欢迎来到天天文库
浏览记录
ID:48015189
大小:5.94 MB
页数:22页
时间:2019-07-14
《Least-privilegeMicroservices.pdf》由会员上传分享,免费在线阅读,更多相关内容在学术论文-天天文库。
1、Least-privilegeMicroservicesDiogoMónicaNathanMcCauleyAgenda•Whyleast-privilege•Historyofleast-privilege•Least-privilegewithDocker•Ongoingandfuturework•Conclusions“Everyprocessmustbeabletoaccessonlytheinformationandresourcesthatarenecessaryforitslegitimatepur
2、pose”AuthServiceDatabaseFront-endServer1990InternetAll-in-one2000InternetFront-endServicesDatabases2010InternetOneProcessContainerAppAAppBAppCAppDAppEAppFlibrariesDockerEngineHostOSServerTodayInternetProfiles‣AFEserverhasaverydifferentsecurityprofilethanadata
3、baseoraworkerhost‣ImaginethateachcontaineronlyhasaccessexactlytotheresourcesandAPIsitneeds.Nomore,noless.Front-endServerBack-endServerWorkerHost‣Accesstoalotof‣I/Ointensive‣CPUIntensivedownstreamservices‣Limitednetworkaccess‣Widerangeofworkloads‣MostexposedP
4、rocessMonitoring‣Acontainerisaprocess.Let’sfindoutwhatsyscallsitneeds.Fine-grainedcontrols‣Namespacesprovideanisolatedviewofthesystem(Network,PID,etc)‣Cgroupslimitandisolatetheresourceusageofacollectionofprocesses‣LinuxSecurityModulesgiveusaMAC(AppArmor,SELin
5、ux)Fine-grainedcontrols‣Capabilitiesdividestheprivilegesofrootintodistinctunits(bind,chown,etc)‣Per-containerulimit(since1.6)‣User-namespaces:rootinsideisnotrootoutside(remappedrootfor1.8)‣Seccomp:Individualsyscallfiltering(workingonmylaptop)Saferbydefault‣Le
6、ssthanhalftheLinuxcapabilitiesbydefault‣Copy-on-writeensuresimmutability‣Nodeviceaccessbydefault‣DefaultAppArmorandSELinuxprofilesforanincreasingnumberofcontainersSaferbydefault‣Smallerfootprint‣Removeallunneededpackages‣RemoveallunneededusersDebia‣Removealls
7、uidbinariesn…SecurityProfiles‣Producersofcontainersshouldberesponsibleforcreatingadequateprofiles‣ProfilegetsshippedwiththecontainerDebia‣AggregatesallofthedifferentisolationmechanismsintoonesingleprofilenSecuringtheEcosystemUser-namespacesSeccompProvenanceDebi
8、aSelinuxKerberosnIntrotoContainerSecurityDebianhttp://bit.ly/1M4O9XEDockerBench‣Fullyautomated‣ShippedasacontainerthattestscontainersDebianhttps://dockerbench.com/Conclusion‣Dockerisonthepathtos
此文档下载收益归作者所有
点击更多查看相关文章~~