{"id":91364,"date":"2020-08-12T07:42:33","date_gmt":"2020-08-12T05:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes"},"modified":"2020-08-12T07:42:33","modified_gmt":"2020-08-12T05:42:33","slug":"izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","title":{"rendered":"Examin\u0103m (lipsa) securit\u0103\u021bii uzualelor instal\u0103ri Docker \u0219i Kubernetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Examin\u0103m
\nLucrez \u00een IT de peste 20 de ani, dar p\u00e2n\u0103 acum nu am avut ocazia s\u0103 m\u0103 ocup cu containerele. Teoretic, \u00een\u021belegeam cum func\u021bioneaz\u0103 \u0219i care sunt conceptele de baz\u0103. Dar, deoarece nu am avut experien\u021b\u0103 practic\u0103 cu ele, nu eram sigur cum func\u021bioneaz\u0103 toate componentele lor interne. <\/p>\n

<\/p>\n

\u00cen plus, nu aveam nicio idee despre securitatea lor. Din nou, teoria suna bine, dar vechea zical\u0103 \u201epe m\u0103sur\u0103 ce cre\u0219te securitatea, scade u\u0219urin\u021ba utiliz\u0103rii\u201d \u00eemi st\u0103tea \u00een minte. A\u0219a c\u0103 m-am g\u00e2ndit c\u0103 dac\u0103 este at\u00e2t de simplu s\u0103 lucrezi cu containere, atunci securitatea este sub nivelul acceptabil. Se pare c\u0103 aveam dreptate.<\/p>\n

<\/a><\/noindex><\/p>\n

Pentru un \u00eenceput rapid, m-am \u00eenscris la cursuri Black Hat<\/a><\/noindex> 2020 intitulat\u0103 \u201eDin mizerie \u00een noble\u021be: penetrarea \u0219i protec\u021bia mediilor Docker Swarm \u0219i Kubernetes<\/a><\/noindex>\u00bb. <\/p>\n

<\/p>\n

Cursul, condus de Sheila A. Berta \u0219i Sol Ozzan, a \u00eenceput imediat cu o descriere a modului \u00een care func\u021bioneaz\u0103 containerele Docker \u0219i parcursul lor \u00een cadrul Kubernetes. A fost o sesiune complet practic\u0103 \u2014 studen\u021bii trebuiau s\u0103 instaleze Docker \u0219i microk8s pe ma\u0219inile lor \u00eenainte de cursuri \u2014 o modalitate excelent\u0103 de a observa interac\u021biunea instrumentelor, de a identifica punctele slabe \u0219i, ceea ce este cel mai important, de a \u00eencerca s\u0103 le securiz\u0103m.<\/p>\n

<\/p>\n

Din p\u0103cate, de\u0219i cursurile promiteau s\u0103 te transforme \u00een \u201enobil\u201d \u00een doar dou\u0103 zile, sim\u021beam c\u0103 abia \u00eencepe \u0219i c\u0103 mai am multe de \u00eenv\u0103\u021bat.<\/p>\n

<\/p>\n

\"Examin\u0103m<\/p>\n

<\/p>\n

\u00cenainte de a-mi prezenta observa\u021biile, este important s\u0103 explic ce este un container. \u00cen lumea dezvolt\u0103rii, este considerat normal ca un cod scris pe ma\u0219ina personal\u0103 s\u0103 func\u021bioneze perfect, dar c\u00e2nd \u00eencerci s\u0103-l rulezi pe un server \u2014 pur \u0219i simplu nu func\u021bioneaz\u0103. Containerele \u00eencearc\u0103 s\u0103 dep\u0103\u0219easc\u0103 aceast\u0103 problem\u0103 oferind ma\u0219ini autonome, pe care le po\u021bi transporta u\u0219or de pe un server pe altul, \u0219tiind c\u0103 vor func\u021biona \u00eentotdeauna. A\u0219a cum sugereaz\u0103 numele, ele con\u021bin cod, biblioteci \u0219i alte software-uri necesare pentru func\u021bionare. Kubernetes, pe de alt\u0103 parte, este o platform\u0103 de orchestrare pentru containere<\/a><\/noindex>. Practic, cu ajutorul s\u0103u, po\u021bi gestiona f\u0103r\u0103 probleme sute sau mii de containere diferite.<\/p>\n

<\/p>\n

Mai jos sunt c\u00e2teva dintre concluziile mele din perspectiva echipelor ro\u0219ii \u0219i albastre.<\/p>\n

<\/p>\n

Echipa ro\u0219ie<\/h2>\n

<\/p>\n

Cea mai mare parte a con\u021binutului containerelor ruleaz\u0103 sub root<\/strong>: aceasta \u00eenseamn\u0103 c\u0103, dac\u0103 compromiti un container, vei ob\u021bine acces complet la acesta. Acest lucru face ca pa\u0219ii urm\u0103tori s\u0103 fie semnificativ mai u\u0219or de realizat.<\/p>\n

<\/p>\n

Montarea docker.sock \u00een interiorul unui container este periculoas\u0103<\/strong>: dac\u0103 ai ob\u021binut root \u00een interiorul containerului \u0219i ai instalat, de asemenea, Docker \u00een interiorul unui container care are socketul Docker (\\\/var\\\/run\\\/docker.sock), ai o oportunitate poten\u021bial\u0103 de a explora \u00eentregul cluster, inclusiv accesul la orice alt container. Un astfel de acces nu poate fi prevenit nici prin izolare de re\u021bea, nici prin alte metode.<\/p>\n

<\/p>\n

Variabilele de mediu con\u021bin adesea date secrete<\/strong>: \u00een majoritatea cazurilor, oamenii trimit parole \u00een container folosind variabile de mediu obi\u0219nuite. A\u0219adar, dac\u0103 ai acces la cont, po\u021bi spiona aceste variabile de mediu pentru a-\u021bi extinde ulterior privilegii.<\/p>\n

<\/p>\n

API-ul Docker poate oferi o mul\u021bime de informa\u021bii<\/strong>: API-ul Docker, configurat implicit, func\u021bioneaz\u0103 f\u0103r\u0103 autorizare \u0219i poate oferi o mul\u021bime de informa\u021bii. Folosind Shodan, este u\u0219or s\u0103 g\u0103se\u0219ti o list\u0103 de porturi deschise, apoi s\u0103 ob\u021bii informa\u021bii detaliate despre cluster \u2014 \u0219i s\u0103 ajungi la capturarea complet\u0103 a acestuia. TrendMicro a scris un articol foarte interesant<\/a><\/noindex>.<\/p>\n

<\/p>\n

Echipa albastr\u0103<\/h2>\n

<\/p>\n

Nu rula\u021bi con\u021binutul containerelor sub root<\/strong>: de\u0219i este mai simplu s\u0103 rula\u021bi sub root, nu ar trebui s\u0103 face\u021bi acest lucru. \u00cen schimb, rula\u021bi aplica\u021biile cu privilegii reduse, afi\u0219\u00e2nd uid-ul, fie folosind parametrul \u2014user c\u00e2nd lucra\u021bi cu CLI, fie specific\u00e2nd USER \u00een Dockerfile.<\/p>\n

<\/p>\n

Nu permite\u021bi instalarea de programe \u00een containere<\/strong>: aproape fiecare atac \u00eencepe prin instalarea a ceva. De la nmap \u0219i p\u00e2n\u0103 la ifconfig \u0219i Docker \u00eensu\u0219i (\u00een interiorul containerului), instalarea a ceva \u00een container a fost o practic\u0103 obi\u0219nuit\u0103. Din acest motiv, trebuie s\u0103 blochezi toate por\u021bile neutilizate. Acest lucru ajut\u0103, de asemenea, la prevenirea transmiterii comenzilor de control \u00een cazul infect\u0103rii ma\u0219inii tale. Pe l\u00e2ng\u0103 prevenirea instal\u0103rii programelor, ar trebui s\u0103 te asiguri c\u0103 \u00een container sunt instalate un num\u0103r minim de aplica\u021bii necesare pentru a \u00eendeplini sarcina.<\/p>\n

<\/p>\n

Proteja\u021bi docker.sock<\/strong>: trebuie protejat, deoarece prin acest socket se gestioneaz\u0103 comunica\u021bia \u00eentre container \u0219i cluster. Deoarece nu vreau s\u0103 intru \u00een detalii \u00een acest articol, cite\u0219te nota de la Docker<\/a><\/noindex>, ce poate s\u0103 se \u00eent\u00e2mple, precum \u0219i cum s\u0103 blochezi totul.<\/p>\n

<\/p>\n

Folosi\u021bi secretele Docker \u00een loc de variabile de mediu<\/strong>: Exist\u0103 secrete aproximativ din 2017<\/a><\/noindex>. De\u0219i nu este sigur, este totu\u0219i mai bine dec\u00e2t variabilele de mediu pentru a transmite date sensibile \u00een containere.<\/p>\n

<\/p>\n

Dac\u0103 articolul v-a st\u00e2rnit interesul pentru containere, pute\u021bi instala destul de u\u0219or Docker sau microk8s (o versiune mic\u0103 de Kubernetes). Aici<\/a><\/noindex> exist\u0103 instruc\u021biuni pentru instalarea Docker pe Linux \u0219i MacOS, iar aici<\/a><\/noindex> \u2014 instruc\u021biuni pentru instalarea microk8s pe Windows, Linux \u0219i MacOS.<\/p>\n

<\/p>\n

Dup\u0103 instalare, pute\u021bi urm\u0103ri acest ghid de ini\u021biere rapid\u0103<\/a><\/noindex> de la Docker, o variant\u0103 similar\u0103 se ofer\u0103<\/a><\/noindex> \u0219i pentru microk8s.<\/p>\n

<\/p>\n

Dac\u0103 ave\u021bi dorin\u021ba sau necesitatea de a urma un curs complet de Docker, \u00een care vorbitorii practici discut\u0103 despre toate instrumentele sale: de la abstrac\u021bii de baz\u0103 p\u00e2n\u0103 la op\u021biunile de re\u021bea, nuan\u021bele func\u021bion\u0103rii cu diferite sisteme de operare \u0219i limbaje de programare, atunci \u00eencerca\u021bi \u201eCurs video despre Docker<\/a><\/noindex>\u201d. V\u0103 ve\u021bi familiariza cu tehnologia \u0219i ve\u021bi \u00een\u021belege unde \u0219i cum este mai bine s\u0103 folosi\u021bi Docker. \u00cen acela\u0219i timp, ve\u021bi ob\u021bine cazuri de best practice \u2014 este mai bine s\u0103 \u00eenv\u0103\u021ba\u021bi \u00eentr-un mediu sigur \u0219i cu suportul practicienilor, baz\u00e2ndu-v\u0103 pe pove\u0219ti despre gre\u0219eli, dec\u00e2t pe propriile gre\u0219eli cu m\u00e2neri \u00een\u021bepate.<\/p>\n

Sursa: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f \u0440\u0430\u0431\u043e\u0442\u0430\u044e \u0432 IT \u0431\u043e\u043b\u044c\u0448\u0435 20 \u043b\u0435\u0442, \u043d\u043e \u043a\u0430\u043a-\u0442\u043e \u0440\u0443\u043a\u0438 \u043d\u0435 \u0434\u043e\u0445\u043e\u0434\u0438\u043b\u0438 \u0434\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0412 \u0442\u0435\u043e\u0440\u0438\u0438 \u044f \u043f\u043e\u043d\u0438\u043c\u0430\u043b, \u043a\u0430\u043a \u043e\u043d\u0438 \u0443\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u0438 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442. \u041d\u043e \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044f \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u0441 \u043d\u0438\u043c\u0438 \u043d\u0435 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0441\u044f \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u2014 \u044f \u043d\u0435 \u0431\u044b\u043b \u0443\u0432\u0435\u0440\u0435\u043d \u0432 \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u043a\u0440\u0443\u0442\u044f\u0442\u0441\u044f-\u0432\u0435\u0440\u0442\u044f\u0442\u0441\u044f \u0443 \u043d\u0438\u0445 \u0448\u0435\u0441\u0442\u0435\u0440\u0451\u043d\u043a\u0438 \u043f\u043e\u0434 \u043a\u0430\u043f\u043e\u0442\u043e\u043c. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u044f \u0431\u044b\u043b \u0431\u0435\u0437 \u043f\u043e\u043d\u044f\u0442\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91365,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91364","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Explor\u0103m (lipsa) securit\u0103\u021bii instala\u021biilor tipice Docker \u0219i Kubernetes | ProHoster","description":"Lucrez \u00een IT.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437\u0443\u0447\u0430\u0435\u043c (\u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0443\u044e) \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0442\u0438\u043f\u0438\u0447\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a Docker \u0438 Kubernetes | ProHoster","og:description":"\u042f \u0440\u0430\u0431\u043e\u0442\u0430\u044e \u0432 IT.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-12T05:42:33+00:00","article:modified_time":"2020-08-12T05:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91364","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:29:22","updated":"2022-09-28 18:39:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/91364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=91364"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/91364\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/91365"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=91364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=91364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=91364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}