Share
Embed
container-breakout
2021/06/22 Kubernetes Novice Tokyo #11
コンテナを突き破れ!!〜コンテナセキュリティ入門基礎の基礎〜
mochizuki875
June 22, 2021
Transcript
28 slides
-
ఆγφϦΦ ❯❯❯ kubectl get po NAME READY STATUS RESTARTS AGE
web-back 1/1 Running 1 20d database 1/1 Running 0 6d2h ubuntu 1/1 Running 0 25d web-front 1/1 Running 0 5d4h ,VCFSOFUFT্Ͱίϯςφʢ1PEʣ͕ಈ͍͍ͯΔͱ͠·͢ɻ ͋Δίϯςφʹ߈ܸऀ͕৵ೖͯ͠TIFMMΛऔಘ͞Εͨͱఆ͠·͢ɻ ˠʮίϯςφଞ͔Βִ͞Ε͍ͯΔʯͷͰ҆৺ɾɾɾͰ͢ΑͶʁʁ $POUBJOFS)PTUʢ8PSLFS/PEFʣ XFCGSPOU XFCCBDL EBUBCBTF VCVOUV "UUBDL Өڹ͕͋Δͷ ͜ͷίϯςφ͚ͩͷͣɾɾɾ CJOCBTI -
$POUBJOFS#SFBLPVU ৵ೖͨ͠ίϯςφ͔Β8PSLFS/PEFͰҙͷίϚϯυΛ࣮ߦ͢Δ͜ͱΛࢼΈ·͢ɻ ͜ͷΑ͏ʹίϯςφͷִڥ͔Βίϯςφ֎ʢϗετͳͲʣʹӨڹΛٴ΅͢ࣄΛ $POUBJOFS#SFBLPVUͱݺͼ·͢ɻ ˠ͜Ε͕Ͱ͖ΕΓ͍ͨ์ʂʂ $POUBJOFS)PTUʢ8PSLFS/PEFʣ VCVOUV "UUBDL CJOCBTI DNE
ίϯςφ͔Βϗετ্Ͱҙͷ ίϚϯυΛ࣮ߦ XFCGSPOU XFCCBDL EBUBCBTF ଞͷίϯςφͷ ߈ܸՄೳ ͬͨͥʂʂ ˞ࠓճରͷίϯςφʹ͋ΔઃఆෆඋΛࠐΜͰ͓Γɺͦ͜Λಥ͍ͯ߈ܸΛߦ͍·͢ɻ ɹʢܾͯ͠ಛघͳͷͰແ͍ͷͰҎ߱ͷ߈ܸखॱΛݟͳ͕ΒͲ͕͜Ϡό͍͔Ұॹʹߟ͑ͯΈ͍ͯͩ͘͞ʂʣ Կ͔͠ΒͷखஈͰίϯςφʹ ৵ೖͰ͖ͨͱ͠·͢ -
·ͣίϯςφͰಛఆDHSPVQʹαϒάϧʔϓΛ࡞͠·͢ɻ ίϯςφϗετͱDHSPVQΛڞ༗͍ͯ͠ΔͨΊɺϗετଆʹಉ͡αϒάϧʔϓ͕࡞͞Ε·͢ɻ ˞ҰൠతʹσϑΥϧτͰDHSPVQOBNFTQBDFϗετͱίϯςφͰڞ௨ SPPU!VCVOUVLTXPSLFSdMTTZTGTDHSPVQSENB DHSPVQDMPOF@DIJMESFODHSPVQQSPDTDHSPVQTBOF@CFIBWJPSOPUJGZ@PO@SFMFBTFSFMFBTF@BHFOUUBTLTY NLEJSTZTGTDHSPVQSENBY MTTZTGTDHSPVQSENB DHSPVQDMPOF@DIJMESFODHSPVQQSPDTDHSPVQTBOF@CFIBWJPSOPUJGZ@PO@SFMFBTFSFMFBTF@BHFOUUBTLTY ʢίϯςφʣ ʢϗετʣ
$POUBJOFS)PTUʢ8PSLFS/PEFʣ VCVOUV TZTGTDHSPVQSENB Y ίϯςφͰDHSPVQΛ࡞͢Δͱɺ ಉ͡ͷ͕ϗετ্ʹ࡞͞ΕΔ NLEJS $POUBJOFS#SFBLPVU -
DHSPVQͷSFMFBTFBHFOUΛ༗ޮԽ͠·͢ɻ OPUJGZ@PO@SFMFBTFʹઃఆ͢Δ͜ͱͰɺରDHSPVQͰཧ͍ͯ͠Δϓϩηε͕ऴྃͨ͠Β SFMFBTF@BHFOUʹొ͞ΕͨϓϩάϥϜΛ࣮ߦͤ͞Δ͜ͱ͕Ͱ͖·͢ɻ ˞ࠓճͷ߹SENBYʹॴଐ͢Δϓϩηε͕ऴྃͨ͠ΒSFMFBTF@BHFOUʹهࡌ͞ΕͨϓϩάϥϜ Λ࣮ߦͤ͞ΔΑ͏ʹ͠·͢ɻ FDIPTZTGTDHSPVQSENBYOPUJGZ@PO@SFMFBTF ʢίϯςφʣ $POUBJOFS)PTUʢ8PSLFS/PEFʣ VCVOUV TZTGTDHSPVQSENB
Y SFMFBTF@BHFOUΛ ༗ޮԽ͢ΔͨΊʹઃఆ FDIP OPUJGZ@PO@SFMFBTF $POUBJOFS#SFBLPVU -
ϗετͰ࣮ߦ͍ͨ͠ϓϩάϥϜΛίϯςφͰ࡞͠·͢ɻ DBU&0'DNE CJOTI FDIPIPTUOBNF$PNNBOEGSPN$POUBJOFSUNQPVUQVU IPTUOBNFUNQPVUQVU &0' DINPE YDNE ʢίϯςφʣ $POUBJOFS)PTUʢ8PSLFS/PEFʣ
VCVOUV TZTGTDHSPVQSENB Y ϓϩάϥϜΛ༻ҙ DNE FDIP OPUJGZ@PO@SFMFBTF $POUBJOFS#SFBLPVU -
NPVOUcHSFQPWFSMBZ PWFSMBZPOUZQFPWFSMBZ SX SFMBUJNF MPXFSEJSWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGT TOBQTIPUTGTWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTWBSMJC DPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGT VQQFSEJSWBSMJCDPOUBJOFSE JPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGT XPSLEJSWBSMJCDPOUBJOFSE
JPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTXPSL YJOPP ff ʢίϯςφʣ $POUBJOFS)PTUʢ8PSLFS/PEFʣ VCVOUV TZTGTDHSPVQSENB Y ࣮ࡍʹϗετ্ͷ 0WFSMBZGTʹଘࡏ 6QQFSEJS -PXFSEJS -BZFS -PXFSEJS -BZFS XPSL 0WFSMBZGT DNE DNE *NNVUBCMF-BZFS มߋࠩ ίϯςφͷSPPUGTϗετ্ͷ0WFSMBZGT͔ΒϚϯτ͞Ε͓ͯΓɺίϯςφ্Ͱ࡞ͨ͠ϑΝΠ ϧDNE࣮ࡍʹϗετ্ͷ0WFSMBZGTʢมߋ͕ࠩ֨ೲ͞ΕΔ6QQFSEJS্ʣʹଘࡏ͠·͢ɻ Ϛϯτ͞Ε͍ͯΔ0WFSMBZGTͷϗετ্ͰͷύεɺίϯςφͰNPVOUίϚϯυΛ࣮ߦ͢Δ͜ ͱͰ֬ೝՄೳͰ͢ɻ OPUJGZ@PO@SFMFBTF $POUBJOFS#SFBLPVU -
FDIPWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTDNETZTGT DHSPVQSENBSFMFBTF@BHFOU ʢίϯςφʣ $POUBJOFS)PTUʢ8PSLFS/PEFʣ VCVOUV TZTGTDHSPVQSENB Y 6QQFSEJS -PXFSEJS -BZFS
-PXFSEJS -BZFS XPSL 0WFSMBZGT DNE ొ SFMFBTF@BHFOU VQQFSEJSDNEϗετ͔Βݟ࣮ͨߦՄೳͳύεͱͳΔͨΊɺSFMFBTF@BHFOUʹొ͓ͯ͘͠ࣄͰ ରDHSPVQʢOPUJGZ@PO@SFMFBTFΛʹઃఆͨ͠DHSPVQʣʹॴଐ͢Δϓϩηε͕ऴྃͨ͠ࡍʹ ࣮ߦ͞ΕΔࣄʹͳΓ·͢ɻ ͜ΕͰ߈ܸͷ४උ͕͍·ͨ͠ɻ OPUJGZ@PO@SFMFBTF $POUBJOFS#SFBLPVU FDIP ࣮ߦϓϩάϥϜͱͯ͠ࢦఆ -
TIDFDIPaaTZTGTDHSPVQSENBYDHSPVQQSPDT ʢίϯςφʣ $POUBJOFS)PTUʢ8PSLFS/PEFʣ VCVOUV TZTGTDHSPVQSENB Y OPUJGZ@PO@SFMFBTF 6QQFSEJS -PXFSEJS -BZFS
-PXFSEJS -BZFS XPSL 0WFSMBZGT DNE ొ͞ΕͨϓϩάϥϜ͕࣮ߦ SFMFBTF@BHFOU ࣮ࡍʹ߈ܸ͠·͢ɻ VQQFSEJSDNEΛSFMFBTFBHFOUΛ࣮ͬͯߦͤ͞ΔͨΊʹɺҎԼͷίϚϯυʹΑΓ 1*%ΛDHSPVQ TZTGTDHSPVQSENBY ʹొ͠·͢ɻ ίϚϯυ࣮ߦ͕ྃ͢ΔͱDHSPVQʹઃఆͨ͠ϓϩηε͕ଘࡏ͠ͳ͍͜ͱʹͳΓSFMFBTF@BHFOUʹ ొͨ͠ϓϩάϥϜ͕ൃՐ͠·͢ɻ DHSPVQQSPDT QSPDFTT TI ίϚϯυ࣮ߦ࣌ʹ1*%͕ొ͞Ε ྃʹ͍আ͞ΕΔ ίϯςφͰίϚϯυΛ࣮ߦ ෦ʹهࡌͨ͠ίϚϯυ͕ ϗετ্Ͱ࣮ߦ $POUBJOFS#SFBLPVU -
ʢίϯςφଆͰ༻ҙͨ͠ϓϩάϥϜ࠶ܝʣ ίϯςφଆͰ༻ҙͨ͠ϓϩάϥϜ͕ϗετଆͰ࣮ߦ͞Εɺهࡌͨ͠ίϚϯυ͕࣮ߦ͞Ε͍ͯΔ͜ͱΛ֬ೝ͠· ͢ɻࠓճҎԼͷΑ͏ʹϗετଆʹϑΝΠϧΛ࡞͠ɺϝοηʔδΛग़ྗ͢ΔίϚϯυΛϓϩάϥϜͰఆٛ ͠·ͨ͠ɻ ϗετଆͰ֬ೝ͢ΔͱίϯςφͰ༻ҙͨ͠ϓϩάϥϜ͕࣮ߦ͞Εɺϝοηʔδ͕ग़ྗ͞Ε͍ͯΔ͜ͱ͕͔Γ ·͢ɻ SPPU!VCVOUVLTXPSLFSdDBUUNQPVUQVU IPTUOBNF$PNNBOEGSPN$POUBJOFS VCVOUVLTXPSLFS ʢϗετʣ
DBU&0'DNE CJOTI FDIPIPTUOBNF$PNNBOEGSPN$POUBJOFSUNQPVUQVU IPTUOBNFUNQPVUQVU &0' ྫ͑ҎԼͷΑ͏ͳϓϩάϥϜΛίϯςφͰ༻ҙ࣮ͯ͠ߦͨ͠߹ɺίϯςφ͔Βϗετ্ͷશͯͷϑΝΠϧʹ ΞΫηεग़དྷΔ༷ʹͳΓ·͢ɻʢྫ͑͜ͷঢ়ଶͰ$3*ιέοτʹΞΫηε͢Είϯςφͷૢ࡞Մೳʣ DBU&0'DNE CJOTI MOTWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTIPTUSPPU &0' $POUBJOFS#SFBLPVU -
ʢίϯςφଆͰ༻ҙͨ͠ϓϩάϥϜ࠶ܝʣ SPPU!VCVOUVLTXPSLFSdDBUUNQPVUQVU IPTUOBNF$PNNBOEGSPN$POUBJOFS VCVOUVLTXPSLFS ʢϗετʣ DBU&0'DNE CJOTI FDIPIPTUOBNF$PNNBOEGSPN$POUBJOFSUNQPVUQVU IPTUOBNFUNQPVUQVU &0'
ྫ͑ҎԼͷΑ͏ͳϓϩάϥϜΛίϯςφͰ༻ҙ࣮ͯ͠ߦͨ͠߹ɺίϯςφ͔Βϗετ্ͷશͯͷϑΝΠϧʹ ΞΫηεग़དྷΔ༷ʹͳΓ·͢ɻʢྫ͑͜ͷঢ়ଶͰ$3*ιέοτʹΞΫηε͢Είϯςφͷૢ࡞Մೳʣ DBU&0'DNE CJOTI MOTWBSMJCDPOUBJOFSEJPDPOUBJOFSETOBQTIPUUFSWPWFSMBZGTTOBQTIPUTGTIPTUSPPU &0' $POUBJOFS#SFBLPVU ίϯςφଆͰ༻ҙͨ͠ϓϩάϥϜ͕ϗετଆͰ࣮ߦ͞Εɺهࡌͨ͠ίϚϯυ͕࣮ߦ͞Ε͍ͯΔ͜ͱΛ֬ೝ͠· ͢ɻࠓճҎԼͷΑ͏ʹϗετଆʹϑΝΠϧΛ࡞͠ɺϝοηʔδΛग़ྗ͢ΔίϚϯυΛϓϩάϥϜͰఆٛ ͠·ͨ͠ɻ ϗετଆͰ֬ೝ͢ΔͱίϯςφͰ༻ҙͨ͠ϓϩάϥϜ͕࣮ߦ͞Εɺϝοηʔδ͕ग़ྗ͞Ε͍ͯΔ͜ͱ͕͔Γ ·͢ɻ ͬͨͥʂʂ 😜 -
Կ͕͍͚ͳ͔ͬͨͷ͔ʁʁ ͔݁Βݴ͏ͱίϯςφʹಛݖΛ༩ͯ͠͠·͍ͬͯͨ͜ͱ͕ݪҼͰ͢ɻ ࣮ࠓճ߈ܸରʹͳͬͨίϯςφɺҎԼͷΑ͏ͳઃఆͰಈ͔͍ͯ͠·ͨ͠ɻ ͜ΕʹΑΓίϯςφͷϓϩηεϗετ্ͷSPPUϢʔβʔʢ6*%ʣͱಉͷ ݖݶΛ༗͢Δ͜ͱʹͳΓɺDHSPVQΛૢ࡞ͨ͠ΓϗετͰҙͷίϚϯυΛ ࣮ߦͰ͖·ͨ͠ɻ BQJ7FSTJPOW LJOE1PE NFUBEBUB MBCFMT
SVOVCVOUV OBNFVCVOUV TQFD DPOUBJOFST JNBHFVCVOUV OBNFVCVOUV DPNNBOE<CJOCBTI> BSHT<D UBJMGWBSMPHBMUFSOBUJWFTMPH> TFDVSJUZ$POUFYU QSJWJMFHFEUSVF VCVOUVQSJWJMFHFEZNM ίϯςφΛಛݖͰಈ࡞ TFDVSJUZ$POUFYUͰ1PEىಈʹ͓͚Δ༷ʑͳ ηΩϡϦςΟ߲Λઃఆ͢Δ͜ͱ͕Ͱ͖·͢ɻ ࠓճTFDVSJUZ$POUFYUͰίϯςφΛಛݖͰಈ࡞ͤ͞ ΔΦϓγϣϯΛ༗ޮԽ͍ͯ͠·ͨ͠ɻ ˞ҼΈʹࠓճίϯςφͷ࣮ߦϢʔβʔΛSPPUͱ͍ͯ͠·͢ɻ ɹίϯςφͷηΩϡϦςΟతʹ͜Ε͋·Γྑ͍ͱ͞ΕΔࣄͰ ɹͳ͍ͷͰ͕͢ɺࠓճͷͷຊ࣭Ͱແ͍ͨΊ͜͜ʹ৮Ε·ͤΜ ɹʢҰൠతʹ6TFS/BNFTQBDFΛϗετͱڞ༗͍ͯ͠Δ߹ʣ -
Կ͕͍͚ͳ͔ͬͨͷ͔ʁʁ ಛݖίϯςφͱඇಛݖίϯςφͰDHSPVQͷΞΫηεݖΛൺֱ͢Δͱɺ ඇಛݖίϯςφͰ3FBE0OMZʢ30ʣͰ͋Δͷʹରͯ͠ಛݖίϯςφͰ 3FBE8SJUFʢ38ʣʹͳ͍ͬͯΔ͜ͱ͕͔Γ·͢ɻ SPPU!VCVOUVOPOQSJWJMFHFENPVOUcHSFQDHSPVQ ʢུʣ DHSPVQPOTZTGTDHSPVQNFNPSZUZQFDHSPVQ SP OPTVJE OPEFW
OPFYFD SFMBUJNF NFNPSZ DHSPVQPOTZTGTDHSPVQQJETUZQFDHSPVQ SP OPTVJE OPEFW OPFYFD SFMBUJNF QJET DHSPVQPOTZTGTDHSPVQDQV DQVBDDUUZQFDHSPVQ SP OPTVJE OPEFW OPFYFD SFMBUJNF DQV DQVBDDU DHSPVQPOTZTGTDHSPVQSENBUZQFDHSPVQ SP OPTVJE OPEFW OPFYFD SFMBUJNF SENB ʢུʣ ʢඇಛݖίϯςφʣ ɹ௨ৗίϯςφͰDHSPVQͷΞΫηεݖ30ʹઃఆ͞Ε·͢ SPPU!VCVOUVNPVOUcHSFQDHSPVQ ʢུʣ DHSPVQPOTZTGTDHSPVQNFNPSZUZQFDHSPVQ SX OPTVJE OPEFW OPFYFD SFMBUJNF NFNPSZ DHSPVQPOTZTGTDHSPVQQJETUZQFDHSPVQ SX OPTVJE OPEFW OPFYFD SFMBUJNF QJET DHSPVQPOTZTGTDHSPVQDQV DQVBDDUUZQFDHSPVQ SX OPTVJE OPEFW OPFYFD SFMBUJNF DQV DQVBDDU DHSPVQPOTZTGTDHSPVQSENBUZQFDHSPVQ SX OPTVJE OPEFW OPFYFD SFMBUJNF SENB ʢུʣ ʢಛݖίϯςφʣ ࠓճͷέʔεͰಛݖΛ༩͑ͨ͜ͱʹΑΓDHSPVQͷΞΫηεݖ͕38ʹઃఆ͞Ε·ͨ͠ -
Կ͕͍͚ͳ͔ͬͨͷ͔ʁʁ ͔͠͠ͳ͕Βࠓճͷ߈ܸࣄྫͰ߈ܸରͷίϯςφΛಛݖίϯςφͱͯ͠ ࣮ߦ͍ͯͨ͠ҝɺDHSPVQʹΞΫηε͢Δ͜ͱ͕ՄೳͱͳΓɺϗετͷ߈ܸΛ ߦ͏͜ͱ͕Ͱ͖·ͨ͠ɻ SPPU!VCVOUVOPOQSJWJMFHFENLEJSTZTGTDHSPVQSENBY NLEJSDBOOPUDSFBUFEJSFDUPSZTZTGTDHSPVQSENBY3FBEPOMZ fi MFTZTUFN ʢಛݖίϯςφʣ࠶ܝɿDHSPVQͷ࡞ ʢඇಛݖίϯςφʣ
SPPU!VCVOUVNLEJSTZTGTDHSPVQSENBY ɾ ɾ ɾ ඇಛݖίϯςφͰ͋Εࠓճͷ߈ܸྫͷΑ͏ʹDHSPVQΛ࡞͠Α͏ͱͯ͠ ҎԼͷΑ͏ʹݖݶΤϥʔʹͳΓ·͢ɻ