https://www.chenshaowen.com/en/tags/security/Recent content in Security on Shaowen Chen's WebsiteHugo -- gohugo.ioen©2016 - {year}, All Rights Reserved.Thu, 04 Sep 2025 00:00:00 +0000weeklyhttps://www.chenshaowen.com/en/blog/kubernetes-base-environment-requirements.htmlThu, 04 Sep 2025 00:00:00 +0000Thu, 04 Sep 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/kubernetes-base-environment-requirements.html1. Base Packages Kubernetes version ≥ 1.18 socat Required conntrack Required ebtables Optional, but recommended ipset Optional, but recommended ipvsadm Optional, but recommended 1 apt-get -y install socat conntrack ebtables ipset ipvsadm 2. Port Requirements 2.1 Base Node Services Service Protocol Action Start Port End Port Comment ssh TCP allow 22 22 Node remote management docker TCP allow 2375 2376 Docker remote communication etcd TCP allow 2379 2380 etcd cluster communication 2.微信公众号KubernetesClusterConfigurationSecurityOperationsLearningInstallationDependenciesBest Practiceshttps://www.chenshaowen.com/en/blog/how-to-deploy-jumpserver-on-kubernetes.htmlThu, 09 Jan 2025 00:00:00 +0000Thu, 09 Jan 2025 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-deploy-jumpserver-on-kubernetes.html1. Deploying Jumpserver You need a StorageClass ready in advance to store Jumpserver’s data. Besides the database mentioned below, each component — jms-core, jms-web, jms-koko, jms-lion, jms-chen — also needs a PV for storage. 1.1 Deploying MySQL Refer to https://github.com/shaowenchen/ops-hub/blob/main/database/mysql8.yaml to deploy MySQL. You need to adjust the StorageClass field微信公众号KubernetesJumpserverSecurityOperationsBastion HostDeploymentLearninghttps://www.chenshaowen.com/en/blog/listen-runtime-security-using-falco.htmlSat, 11 Feb 2023 00:00:00 +0000Sat, 11 Feb 2023 00:00:00 +0000https://www.chenshaowen.com/en/blog/listen-runtime-security-using-falco.html1. What Falco Is Falco is a cloud-native runtime security project contributed to the CNCF by Sysdig. Falco implements an extensible event rule filtering engine. Through a series of operations — capturing events, matching security rules, and producing alert notifications — it can surface security problems in a system. The events come from system calls, and it also supports an ebpf probe; the rules are open source [1] and you can define your own extensions [2].微信公众号FalcoKubernetesSecurityToolsOperationshttps://www.chenshaowen.com/en/blog/hijack-docker-io-req-to-private-repository.htmlMon, 18 Jul 2022 00:00:00 +0000Mon, 18 Jul 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/hijack-docker-io-req-to-private-repository.html1. Self-signing a *.docker.io Domain Certificate 1.1 Creating a CA Certificate Generate the CA certificate private key 1 openssl genrsa -out ca.key 4096 Generate the CA certificate 1 2 3 4 openssl req -x509 -new -nodes -sha512 -days 3650 \ -subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=chenshaowen.com" \ -key ca.key \ -out ca.crt 1.2 Creating a *.微信公众号JenkinsKubernetesDockerImagesOperationsSecurityhttps://www.chenshaowen.com/en/blog/add-ssh-key-login-os-and-troubleshooting.htmlThu, 10 Mar 2022 00:00:00 +0000Thu, 10 Mar 2022 00:00:00 +0000https://www.chenshaowen.com/en/blog/add-ssh-key-login-os-and-troubleshooting.html1. Steps to Add a Key 1.1 Generate an SSH Key on the Client There are two key formats: Old format, the private key begins with -----BEGIN RSA PRIVATE KEY----- 1 ssh-keygen -m PEM -t rsa -b 4096 -C "mail@chenshaowen.com" New format, the private key begins with -----BEGIN OPENSSH PRIVATE KEY----- 1 ssh-keygen -t rsa -b 4096 -C "mail@chenshaowen.微信公众号SSHOperationsConfigurationSecurityTroubleshootinghttps://www.chenshaowen.com/en/blog/how-to-configure-networkpolicy-for-nodeport.htmlWed, 23 Jun 2021 00:00:00 +0000Wed, 23 Jun 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-configure-networkpolicy-for-nodeport.html1. Background As shown above, the business team needs to isolate the services in a namespace, forbidding access from workloads in the bar namespace while allowing users to reach the service through a Load Balancer (LB) via NodePort. It is easy to write a network policy: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 apiVersion: networking.微信公众号NetworkPolicyNetworkKubernetesOperationsSecurityLearningNodePortNetwork Isolationhttps://www.chenshaowen.com/en/blog/attack-vectors-under-kubernetes.htmlFri, 22 Jan 2021 00:00:00 +0000Fri, 22 Jan 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/attack-vectors-under-kubernetes.htmlThis document is mainly meant to demonstrate the dangers of Docker privileged mode, so please proceed with caution. Users without CLI access can copy the example YAML and directly create cluster workloads such as Pod, Job, and DaemonSet to carry out the operations. 1. Directly Deleting All Resources If you can log in to the machine, pack your things, and run the command:微信公众号KubernetesSecurityAttack VectorsOperationsDockerTroubleshootinghttps://www.chenshaowen.com/en/blog/operate-host-in-container-and-debug-container-on-host.htmlMon, 11 Jan 2021 00:00:00 +0000Mon, 11 Jan 2021 00:00:00 +0000https://www.chenshaowen.com/en/blog/operate-host-in-container-and-debug-container-on-host.html1. A Strange Requirement My boss had a strange requirement: use a single kubeconfig file to fetch all kinds of host status information, such as the process list and process states. My first reaction was that he must not understand containers — how could anyone use them that way, and if you were going to use them that way, why use containers at all?微信公众号ContainersSecurityKubernetesDockerOperationshttps://www.chenshaowen.com/en/blog/how-to-integrate-kata-in-kubernetes-cluster.htmlSun, 30 Aug 2020 00:00:00 +0000Sun, 30 Aug 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/how-to-integrate-kata-in-kubernetes-cluster.html1. What Problem Kata Solves Security and isolation are what make Kata Container stand out from Docker Container. Kata Container comes from the merger of the Intel Clear Containers and Hyper runV projects. Intel Clear Containers used Intel VT-x technology to provide containers through lightweight virtual machines, solving the security problem while delivering excellent performance.微信公众号KubernetesKataContainersSecurityOperationsVirtualizationhttps://www.chenshaowen.com/en/blog/incomplete-data-using-base64-decoding-jwt-playload.htmlMon, 08 Jun 2020 00:00:00 +0000Mon, 08 Jun 2020 00:00:00 +0000https://www.chenshaowen.com/en/blog/incomplete-data-using-base64-decoding-jwt-playload.htmlWhen Base64-decoding a JWT, I found that the JSON data was incomplete. This article mainly introduces the relevant knowledge and solves this problem. 1. Introduction to JWT JWT passes authentication by setting Authorization: Bearer <token> in the Header. A JWT Token is a Base64-encoded string joined by dots, something like微信公众号GoJWTEncodingBase64SecurityR&Dhttps://www.chenshaowen.com/en/blog/selinux-and-iptables-on-linux.htmlFri, 21 Sep 2018 00:00:00 +0000Fri, 21 Sep 2018 00:00:00 +0000https://www.chenshaowen.com/en/blog/selinux-and-iptables-on-linux.htmlWhile working on servers recently, I ran into a few concepts I wasn’t clear about, so I looked up some references and organized them as follows. 1. The BLP Security Model The model divides the entities in an information system into two parts: Subject: the entity performing the operations, such微信公众号SecurityLinuxiptablesSELinuxOperationshttps://www.chenshaowen.com/en/blog/symmetric-encrypted-transmission-of-aes.htmlWed, 26 Jul 2017 18:52:18 +0000Wed, 26 Jul 2017 18:52:18 +0000https://www.chenshaowen.com/en/blog/symmetric-encrypted-transmission-of-aes.html1. Basic Concepts Symmetric encryption: Symmetric encryption is an encryption method that uses a single-key cryptosystem, in which the same key is used both to encrypt and to decrypt the information. Because it is fast, it is often used to encrypt the transmission of large amounts of data. DES (Data微信公众号SecurityFrontendBackendEncryptionR&Dhttps://www.chenshaowen.com/en/blog/django-forms-function.htmlFri, 21 Jul 2017 21:29:40 +0000Fri, 21 Jul 2017 21:29:40 +0000https://www.chenshaowen.com/en/blog/django-forms-function.html1. Automatically Generating HTML Form Elements A Widget is the tool used to render an HTML element. Specifying a widget 1 2 3 4 5 6 from django import forms class CommentForm(forms.Form): name = forms.CharField() url = forms.URLField() comment = forms.CharField(widget=forms.Textarea) Output of CommentForm().as_table() 1 2 3 4 5 6微信公众号DjangoPythonSecurityR&Dhttps://www.chenshaowen.com/en/blog/permissions-of-django-rest-framework.htmlFri, 07 Jul 2017 06:47:19 +0000Fri, 07 Jul 2017 06:47:19 +0000https://www.chenshaowen.com/en/blog/permissions-of-django-rest-framework.html1. Permission Management in DRF Permission management in Django REST Framework consists of two parts. One is Authentication. It specifies how the user is authenticated, obtaining request.user. The other is Permissions. It performs permission control over Django resources and user categories. 1.1 Authentication Methods The relevant source is in the rest_framework/authentication.微信公众号DjangoPythonBackendSecurityAPIPermissionsR&Dhttps://www.chenshaowen.com/en/blog/source-code-analysis-of-arachni-1.htmlFri, 16 Jun 2017 21:02:22 +0000Fri, 16 Jun 2017 21:02:22 +0000https://www.chenshaowen.com/en/blog/source-code-analysis-of-arachni-1.htmlArachni is a web security vulnerability scanner built on the Ruby on Rails framework. 1. Ruby on Rails Ruby on Rails, abbreviated ROR, is a web framework that consists of two parts: the Ruby language and the Rails framework. Ruby had always been popular in Japan, until 2004, when a 26-year-old Dane, David Heinemeier Hansson, proposed the web framework Rails.微信公众号ToolsSecuritySource CodeR&DRubyhttps://www.chenshaowen.com/en/blog/xss-cheat-sheet.htmlSat, 20 May 2017 09:12:31 +0000Sat, 20 May 2017 09:12:31 +0000https://www.chenshaowen.com/en/blog/xss-cheat-sheet.htmlIf you use the Chrome browser to test XSS vectors, disable the browser’s XSS interception first. First, close all Chrome browser processes, then run: 1 chrome.exe -args --disable-xss-auditor --args --disable-web-security Enter non-web-safe mode. 1. Injecting HTML/JavaScript with the <> tags 1 <script>alert('XSS')</script> 1 '';!--"<XSS>=&{()} 1 2 //The quotes around SRC can be omitted <SCRIPT SRC=http://ha.微信公众号SecurityXSSR&DVulnerabilityFrontendhttps://www.chenshaowen.com/en/blog/principle-and-construction-of-xss.htmlTue, 16 May 2017 20:04:53 +0000Tue, 16 May 2017 20:04:53 +0000https://www.chenshaowen.com/en/blog/principle-and-construction-of-xss.htmlXSS is an attack technique that executes JavaScript in the frontend. With the popularity of UGC sites, the data generated by users has surged, and the ever-denser network of data blocks makes it easier to carry out and spread XSS. The damage XSS causes includes: stealing user cookies and personal information; hijacking sessions and manipulating users’ network data; launching DDoS attacks; tampering with pages, popping up ads, and so on.微信公众号SecurityJavaScriptXSSR&Dhttps://www.chenshaowen.com/en/blog/django-permissions-control.htmlSun, 22 Jan 2017 09:23:45 +0000Sun, 22 Jan 2017 09:23:45 +0000https://www.chenshaowen.com/en/blog/django-permissions-control.html1. Django Built-in Permission Management 1.1 Permission Categories Permission Used to define User A’s permission on Task. User If User A has permission on Model B, then User A has the corresponding permission on all instances in Model B. The user_permission field of the User object is used to manage微信公众号DjangoDevelopmentPermissionsPythonR&DLearningSecurityRBACAuthenticationhttps://www.chenshaowen.com/en/blog/study-of-bwapp.htmlSun, 25 Dec 2016 15:38:42 +0000Sun, 25 Dec 2016 15:38:42 +0000https://www.chenshaowen.com/en/blog/study-of-bwapp.html1. Introduction to BWAPP buggy web Application, abbreviated BWAPP, is an open-source web application that packs in all kinds of common and recent vulnerabilities, with the goal of helping security enthusiasts, developers, and students find and prevent web vulnerabilities. It contains more than 100 vulnerabilities, covering every major known web vulnerability, including the OWASP Top 10 security risks, and most importantly it already includes the OpenSSL and ShellShock vulnerabilities.微信公众号SecurityNetworkLearningBWAPP