云安全基础知识

Cloud

what is cloud computing

Through paying and the internet, shared software and hardware resources and information can be provided on demand to various end devices and other devices for computing and resources, using the computer infrastructure of one or more service providers as a service. This is the "cloud" we see. (Everything as a Service. EaaS, XaaS)

lines

Of course, I don't intend to use complex definitions that are irrelevant to the topic. So I think I can redefine this from the perspective of a developer or DevOps:

Leading companies like Alibaba (Aliyun), Huawei (Huawei Cloud), Google (GCP), and Amazon (AWS) provide a suite of products that cover almost the entire development lifecycle for small and micro enterprises, individual users, and even students.

In this article, we focus more on development-related content, so the following aspects are commonly listed:

For example:

• Code
• Code hosting services like Tencent Coding Platform and various alternatives (not very common though)
• Data storage
• Object storage like OSS AWS S3
• Database management like RDS (turnkey Mysql, Redis services for unified management)
• Deployment
• Virtual Server products like ECS (in AlibabaCloud) EC2 (in AWS)
• Middleware or Gateways
• Message queues
• CDN caching for efficient content delivery
• Security products like DDoS protection and cloud firewalls
• More Virtualization
• Container orchestration like ready-to-use Kubernetes clusters (almost all have this)
• Storage virtualization like virtual cloud disks
• Network virtualization like SDN for customizable internal networks, VPCs, domain names, IPs
• Container image storage for uploading and managing images
• Other peripheral services
• Compute services: GPU servers for big data and AI researchers
• Serverless: Proxy compute to distribute workload without buying servers to save costs
• Ops-related: Log management, protection, simple ops, domain and website hosting, cloud load balancing
• IoT device connectivity
• SMS services
• Cloud APIs for programmability: CLIs and underlying server APIs

This suite covers most common cloud services in developers and hackers' eyes.

Infrastructure-as-Code (IaC)

Infrastructure as code maybe originated from the need for collaboration between development and operations.

Due to security and access control requirements, developers often do not have direct server access privileges in practice. This makes debugging deployment issues extremely difficult for developers.

Additionally, in the classic workflow from code to deployment, code submitted by developers often has to go through "inspection", "review", "testing", and "release" before reaching the deployment side. So developers don't really have access to production environments.

At this point, they need to agree on some documentation or instructions to guide the deployment process. Of course, as those who have done collaborative development know, most of the time no one writes or reads the docs. Sometimes when a version iterates, things break and the deployment method changes. This foreshadows something I'll mention later.

So IaC emerged to define or declare the deployment process and resource dependencies (dependency library versions, packaging methods, startup methods, server resources like networking and databases, logging) through configuration scripts/tools. Using version control tools like Git brings scripted infrastructure definitions under version control. When you maintain the code in Git, it becomes GitOps. So It converts abstract infrastructure as a kind of code snippets.

Now, instead of coordinating with ops, config definitions allow developers who are also responsible for ops in DevOps to directly interface with servers, cloud, and CI/CD for business needs and requirements. Eliminating coordination overhead improves efficiency and speed.

Note

Lac实际就是一种规范和配置，方便运维部署多个相同的基础环境，类似于docker-compose.yaml文件

When Cloud involved

Container

Containerization is the first technological change in the cloud era.

To be more precise, containerization and container orchestration brought about the beginning of the cloud era.

The more common one is Kubernetes, which is Google rewriting its internal orchestration system and then donating it to the Linux Foundation as the beginning of the cloud era.

Of course this is not an article to study history.

Containers mainly provide developers with isolated minimal runtime environments to solve the pain point of "it runs locally but doesn't run remotely". See the IaC section of my first article.

Containers isolate many things. The specific method is to isolate various system resources through some new kernel features like cgroup and namespace, which greatly reduces the harm of traditional attacks that abuse dependent resources.

For example:

Consider this scenario: The application and compromised database resources are separated on a container-based repository

This prevents us from gaining server shell through writing one-line trojans using methods like dumpfile or logs, even if we take over all permissions in the database. The filesystem is isolated here.

However, the container itself still has two core attack surfaces. Here are some escapes, as follows:

- Kernel shared calls/memory

- Resources without proper separation, such as proc, etc.

> I know the interview question Zhiyou gave me Release-Agent Docker Escape. It's open sourced now, I built a knowledge graph with Obsidian. Check it out as a reference. Of course this article is also edited here.

The latter is basically an error configuration caused by developers being lazy or careless. The commonly used technique is called LoLBins. This is a very broad topic. I won't go into too much detail here.

> (To give a small example, the find command with incorrect suid can be used for privilege escalation with -exec /bin/bash -p etc.)

Tip

容器通常会使用各种安全机制来实现隔离性(cgroup、namespace etc)，但也存在容器逃逸的情况

Kubernetes

Google's famous orchestration system developed in Go and then donated to the Linux Foundation, thus CNCF. We won't say too much about the courtesy.

Similar systems include docker swarm, etc. but they are rarely used, and some are commercial solutions.

A "relatively" common configuration in small Internet companies is one set of k8s for development and testing, and one set of k8s environment for formal environment, mutually isolated. But they are very similar, doing microservices internally, and doing an nginx ingress load balancing and API Gateway externally, etc. Coupled with k8s service discovery and other features, it can greatly ensure a similar environment to development and testing during the release process.

Now there are also many public cloud services that have such services that can be purchased and used out of the box. Although there is no difference from building it yourself (x

As these services continue to improve, some companies will also gradually use the cloud to build their services.

If you're new to k8s, I'd recommend trying two materials - reading the official docs and hacktricks cloud security pentesting k8s (using the basics there as reading material can also allow us to quickly grasp the key points of the entire k8s framework), especially the latter.

The main vulnerabilities of k8s need to pay attention to the following scenarios

- The container issues mentioned above

- Permission configuration issues like serviceaccount credentials

- Also pay attention to whether there are some serious CVEs, especially privilege escalation ones

- Exposed control ports, monitoring platforms, management platforms, or Pods with special privileges

In addition, there is a useful enumeration tool called CDK, which also has https://madhuakula.com/kubernetes-goat/docs/ for these common scenarios.

The cluster monitoring web interface is often used by developers to monitor and test the status of the entire cluster. For example weave, of course this is a management tool, and also a legitimate backdoor. And it seems someone has done that.

As we all know, all management tools can be abused as hacker tools, such as psexec in the sysinternals toolkit.

云计算

云计算概念

云计算概念最早由Google前首席执行官， 埃里克*施密特， 在2006年搜索引擎大会上首次提出的一种构想， 而“云计算”就是这种构思的代名词， 云计算以虚拟化为基础，以网络为中心，为用户提供安全、快速、便捷的数据存储和网络计算服务，包括所需要的硬件、平台、软件及服务等资源，而提供资源的网络就被称为，“云”。

用通俗易懂的话解释就是：云计算是一种计算模型，它提供了一种通过互联网远程使用共享计算资源的方式。这些计算资源包括计算机处理能力、存储空间、数据库和软件等。这样，用户就可以在需要时随时随地获取这些资源，而不用自己拥有和维护这些硬件和软件。简单来说，云计算就是在互联网上用别人的电脑来运行自己的程序。

云计算模式

云计算模式是指云计算服务的不同类型。常见的云计算模式有：

1. IaaS (Infrastructure-as-a-Service)：基础设施即服务。这种模式提供了基础设施层的服务，如虚拟机、存储、网络等，用户可以根据需要自己搭建和管理系统。
2. PaaS (Platform-as-a-Service)：平台即服务。这种模式提供了平台层的服务，如数据库、编程框架等，用户可以在这个平台上开发和部署自己的应用程序。
3. SaaS (Software-as-a-Service)：软件即服务。这种模式提供了应用层的服务，如电子邮件、协作工具等，用户可以直接使用这些软件。优点是减少安装、减少的繁琐升级操作、统一管理。

这三种模式可以相互结合使用，根据需要提供不同层次的服务。

云计算分类

• 公有云：公有云是由云服务提供商提供的服务，可以由多个客户共享。常见的公有云服务包括亚马逊云、谷歌云、微软云等。公有云通常提供自动化、弹性和可伸缩性，适用于应用程序和数据的开发和部署。
• 私有云：私有云是由单个组织拥有和管理的云服务，只能由该组织的员工使用。私有云常用于保护敏感数据和满足特殊需求。私有云提供了更高的安全性和控制性，适用于数据中心的迁移和现有应用程序的升级。
• 混合云：混合云是私有云和公有云的结合。它允许组织在公有云和私有云之间进行数据和应用程序的流动。混合云可以提供最佳的安全性和灵活性，适用于多种业务场景。

在了解了云计算的分类之后，建立云环境时会使用到虚拟化和容器化技术。让我们简单地介绍一下它们。

公有云和私有云的核心在于最大化利用计算资源，通过虚拟化技术可以将一台物理机转化为多台虚拟服务器。虚拟化技术不可或缺的是虚拟化软件，常见的虚拟化软件包括Vmware和KVM，KVM是一个开源的解决方案，目前在公有云场景中较为常见，并且代表着整个行业的最高水平。

而容器技术是近几年非常热门的一种理念，它代表了兼容性和弹性能力。容器非常轻量级，主要依靠Linux内核的隔离能力。目前有影响力和流行的两个容器产品是Docker和K8S，K8S常常被称为云原生的代名词。

Cloud Service

云服务，顾名思义就是云上的服务，简单的来说就是在云厂商（例如 AWS、阿里云）那里买的服务。

目前国内云厂商有阿里云、腾讯云、华为云、天翼云、Ucloud、金山云等等，国外有亚马逊的 AWS、Google 的 GCP、微软的 Azure 等等。

各个云厂商对云服务的叫法都不统一，这里统一以 AWS 为例。

S3 对象存储Simple Storage Service，简单的说就是一个类似网盘的东西，当然跟网盘是有一定区别的。

EC2 即弹性计算服务Elastic Compute Cloud，简单的说就是在云上的一台虚拟机。

RDS 云数据库Relational Database Service，简单的说就是云上的一个数据库。

IAM 身份和访问管理Identity and Access Management，简单的说就是云控制台上的一套身份管理服务，可以用来管理每个子账号的权限。

因为这些原本都放在本地的东西上了云，相应的就会产生对应的安全风险，因为便有了研究的意义。

reference to：云服务 | T Wiki (teamssix.com)

云原生

容器

Docker 是一个开放源代码软件，是一个开放平台，用于开发应用、交付（shipping）应用、运行应用。Docker允许用户将基础设施（Infrastructure）中的应用单独分割出来，形成更小的颗粒（容器），从而提高交付软件的速度。

Docker 容器与虚拟机类似，但二者在原理上不同，容器是将操作系统层虚拟化，虚拟机则是虚拟化硬件，因此容器更具有便携性、高效地利用服务器。

下图是 Docker 官方给出的架构图，里面包括了 Docker 客户端、Docker 容器所在的宿主机和 Docker 镜像仓库三个部分。

其中宿主机包括了 Docker 守护进程、本地容器和本地镜像，Docker 守护进程（dockerd）的作用是侦听 Docker API 请求和管理 Docker 对象。

容器编排

容器编排（Container Orchestration）是指自动化容器的部署、管理、扩展和联网，容器编排可以为需要部署和管理成百上千个 Linux 容器和主机的

企业提供便利。

常见的容器编排工具方案有 Kubernetes、Docker Swarm 和 Apache Mesos 等。

以下是 Sysdig 在 2021 年给出的容器编排工具流行度图表，可以看到 Kubernetes 可谓是一骑绝尘。

图片来源：https://dig.sysdig.com/c/pf-2021-container-security-and-usage-report?x=u_WFRi&utm_source=gated-organic&utm_medium=website

无服务

无服务（Serverless）是一种云原生开发模型，可使开发人员专注构建和运行应用，这并不是说没有服务器，而是说开发者不用去管服务器只负责开发就行。

无服务计算产品通常被分为两类，分别是后端即服务（BaaS）和函数即服务（FaaS），其中 FaaS 是 Serverless 的主要实现方式，FaaS 的相关产品主要有 AWS 的 Lambda、Azure 的 Functions Serverless Compute、GCP 的 Firebase Cloud Functions、阿里云的 Function Compute 等。

微服务

微服务（Microservices）是一种软件架构风格，它是以专注于单一责任与功能的小型功能区块为基础，利用模块化的方式组合出复杂的大型应用程序，各功能区块使用与语言无关的API集相互通信。

这个是 Wiki 上给出的定义，如果具体的想了解微服务是什么可以看知乎上的这个帖子：https://www.zhihu.com/question/65502802

服务网格

服务网格（Service Mesh）用于控制应用的不同部分之间如何共享数据，服务网格内置于应用程序中的专用基础架构层，这个可见的基础架构层可以记录应用的不同部分是否能正常交互。

在服务网格中，请求将通过所在基础架构层中的代理在微服务之间路由，构成服务网格的各个代理有时被称为"sidecar"

如果没有服务网格，每项微服务都需要进行逻辑编码，才能管理服务间通信，这会导致开发人员无法专注于业务目标，同时，这也意味着通信故障难以诊断，因为管理服务间通信的逻辑隐藏在每项服务中。

CNCF

CNCF (Cloud Native Computing Foundation) 云原生计算基金会，于 2015 年7月21日成立，隶属于 Linux 基金会，CNCF 的口号是坚持和整合开源技术来编排容器作为微服务架构的一部分。

CNCF 是一个孵化、运营云原生生态的中立组织，CNCF 对于云原生应用的推广和普及发挥着重要的作用。

在 landscape.cncf.io 可以看到由 CNCF 所维护的云原生全景图。

云原生安全

云原生

云原生（Cloud Native）可以拆分成「云」和「原生」去看。

「云」相对的就是本地，传统应用都跑在本地服务器上，而云则表示跑在云服务器上。

「原生」则可以简单的理解成出生地的意思，放在云环境中所表达的意思就是：在把应用跑到云服务器上时，应该充分的利用云自身的特点，比如弹性和分布式优势。

如果只是简单的把原来本地跑的业务放到云上，高举“上云”大旗，那只能叫做“拆迁户”，不能叫做云原生；当“上云”的风潮过去后，开始出现了直接就部署在云上的业务，这些业务完全按照“云”的特点去设计，这种是“云”的原住民，可以叫做云原生。

CNCF 对于云原生的见解为：

云原生技术有利于各组织在公有云、私有云和混合云等新型动态环境中，构建和运行可弹性扩展的应用。云原生的代表技术包括容器、服务网格、微服务、不可变基础设施和声明式 API。

这些技术能够构建容错性好、易于管理和便于观察的松耦合系统。结合可靠的自动化手段，云原生技术使工程师能够轻松地对系统作出频繁和可预测的重大变更。

对于云原生系统一般有以下特征：

• 轻、快、不变的基础设施
• 弹性服务编排
• 开发运营一体化
• 微服务架构
• 无服务模型

云原生安全

在介绍完云原生后，云原生安全就变得容易理解了，云原生安全至少包含了微服务安全、无服务安全、编排平台安全、服务网格安全、容器安全、宿主机安全等等。

根据云原生环境的构成，面向云原生环境的安全体系可以概括为以下三个层面：

• 容器安全
• 编排系统安全
• 云原生应用安全：包括了微服务、无服务、服务网格、零信任体系、API 安全等等

另外除了这些和云原生环境相关的技术之外，云原生安全还包含了一些传统安全的内容，比如宿主机的安全等等。

参考链接：

《云原生安全-攻防实践与体系构建》

https://zh.wikipedia.org/wiki/Docker

https://www.jianshu.com/p/a37baa7c3eff

https://www.51cto.com/article/652294.html

https://jimmysong.io/kubernetes-handbook/cloud-native/cncf.html

https://zh.wikipedia.org/wiki/%E5%BE%AE%E6%9C%8D%E5%8B%99

https://www.redhat.com/zh/topics/cloud-native-apps/what-is-serverless

https://www.redhat.com/zh/topics/microservices/what-is-a-service-mesh

https://decodezp.github.io/2020/05/23/quickwords43-what-is-cloudnative

https://www.redhat.com/zh/topics/containers/what-is-container-orchestration

https://jimmysong.io/kubernetes-handbook/cloud-native/cloud-native-definition.html

https://www.cncf.io/announcements/2015/06/21/new-cloud-native-computing-foundation-to-drive-alignment-among-container-technologies/