{"id":81884,"date":"2020-05-17T13:42:18","date_gmt":"2020-05-17T11:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity"},"modified":"2020-05-17T13:42:18","modified_gmt":"2020-05-17T11:42:18","slug":"bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","title":{"rendered":"Bezpe\u010dnos\u0165 a DBMS: na \u010do pam\u00e4ta\u0165 pri v\u00fdbere ochrann\u00fdch prostriedkov","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h1><img decoding=\"async\" alt=\"Bezpe\u010dnos\u0165 a DBMS: na \u010do pam\u00e4ta\u0165 pri v\u00fdbere ochrann\u00fdch prostriedkov\" src=\"\/wp-content\/uploads\/2020\/05\/ac49253838e36336af127d71394139d8.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/h1>\n<p>\nVol\u00e1m sa Denis Ro\u017ekov, som ved\u00faci v\u00fdvoja softv\u00e9ru v spolo\u010dnosti \u201eGazinformservis\u201c, v produktovom t\u00edme <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\">Jatoba<\/a><\/noindex>. Z\u00e1konodarstvo a firemn\u00e9 normy ukladaj\u00fa ur\u010dit\u00e9 po\u017eiadavky na bezpe\u010dnos\u0165 ukladania \u00fadajov. Nikto nechce, aby k d\u00f4vern\u00fdm inform\u00e1ci\u00e1m mali pr\u00edstup tretie strany, a preto s\u00fa pre ak\u00fdko\u013evek projekt d\u00f4le\u017eit\u00e9 nasleduj\u00face ot\u00e1zky: identifik\u00e1cia a autentifik\u00e1cia, spr\u00e1va pr\u00edstupov k \u00fadajom, zabezpe\u010denie integrity inform\u00e1ci\u00ed v syst\u00e9me, registr\u00e1cia bezpe\u010dnostn\u00fdch udalost\u00ed. Chcel by som preto hovori\u0165 o niektor\u00fdch zauj\u00edmav\u00fdch aspektoch t\u00fdkaj\u00facich sa bezpe\u010dnosti DBMS. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n\u010cl\u00e1nok bol pripraven\u00fd na z\u00e1klade vyst\u00fapenia na <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup,<\/a><\/noindex> organizovanom <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/\">Mail.ru Cloud Solutions<\/a><\/noindex>. Ak nechcete \u010d\u00edta\u0165, m\u00f4\u017eete sa pozrie\u0165 na:<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"n-54j9FHaMU\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/n-54j9FHaMU\/hqdefault.jpg\" alt=\"Prehrajte video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\nV \u010dl\u00e1nku bud\u00fa tri \u010dasti:<\/p>\n<ul>\n<li>Ako chr\u00e1ni\u0165 pripojenia.<\/li>\n<li>\u010co je audit \u010dinnosti a ako zaznamen\u00e1va\u0165, \u010do sa deje zo strany datab\u00e1zy a pripojenia k nej.<\/li>\n<li>Ako chr\u00e1ni\u0165 \u00fadaje v samotnej datab\u00e1ze a ak\u00e9 technol\u00f3gie s\u00fa na to k dispoz\u00edcii.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Bezpe\u010dnos\u0165 a DBMS: na \u010do pam\u00e4ta\u0165 pri v\u00fdbere ochrann\u00fdch prostriedkov\" src=\"\/wp-content\/uploads\/2020\/05\/fbdca7f4a925b9ceb78de06c6e245b23.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tri zlo\u017eky bezpe\u010dnosti DBMS: ochrana pripojen\u00ed, audit \u010dinnost\u00ed a ochrana \u00fadajov<\/i><\/p>\n<h2>Ochrana pripojen\u00ed<\/h2>\n<p>\nK datab\u00e1ze sa m\u00f4\u017eete pripoji\u0165 priamo alebo nepriamo prostredn\u00edctvom webov\u00fdch aplik\u00e1ci\u00ed. Zvy\u010dajne pou\u017e\u00edvate\u013e z biznisu, teda osoba, ktor\u00e1 pracuje s DBMS, neinteraguje s \u0148ou priamo.<\/p>\n<p>Predt\u00fdm, ako budeme hovori\u0165 o ochrane pripojen\u00ed, mus\u00edme odpoveda\u0165 na d\u00f4le\u017eit\u00e9 ot\u00e1zky, od ktor\u00fdch z\u00e1vis\u00ed, ako bud\u00fa bezpe\u010dnostn\u00e9 opatrenia nastaven\u00e9:<\/p>\n<ul>\n<li>je rovn\u00fd jeden biznis pou\u017e\u00edvate\u013e jedn\u00e9mu pou\u017e\u00edvate\u013eovi DBMS;<\/li>\n<li>je zabezpe\u010den\u00fd pr\u00edstup k \u00fadajom DBMS len cez API, ktor\u00e9 kontrolujete, alebo existuje pr\u00edstup k tabu\u013ek\u00e1m priamo;<\/li>\n<li>je DBMS vy\u010dlenen\u00e1 do samostatn\u00e9ho chr\u00e1nen\u00e9ho segmentu, kto a ako s n\u00edm interaguje;<\/li>\n<li>pou\u017e\u00edva sa pooling\/proxy a medzivrstvy, ktor\u00e9 m\u00f4\u017eu meni\u0165 inform\u00e1cie o tom, ako je pripojenie nastaven\u00e9 a kto pou\u017e\u00edva datab\u00e1zu.<\/li>\n<\/ul>\n<p>\nTeraz sa pozrime, ak\u00e9 n\u00e1stroje mo\u017eno pou\u017ei\u0165 na ochranu pripojen\u00ed:<\/p>\n<ol>\n<li>Pou\u017eite rie\u0161enia triedy database firewall. \u010eal\u0161ia vrstva ochrany, minim\u00e1lne, zv\u00fd\u0161i prieh\u013eadnos\u0165 toho, \u010do sa deje v DBMS, maxim\u00e1lne \u2014 budete m\u00f4c\u0165 zabezpe\u010di\u0165 dodato\u010dn\u00fa ochranu \u00fadajov.<\/li>\n<li>Pou\u017e\u00edvajte politiky hesiel. Ich uplatnenie z\u00e1vis\u00ed od toho, ako je va\u0161a architekt\u00fara postaven\u00e1. V ka\u017edom pr\u00edpade \u2014 jedno heslo v konfigura\u010dnom s\u00fabore webovej aplik\u00e1cie, ktor\u00e1 sa prip\u00e1ja k DBMS, nesta\u010d\u00ed na ochranu. Existuje nieko\u013eko n\u00e1strojov DBMS, ktor\u00e9 umo\u017e\u0148uj\u00fa kontrolova\u0165, ako a kedy sa m\u00e1 aktualizova\u0165 pou\u017e\u00edvate\u013esk\u00e9 meno a heslo.\n<p>Pre\u010d\u00edtajte si viac o funkci\u00e1ch hodnotenia pou\u017e\u00edvate\u013eov. <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.cloud.oracle.com\/en-us\/iaas\/data-safe\/doc\/user-assessment-reports.html\">tu<\/a><\/noindex>, rovnako ako o MS SQL Vulnerability Assessment sa d\u00e1 dozvedie\u0165. <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.microsoft.com\/en-us\/sql\/relational-databases\/security\/sql-vulnerability-assessment?view=sql-server-ver15\">tu<\/a><\/noindex>.\u00a0<\/li>\n<li>Obohacujte kontext rel\u00e1cie potrebn\u00fdmi inform\u00e1ciami. Ak je rel\u00e1cia neprieh\u013eadn\u00e1, nemus\u00edte ch\u00e1pa\u0165, kto v jej r\u00e1mci pracuje s DBMS, a m\u00f4\u017eete doplni\u0165 inform\u00e1cie o tom, kto, \u010do a pre\u010do rob\u00ed. Tieto inform\u00e1cie m\u00f4\u017eete vidie\u0165 v audite.<\/li>\n<li>Nastavte SSL, ak nem\u00e1te sie\u0165ov\u00e9 rozdelenie DBMS od koncov\u00fdch pou\u017e\u00edvate\u013eov, ktor\u00e9 nie je v samostatnom VLAN. V tak\u00fdchto pr\u00edpadoch je nevyhnutn\u00e9 chr\u00e1ni\u0165 kan\u00e1l medzi spotrebite\u013eom a samotn\u00fdm DBMS. Ochrann\u00e9 n\u00e1stroje s\u00fa dostupn\u00e9 aj medzi open source.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Ak\u00fd vplyv to bude ma\u0165 na v\u00fdkon DBMS?<\/h3>\n<p>\nPozrieme sa na pr\u00edklad PostgreSQL, ako SSL ovplyv\u0148uje z\u00e1\u0165a\u017e CPU, zvy\u0161ovanie \u010dasov a zn\u00ed\u017eenie TPS, nezabudne sa, ak\u00e9 ve\u013ea zdrojov sa vynalo\u017e\u00ed pri jeho zapnut\u00ed.<\/p>\n<p>Zat\u011b\u017eujeme PostgreSQL pomocou pgbench \u2014 ide o jednoduch\u00fd program na sp\u00fa\u0161\u0165anie testov v\u00fdkonnosti. Opakovane vykon\u00e1va jednu sekvenciu pr\u00edkazov, mo\u017eno v paraleln\u00fdch datab\u00e1zov\u00fdch rel\u00e1ci\u00e1ch, a potom vypo\u010d\u00edta priemern\u00fa r\u00fdchlos\u0165 transakci\u00ed.<\/p>\n<p><strong>Test 1 bez SSL a s pou\u017eit\u00edm SSL<\/strong> \u2014 pripojenie sa vytv\u00e1ra pri ka\u017edej transakcii:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require \nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Test 2 bez SSL a s pou\u017eit\u00edm SSL<\/strong> \u2014 v\u0161etky transakcie sa vykon\u00e1vaj\u00fa v jednom pripojen\u00ed:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require\nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Ostatn\u00e9 nastavenia<\/strong>:<\/p>\n<pre><code class=\"plaintext\">faktor \u0161k\u00e1lovania: 1\nm\u00f3d dotazu: jednoduch\u00fd\npo\u010det klientov: 10\npo\u010det threadov: 1\npo\u010det transakci\u00ed na klienta: 5000\npo\u010det transakci\u00ed skuto\u010dne spracovan\u00fdch: 50000\/50000<\/code><\/pre>\n<p>\n<strong>V\u00fdsledky testovania<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>\u017dIADNE SSL<\/strong><br \/>\n<strong>SSL<\/strong><\/p>\n<p><strong>Pripojenie sa vytv\u00e1ra pri ka\u017edej transakcii.<\/strong><\/p>\n<p>priemern\u00e1 latencia<br \/>\n171.915 ms<br \/>\n187.695 ms<\/p>\n<p>tps vr\u00e1tane vytv\u00e1rania pripojen\u00ed<br \/>\n58.168112<br \/>\n53.278062<\/p>\n<p>tps bez vytv\u00e1rania pripojen\u00ed<br \/>\n64.084546<br \/>\n58.725846<\/p>\n<p>CPU<br \/>\n24%<br \/>\n28%<\/p>\n<p><strong>V\u0161etky transakcie sa vykon\u00e1vaj\u00fa v jednom pripojen\u00ed<\/strong><\/p>\n<p>priemern\u00e1 latencia<br \/>\n6.722 ms<br \/>\n6.342 ms<\/p>\n<p>tps vr\u00e1tane vytv\u00e1rania pripojen\u00ed<br \/>\n1587.657278<br \/>\n1576.792883<\/p>\n<p>tps bez vytv\u00e1rania pripojen\u00ed<br \/>\n1588.380574<br \/>\n1577.694766<\/p>\n<p>CPU<br \/>\n17%<br \/>\n21%<\/p>\n<p>\nPri n\u00edzkych za\u0165a\u017eeniach je vplyv SSL porovnate\u013en\u00fd s chybou merania. Ak je objem pren\u00e1\u0161an\u00fdch \u00fadajov ve\u013emi ve\u013ek\u00fd, situ\u00e1cia m\u00f4\u017ee by\u0165 in\u00e1. Ak vytv\u00e1rame jedno spojenie na ka\u017ed\u00fa transakciu (\u010do sa st\u00e1va zriedka, zvy\u010dajne sa spoje delia medzi pou\u017e\u00edvate\u013emi), po\u010det pripojen\u00ed\/odpojen\u00ed je vysok\u00fd, vplyv m\u00f4\u017ee by\u0165 o nie\u010do v\u00e4\u010d\u0161\u00ed. T\u00fdm p\u00e1dom m\u00f4\u017eu existova\u0165 rizik\u00e1 zn\u00ed\u017eenia v\u00fdkonu, av\u0161ak rozdiel nie je nato\u013eko ve\u013ek\u00fd, aby sa ochrana nemohla pou\u017ei\u0165.<\/p>\n<p>V\u0161imnite si \u2014 existuje v\u00fdrazn\u00fd rozdiel, ak porovn\u00e1vate re\u017eimy pr\u00e1ce: v r\u00e1mci jednej rel\u00e1cie pracujete alebo v r\u00f4znych. To je jasn\u00e9: na vytvorenie ka\u017ed\u00e9ho spojenia s\u00fa potrebn\u00e9 zdroje.<\/p>\n<p>Mali sme pr\u00edpad, ke\u010f sme pripojili Zabbix v re\u017eime d\u00f4very, to znamen\u00e1, \u017ee sme nekontrolovali md5 a autentifik\u00e1cia nebola potrebn\u00e1. N\u00e1sledne z\u00e1kazn\u00edk po\u017eiadal o zapnutie re\u017eimu md5 autentifik\u00e1cie. To vyvolalo ve\u013ek\u00e9 za\u0165a\u017eenie CPU, v\u00fdkon klesol. Za\u010dali sme h\u013eada\u0165 cesty na optimaliz\u00e1ciu. Jedn\u00fdm z mo\u017en\u00fdch rie\u0161en\u00ed probl\u00e9mu je implementova\u0165 sie\u0165ov\u00e9 obmedzenie, vytvori\u0165 pre DBMS samostatn\u00e9 VLAN, prida\u0165 nastavenia, aby bolo jasn\u00e9, kto a odkia\u013e sa prip\u00e1ja a odstr\u00e1ni\u0165 autentifik\u00e1ciu. Taktie\u017e je mo\u017en\u00e9 optimalizova\u0165 nastavenia autentifik\u00e1cie, aby sa zn\u00ed\u017eili n\u00e1klady pri zap\u00ednan\u00ed autentifik\u00e1cie, ale vo v\u0161eobecnosti m\u00e1 pou\u017eitie r\u00f4znych met\u00f3d autentifik\u00e1cie vplyv na v\u00fdkon a je potrebn\u00e9 zoh\u013eadni\u0165 tieto faktory pri navrhovan\u00ed v\u00fdpo\u010dtov\u00fdch v\u00fdkonov serverov (hardv\u00e9ru) pre DBMS.<\/p>\n<p>Z\u00e1ver: v niektor\u00fdch rie\u0161eniach m\u00f4\u017eu aj mal\u00e9 nuansy v autentifik\u00e1cii v\u00fdznamne ovplyvni\u0165 projekt a je zl\u00e9, ke\u010f sa to uk\u00e1\u017ee a\u017e pri nasaden\u00ed do produkcie.<\/p>\n<h2>Audit \u010dinnost\u00ed<\/h2>\n<p>\nAudit nemus\u00ed by\u0165 len DBMS. Audit je z\u00edskavanie inform\u00e1ci\u00ed o tom, \u010do sa deje na r\u00f4znych segmentoch. M\u00f4\u017ee to by\u0165 aj database firewall, aj opera\u010dn\u00fd syst\u00e9m, na ktorom je postaven\u00fd DBMS.<\/p>\n<p>V komer\u010dn\u00fdch DBMS \u00farovne Enterprise je audit v poriadku, v open source \u2014 nie v\u017edy. Tu s\u00fa mo\u017enosti v PostgreSQL:<\/p>\n<ul>\n<li>default log \u2014 vstavan\u00e9 logovanie;<\/li>\n<li>extensions: pgaudit \u2014 ak v\u00e1m ch\u00fdba predvolen\u00e9 logovanie, m\u00f4\u017eete vyu\u017ei\u0165 samostatn\u00e9 nastavenia, ktor\u00e9 rie\u0161ia \u010das\u0165 \u00faloh.<\/li>\n<\/ul>\n<p>\n<b>Doplnok k prezent\u00e1cii vo videu:<\/b><\/p>\n<p>Z\u00e1kladn\u00e1 registr\u00e1cia oper\u00e1torov m\u00f4\u017ee by\u0165 zabezpe\u010den\u00e1 \u0161tandardn\u00fdm n\u00e1strojom na vedenie denn\u00edka s log_statement = all.<\/p>\n<p>Je to prijate\u013en\u00e9 pre monitorovanie a in\u00e9 typy vyu\u017eitia, ale nezabezpe\u010duje \u00farove\u0148 detailov, ktor\u00e1 je zvy\u010dajne potrebn\u00e1 na audit.<\/p>\n<p>Nemo\u017eno ma\u0165 len zoznam v\u0161etk\u00fdch oper\u00e1ci\u00ed vykonan\u00fdch s datab\u00e1zou.<\/p>\n<p>Mus\u00ed existova\u0165 aj mo\u017enos\u0165 n\u00e1js\u0165 konkr\u00e9tne tvrdenia, ktor\u00e9 s\u00fa pre aud\u00edtora zauj\u00edmav\u00e9.<\/p>\n<p>\u0160tandardn\u00fd n\u00e1stroj na vedenie denn\u00edka ukazuje, \u010do pou\u017e\u00edvate\u013e po\u017eiadal, zatia\u013e \u010do pgAudit sa zameriava na detaily toho, \u010do sa stalo, ke\u010f datab\u00e1za vykonala dopyt.<\/p>\n<p>Napr\u00edklad aud\u00edtor m\u00f4\u017ee chcie\u0165 zabezpe\u010di\u0165, \u017ee konkr\u00e9tna tabu\u013eka bola vytvoren\u00e1 v zdokumentovanom okne \u00fadr\u017eby.<\/p>\n<p>M\u00f4\u017ee sa to zda\u0165 ako jednoduch\u00e1 \u00faloha pre z\u00e1kladn\u00fd audit a grep, ale \u010do ak naraz\u00edte na nie\u010do podobn\u00e9 (\u00famyselne zamotan\u00e9) pr\u00edklad:<\/p>\n<p>DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>\u0160tandardn\u00e9 vedenie denn\u00edka v\u00e1m d\u00e1 toto:<\/p>\n<p>LOG: statement: DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>Vyzer\u00e1 to, \u017ee pre h\u013eadanie zauj\u00edmavej tabu\u013eky m\u00f4\u017ee by\u0165 potrebn\u00e9 ur\u010dit\u00e9 poznanie k\u00f3du v pr\u00edpadoch, ke\u010f sa tabu\u013eky vytv\u00e1raj\u00fa dynamicky.<\/p>\n<p>Nie je to ide\u00e1lne, preto\u017ee by bolo lep\u0161ie jednoducho h\u013eada\u0165 pod\u013ea n\u00e1zvu tabu\u013eky.<\/p>\n<p>Tu prich\u00e1dza na pomoc pgAudit.<\/p>\n<p>Pre ten ist\u00fd vstup by poskytol tento v\u00fdstup do denn\u00edka:<\/p>\n<p>AUDIT: SESSION,33,1,FUNCTION,DO,,,'DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<br \/>\nAUDIT: SESSION,33,2,DDL,CREATE TABLE,TABLE,public.important_table,CREATE TABLE important_table (id INT)<\/p>\n<p>Zaznamen\u00e1va sa nielen blok DO, ale aj cel\u00fd text CREATE TABLE s typom oper\u00e1tora, typom objektu a cel\u00fdm menom, \u010do u\u013eah\u010duje h\u013eadanie.<\/p>\n<p>Pri veden\u00ed denn\u00edka oper\u00e1torov SELECT a DML m\u00f4\u017ee by\u0165 pgAudit nakonfigurovan\u00fd tak, aby zaznamen\u00e1val osobitn\u00fd z\u00e1znam pre ka\u017ed\u00fd vz\u0165ah, na ktor\u00fd sa odkazuje v oper\u00e1tore.<\/p>\n<p>Nie je potrebn\u00e1 syntaktick\u00e1 anal\u00fdza na n\u00e1jdenie v\u0161etk\u00fdch oper\u00e1torov, ktor\u00e9 sa t\u00fdkaj\u00fa konkr\u00e9tnej tabu\u013eky (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/pgaudit\/pgaudit\/blob\/master\/README.md\">*<\/a><\/noindex>)\u00bb.<\/p>\n<h3>Ak\u00fd vplyv to bude ma\u0165 na v\u00fdkon DBMS?<\/h3>\n<p>\nPo\u010fme vykona\u0165 testy so zapnut\u00fdm \u00fapln\u00fdm auditom a pozrime sa, \u010do sa stane s v\u00fdkonom PostgreSQL. Zapneme maxim\u00e1lne logovanie DB pre v\u0161etky parametre.<\/p>\n<p>V konfigura\u010dnom s\u00fabore takmer ni\u010d nemen\u00edme, z d\u00f4le\u017eit\u00fdch vec\u00ed zapneme re\u017eim debug5, aby sme z\u00edskali maximum inform\u00e1ci\u00ed.<\/p>\n<p>postgresql.conf<\/p>\n<p>log_destination = 'stderr'<br \/>\nlogging_collector = on<br \/>\nlog_truncate_on_rotation = on<br \/>\nlog_rotation_age = 1d<br \/>\nlog_rotation_size = 10MB<br \/>\nlog_min_messages = <strong>debug5<\/strong><br \/>\nlog_min_error_statement = <strong>debug5<\/strong><br \/>\nlog_min_duration_statement = 0<br \/>\ndebug_print_parse = on<br \/>\ndebug_print_rewritten = on<br \/>\ndebug_print_plan = on<br \/>\ndebug_pretty_print = zapnut\u00e9<br \/>\nlog_checkpoints = zapnut\u00e9<br \/>\nlog_connections = zapnut\u00e9<br \/>\nlog_disconnections = zapnut\u00e9<br \/>\nlog_duration = zapnut\u00e9<br \/>\nlog_hostname = zapnut\u00e9<br \/>\nlog_lock_waits = zapnut\u00e9<br \/>\nlog_replication_commands = zapnut\u00e9<br \/>\nlog_temp_files = 0<br \/>\nlog_timezone = 'Europe\/Moscow'<\/p>\n<p>\nNa datab\u00e1zovom syst\u00e9me PostgreSQL s parametrami 1 CPU, 2,8 GHz, 2 GB RAM, 40 GB HDD vykon\u00e1vame tri z\u00e1\u0165a\u017eov\u00e9 testy pomocou pr\u00edkazov:<\/p>\n<pre><code class=\"plaintext\">$ pgbench -p 3389 -U postgres -i -s 150 benchmark\n$ pgbench -p 3389 -U postgres -c 50 -j 2 -P 60 -T 600 benchmark\n$ pgbench -p 3389 -U postgres -c 150 -j 2 -P 60 -T 600 benchmark<\/code><\/pre>\n<p>\n<strong>V\u00fdsledky testovania:<\/strong><\/p>\n<p><strong>Bez logovania<\/strong><br \/>\n<strong>S logovan\u00edm<\/strong><\/p>\n<p>Kone\u010dn\u00fd \u010das na\u010d\u00edtania DB<br \/>\n43,74 s<br \/>\n53,23 s<\/p>\n<p>RAM<br \/>\n24%<br \/>\n40%<\/p>\n<p>CPU<br \/>\n72%<br \/>\n91%<\/p>\n<p><strong>Test 1 (50 pripojen\u00ed)<\/strong><\/p>\n<p>Po\u010det transakci\u00ed za 10 min\u00fat<br \/>\n74169<br \/>\n32445<\/p>\n<p>Transakci\u00ed\/s<br \/>\n123<br \/>\n54<\/p>\n<p>Priemern\u00e9 oneskorenie<br \/>\n405 ms<br \/>\n925 ms<\/p>\n<p><strong>Test 2 (150 pripojen\u00ed pri 100 mo\u017en\u00fdch)<\/strong><\/p>\n<p>Po\u010det transakci\u00ed za 10 min\u00fat<br \/>\n81727<br \/>\n31429<\/p>\n<p>Transakci\u00ed\/s<br \/>\n136<br \/>\n52<\/p>\n<p>Priemern\u00e9 oneskorenie<br \/>\n550 ms<br \/>\n1432 ms<\/p>\n<p><strong>O ve\u013ekostiach<\/strong><\/p>\n<p>Ve\u013ekos\u0165 DB<br \/>\n2251 MB<br \/>\n2262 MB<\/p>\n<p>Ve\u013ekos\u0165 logov DB<br \/>\n0 MB<br \/>\n4587 MB<\/p>\n<p>\nCelkovo: kompletn\u00fd audit je dos\u0165 zl\u00fd. \u00dadaje z auditu bud\u00fa ma\u0165 objem ako \u00fadaje v samotnej datab\u00e1ze, ak nie v\u00e4\u010d\u0161\u00ed. Tak\u00fd objem logovania, ktor\u00fd sa generuje pri pr\u00e1ci s datab\u00e1zov\u00fdm syst\u00e9mom, je be\u017en\u00fdm probl\u00e9mom v produkcii.<\/p>\n<p>Pozrime sa na \u010fal\u0161ie parametre:<\/p>\n<ul>\n<li>R\u00fdchlos\u0165 sa v\u00fdrazne nemen\u00ed: bez logovania \u2014 43,74 s, s logovan\u00edm \u2014 53,23 s.<\/li>\n<li>V\u00fdkon RAM a CPU bude klesa\u0165, preto\u017ee je potrebn\u00e9 vytvori\u0165 s\u00fabor s auditom. To je tie\u017e znate\u013en\u00e9 v produkcii.<\/li>\n<\/ul>\n<p>\nPri zvy\u0161ovan\u00ed po\u010dtu pripojen\u00ed sa, samozrejme, miera v\u00fdkonu mierne zhor\u0161\u00ed.<\/p>\n<p>Vo firm\u00e1ch s auditom je to e\u0161te komplikovanej\u0161ie:<\/p>\n<ul>\n<li>\u00fadajov je ve\u013ea;<\/li>\n<li>audit je potrebn\u00fd nielen cez syslog v SIEM, ale aj do s\u00faborov: \u010do ke\u010f sa s syslog nie\u010do stane, mal by by\u0165 s\u00fabor bl\u00edzko datab\u00e1zy, v ktorom sa uchov\u00e1vaj\u00fa \u00fadaje;<\/li>\n<li>na audit je potrebn\u00e1 samostatn\u00e1 polica, aby nedo\u0161lo k pre\u0165a\u017eeniu I\/O diskov, preto\u017ee zaber\u00e1 ve\u013ea miesta;<\/li>\n<li>st\u00e1va sa, \u017ee pracovn\u00edci odboru informa\u010dnej bezpe\u010dnosti potrebuj\u00fa v\u0161ade normy, vy\u017eaduj\u00fa identifik\u00e1ciu pod\u013ea \u0161tandardov.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Obmedzenie pr\u00edstupu k \u00fadajom<\/h2>\n<p>\nPozrime sa na technol\u00f3gie, ktor\u00e9 sa pou\u017e\u00edvaj\u00fa na ochranu \u00fadajov a pr\u00edstup k nim v komer\u010dn\u00fdch datab\u00e1zov\u00fdch syst\u00e9moch a open source.<\/p>\n<p>\u010co sa celkovo d\u00e1 pou\u017ei\u0165:<\/p>\n<ol>\n<li>\u0160ifrovanie a obfuskovanie proced\u00far a funkci\u00ed (Wrapping) \u2014 to s\u00fa n\u00e1stroje a utilitky, ktor\u00e9 robia \u010ditate\u013en\u00fd k\u00f3d ne\u010ditate\u013en\u00fdm. Pravda je, \u017ee ho u\u017e nie je mo\u017en\u00e9 zmeni\u0165 ani refaktorova\u0165 sp\u00e4\u0165. Tak\u00fdto pr\u00edstup je niekedy potrebn\u00fd aspo\u0148 na strane datab\u00e1zov\u00e9ho syst\u00e9mu \u2014 logika licen\u010dn\u00fdch obmedzen\u00ed alebo logika autoriz\u00e1cie je \u0161ifrovan\u00e1 pr\u00e1ve na \u00farovni proced\u00fary a funkci\u00ed.<\/li>\n<li>Obmedzenie vidite\u013enosti \u00fadajov po riadkoch (RLS) je situ\u00e1cia, ke\u010f r\u00f4zni pou\u017e\u00edvatelia vidia jednu tabu\u013eku, ale r\u00f4zne zostavy riadkov v nej, t.j. niektor\u00fdm pou\u017e\u00edvate\u013eom nie\u010do nemo\u017eno zobrazi\u0165 na \u00farovni riadkov.<\/li>\n<li>\u00daprava zobrazen\u00fdch \u00fadajov (Masking) je situ\u00e1cia, ke\u010f pou\u017e\u00edvatelia v jednom st\u013apci tabu\u013eky vidia bu\u010f \u00fadaje, alebo iba hviezdi\u010dky, t.j. pre niektor\u00fdch pou\u017e\u00edvate\u013eov bude inform\u00e1cia uzavret\u00e1. Technol\u00f3gia ur\u010duje, ak\u00e9mu pou\u017e\u00edvate\u013eovi \u010do zobrazi\u0165 s oh\u013eadom na \u00farove\u0148 pr\u00edstupu.<\/li>\n<li>Rozdelenie pr\u00edstupu Security DBA\/Application DBA\/DBA je sk\u00f4r o obmedzen\u00ed pr\u00edstupu k samotnej DBMS, t.j. zamestnancov IT mo\u017eno oddeli\u0165 od administr\u00e1torov datab\u00e1zy a administr\u00e1torov aplik\u00e1ci\u00ed. V open source tak\u00fdch technol\u00f3gi\u00ed je m\u00e1lo, v komer\u010dn\u00fdch DBMS ich je dostatok. S\u00fa potrebn\u00e9, ke\u010f je ve\u013ea pou\u017e\u00edvate\u013eov s pr\u00edstupom k samotn\u00fdm serverom.<\/li>\n<li>Obmedzenie pr\u00edstupu k s\u00faborom na \u00farovni s\u00faborov\u00e9ho syst\u00e9mu. M\u00f4\u017eete priradi\u0165 pr\u00e1va, privilegovan\u00e9 pr\u00edstupy k adres\u00e1rom, aby ka\u017ed\u00fd administr\u00e1tor mal pr\u00edstup iba k potrebn\u00fdm \u00fadajom.<\/li>\n<li>Mand\u00e1tov\u00fd pr\u00edstup a vymaz\u00e1vanie pam\u00e4te sa tieto technol\u00f3gie pou\u017e\u00edvaj\u00fa zriedka.<\/li>\n<li>End-to-end encryption priamo DBMS je \u0161ifrovanie na strane klienta s riaden\u00edm k\u013e\u00fa\u010dov na serverovej strane.<\/li>\n<li>\u0160ifrovanie \u00fadajov. Napr\u00edklad st\u013apcov\u00e9 \u0161ifrovanie je situ\u00e1cia, ke\u010f pou\u017e\u00edvate mechanizmus, ktor\u00fd \u0161ifruje jednotliv\u00fd st\u013apec datab\u00e1zy.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Ako to ovplyv\u0148uje v\u00fdkon DBMS?<\/h3>\n<p>\nPozrime sa na pr\u00edklad st\u013apcov\u00e9ho \u0161ifrovania v PostgreSQL. Existuje modul pgcrypto, ktor\u00fd umo\u017e\u0148uje uchov\u00e1va\u0165 vybran\u00e9 polia v za\u0161ifrovanej podobe. Je to u\u017eito\u010dn\u00e9, ke\u010f je hodnotn\u00e1 iba ur\u010dit\u00e1 \u010das\u0165 \u00fadajov. Aby ste pre\u010d\u00edtali za\u0161ifrovan\u00e9 polia, klient odovzd\u00e1 de\u0161ifrovac\u00ed k\u013e\u00fa\u010d, server de\u0161ifruje \u00fadaje a vyd\u00e1 ich klientovi. Bez k\u013e\u00fa\u010da s va\u0161imi \u00fadajmi nikto ni\u010d neurob\u00ed.<\/p>\n<p><strong>Vykonajme test s pgcrypto<\/strong>. Vytvor\u00edme tabu\u013eku so za\u0161ifrovan\u00fdmi \u00fadajmi a be\u017en\u00fdmi \u00fadajmi. Ni\u017e\u0161ie s\u00fa pr\u00edkazy na vytvorenie tabuliek, v prvej riadku je u\u017eito\u010dn\u00fd pr\u00edkaz \u2014 vytvorenie samotnej roz\u0161\u00edrenia s registr\u00e1ciou DBMS:<\/p>\n<pre><code class=\"plaintext\">CREATE EXTENSION pgcrypto;\nCREATE TABLE t1 (id integer, text1 text, text2 text);\nCREATE TABLE t2 (id integer, text1 bytea, text2 bytea);\nINSERT INTO t1 (id, text1, text2)\nVALUES (generate_series(1,10000000), generate_series(1,10000000)::text, generate_series(1,10000000)::text);\nINSERT INTO t2 (id, text1, text2) VALUES (\ngenerate_series(1,10000000),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'));<\/code><\/pre>\n<p>\n\u010ealej sa pok\u00fasime z\u00edska\u0165 d\u00e1ta z ka\u017edej tabu\u013eky a pozrieme sa na \u010dasy vykon\u00e1vania.<\/p>\n<p><strong>V\u00fdber d\u00e1t z tabu\u013eky bez funkcie \u0161ifrovania<\/strong>:<\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select * from t1 limit 1000;\" \"host=192.168.220.129 dbname=taskdb\nuser=postgres sslmode=disable\" &gt; 1.txt<\/code><\/pre>\n<p>\nStopky s\u00fa spusten\u00e9.<\/p>\n<p>\u00a0\u00a0id | text1 | text2<br \/>\n\u2014\u2014+\u2014\u2014-+\u2014\u2014\u2014<br \/>\n 1 | 1 \u00a0 \u00a0 | 1<br \/>\n 2 | 2 \u00a0 \u00a0 | 2<br \/>\n 3 | 3 \u00a0 \u00a0 | 3<br \/>\n\u2026<br \/>\n997 | 997 \u00a0 | 997<br \/>\n998 | 998 \u00a0 | 998<br \/>\n999 | 999 \u00a0 | 999<br \/>\n1000 | 1000\u00a0 | 1000<br \/>\n(1000 riadkov)<\/p>\n<p>\u010cas: 1,386 ms<\/p>\n<p><strong>V\u00fdber d\u00e1t z tabu\u013eky s funkciou \u0161ifrovania:<\/strong><\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select id, decrypt(text1, 'key'::bytea, 'bf'),\ndecrypt(text2, 'key'::bytea, 'bf') from t2 limit 1000;\"\n\"host=192.168.220.129 dbname=taskdb user=postgres sslmode=disable\" &gt; 2.txt<\/code><\/pre>\n<p>\nStopky s\u00fa spusten\u00e9.<\/p>\n<p>\u00a0\u00a0id | decrypt | decrypt<br \/>\n\u2014\u2014+\u2014\u2014\u2014\u2013+\u2014\u2014\u2014<br \/>\n 1 | x31 | x31<br \/>\n 2 | x32 | x32<br \/>\n 3 | x33 | x33<br \/>\n\u2026<br \/>\n999 | x393939 | x393939<br \/>\n1000 | x31303030 | x31303030<br \/>\n(1000 riadkov)<\/p>\n<p>\u010cas: 50,203 ms<\/p>\n<p><strong>V\u00fdsledky testovania<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>Bez \u0161ifrovania<\/strong><br \/>\n<strong>Pgcrypto (decrypt)<\/strong><\/p>\n<p>V\u00fdber 1000 riadkov<br \/>\n1,386 ms<br \/>\n50,203 ms<\/p>\n<p>CPU<br \/>\n15%<br \/>\n35%<\/p>\n<p>RAM<br \/>\n\u00a0<br \/>\n+5%<\/p>\n<p>\n\u0160ifrovanie m\u00e1 v\u00fdrazn\u00fd vplyv na v\u00fdkon. Je jasn\u00e9, \u017ee \u010das vykon\u00e1vania vzr\u00e1stol, preto\u017ee oper\u00e1cie de\u0161ifrovania za\u0161ifrovan\u00fdch d\u00e1t (a de\u0161ifrovanie je zvy\u010dajne e\u0161te obalen\u00e9 vo va\u0161ej logike) vy\u017eaduj\u00fa zna\u010dn\u00e9 zdroje. Teda my\u0161lienka za\u0161ifrova\u0165 v\u0161etky st\u013apce, ktor\u00e9 obsahuj\u00fa d\u00e1ta, je viazan\u00e1 na zn\u00ed\u017eenie v\u00fdkonu.<\/p>\n<p>\u0160ifrovanie nie je strieborn\u00e1 gu\u013eka, ktor\u00e1 rie\u0161i v\u0161etky probl\u00e9my. De\u0161ifrovan\u00e9 d\u00e1ta a k\u013e\u00fa\u010d de\u0161ifrovania s\u00fa po\u010das de\u0161ifrovania a pren\u00e1\u0161ania d\u00e1t na serveri. Preto m\u00f4\u017eu by\u0165 k\u013e\u00fa\u010de zachyten\u00e9 t\u00fdm, kto m\u00e1 pln\u00fd pr\u00edstup k serveru datab\u00e1z, napr\u00edklad syst\u00e9mov\u00fdm administr\u00e1torom.<\/p>\n<p>Ke\u010f existuje jeden k\u013e\u00fa\u010d pre cel\u00fa tabu\u013eku pre v\u0161etk\u00fdch pou\u017e\u00edvate\u013eov (aj ke\u010f nie pre v\u0161etk\u00fdch, ale pre obmedzen\u00fa skupinu klientov), nie je to v\u017edy dobr\u00e9 a spr\u00e1vne. Preto sa za\u010dalo robi\u0165 end-to-end \u0161ifrovanie, v S\u00daBD sa za\u010dali zva\u017eova\u0165 mo\u017enosti \u0161ifrovania d\u00e1t zo strany klienta a servera, objavili sa tzv. k\u013e\u00fa\u010dov\u00e9 trezory \u2014 samostatn\u00e9 produkty, ktor\u00e9 zabezpe\u010duj\u00fa spr\u00e1vu k\u013e\u00fa\u010dov na strane S\u00daBD.<\/p>\n<p><img decoding=\"async\" alt=\"Bezpe\u010dnos\u0165 a DBMS: na \u010do pam\u00e4ta\u0165 pri v\u00fdbere ochrann\u00fdch prostriedkov\" src=\"\/wp-content\/uploads\/2020\/05\/cbaa7b9579a65963518ba3cec6114842.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/docs.mongodb.com\/manual\/core\/security-client-side-encryption\/\"><i>Pr\u00edklad tak\u00e9ho \u0161ifrovania v MongoDB<\/i><\/a><\/noindex><\/p>\n<h2>Bezpe\u010dnostn\u00e9 n\u00e1stroje v komer\u010dn\u00fdch a open source S\u00daBD<\/h2>\n<p><\/p>\n<p><strong>Funkcie<\/strong><br \/>\n<strong>Typ<\/strong><br \/>\n<strong>Politika hesiel<\/strong><br \/>\n<strong>Audit<\/strong><br \/>\n<strong>Ochrana zdrojov\u00e9ho k\u00f3du proced\u00far a funkci\u00ed<\/strong><br \/>\n<strong>RLS<\/strong><br \/>\n<strong>\u0160ifrovanie<\/strong><\/p>\n<p><strong>Oracle<\/strong><br \/>\nKomer\u010dn\u00e9<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><strong>MsSql<\/strong><br \/>\nKomer\u010dn\u00e9<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\"><strong>Jatoba<\/strong><\/a><\/noindex><br \/>\nKomer\u010dn\u00e9<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\nroz\u0161\u00edrenia<\/p>\n<p><strong>PostgreSQL<\/strong><br \/>\nBezplatn\u00e9<br \/>\nroz\u0161\u00edrenia<br \/>\nroz\u0161\u00edrenia<br \/>\n\u2014<br \/>\n+<br \/>\nroz\u0161\u00edrenia<\/p>\n<p><strong>MongoDb<\/strong><br \/>\nBezplatn\u00e9<br \/>\n\u2014<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<br \/>\nDostupn\u00e9 iba v MongoDB Enterprise<\/p>\n<p>\nTabu\u013eka nie je \u00fapln\u00e1, ale situ\u00e1cia je tak\u00e1: v komer\u010dn\u00fdch produktoch sa \u00falohy bezpe\u010dnosti rie\u0161ia u\u017e d\u00e1vno, v open source sa zvy\u010dajne na zabezpe\u010denie pou\u017e\u00edvaj\u00fa nejak\u00e9 nadstavby, mnoh\u00e9 funkcie ch\u00fdbaj\u00fa, niekedy je potrebn\u00e9 nie\u010do dop\u00edsa\u0165. Napr\u00edklad politiky hesiel \u2014 v PostgreSQL je ve\u013ea r\u00f4znych roz\u0161\u00edren\u00ed (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/postgres\/postgres\/tree\/master\/contrib\/passwordcheck\">1<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ykrysko\/passwordcheck\">2<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michaelpq\/pg_plugins\/tree\/master\/passwordcheck_extra\">3<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/devrimgunduz\/passwordcheck_cracklib\">4<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/asio\/password\">5<\/a><\/noindex>), ktor\u00e9 implementuj\u00fa politiky hesiel, ale v\u0161etky potreby dom\u00e1ceho podnikate\u013esk\u00e9ho segmentu zatia\u013e nijak\u00e9 nepokryli.<\/p>\n<p><strong>\u010co robi\u0165, ak nikde nie je to, \u010do potrebujete<\/strong>? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u0421\u0423\u0411\u0414, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a.<\/p>\n<p>Potom m\u00f4\u017eete pou\u017ei\u0165 extern\u00e9 rie\u0161enia, ktor\u00e9 pracuj\u00fa s r\u00f4znymi DBMS, ako napr\u00edklad \u201eKrypto DB\u201c alebo \u201eGarda DB\u201c. Ak ide o rie\u0161enia z dom\u00e1ceho segmentu, tam o norm\u00e1ch GOST vedia lep\u0161ie ako v open source.<\/p>\n<p>Druhou mo\u017enos\u0165ou je nap\u00edsa\u0165 si, \u010do potrebujete, a implementova\u0165 pr\u00edstup k d\u00e1tam a \u0161ifrovanie na \u00farovni proced\u00far v aplik\u00e1cii. Pravda, s normou GOST bude \u0165a\u017e\u0161ie. Ale vo v\u0161eobecnosti \u2014 m\u00f4\u017eete skry\u0165 d\u00e1ta podle svojich po\u017eiadaviek, ulo\u017ei\u0165 ich do DBMS, potom ich vybra\u0165 a de\u0161ifrova\u0165 pod\u013ea potreby priamo na \u00farovni aplik\u00e1cie. Pri tom okam\u017eite zva\u017eujte, ako budete chr\u00e1ni\u0165 tieto algoritmy na \u00farovni aplik\u00e1cie. Pod\u013ea n\u00e1\u0161ho n\u00e1zoru je potrebn\u00e9 to robi\u0165 na \u00farovni DBMS, preto\u017ee to bude pracova\u0165 r\u00fdchlej\u0161ie.<\/p>\n<p>Tento pr\u00edspevok bol prv\u00fdkr\u00e1t prednesen\u00fd na <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup<\/a><\/noindex> od Mail.ru Cloud Solutions. Pozrite sa<noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/redirect?q=https%3A%2F%2Fbit.ly%2F2U57FAd&amp;redir_token=XNWSBN1AKQA2sjhdReDAv6VnkOV8MTU4OTAxNjMwMEAxNTg4OTI5OTAw&amp;v=wigSv2_zWBU&amp;event=video_description\"> videu <\/a><\/noindex>in\u00e9 vyst\u00fapenia a prihl\u00e1ste sa na ozn\u00e1menia udalost\u00ed v Telegrame <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/k8s_mail\">Okolo Kubernetes v Mail.ru Group<\/a><\/noindex>.<\/p>\n<p><strong>\u010co \u010fal\u0161ie si pre\u010d\u00edta\u0165 na t\u00fato t\u00e9mu<\/strong>:<\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/472694\/\">Viac ne\u017e Ceph: blokov\u00e9 \u00falo\u017eisko cloudu MCS<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/kakuyu-bazu-dannyh-vybrat-dlya-proekta-chtoby-ne-oshibitsya\">Ako vybra\u0165 datab\u00e1zu pre projekt, aby ste nemuseli vybera\u0165 znova<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/500708\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441 \u0420\u043e\u0436\u043a\u043e\u0432, \u044f \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u00ab\u0413\u0430\u0437\u0438\u043d\u0444\u043e\u0440\u043c\u0441\u0435\u0440\u0432\u0438\u0441\u00bb, \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 Jatoba. \u0417\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043d\u043e\u0440\u043c\u044b \u043d\u0430\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445. \u041d\u0438\u043a\u0442\u043e \u043d\u0435 \u0445\u043e\u0447\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0442\u0440\u0435\u0442\u044c\u0438 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432\u0430\u0436\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b: \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430\u043c\u0438 \u043a \u0434\u0430\u043d\u043d\u044b\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81885,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81884","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bezpe\u010dnos\u0165 a DBMS: na \u010do nezabudn\u00fa\u0165, pri v\u00fdbere ochrann\u00fdch prostriedkov | ProHoster","description":"Vol\u00e1m sa Denis.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster","og:description":"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-17T11:42:18+00:00","article:modified_time":"2020-05-17T11:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81884","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:48:24","updated":"2022-10-05 02:01:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/81884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=81884"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/81884\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/81885"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=81884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=81884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=81884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}