{"id":91364,"date":"2020-08-12T07:42:33","date_gmt":"2020-08-12T05:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes"},"modified":"2020-08-12T07:42:33","modified_gmt":"2020-08-12T05:42:33","slug":"izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","title":{"rendered":"Shqyrtojm\u00eb sigurin\u00eb (q\u00eb mungon) t\u00eb instalimeve tipike t\u00eb Docker dhe Kubernetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Shqyrtojm\u00eb
\nUn\u00eb punoj n\u00eb IT p\u00ebr m\u00eb shum\u00eb se 20 vjet, por ndonj\u00ebher\u00eb nuk pata rastin t\u00eb merrem me kontejner\u00ebt. N\u00eb teori, e kuptoja se si funksionojn\u00eb dhe \u00e7far\u00eb jan\u00eb. Por, pasi nuk kisha pasur ndonj\u00ebher\u00eb p\u00ebrvoj\u00eb praktike me ta, nuk isha i sigurt se si funksionojn\u00eb gj\u00ebrat n\u00ebn kapak. <\/p>\n

<\/p>\n

P\u00ebrve\u00e7 k\u00ebsaj, nuk dija asgj\u00eb p\u00ebr sigurin\u00eb e tyre. Por, prap\u00eb, teoria ting\u00ebllon bukur dhe k\u00ebnga e vjet\u00ebr \"me rritjen e siguris\u00eb bie komoditeti\" m\u00eb ishte ngulitur n\u00eb mendje. K\u00ebshtu q\u00eb mendova se n\u00ebse \u00ebsht\u00eb kaq e leht\u00eb t\u00eb punosh me kontejner\u00ebt, at\u00ebher\u00eb siguria atje \u00ebsht\u00eb shum\u00eb e dob\u00ebt. Si\u00e7 rezultoi, kisha t\u00eb drejt\u00eb.<\/p>\n

<\/a><\/noindex><\/p>\n

P\u00ebr nj\u00eb fillim t\u00eb shpejt\u00eb, u regjistrova n\u00eb kursin Black Hat<\/a><\/noindex> 2020 me titull \"Nga lig\u00ebsia n\u00eb p\u00ebrpar\u00ebsi: dep\u00ebrtimi dhe mbrojtja e mjediseve Docker Swarm dhe Kubernetes<\/a><\/noindex>\u00bb. <\/p>\n

<\/p>\n

Kursi, i udh\u00ebhequr nga Sheila A. Berta dhe Sol Ozzan, filloi menj\u00ebher\u00eb me p\u00ebrshkrimin e asaj si funksionojn\u00eb kontejner\u00ebt Docker, si dhe rrug\u00ebn q\u00eb ata ndjekin gjat\u00eb shp\u00ebrndarjes n\u00eb Kubernetes. Ishte nj\u00eb aktivitet krejt\u00ebsisht praktik - student\u00ebt duhej t\u00eb instalonin paraprakisht Docker dhe microk8s n\u00eb makinat e tyre para or\u00ebve - nj\u00eb m\u00ebnyr\u00eb e shk\u00eblqyer p\u00ebr t\u00eb par\u00eb nd\u00ebrveprimin e mjeteve me nj\u00ebri-tjetrin, p\u00ebr t\u00eb gjetur dob\u00ebsit\u00eb dhe, m\u00eb e r\u00ebnd\u00ebsishmja, p\u00ebr t\u00eb provuar t'i bllokoni ato.<\/p>\n

<\/p>\n

Fatkeq\u00ebsisht, edhe pse kurset premtuan se do t\u00eb isha \"princi\" pas dy dit\u00ebsh, un\u00eb ndihesha se gjith\u00e7ka sapo kishte filluar dhe gjithmon\u00eb kisha shum\u00eb p\u00ebr t\u00eb m\u00ebsuar.<\/p>\n

<\/p>\n

\"Shqyrtojm\u00eb<\/p>\n

<\/p>\n

Para se t\u00eb kaloj n\u00eb v\u00ebzhgimet e mia t\u00eb larta, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb shpjegohet se \u00e7far\u00eb \u00ebsht\u00eb nj\u00eb kontejner. N\u00eb bot\u00ebn e zhvillimit, \u00ebsht\u00eb normale q\u00eb kodi, i shkruar n\u00eb makin\u00ebn tuaj personale, t\u00eb funksionoj\u00eb perfekt, por kur p\u00ebrpiqeni ta ekzekutoni at\u00eb diku n\u00eb nj\u00eb server - thjesht nuk funksionon. Kontejner\u00ebt p\u00ebrpiqen t\u00eb tejkalojn\u00eb k\u00ebt\u00eb problem duke ofruar makina autonome, t\u00eb cilat mund t'i transferoni leht\u00ebsisht nga nj\u00eb server n\u00eb tjet\u00ebr, duke e ditur se ato gjithmon\u00eb do t\u00eb funksionojn\u00eb. Si\u00e7 tregohet nga emri, ato p\u00ebrmbajn\u00eb kodin, bibliotekat dhe software t\u00eb tjera t\u00eb nevojshme p\u00ebr funksionim. Kubernetes, nga ana tjet\u00ebr, \u00ebsht\u00eb nj\u00eb platform\u00eb orkestrimi p\u00ebr kontejner\u00ebt<\/a><\/noindex>. N\u00eb p\u00ebrgjith\u00ebsi, me ndihm\u00ebn e tij, mund t\u00eb menaxhoni pa probleme qindra ose mij\u00ebra kontejner\u00eb t\u00eb ndrysh\u00ebm.<\/p>\n

<\/p>\n

M\u00eb posht\u00eb jan\u00eb disa nga p\u00ebrfundimet e mia nga perspektiva e ekipit t\u00eb kuq dhe t\u00eb blu.<\/p>\n

<\/p>\n

Ekipi i kuq<\/h2>\n

<\/p>\n

Shumica e p\u00ebrmbajtjes s\u00eb kontejner\u00ebve ekzekutohet si root<\/strong>: kjo do t\u00eb thot\u00eb se n\u00ebse komprometoni kontejnerin, do t\u00eb keni akses t\u00eb plot\u00eb n\u00eb t\u00eb. Kjo i b\u00ebn hapat e m\u00ebpassh\u00ebm shum\u00eb m\u00eb t\u00eb leht\u00eb.<\/p>\n

<\/p>\n

Mtimi i docker.sock brenda kontejnerit \u00ebsht\u00eb i rreziksh\u00ebm<\/strong>: n\u00ebse keni marr\u00eb root brenda kontejnerit, dhe gjithashtu keni instaluar Docker brenda kontejnerit q\u00eb ka soket Docker (\\\/var\\\/run\\\/docker.sock), keni nj\u00eb mund\u00ebsi t\u00eb mundshme p\u00ebr t\u00eb hetuar t\u00ebr\u00eb grumbullin, duke p\u00ebrfshir\u00eb aksesin n\u00eb \u00e7do kontejner tjet\u00ebr. Ky akses nuk mund t\u00eb parandalohet as nga izolimi rrjetor, as nga m\u00ebnyra t\u00eb tjera.<\/p>\n

<\/p>\n

Variablat e mjedisit shpesh p\u00ebrmbajn\u00eb t\u00eb dh\u00ebna sekrete<\/strong>: n\u00eb shumic\u00ebn e rasteve, njer\u00ebzit d\u00ebrgojn\u00eb fjal\u00ebkalime n\u00eb kontejner duke p\u00ebrdorur variabla mjedisi t\u00eb zakonsh\u00ebm. Pra, n\u00ebse keni akses n\u00eb llogarin\u00eb, mund t\u00eb shihni k\u00ebto variabla mjedisi me q\u00ebllim p\u00ebr t\u00eb zgjeruar m\u00eb pas fuqit\u00eb tuaja.<\/p>\n

<\/p>\n

Docker API mund t\u00eb jap\u00eb shum\u00eb informacion<\/strong>: Docker API, n\u00eb konfigurimin e tij t\u00eb paracaktuar, punon pa autorizim dhe mund t\u00eb jap\u00eb shum\u00eb informacion. Duke p\u00ebrdorur Shodan, mund t\u00eb gjeni leht\u00ebsisht nj\u00eb list\u00eb portesh t\u00eb hapura, m\u00eb pas t\u00eb merrni informacion t\u00eb detajuar p\u00ebr grumbullin - dhe t\u00eb kaloni n\u00eb kapjen e tij t\u00eb plot\u00eb. TrendMicro shkroi p\u00ebr k\u00ebt\u00eb nj\u00eb artikull shum\u00eb interesant<\/a><\/noindex>.<\/p>\n

<\/p>\n

Ekipi blu<\/h2>\n

<\/p>\n

Mos e drejtoni p\u00ebrmbajtjen e kontejner\u00ebve n\u00ebn root<\/strong>: megjith\u00ebse \u00ebsht\u00eb m\u00eb e leht\u00eb t\u00eb nisni si root, nuk duhet ta b\u00ebni k\u00ebt\u00eb. N\u00eb vend t\u00eb k\u00ebsaj, nisni aplikacionet me privilegje t\u00eb reduktuara duke shfaqur uid ose duke p\u00ebrdorur parametrin \u2014user kur punoni me CLI, ose duke e specifikuar USER n\u00eb Dockerfile.<\/p>\n

<\/p>\n

Mos lejoni instalimin e programeve n\u00eb kontejner\u00eb<\/strong>: pothuajse \u00e7do sulm fillon me instalimin e di\u00e7kaje. Duke filluar nga nmap dhe duke p\u00ebrfshir\u00eb ifconfig dhe vet\u00eb Docker (brenda kontejnerit), instalimi i di\u00e7kaje n\u00eb kontejner ishte nj\u00eb praktik\u00eb e zakonshme. P\u00ebr k\u00ebt\u00eb arsye, gjithmon\u00eb duhet t\u00eb bllokoni t\u00eb gjitha portet e pap\u00ebrdorura. Kjo ndihmon gjithashtu p\u00ebr t\u00eb parandaluar d\u00ebrgimin e komandave t\u00eb menaxhimit kur makina juaj infektohet. P\u00ebrve\u00e7 parandaluar instalimin e programeve, \u00ebsht\u00eb e nevojshme t\u00eb siguroheni q\u00eb brenda kontejnerit t\u00eb jet\u00eb instaluar numri minimal i aplikacioneve t\u00eb nevojshme p\u00ebr t\u00eb kryer detyr\u00ebn.<\/p>\n

<\/p>\n

Mbroni docker.sock<\/strong>: duhet t\u00eb mbroni, pasi p\u00ebrmes k\u00ebtij soketi p\u00ebrpunohen lidhjet midis kontejnerit dhe grumbullit. Meqen\u00ebse nuk dua t\u00eb hyj n\u00eb detaje n\u00eb k\u00ebt\u00eb artikull, lexoni sh\u00ebnimin nga Docker<\/a><\/noindex>, \u00e7far\u00eb mund t\u00eb ndodh\u00eb, si dhe si t\u00eb bllokoni gjith\u00e7ka.<\/p>\n

<\/p>\n

P\u00ebrdorni sekretet e Docker p\u00ebrve\u00e7 variablave t\u00eb mjedisit<\/strong>: Sekretet ekzistojn\u00eb q\u00eb nga viti 2017<\/a><\/noindex>. Megjith\u00ebse kjo nuk \u00ebsht\u00eb e sigurt, \u00ebsht\u00eb m\u00eb mir\u00eb se variablat e mjedisit p\u00ebr t\u00eb kaluar t\u00eb dh\u00ebnat sekrete n\u00eb kontejner.<\/p>\n

<\/p>\n

N\u00ebse artikulli ju ka interesuar p\u00ebr kontejner\u00ebt \u2014 mund t\u00eb instaloni leht\u00ebsisht Docker ose microk8s (versioni i vog\u00ebl i Kubernetes). K\u00ebtu<\/a><\/noindex> ka udh\u00ebzime p\u00ebr instalimin e Docker p\u00ebr Linux dhe MacOS, dhe k\u00ebtu<\/a><\/noindex> \u2014 udh\u00ebzime p\u00ebr instalimin e microk8s p\u00ebr Windows, Linux dhe MacOS.<\/p>\n

<\/p>\n

Pas instalimit, mund t\u00eb kaloni k\u00ebt\u00eb udh\u00ebzues p\u00ebr fillimin e shpejt\u00eb<\/a><\/noindex> nga Docker, nj\u00eb version i ngjash\u00ebm ofrohet<\/a><\/noindex> edhe p\u00ebr microk8s.<\/p>\n

<\/p>\n

N\u00ebse keni d\u00ebshir\u00eb ose nevoj\u00eb p\u00ebr t\u00eb ndjekur nj\u00eb kurs t\u00eb plot\u00eb mbi Docker, ku fol\u00ebsit praktik\u00eb shqyrtojn\u00eb t\u00eb gjith\u00eb mjetet e tij: nga abstraksionet kryesore deri te parametrat e rrjetit, holl\u00ebsit\u00eb e pun\u00ebs me sisteme t\u00eb ndryshme operative dhe gjuh\u00eb programuese, provoni \"visa1<\/a><\/noindex>\". Do t\u00eb njiheni me teknologjin\u00eb dhe do t\u00eb kuptoni se ku dhe si \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb p\u00ebrdorni Docker. Nj\u00ebkoh\u00ebsisht do t\u00eb merrni raste best practice \u2014 m\u00eb mir\u00eb t\u00eb m\u00ebsoni n\u00eb siguri dhe me mb\u00ebshtetje nga praktikant\u00ebt p\u00ebrmes historive mbi pengesat sesa vet\u00eb duke u p\u00ebrballur me to.<\/p>\n

Burimi: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f \u0440\u0430\u0431\u043e\u0442\u0430\u044e \u0432 IT \u0431\u043e\u043b\u044c\u0448\u0435 20 \u043b\u0435\u0442, \u043d\u043e \u043a\u0430\u043a-\u0442\u043e \u0440\u0443\u043a\u0438 \u043d\u0435 \u0434\u043e\u0445\u043e\u0434\u0438\u043b\u0438 \u0434\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0412 \u0442\u0435\u043e\u0440\u0438\u0438 \u044f \u043f\u043e\u043d\u0438\u043c\u0430\u043b, \u043a\u0430\u043a \u043e\u043d\u0438 \u0443\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u0438 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442. \u041d\u043e \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044f \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u0441 \u043d\u0438\u043c\u0438 \u043d\u0435 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0441\u044f \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u2014 \u044f \u043d\u0435 \u0431\u044b\u043b \u0443\u0432\u0435\u0440\u0435\u043d \u0432 \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u043a\u0440\u0443\u0442\u044f\u0442\u0441\u044f-\u0432\u0435\u0440\u0442\u044f\u0442\u0441\u044f \u0443 \u043d\u0438\u0445 \u0448\u0435\u0441\u0442\u0435\u0440\u0451\u043d\u043a\u0438 \u043f\u043e\u0434 \u043a\u0430\u043f\u043e\u0442\u043e\u043c. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u044f \u0431\u044b\u043b \u0431\u0435\u0437 \u043f\u043e\u043d\u044f\u0442\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91365,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91364","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Po studiojm\u00eb (munges\u00ebn) e siguris\u00eb s\u00eb instalimeve tipike t\u00eb Docker dhe Kubernetes | ProHoster","description":"Un\u00eb punoj n\u00eb IT.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437\u0443\u0447\u0430\u0435\u043c (\u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0443\u044e) \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0442\u0438\u043f\u0438\u0447\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a Docker \u0438 Kubernetes | ProHoster","og:description":"\u042f \u0440\u0430\u0431\u043e\u0442\u0430\u044e \u0432 IT.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-12T05:42:33+00:00","article:modified_time":"2020-08-12T05:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91364","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:29:22","updated":"2022-09-28 18:39:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=91364"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91364\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/91365"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=91364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=91364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=91364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}