{"id":91364,"date":"2020-08-12T07:42:33","date_gmt":"2020-08-12T05:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes"},"modified":"2020-08-12T07:42:33","modified_gmt":"2020-08-12T05:42:33","slug":"izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","title":{"rendered":"Studimi i (munges\u00ebs s\u00eb) siguris\u00eb s\u00eb instalimeve tipike t\u00eb Docker dhe Kubernetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Studimi
\nKam punoj n\u00eb IT p\u00ebr m\u00eb shum\u00eb se 20 vjet, por ndonj\u00ebher\u00eb nuk kam arritur t\u00eb merrem me kontejner\u00ebt. N\u00eb teori e kisha kuptuar si ishin t\u00eb strukturuar dhe si punonin ato. Por, duke qen\u00eb se nuk kisha p\u00ebrballur ndonj\u00ebher\u00eb me ta n\u00eb praktik\u00eb, nuk isha i sigurt se si sakt\u00ebsisht funksiononin ato n\u00ebn kapak. <\/p>\n

<\/p>\n

P\u00ebrve\u00e7 k\u00ebsaj, nuk kisha asnj\u00eb informacion p\u00ebr sigurin\u00eb e tyre. Por p\u00ebrs\u00ebri, teoria ting\u00ebllon bukur, dhe k\u00ebnga e vjet\u00ebr 'kur rritet siguria, bie p\u00ebrshtatshm\u00ebria' ishte e ngritur n\u00eb mendjen time. Prandaj mendoja se, n\u00ebse \u00ebsht\u00eb kaq e leht\u00eb t\u00eb punohet me kontejner\u00ebt, at\u00ebher\u00eb siguria aty \u00ebsht\u00eb shum\u00eb e ul\u00ebt. Si\u00e7 doli, isha i sakt\u00eb.<\/p>\n

<\/a><\/noindex><\/p>\n

P\u00ebr nj\u00eb fillim t\u00eb shpejt\u00eb, u regjistrova n\u00eb kurse Black Hat<\/a><\/noindex> 2020 me titull \"Nga llumi n\u00eb princ: infiltrimi dhe mbrojtja e mjediseve Docker Swarm dhe Kubernetes<\/a><\/noindex>\u00bb. <\/p>\n

<\/p>\n

Kursi, i zhvilluar nga Sheila A. Berta dhe Sol Ozzan, filloi menj\u00ebher\u00eb me shpjegimin se si funksionojn\u00eb kontejner\u00ebt Docker, si dhe rrug\u00ebn q\u00eb ndoqin ato kur vendosen n\u00eb Kubernetes. Ishte nj\u00eb sesion krejt\u00ebsisht praktik \u2013 student\u00ebt duhej t\u00eb instalonin paraprakisht Docker dhe microk8s n\u00eb makinat e tyre p\u00ebrpara se t\u00eb fillonin, nj\u00eb m\u00ebnyr\u00eb e shk\u00eblqyer p\u00ebr t\u00eb par\u00eb nd\u00ebrlidhjen e mjeteve me nj\u00ebri-tjetrin, p\u00ebr t\u00eb gjetur pika t\u00eb dob\u00ebta dhe, m\u00eb e r\u00ebnd\u00ebsishmja, p\u00ebr t'i bllokuar ato.<\/p>\n

<\/p>\n

Fatkeq\u00ebsisht, ndon\u00ebse kurset premtonin t\u00eb b\u00ebheshin 'princ' pas dy dit\u00ebsh, un\u00eb ndieja se gjith\u00e7ka sapo kishte filluar dhe m'u duhej t\u00eb m\u00ebsoja akoma shum\u00eb.<\/p>\n

<\/p>\n

\"Studimi<\/p>\n

<\/p>\n

Para se t\u00eb kaloj n\u00eb v\u00ebzhgimet e mia t\u00eb larta, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb shpjegohet se \u00e7far\u00eb \u00ebsht\u00eb nj\u00eb kontejner. N\u00eb bot\u00ebn e zhvillimit, konsiderohet normale situata ku kodi i shkruar n\u00eb makin\u00ebn tuaj personale punon n\u00eb m\u00ebnyr\u00eb perfekte, por kur p\u00ebrpiqeni ta nisin at\u00eb diku n\u00eb server, ai thjesht nuk punon. Kontejner\u00ebt p\u00ebrpiqen t\u00eb tejkalojn\u00eb k\u00ebt\u00eb problem duke ofruar makina autonome, t\u00eb cilat mund t'i transportoni leht\u00ebsisht nga nj\u00eb server n\u00eb tjetrin, duke ditur se ato do t\u00eb funksionojn\u00eb gjithmon\u00eb. Si\u00e7 e tregon emri, ato p\u00ebrmbajn\u00eb kodin, bibliotekat dhe software t\u00eb tjera t\u00eb nevojshme p\u00ebr funksionimin. Kubernetes, nga ana tjet\u00ebr, \u00ebsht\u00eb nj\u00eb platform\u00eb orkestrimi p\u00ebr kontejner\u00ebt<\/a><\/noindex>. N\u00eb parim, me t\u00eb mund t\u00eb menaxhoni pa nd\u00ebrprerje qindra ose mij\u00ebra kontejner\u00eb t\u00eb ndrysh\u00ebm.<\/p>\n

<\/p>\n

M\u00eb posht\u00eb jan\u00eb disa p\u00ebrfundime q\u00eb kam dal\u00eb nga k\u00ebndv\u00ebshtrimi i ekipit t\u00eb kuq dhe atij t\u00eb blu.<\/p>\n

<\/p>\n

Ekipi i kuq<\/h2>\n

<\/p>\n

Shumica e p\u00ebrmbajtjes s\u00eb kontejner\u00ebve funksionon n\u00ebn root<\/strong>: kjo do t\u00eb thot\u00eb se n\u00ebse kompromentoni nj\u00eb kontejner, do t\u00eb keni qasje t\u00eb plot\u00eb n\u00eb at\u00eb kontejner. Kjo e b\u00ebn hapat pasues significativamente m\u00eb t\u00eb leht\u00eb.<\/p>\n

<\/p>\n

Montimi i docker.sock brenda kontejnerit \u00ebsht\u00eb i rreziksh\u00ebm<\/strong>: n\u00ebse fitoni root brenda kontejnerit dhe po ashtu instaluat Docker brenda kontejnerit q\u00eb ka socket-in Docker (\/var\/run\/docker.sock), keni nj\u00eb mund\u00ebsi potenciale p\u00ebr t\u00eb shqyrtuar nj\u00eb kluster t\u00eb t\u00ebr\u00eb, duke p\u00ebrfshir\u00eb qasjen n\u00eb \u00e7do kontejner tjet\u00ebr. Ky lloj qasjeje nuk \u00ebsht\u00eb e mundur t\u00eb parandalohet as me izolimin rrjetor, as me m\u00ebnyra t\u00eb tjera.<\/p>\n

<\/p>\n

Variablat e mjedisit shpesh p\u00ebrmbajn\u00eb t\u00eb dh\u00ebna sekrete<\/strong>: n\u00eb shumic\u00ebn e rasteve, njer\u00ebzit d\u00ebrgojn\u00eb fjal\u00ebkalime n\u00eb kontejner p\u00ebrmes variablave t\u00eb zakonsh\u00ebm t\u00eb ambientit. Pra, n\u00ebse keni qasje n\u00eb llogarin\u00eb, mund t\u00eb shikoni k\u00ebta variabla t\u00eb ambientit p\u00ebr t\u00eb zgjeruar m\u00eb pas kompetencat tuaja.<\/p>\n

<\/p>\n

Docker API mund t\u00eb jap\u00eb shum\u00eb informacion<\/strong>: Docker API, kur \u00ebsht\u00eb konfiguruar n\u00eb m\u00ebnyr\u00eb standarde, punon pa autorizim dhe mund t\u00eb ofroj\u00eb nj\u00eb mori informacioni. Duke p\u00ebrdorur Shodan mund t\u00eb gjeni leht\u00ebsisht nj\u00eb list\u00eb t\u00eb porteve t\u00eb hapura, gjithashtu mund t\u00eb merrni informacion t\u00eb holl\u00ebsish\u00ebm p\u00ebr klust\u00ebrin \u2013 dhe t\u00eb kaloni n\u00eb kapjen e tij t\u00eb plot\u00eb. TrendMicro kan\u00eb shkruar nj\u00eb artikull shum\u00eb interesant<\/a><\/noindex>.<\/p>\n

<\/p>\n

Ekipi i blus\u00eb<\/h2>\n

<\/p>\n

Mos e lan\u00e7oni p\u00ebrmbajtjen e kontejner\u00ebve n\u00ebn root<\/strong>: megjith\u00ebse \u00ebsht\u00eb m\u00eb e leht\u00eb t\u00eb ekzekutosh n\u00ebn root, nuk duhet ta b\u00ebsh k\u00ebt\u00eb. N\u00eb vend t\u00eb k\u00ebsaj, ekzekuto aplikacionet me t\u00eb drejtat e hequra duke shfaqur uid ose duke p\u00ebrdorur parametrin \u2014user kur punon me CLI, ose duke caktuar USER n\u00eb Dockerfile.<\/p>\n

<\/p>\n

Mos lejoni instalimin e programeve n\u00eb kontejner\u00eb<\/strong>: pothuajse \u00e7do sulm fillon me instalimin e di\u00e7kaje. Duke filluar nga nmap dhe duke p\u00ebrfunduar me ifconfig e m\u00eb pas vet\u00eb Docker (brenda kontejnerit), instalimi i di\u00e7kaje brenda kontejnerit ka qen\u00eb nj\u00eb norm\u00eb. P\u00ebr k\u00ebt\u00eb arsye, duhet t\u00eb bllokoni gjithmon\u00eb t\u00eb gjith\u00eb portet e pap\u00ebrdorura. Kjo gjithashtu ndihmon p\u00ebr t\u00eb parandaluar d\u00ebrgimin e komandave t\u00eb menaxhimit kur kompjuteri juaj infektohet. P\u00ebrve\u00e7 parandalimit t\u00eb instalimit t\u00eb programeve, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb siguroheni q\u00eb n\u00eb vet\u00eb kontejneri t\u00eb jet\u00eb instaluar numri minimal i aplikacioneve t\u00eb nevojshme p\u00ebr t\u00eb p\u00ebrfunduar detyr\u00ebn.<\/p>\n

<\/p>\n

Mbroni docker.sock<\/strong>: duhet mbrojtur, sepse p\u00ebrmes k\u00ebtij socket-i trajtohet komunikimi mes kontejnerit dhe klusterit. Duke qen\u00eb se nuk dua t\u00eb futem n\u00eb detaje n\u00eb k\u00ebt\u00eb artikull, ju lutem lexoni sh\u00ebnimin nga Docker<\/a><\/noindex>, \u00e7far\u00eb mund t\u00eb ndodh\u00eb, si dhe se si mund ta bllokoni k\u00ebt\u00eb t\u00eb gjith\u00eb.<\/p>\n

<\/p>\n

P\u00ebrdorni sekretet Docker n\u00eb vend t\u00eb variablave t\u00eb ambientit<\/strong>: Sekretet ekzistojn\u00eb q\u00eb nga viti 2017<\/a><\/noindex>. Edhe pse nuk \u00ebsht\u00eb e sigurt, \u00ebsht\u00eb m\u00eb mir\u00eb se sa variablat e mjedisit p\u00ebr t\u00eb transferuar t\u00eb dh\u00ebna sekrete n\u00eb konteiner.<\/p>\n

<\/p>\n

N\u00ebse artikulli ju ka interesante p\u00ebr konteiner\u00ebt \u2014 mund t\u00eb instaloni leht\u00ebsisht Docker ose microk8s (nj\u00eb version i vog\u00ebl i Kubernetes). K\u00ebtu<\/a><\/noindex> ka udh\u00ebzime p\u00ebr instalimin e Docker p\u00ebr Linux dhe MacOS, dhe k\u00ebtu<\/a><\/noindex> \u2014 udh\u00ebzime p\u00ebr instalimin e microk8s p\u00ebr Windows, Linux dhe MacOS.<\/p>\n

<\/p>\n

Pas instalimit mund t\u00eb ndiqni k\u00ebt\u00eb udh\u00ebzues p\u00ebr fillestar\u00eb<\/a><\/noindex> nga Docker, nj\u00eb variant i ngjash\u00ebm propozohet<\/a><\/noindex> edhe p\u00ebr microk8s.<\/p>\n

<\/p>\n

N\u00ebse keni d\u00ebshir\u00eb ose nevoj\u00eb p\u00ebr t\u00eb ndjekur nj\u00eb kurs t\u00eb plot\u00eb mbi Docker, n\u00eb t\u00eb cilin fol\u00ebs praktik\u00eb analizojn\u00eb t\u00eb gjith\u00eb mjetet e tij: nga abstraksionet baz\u00eb te parametrat e rrjetit, nuancat e pun\u00ebs me sisteme t\u00eb ndryshme operative dhe gjuh\u00eb programimi, provoni \"Kursi video p\u00ebr Docker<\/a><\/noindex>\". Do t\u00eb njiheni me teknologjin\u00eb dhe do t\u00eb kuptoni se ku dhe si t\u00eb p\u00ebrdorni m\u00eb mir\u00eb Docker. Gjithashtu do t\u00eb merrni raste nga praktikat m\u00eb t\u00eb mira \u2014 m\u00eb mir\u00eb t\u00eb m\u00ebsoni n\u00eb siguri dhe me mb\u00ebshtetje nga praktikant\u00eb p\u00ebrmes historive mbi pengesat, sesa vet\u00eb p\u00ebrmes pengesave me doreza t\u00eb mprehta.<\/p>\n

Burimi: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u042f \u0440\u0430\u0431\u043e\u0442\u0430\u044e \u0432 IT \u0431\u043e\u043b\u044c\u0448\u0435 20 \u043b\u0435\u0442, \u043d\u043e \u043a\u0430\u043a-\u0442\u043e \u0440\u0443\u043a\u0438 \u043d\u0435 \u0434\u043e\u0445\u043e\u0434\u0438\u043b\u0438 \u0434\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u0412 \u0442\u0435\u043e\u0440\u0438\u0438 \u044f \u043f\u043e\u043d\u0438\u043c\u0430\u043b, \u043a\u0430\u043a \u043e\u043d\u0438 \u0443\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u0438 \u043a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442. \u041d\u043e \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044f \u043d\u0438\u043a\u043e\u0433\u0434\u0430 \u0441 \u043d\u0438\u043c\u0438 \u043d\u0435 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u043b\u0441\u044f \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u2014 \u044f \u043d\u0435 \u0431\u044b\u043b \u0443\u0432\u0435\u0440\u0435\u043d \u0432 \u0442\u043e\u043c, \u043a\u0430\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u043a\u0440\u0443\u0442\u044f\u0442\u0441\u044f-\u0432\u0435\u0440\u0442\u044f\u0442\u0441\u044f \u0443 \u043d\u0438\u0445 \u0448\u0435\u0441\u0442\u0435\u0440\u0451\u043d\u043a\u0438 \u043f\u043e\u0434 \u043a\u0430\u043f\u043e\u0442\u043e\u043c. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u044f \u0431\u044b\u043b \u0431\u0435\u0437 \u043f\u043e\u043d\u044f\u0442\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91365,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91364","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Studimi i (munges\u00ebs s\u00eb) siguris\u00eb s\u00eb instalimeve tipike t\u00eb Docker dhe Kubernetes | ProHoster","description":"Un\u00eb punoj n\u00eb IT.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437\u0443\u0447\u0430\u0435\u043c (\u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0443\u044e) \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0442\u0438\u043f\u0438\u0447\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a Docker \u0438 Kubernetes | ProHoster","og:description":"\u042f \u0440\u0430\u0431\u043e\u0442\u0430\u044e \u0432 IT.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/izuchaem-otsutstvuyushhuyu-bezopasnost-tipichnyh-ustanovok-docker-i-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-12T05:42:33+00:00","article:modified_time":"2020-08-12T05:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91364","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:29:22","updated":"2022-09-28 18:39:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=91364"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91364\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/91365"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=91364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=91364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=91364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}