufuna kulowa muumisiri wachisokonezo: Choyenera kuswa choyamba?
Funso lalikulu! Komabe, sakuwoneka kuti akuvutitsidwa kwambiri ndi panda uyu ...
Yang'anani mbiri ya ngozi ndi kuzindikira mapangidwe;
Sankhani kudalira kwambiri;
Gwiritsani otchedwa kudzidalira mopambanitsa.
Ndizoseketsa, koma gawo ili likhoza kutchedwa mosavuta "Ulendo Wodzipezera Wekha ndi Kuzindikira". Mmenemo tidzayamba "kusewera" ndi zida zina zozizira.
Ngati simukuidziwa bwino nambala ya pulogalamu yanu kapena yakhala yayikulu kwambiri, zitha kukhala zovuta kumvetsetsa zomwe codeyo imachita komanso kudalira kwake. Kumvetsetsa zodalira izi komanso momwe zingakhudzire kugwiritsa ntchito ndi ogwiritsa ntchito ndikofunikira kuti mudziwe komwe mungayambire ndi uinjiniya wachisokonezo: poyambira ndi gawo lomwe lili ndi radius yayikulu kwambiri.
Kuzindikira ndi kulemba zodalira kumatchedwa "kupanga mapu odalira» (kudalira mapu). Izi zimachitika makamaka pamapulogalamu omwe ali ndi ma code akuluakulu pogwiritsa ntchito zida zowonetsera ma code. (mbiri ya kodi) ndi zida (zida). Mutha kupanganso mapu powunika kuchuluka kwa ma network.
Mu AWS mungagwiritse ntchito zipika zoyenda (flow logs) VPC ndi njira yomwe imakulolani kusonkhanitsa zambiri za IP traffic kupita kapena kuchokera ku network interfaces mu VPC. Mitengo yotereyi ingathandizenso ndi ntchito zina - mwachitsanzo, kupeza yankho ku funso loti chifukwa chiyani magalimoto ena safika.
Mapu odalira pa netiweki ndi njira yochepa chabe. Inde, zikuwonetsa kuti ndi pulogalamu iti yomwe imalumikizana nayo, koma pali zodalira zina.
Mapulogalamu ambiri amagwiritsira ntchito DNS kuti agwirizane ndi zodalira, pamene ena angagwiritse ntchito kupeza ntchito kapena ma adilesi a IP olimba kwambiri pamafayilo osintha (mwachitsanzo. /etc/hosts).
Mwachitsanzo, mukhoza kupanga DNS yakuda ndi thandizo iptables ndikuwona zomwe zasweka. Kuti muchite izi, lowetsani lamulo ili:
Ngati /etc/hosts kapena mafayilo ena osinthira, mupeza ma adilesi a IP omwe simudziwa chilichonse (inde, mwatsoka, izi zimachitikanso), mutha kupulumutsanso. iptables. Tiyerekeze kuti mwapeza 8.8.8.8 ndipo sindikudziwa kuti iyi ndi adilesi ya seva ya Google ya DNS. Pogwiritsa ntchito iptables Mutha kuletsa magalimoto obwera ndi otuluka ku adilesiyi pogwiritsa ntchito malamulo awa:
❯ iptables -A INPUT -s 8.8.8.8 -j DROP -m comment --comment "Reject from 8.8.8.8"
❯ iptables -A OUTPUT -d 8.8.8.8 -j DROP -m comment --comment "Reject to 8.8.8.8"
Kutseka mwayi
Lamulo loyamba limagwetsa mapaketi onse kuchokera ku Google DNS yapagulu: ping amagwira ntchito, koma mapaketi sabwezeredwa. Lamulo lachiwiri limagwetsa mapaketi onse ochokera kudongosolo lanu kupita ku DNS yapagulu ya Google - poyankha ping timapeza Kugwira ntchito sikuloledwa.
Zindikirani: mu nkhani iyi zingakhale bwino kugwiritsa ntchito whois 8.8.8.8, koma ichi ndi chitsanzo chabe.
Titha kulowa pansi pa dzenje la kalulu, chifukwa chilichonse chomwe chimagwiritsa ntchito TCP ndi UDP chimadaliranso IP. Nthawi zambiri, IP imalumikizidwa ndi ARP. Musaiwale za ma firewall ...
Mukamwa mapiritsi ofiira, mumakhala ku Wonderland, ndipo ndikuwonetsani kuya kwa dzenje la kalulu."
Njira yowonjezereka ndiyo ku kusagwirizana magalimoto imodzi ndi imodzi ndikuwona zomwe zasweka ... kukhala "nyani wachisokonezo." Zachidziwikire, machitidwe ambiri opanga sanapangidwe kuti aziwukira mwankhanza, koma amatha kuyesedwa pamalo oyeserera.
Kupanga mapu odalirana nthawi zambiri ndi ntchito yayitali kwambiri. Posachedwa ndidalankhula ndi kasitomala yemwe adakhala pafupifupi zaka 2 ndikupanga chida chomwe chimapanga mamapu odalira mazana a ma microservices ndi malamulo.
Zotsatira zake, komabe, ndizosangalatsa komanso zothandiza. Muphunzira zambiri za dongosolo lanu, kudalira kwake ndi ntchito zake. Apanso, khalani oleza mtima: ndi ulendo womwewo womwe ndi wofunika kwambiri.