Ina pēhi koe i tētahi commit, to CI/CD pipeline ka oma, ka paahitia ngā whakamātautau, ā, he pāwhiri noa iho te tawhiti o te whakatinanatanga. Kātahi ka hē tō hanganga me te karere TLS ngaro.
Kāore he whakarerekētanga waehere hei whakapae, engari ko te pipeline he whero. I aha? Mō te nuinga o ngā tīma, ko te take he raruraru haumarutanga TLS, pērā i te tiwhikete kua pau te wā, te kupuhipa ngoikore, te tūmau whirihoranga hē rānei. Ko te rongo pai? He ngāwari te kite i ēnei raruraru i mua i te pakaru o ō hanganga mēnā e mōhio ana koe ki te whakamahi. OpenSSL s_client.
Mā tēnei tuhinga koe e ārahi i roto i te tātaritanga me te ārai i ngā hapa SSL i roto i CI/CD pipelines te whakamahi openssl s_client. Ka hipokina e mātou ngā tauira tūturu, ngā tikanga aunoatanga, me guardrails e pupuri ana i te haumaru o ō whakatinanatanga.
Ina tō Pipeline Ngā Karanga: He Rahunga TLS Tuturu
Anei tētahi āhuatanga e mōhiotia whānuitia ana e te tini o ngā miihini DevOps:
e Hapa SSL ko te tikanga kua pau te tiwhikete o te pūmutunga. In CI/CD, ka mutu ngā whakatinanatanga, ka pakaru ngā whakamātautau whakauru, ā, ka ārai pea i tō tukunga katoa.
Ko te mea kino rawa atu, ki te kore e arohia, ka taea e tēnei āputa haumarutanga TLS te whakaatu i ngā pūnaha whakaputa ki ngā whakaeke tangata-i-waenganui, te whakararu rānei i te ratonga.
He aha te take i noho ai a OpenSSL s_client hei maripi patuiro TLS a te Kaiwhakawhanake
He rerekē ki ngā whakatūpato pūtirotiro, he koretake, he ā-ringa hoki, s_client a OpenSSL e whakaatu ana i tētahi tirohanga mata, taipitopito o te rūrū a te TLS.
He pai mo:
- Te tirotiro i te putanga TLS me te whakamunatanga e whakamahia ana e te pito
- Te whakamana i te tika me te pono o ngā tiwhikete
- Te patuiro i ngā hononga tika i roto i te CI/CD mahi
Tauira tirotiro rūrū:
Ka kitea tonutia ngā taipitopito tiwhikete, ngā tuhinga huna e tautokona ana, me ngā hapa SSL katoa i te wā whiriwhiringa. Koia te take e whakamahia ana e te nuinga o ngā tīma DevSecOps hei taputapu haumarutanga TLS matua.
Ngā Hapa TLS/SSL Noa e Pakaru ai te CI Pipelines
Me wehewehe tātou i ngā hapa e tino kitea ana i roto i CI/CD, me ngā tauira poto me ngā pānga.
1 Ngā Tiwhikete Kua Pau, Kāore anō kia Whai Mana
Pānga: Ka rahua ngā whakamātautau aunoa ina whakamahia he tiwhikete tawhito e te whakawhirinakitanga. I roto i ngā hoahoa ratonga moroiti, ka taea e te tiwhikete kua pau te wā i roto i te ratonga ā-roto te aukati i te mekameka whakatinanatanga katoa.
2 Ngā Pūnaha Whakamutunga Ngoikore, Ngā Kawa Kua Whakakorehia rānei
Pānga: Ka rahua ngā kēti haumarutanga ina tautokona e tētahi ratonga te TLS 1.0/1.1, ngā tohu huna ngoikore rānei. He maha ngā wā ka puta tēnei i ngā wā matawai ture i roto i ngā taiao kua whakaritea.
3 Ngā Ingoa Kaihautū Kāore i te Taurite me ngā Tiwhikete Waitohu-ā-Whaiaro
Tauira: Ka whakamahia e te ratonga whakarite ā-roto he tiwhikete i tukuna mō ratonga.ā-rohe, engari te pipeline piiraa ratonga.whakawhanake. Heoi anō, tera pea nā te tangata ake i haina te tiwhikete, ā, kāore i te whakawhirinakihia e te toa whakawhirinaki a te kaiwhai.
Pānga: Ka rahua te manatoko rūrū ringa mēnā kāore i te tahakihia, he mea morearea i roto i te whakaputanga. He mea noa tēnei i roto i ngā karangatanga API ā-roto, i ngā tatūnga whakamātautau ā-rohe, i ngā taiao whakawhanake kua whirihorahia hē rānei.
4 Ngā Mekameka Tiwhikete Kāore i Oti
Tauira: Kāore he CA waenga i te tiwhikete whakatū.
Pānga: Ka rahua ngā hononga e ngā kaiwhakahaere he tino pakari ake te whakawhirinakitanga o ngā toa, ka hua ake ngā rahunga hanga ā-wā.
E hiahia ana ki te haere hohonu ki roto CI/CD Fakamanamana?
CI/CD pipelineHe mea nui te mahi a ēnei ki te whakahaere i te whanaketanga pūmanawa kia māmā ake. Heoi anō, i te mea ko ēnei pipelineI te mea ka nui haere te hiranga o ēnei, ka nui haere te hiranga o te tiaki i a rātou mai i ngā ngoikoretanga. Rukuhia ki roto i tētahi rangahau hōhonu e aro ana ki te aro atu ki tētahi mōrearea nui kua tautuhia i roto i te OWASP Top-10 CI/CD Ngā Mōrearea Haumarutanga!
Te Tātari i ngā Rahunga TLS i roto i CI/CD me te OpenSSL s_client
Te taahiraa tuatahi: tāruatia te hapa i roto i tō CI/CD taiao.
Mā tēnei ka hoatu he tuhinga rūrū TLS katoa, he kawa, he kupuhipa, he mekameka tiwhikete, me ngā hapa whakamana katoa.
Titiro hoki:
- Manatoko hapa pou
- Ngā putanga kawa TLS tawhito
- Ngā takawaenga ngaro i roto i te mekameka
Te Whakawhiti ki te Aunoatanga:
Kia kitea te pūtake o te take, ko te mahi e whai ake nei ko te whakahaere aunoa i ēnei tirotiro. He pai te tātaritanga ā-ringa kotahi, engari ki te kore he aunoatanga, ka kite koe i te ōrite. Hapa SSL ki tetahi atu pipeline ngā wiki i muri mai.
Te Aunoa i ngā Tirotiro TLS hei Haumarutanga Guardrails
Ka taea e koe te whakauru i ngā arowhai TLS ki roto i tō CI/CD kia kore ai e angitu wawe ngā whirihoranga kino:
- Whakatūpato mēnā ka pau te tiwhikete i roto i ngā rā e 30
- Āraia ngā tohu huna ngoikore me ngā putanga TLS kua kore e whakamahia
- Me whai mekameka tiwhikete katoa
Tauira ārai:
Tohutohu: Whakahaerehia tēnei i te wāhanga o mua i te whakatinanatanga kia kitea ai ngā take i mua i te hanumitanga o te waehere.
Te aukati i ngā ohorere TLS i roto i te whakaputanga
Kāore ngā raruraru TLS e puta noa i te wā whakatinanatanga. Ka pau te wā o ngā tiwhikete i ngā wā katoa. Koia te take e aro turuki tonu ai he mea nui i roto i te DevSecOps.
Tauira tirotiro kua whakaritea me GitHub Actions:
Ka taea e koe te whakarerekē i tēnei ki ngā mahi cron, ki a Jenkins, ki a Kubernetes rānei CronJobs hei matawai tonu i ngā pūwāhi mutunga mō ngā take haumarutanga TLS.
Ngā Tūponotanga Tuturu o te AppSec mai i te TLS Pakaru
Ehara i te mea he raruraru hanga noa iho ngā whirihoranga TLS pakaru; he kawenga haumarutanga hoki:
- Ngā whakaekenga MITM mēnā he ngoikore, he ngaro rānei te whakamunatanga
- Nga whakaeke whakaheke mēnā ka whakaaetia ngā tikanga tawhito
- Ngā mōrearea o te mekameka tuku mēnā ka puta ngā tango mōkihi mā roto i ngā hononga haumaru kore
Te Whakakotahi i ngā Mea Katoa me Guardrails
Whakaarohia tēnei tukanga penei: Tātari → Aunoa → Whakaū.
He aha Guardrails Kaupapa: In CI/CD, guardrails whakamutua ngā whirihoranga TLS kore haumaru i mua i te tīmatanga. Ka taea e rātou te aukati i tētahi whakatinanatanga mēnā:
- Kua tata te paunga o te tiwhikete
- Kua whakahohea he kupuhipa ngoikore
- Kua whakamahia he kawa tawhito
Tauira: I roto i te GitLab CI, ka rahua tonutia tētahi mahi mēnā ka whakautua e tētahi pito me te TLS 1.0, ka akiakihia te whakatika i mua i te hanumi.
Nga taputapu penei Xygeni ka taea te whakawhānui i ēnei guardrails hei matawai i tō mekameka tuku pūmanawa katoa mō ngā āputa haumarutanga TLS.
Ngā Kuputuhi Kotahi-Ringi a te OpenSSL s_client mō te CI
Tirohia te paunga:
Rārangihia ngā tohu huna:
Te tangohanga whakamutunga
OpenSSL s_client ehara i te whakahau rapurongoā noa iho; he taputapu DevSecOps mō te haumarutanga TLS matatau. Whakamahia hei hopu i ngā hapa SSL i mua i te pakaru o ō hanganga, ā, aunoatia kia kore ai koe e ohorere anō i te paunga o te tiwhikete, i te ngoikore rānei o te kupuhipa.
