Least-privilegeMicroservices.pdf

《Least-privilegeMicroservices.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、Least-privilegeMicroservicesDiogoMónicaNathanMcCauleyAgenda•Whyleast-privilege•Historyofleast-privilege•Least-privilegewithDocker•Ongoingandfuturework•Conclusions“Everyprocessmustbeabletoaccessonlytheinformationandresourcesthatarenecessaryforitslegitimatepur

2、pose”AuthServiceDatabaseFront-endServer1990InternetAll-in-one2000InternetFront-endServicesDatabases2010InternetOneProcessContainerAppAAppBAppCAppDAppEAppFlibrariesDockerEngineHostOSServerTodayInternetProfiles‣AFEserverhasaverydifferentsecurityprofilethanadata

3、baseoraworkerhost‣ImaginethateachcontaineronlyhasaccessexactlytotheresourcesandAPIsitneeds.Nomore,noless.Front-endServerBack-endServerWorkerHost‣Accesstoalotof‣I/Ointensive‣CPUIntensivedownstreamservices‣Limitednetworkaccess‣Widerangeofworkloads‣MostexposedP

4、rocessMonitoring‣Acontainerisaprocess.Let’sfindoutwhatsyscallsitneeds.Fine-grainedcontrols‣Namespacesprovideanisolatedviewofthesystem(Network,PID,etc)‣Cgroupslimitandisolatetheresourceusageofacollectionofprocesses‣LinuxSecurityModulesgiveusaMAC(AppArmor,SELin

5、ux)Fine-grainedcontrols‣Capabilitiesdividestheprivilegesofrootintodistinctunits(bind,chown,etc)‣Per-containerulimit(since1.6)‣User-namespaces:rootinsideisnotrootoutside(remappedrootfor1.8)‣Seccomp:Individualsyscallfiltering(workingonmylaptop)Saferbydefault‣Le

6、ssthanhalftheLinuxcapabilitiesbydefault‣Copy-on-writeensuresimmutability‣Nodeviceaccessbydefault‣DefaultAppArmorandSELinuxprofilesforanincreasingnumberofcontainersSaferbydefault‣Smallerfootprint‣Removeallunneededpackages‣RemoveallunneededusersDebia‣Removealls

7、uidbinariesn…SecurityProfiles‣Producersofcontainersshouldberesponsibleforcreatingadequateprofiles‣ProfilegetsshippedwiththecontainerDebia‣AggregatesallofthedifferentisolationmechanismsintoonesingleprofilenSecuringtheEcosystemUser-namespacesSeccompProvenanceDebi

8、aSelinuxKerberosnIntrotoContainerSecurityDebianhttp://bit.ly/1M4O9XEDockerBench‣Fullyautomated‣ShippedasacontainerthattestscontainersDebianhttps://dockerbench.com/Conclusion‣Dockerisonthepathtos