Chii chinonzi kurwiswa kwemunhu ari pakati uye kuti kunonangwa sei Pipelines
Kana uchibvunza kuti chii chinonzi kurwisa kwevanhu vari pakati nepakati muDevOps, haisi nzira yekungofemba netiweki chete. Inzira yekunangwa. nzira yekukanganisa pfungwa dzako CI/CD pipelines nekubata nekushandura data riri kufambiswa, zvinoenderana, zvinyorwa, kana zvinhu zvakagadzirwa, kana encryption isina simba kana kuti isipo.
Ngatitorei mamiriro ezvinhu chaiwo: mumhanyi weCI anotora zvinhu zvinoenderana nedata kubva kune repository yechitatu achishandisa HTTP. Kana TLS isina kugadziriswa zvakanaka, kana kuti zvikatoipa, vapambi vanogona kumisa chikumbiro ichocho voisa mapakeji ane njodzi anoita seari echokwadi. pipelines, zvinhu izvi zvinogona kuvakwa uye kuiswa panzvimbo yacho munhu asati azviona. Iro bhuku rekushandisa kurwisa munhu ari pakati nepakati, asi ne CI/CD mhedzisiro.
Kurwiswa uku hakudi kuputsa encryption; kunoshandisa magadzirirwo asina kusimba. Funga nezve container building inodhawunirodha base image kana script kubva ku internal repo isina authentication. Ndiyo window yeMITM kana internal traffic isina encrypted kana segmented. Kana usati wanzwisisa kuti chii chinonzi kurwisa kwevanhu vari pakati nepakati, funga nezvazvo semutambi asingaonekwe achichinja chinyararire zvaunoita. pipeline inodya, pasina kusiya zviratidzo zviri pachena.
Iko iyo Pipeline Kuputsika: Mapoinzi Ekupinda eMITM Chaiwo mu CI/CD
Kune nzvimbo dzakawanda dzisina simba apo kurwisa kwemunhu ari pakati nepakati kunogona kutora mafambiro eDevOps:
- Kutora mapakeji kuburikidza neHTTP: Zvakajairika muzvivakwa zvekare kana marejista anozvishandira ega. Kana uri kudhonza Mapakeji ePython, NPM mamodule, kana Mifananidzo yeDocker Pasina HTTPS, unofumurwa.
- Manyuko asina kusimbiswa: PipelineKazhinji vanoshandisa maturusi emunharaunda kana maturusi akavhurika pasina kusimbisa kuvimbika. Varwisi veMITM vanogona kukanganisa madhawunirodha aya.
- Nzvimbo dzekuchengetedza zvinhu zvisina kusimbiswa: S3 buckets, Git LFS servers, kana internal artifact stores dzinowanikwa kuburikidza ne plain HTTP ibasa riri nyore kushandisa.
- Masevhisi emukati asina kuchengetedzeka: Zvizhinji zvemukati CI/CD zvishandiso (zvinomhanya, vamiririri, zvinyorwa zvekuparadzira) zvinofungidzira kuchengetedzeka kwenzvimbo yenetwork. MITM inogona kushandisa pfungwa iyoyo.
muenzaniso:
⚠️ Muenzaniso usina kuchengetedzeka: usashandise mukugadzira
Kana vanhu vakabatwa, murwisi anongoda kushandisa nzira yakanyorerwa .tar.gz nepayload. Izvi zvinoburitswa uye zvinoitwa panguva yekuvaka. Izvi zvisati zvaitikacisely chii chinonzi kurwiswa kwevanhu vari pakati nepakati mumazuva ano pipelines: zvinoshandisa mukana wekufungidzira kwekuvimba.
Kuvaka Kwakaipa: Kuiswa Kwekodhi Munguva Yekushanda Nenguva Yekuvaka
Kurwiswa kwevanhu vari pakati nepakati kunopfuura kubatwa kwemunhu; kunotungamira pakuiswa kwekodhi. Kana chinhu chine njodzi kana chinhu chakagadzirwa chikapinda mu pipeline, murwisi anodzora kuvakwa kwechinhu.
- Kupinza nguva yekuvaka: Makomputa kana ma script ekuvaka anoshandisa unverified dependencies anogona kusanganisira trojaned code. Funga nezvemutsetse wakavharika muMakefile unoitiswa nemvumo yakakwira.
- Jekiseni renguva yekumhanya: Zvinhu zvakavanzwa kana zvakavanzika zvinoratidzwa mumagwaro akajeka zvinogona kutorwa uye kushandiswazve. Kana runner yako ikanyora tumira kunze AWS_SECRET_KEY=…, une dambudziko rekubuda kwemvura rakamirira kuitika.
- Kugadziriswa kwematanho ane simba: CI yakatsanangurwa neYAML pipelines dzinowanzo vimba ne curl/wget kutora ma dynamic scripts. Kana iwayo asina kudzivirirwa, MITM attackers vanogona kuatsiva nekukurumidza.
⚠️ Muenzaniso usina kuchengetedzeka: usashandise mukugadzira
Kuziva chinonzi kurwiswa kwevanhu vari pakati nepakati kunoita kuti zvive nyore kunzwisisa kuti majekiseni aya anoitika sei: munhu anorwisa anova chikamu chehurongwa hwekutumira, achiisa mirairo yakaipa pasina mukana wekuwana kodhi yako.
Kuchengetedza DevOps PipelineKurwisa Njodzi Dzekurwiswa Nevanhu Pakati Nepakati
Haugone kubvisa kutyisidzira kwevanhu vari pakati nepakati, asi unogona kuita kuti pipelineZvakanyanya kuoma kuti zvibvumirane.
Matanho anogona kuitwa:
- Gara uchisimbisa TLS: Chinhu chega chega chakagadzirwa, chakavimbika, uye chinyorwa chinofanira kutorwa kuburikidza neHTTPS.
- Simbisa macheki/hashes: Shandisa SHA256 kana ma digest akasimba uye simbisa usati waita.
- Saina uye simbisa zvinhu zvakagadzirwaShandisa Sigstore kana kuti in-toto kuti uve nechokwadi chekuti inobva kupi.
- Vanomhanya veCI vakachengeteka: Bvisa nzvimbo dzakasiyana-siyana, dzivisa ma "runners" anowanikwa pamwe chete, uye dzima mukana we "shell access" kana zvichibvira.
- Bvisa zvakavanzika: Isa zvakavanzika mumatanho aunoda chete. Usambozvidhinda kana kuzvichengeta mumatanda.
matanho:
✅ Inoongorora kuvimbika kwechinyorwa usati waita
Idzi ndidzo mhando dzematanho ekuomesa musoro anoita kuti kurwiswa kwevanhu vari pakati nepakati kuve mubvunzo wepfungwa, kwete chiitiko chekugadzira.
Nei Izvi Zvichikosha: Kukanganisa Kwekutengeswa Kwezvinhu Uye Kuwedzera Njodzi
Kurwiswa kwemurume ari pakati nepakati CI/CD pipeline haisi nyaya yemuno chete; inokanganisa hupenyu hwako hwese cheni yekugovera software. Mutengi wese wechivakwa chako ari panjodzi.
Kana chinhu chine njodzi chikapinda muchivakwa, chinoparadzirwa pasi pemvura:
- Matangi akakanganisika anotanga kugadzirwa.
- Maraibhurari ane chepfu anoburitswa kumahofisi ehurumende.
- Vatengi vanoisa software ye backdoored.
Rudzi urwu rwekuwedzera simba ndiko kunoita kuti kurwiswa kwemagetsi emagetsi kuve kwakaipa zvikuru. MITM kazhinji ndiyo danho rekutanga, kwete chinangwa chekupedzisira. Kana wanga uchibvunza kuti chii chinonzi kurwisa kwevanhu vari pakati nepakati, ikozvino wava kuziva: ndiyo nzvimbo yekutanga yekubvumirana zvizere.
Mhedziso: Kuchinja Kuruboshwe kuenda Pipeline Security
Kurwiswa kwemunhu ari pakati nepakati muDevOps hakusi kwekuteerera pasina kungoita; asi ndeyekubata vanhu vasina kuchengetedzeka vari mukati mako. CI/CD. TLS isina kugadziriswa zvakanaka, manyuko asina kusimbiswa, uye zvinhu zvisina kusimbiswa zvinovhura musuwo. Vagadziri vanofanirwa kugadzirisa pipelines sekodhi yekugadzira: yakaedzwa, yakasimbiswa, uye yakachengetedzwa. Izvi zvinoreva kuti hapana kudhawunirodha kusina kusimbiswa, hapana masosi akavakirwa paHTTP, uye hapana dynamic execution isina kusimbiswa.
Zvishandiso senge Xygeni batsirai zvikwata kuti zviomese pipelinenekuona nzvimbo dzisina kusimba, kusimbisa kuvimbika kwechinhu chakagadzirwa, uye kubata vanhu vachikanganisa kuvimba nepfungwa dzavo vasati vapararira. Kuchinja kuruboshwe hakusi sarudzo; ndizvo zvinoita kuti urambe uri pamberi pezvipingamupinyi zveAppSec. Kunzwisisa chinonzi kurwiswa kwevanhu vari pakati nepakati hakuna kukwana. Unofanira kuzviona, kuzvidzivirira, uye kurega kurapa pipeline semugari wepamusoro-soro mumuenzaniso wako wekuchengetedza.
