Firewall policy configuration method, electronic device, storage medium and program product

Abstract

Embodiments of the present application provide a firewall policy configuration method, electronic equipment, storage medium and program product, the method comprises: obtaining detection information of a target container, wherein the detection information of the target container at least includes a target container identifier and target port information corresponding to the target container identifier; determining preset port information corresponding to the target container identifier according to a pre-stored container mapping list; determining port change information according to the target port information and the preset port information; determining a protection policy corresponding to the target container according to the port change information, and configuring according to the protection policy, when the port of the Docker container changes, the detection information of the target container can be automatically updated to the firewall policy, the availability of the script is improved, and the container with port abnormalities can be detected in time, and the firewall is updated in time.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to methods for configuring firewall policies, electronic devices, storage media, and program products. Background Technology

[0002] Currently, servers typically use the Linux operating system, and Docker is a common virtualization container built on Linux. As an emerging virtualization method, Docker offers significant advantages over traditional virtual machines, such as higher resource utilization, faster startup times, a consistent runtime environment, continuous deployment and maintenance, easier migration, and easier maintenance and expansion. Existing Linux firewall settings rely on Docker containers for cross-network isolation and communication, and by default, expose all container ports to all networks. However, this default exposure of all ports poses a significant security risk to Docker, potentially leading to unrestricted container access or exploitation of application vulnerabilities. Therefore, firewall management of these ports is necessary. How to quickly monitor changes to Docker ports and update the firewall in real time is a pressing issue that needs to be addressed. Summary of the Invention

[0003] The purpose of some embodiments of this application is to provide a firewall policy configuration method, electronic device, storage medium, and program product. Through the technical solutions of the embodiments of this application, by acquiring detection information of a target container, wherein the detection information of the target container includes at least a target container identifier and target port information corresponding to the target container identifier; determining preset port information corresponding to the target container identifier according to a pre-stored container mapping list; wherein the pre-stored container mapping list includes at least a correspondence between container identifiers and port information; determining port change information according to the target port information and the preset port information; determining a protection policy corresponding to the target container according to the port change information, and configuring it according to the protection policy, the embodiments of this application, by acquiring the detection information of the target container and determining the corresponding preset interface information according to the pre-stored container mapping list, can analyze in real time whether the port of the target container has changed. When the port of the Docker container changes, the detection information of the target container can be automatically updated to the firewall policy, improving the availability of the script and enabling timely detection of containers with abnormal ports, and timely updating the firewall.

[0004] Firstly, some embodiments of this application provide a method for configuring a firewall policy, including:

[0005] Obtain detection information of the target container, wherein the detection information of the target container includes at least the target container identifier and the target port information corresponding to the target container identifier;

[0006] Based on a pre-stored container mapping list, determine the preset port information corresponding to the target container identifier; wherein, the pre-stored container mapping list includes at least the correspondence between container identifiers and port information;

[0007] Based on the target port information and the preset port information, determine the port change information;

[0008] Based on the port change information, a protection policy corresponding to the target container is determined, and the protection policy is configured accordingly.

[0009] Some embodiments of this application obtain the detection information of the target container and determine the corresponding preset interface information according to the pre-stored container mapping list. Then, they analyze in real time whether the port of the target container has changed. When the port of the Docker container changes, the detection information of the target container can be automatically updated to the firewall policy, improving the availability of the script and enabling timely detection of containers with abnormal ports and timely updating of the firewall.

[0010] Optionally, the container mapping list is obtained as follows:

[0011] Obtain the mapping information between the container identifier and port information, which is used to map the container's log directory to a specified path;

[0012] The mapping information between the container identifier and the port information is stored in a first database;

[0013] Based on the mapping information, obtain the container's log directory;

[0014] Based on the container's log directory, determine the log file corresponding to the container;

[0015] The log file is parsed to obtain keyword information, and the keyword information is stored in the first database;

[0016] The container mapping list is determined based on the correspondence between container identifiers, port information, log files, and keyword information in the first database.

[0017] Some embodiments of this application analyze the logs of Docker containers, record abnormal access IP addresses, analyze abnormal IPs on the host machine, record them after deduplication, add the recorded information to the DOCKER-USER chain, and store the results of historical log analysis to obtain the container mapping list.

[0018] Optionally, the step of obtaining the mapping information between the container identifier and port information, wherein the mapping information is used to map the container's log directory to a specified path, includes:

[0019] Start the Docker container;

[0020] Use the -v parameter to map the container's log directory.

[0021] Some embodiments of this application start containers using Docker, map log directories into containers, and record container IDs and corresponding ports in the database.

[0022] Optionally, determining the log file corresponding to the container based on the container's log directory includes:

[0023] Based on the container's log directory, retrieve multiple data entries from the same client source address within a preset time period;

[0024] The multiple data entries are deduplicated to obtain the processed data;

[0025] Based on the processed data, a log file corresponding to the container is obtained.

[0026] Some embodiments of this application reduce the storage space occupied by retaining only the last record in each group of marked data and deleting the remaining data with the same IP address in the same group.

[0027] Optionally, parsing the log file to obtain keyword information and storing the keyword information in the first database includes:

[0028] The log file is parsed, and keyword information corresponding to the keyword identifier is obtained based on the keyword identifier. The keyword identifier includes at least client information, and the client information includes at least a client identifier and a client source address.

[0029] Based on the keyword information, determine the error log information corresponding to the keyword information;

[0030] The time, keyword information, and error log information of the log file are stored in the first database.

[0031] Some embodiments of this application can automatically analyze Docker container logs in real time. By analyzing frequently occurring special fields in the logs, the IP addresses of abnormal access can be extracted and added to the firewall protection policy. This achieves the purpose of dynamically protecting Docker containers by analyzing logs, thereby improving the security of Docker containers. Moreover, the firewall policy does not need to be manually executed, improving efficiency and real-time performance.

[0032] Optionally, determining the protection policy corresponding to the target container based on the port change information, and configuring it according to the protection policy, includes:

[0033] Based on the port change information, obtain the client information in the first database;

[0034] Based on the target port information and the client information, the protection policy corresponding to the target container is determined using iptables commands, and then configured according to the protection policy.

[0035] Some embodiments of this application can monitor changes in Docker ports and update modified ports to firewall policies in a timely manner, thereby improving script availability.

[0036] Optionally, the method further includes:

[0037] Based on the port change information, the original protection strategy is deleted.

[0038] Some embodiments of this application avoid policy redundancy and facilitate subsequent management by promptly deleting obsolete policies from the DOCKER-USER chain.

[0039] Secondly, some embodiments of this application provide a firewall policy configuration apparatus, including:

[0040] The acquisition module is used to acquire detection information of the target container, wherein the detection information of the target container includes at least the target container identifier and the target port information corresponding to the target container identifier;

[0041] The lookup module is used to determine the preset port information corresponding to the target container identifier based on a pre-stored container mapping list; wherein the pre-stored container mapping list includes at least the correspondence between container identifiers and port information;

[0042] The determining module is used to determine port change information based on the target port information and the preset port information;

[0043] The configuration module is used to determine the protection policy corresponding to the target container based on the port change information, and to configure the protection policy accordingly.

[0044] Some embodiments of this application obtain the detection information of the target container and determine the corresponding preset interface information according to the pre-stored container mapping list. Then, they analyze in real time whether the port of the target container has changed. When the port of the Docker container changes, the detection information of the target container can be automatically updated to the firewall policy, improving the availability of the script and enabling timely detection of containers with abnormal ports and timely updating of the firewall.

[0045] Optionally, the apparatus further includes a setup module, the setup module being used for:

[0046] Obtain the mapping information between the container identifier and port information, which is used to map the container's log directory to a specified path;

[0047] The mapping information between the container identifier and the port information is stored in a first database;

[0048] Based on the mapping information, obtain the container's log directory;

[0049] Based on the container's log directory, determine the log file corresponding to the container;

[0050] The log file is parsed to obtain keyword information, and the keyword information is stored in the first database;

[0051] The container mapping list is determined based on the correspondence between container identifiers, port information, log files, and keyword information in the first database.

[0052] Some embodiments of this application analyze the logs of Docker containers, record abnormal access IP addresses, analyze abnormal IPs on the host machine, record them after deduplication, add the recorded information to the DOCKER-USER chain, and store the results of historical log analysis to obtain the container mapping list.

[0053] Optionally, the establishment module is used for:

[0054] Start the Docker container;

[0055] Use the -v parameter to map the container's log directory.

[0056] Some embodiments of this application start containers using Docker, map log directories into containers, and record container IDs and corresponding ports in the database.

[0057] Optionally, the establishment module is used for:

[0058] Based on the container's log directory, retrieve multiple data entries from the same client source address within a preset time period;

[0059] The multiple data entries are deduplicated to obtain the processed data;

[0060] Based on the processed data, a log file corresponding to the container is obtained.

[0061] Some embodiments of this application reduce the storage space occupied by retaining only the last record in each group of marked data and deleting the remaining data with the same IP address in the same group.

[0062] Optionally, the establishment module is used for:

[0063] The log file is parsed, and keyword information corresponding to the keyword identifier is obtained based on the keyword identifier. The keyword identifier includes at least client information, and the client information includes at least a client identifier and a client source address.

[0064] Based on the keyword information, determine the error log information corresponding to the keyword information;

[0065] The time, keyword information, and error log information of the log file are stored in the first database.

[0066] Some embodiments of this application can automatically analyze Docker container logs in real time. By analyzing frequently occurring special fields in the logs, the IP addresses of abnormal access can be extracted and added to the firewall protection policy. This achieves the purpose of dynamically protecting Docker containers by analyzing logs, thereby improving the security of Docker containers. Moreover, the firewall policy does not need to be manually executed, improving efficiency and real-time performance.

[0067] Optionally, the configuration module is used for:

[0068] Based on the port change information, obtain the client information in the first database;

[0069] Based on the target port information and the client information, the protection policy corresponding to the target container is determined using iptables commands, and then configured according to the protection policy.

[0070] Some embodiments of this application can monitor changes in Docker ports and update modified ports to firewall policies in a timely manner, thereby improving script availability.

[0071] Optionally, the configuration module is used for:

[0072] Based on the port change information, the original protection strategy is deleted.

[0073] Some embodiments of this application avoid policy redundancy and facilitate subsequent management by promptly deleting obsolete policies from the DOCKER-USER chain.

[0074] Thirdly, some embodiments of this application provide an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement a firewall policy configuration method as described in any embodiment of the first aspect.

[0075] Fourthly, some embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the firewall policy configuration method as described in any embodiment of the first aspect.

[0076] Fifthly, some embodiments of this application provide a computer program product, the computer program product including a computer program, wherein when the computer program is executed by a processor, it can implement the firewall policy configuration method as described in any embodiment of the first aspect. Attached Figure Description

[0077] To more clearly illustrate the technical solutions of some embodiments of this application, the accompanying drawings used in some embodiments of this application will be briefly described below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0078] Figure 1 A flowchart illustrating a firewall policy configuration method provided in an embodiment of this application;

[0079] Figure 2 A flowchart illustrating another firewall policy configuration method provided in this application embodiment;

[0080] Figure 3 A schematic diagram of a firewall policy configuration device provided in an embodiment of this application;

[0081] Figure 4 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0082] The technical solutions of some embodiments of this application will now be described with reference to the accompanying drawings.

[0083] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0084] Currently, servers typically use the Linux operating system, and Docker is a common virtualization container built on Linux. As an emerging virtualization method, Docker offers significant advantages over traditional virtual machines, such as higher resource utilization, faster startup time, a consistent operating environment, continuous deployment and maintenance, easier migration, and easier maintenance and expansion. Existing Linux firewall settings rely on Docker containers for cross-network isolation and communication, and by default, expose the container's ports to all networks. However, this default opening of all exposed ports poses a significant security risk to Docker, potentially leading to unrestricted container access or exploitation of application vulnerabilities. Therefore, firewall management of these ports is necessary. How to quickly detect changes in Docker ports and update the firewall in real time is a pressing issue. In view of this, some embodiments of this application provide a firewall policy configuration method. This method includes obtaining detection information of a target container, wherein the detection information of the target container includes at least a target container identifier and target port information corresponding to the target container identifier; determining preset port information corresponding to the target container identifier based on a pre-stored container mapping list; wherein... The pre-stored container mapping list includes at least the correspondence between container identifiers and port information; based on the target port information and preset port information, port change information is determined; based on the port change information, the protection policy corresponding to the target container is determined and configured according to the protection policy. In this embodiment, by obtaining the detection information of the target container and determining the corresponding preset interface information based on the pre-stored container mapping list, the port of the target container is analyzed in real time to see if it has changed. When the port of the Docker container changes, the detection information of the target container can be automatically updated to the firewall policy, improving the availability of the script and enabling timely detection of containers with abnormal ports and timely updating of the firewall.

[0085] like Figure 1 As shown, embodiments of this application provide a method for configuring a firewall policy, the method comprising:

[0086] S101. Obtain the detection information of the target container, wherein the detection information of the target container includes at least the target container identifier and the target port information corresponding to the target container identifier;

[0087] Specifically, multiple Docker containers are installed on the terminal device. Docker is an open-source platform for developing, delivering, and running applications. It can run on Windows, macOS, and Linux computers and packages an application and its dependencies into a container. These containers can run in any Docker-enabled environment. Containers are isolated from each other but can exchange information through specific channels. Docker provides a lightweight virtualization solution. Since all containers running on the same computer share the same operating system kernel, the overhead of starting and maintaining virtual machines is avoided. Therefore, compared to traditional virtual machines, Docker containers are more lightweight, faster, and easier to deploy. Using Docker can avoid the problem of inconsistent performance on two computers. Containers provide consistent behavior, thus enabling applications to run with the same effect on computers in different environments.

[0088] The terminal device obtains the detection information of the target container, wherein the detection information of the target container includes at least the target container identifier and the target port information corresponding to the target container identifier. For example, the terminal device obtains container 1 and port number 1 of container 1.

[0089] S102. Determine the preset port information corresponding to the target container identifier based on the pre-stored container mapping list; wherein, the pre-stored container mapping list includes at least the correspondence between container identifiers and port information;

[0090] Specifically, the terminal device has a container mapping list pre-stored. This container mapping list includes container identifiers and port information corresponding to the container identifiers. After obtaining the detection information of the target container, the preset port information corresponding to the target container identifier is found through this container mapping list.

[0091] S103. Determine the port change information based on the target port information and the preset port information;

[0092] The terminal device compares the target port information with the preset port information. If the target port information and the preset port information are the same, it means that the port information of the target container has not changed. If the target port information and the preset port information are different, it means that the port information of the target container has changed.

[0093] S104. Based on the port change information, determine the protection policy corresponding to the target container and configure it accordingly.

[0094] Specifically, when the port changes, based on the changed port information, i.e. the target port information of the target container, the target port information and the source address information of the client related to the target container are passed to the iptables command. Rules are added on the DOCKER-USER chain to prohibit the specified source address IP from accessing the specified port, thereby obtaining the protection policy corresponding to the target container, and configuring it according to the protection policy.

[0095] Some embodiments of this application obtain the detection information of the target container and determine the corresponding preset interface information according to the pre-stored container mapping list. Then, they analyze in real time whether the port of the target container has changed. When the port of the Docker container changes, the detection information of the target container can be automatically updated to the firewall policy, improving the availability of the script and enabling timely detection of containers with abnormal ports and timely updating of the firewall.

[0096] Another embodiment of this application further supplements the description of the firewall policy configuration method provided in the above embodiments.

[0097] Optionally, the container mapping list is obtained as follows:

[0098] Obtain the mapping information between the container identifier and port information. This mapping information is used to map the container's log directory to a specified path.

[0099] The mapping information between container identifiers and port information is stored in the first database;

[0100] Based on the mapping information, obtain the container's log directory;

[0101] Determine the log file corresponding to the container based on the container's log directory;

[0102] The log file is parsed to obtain keyword information, which is then stored in the first database.

[0103] The container mapping list is determined based on the correspondence between container identifiers, port information, log files, and keyword information in the first database.

[0104] Some embodiments of this application analyze the logs of Docker containers, record abnormal access IP addresses, analyze abnormal IPs on the host machine, record them after deduplication, add the recorded information to the DOCKER-USER chain, and store the results of historical log analysis to obtain the container mapping list.

[0105] Optionally, obtain the mapping information between the container identifier and port information. This mapping information is used to map the container's log directory to a specified path, including:

[0106] Start the Docker container;

[0107] Use the -v parameter to map the container's log directory.

[0108] Some embodiments of this application start containers using Docker, map log directories into containers, and record container IDs and corresponding ports in the database.

[0109] Optionally, based on the container's log directory, determine the log file corresponding to the container, including:

[0110] Based on the container's log directory, retrieve multiple data entries from the same client source address within a preset time period;

[0111] Multiple data entries are deduplicated to obtain the processed data;

[0112] Based on the processed data, obtain the log file corresponding to the container.

[0113] Some embodiments of this application reduce the storage space occupied by retaining only the last record in each group of marked data and deleting the remaining data with the same IP address in the same group.

[0114] Optionally, the log file is parsed to obtain keyword information, and the keyword information is stored in the first database, including:

[0115] The log file is parsed, and the keyword information corresponding to the keyword identifier is obtained based on the keyword identifier. The keyword identifier includes at least the client information, and the client information includes at least the client identifier and the client source address.

[0116] Based on the keyword information, determine the error log information corresponding to the keyword information;

[0117] The time, keyword information, and error log information of the log files are stored in the first database.

[0118] Some embodiments of this application can automatically analyze Docker container logs in real time. By analyzing frequently occurring special fields in the logs, the IP addresses of abnormal access can be extracted and added to the firewall protection policy. This achieves the purpose of dynamically protecting Docker containers by analyzing logs, thereby improving the security of Docker containers. Moreover, the firewall policy does not need to be manually executed, improving efficiency and real-time performance.

[0119] Optionally, based on the port change information, a protection policy corresponding to the target container is determined, and configuration is performed according to the protection policy, including:

[0120] Based on the port change information, obtain the client information from the first database;

[0121] Based on the target port information and client information, the protection policy corresponding to the target container is determined using iptables commands, and then configured according to the protection policy.

[0122] Some embodiments of this application can monitor changes in Docker ports and update modified ports to firewall policies in a timely manner, thereby improving script availability.

[0123] Optionally, the method further includes:

[0124] Based on the port change information, the original protection policy was deleted.

[0125] Some embodiments of this application avoid policy redundancy and facilitate subsequent management by promptly deleting obsolete policies from the DOCKER-USER chain.

[0126] like Figure 2 As shown in the figure, this application embodiment provides a configuration method for automatically adding firewall policies to a Docker container, including:

[0127] (1) Start the container using Docker, map the log directory into the container, and record the container ID and corresponding port to database B (the first database);

[0128] A log directory is created on the host machine. Multiple containers can be installed on the host machine, which is the terminal device. Each container can be associated with a client terminal. Each container has its own log file to record the access records of the client terminal. Each container is mapped to a specified path on the host machine. In this way, the host machine can find the log file of the corresponding container through the specified path in the log directory.

[0129] Specifically, the terminal device starts the container and uses the -v parameter to map the directory; the correspondence between the container ID (container identifier) ​​and the port is recorded in database B.

[0130] (2) Check if the DockerChain service is running. If it does not exist or is not running, proceed to step (7).

[0131] Execute the systemctl command to check if the system service DockerChain is running. If it is not running, proceed to step (3).

[0132] If the DockerChain service is already running, proceed to step (7).

[0133] (3) Obtain the container's log file, extract information based on keywords, and record it in database B;

[0134] Specifically, the host machine reads the log files mapped by each container one by one; and locates keywords (Failed password, Access denied, Fail Login, etc.) in the log files.

[0135] Extract keyword information based on keywords. The keyword information includes at least client information, such as the client's IP address and username. Record the log time, client's IP address, user, and error log information into database B.

[0136] (4) Analyze the log file and extract the deduplicated record values ​​to database B;

[0137] View the information in database B and mark multiple data entries with the same source IP from the same client terminal within a certain period of time.

[0138] In multiple groups of marked data, only the last record in each group is kept, and the other records with the same IP address in the same group are deleted. Alternatively, any record can be selected from multiple records as the target data.

[0139] (5) Based on the contents of database B, use the iptables command to add firewall rules on the Docker DOCKER-USER chain and record the rules (iptables command) in database X;

[0140] Based on the contents of database B, extract the port and IP (client) as the destination port and source address parameters;

[0141] Pass the above parameters to the iptables command to add a rule on the DOCKER-USER chain to prohibit the specified source IP address from accessing the specified port;

[0142] Record the iptables commands executed above into database X;

[0143] (6) Write the contents of database X into a shell script and register it to the system service (automatic startup next time, for startup protection function), bind it to the Docker service, and the DockerChain service will start automatically when the Docker service is restarted;

[0144] Write the iptables commands from database X into a shell script and run it;

[0145] Register the shell script file to the system service DockerChain;

[0146] By binding DockerChain to the Docker service, the DockerChain service will automatically start when the Docker service is restarted.

[0147] (7) When monitoring whether the container port has changed, obtain the current Docker container port mapping list (i.e., the container port and host port mapping list) and compare it with the port in database X (i.e. the pre-stored container mapping list, which is the container port in the last executed iptables) to see if there is a change. If there is no change, execute step (3); if there is a change, execute step (8).

[0148] The command retrieves the current Docker container port mapping list, and the host machine obtains the detection information of the target containers in the mapping list, including the target container identifier and target port information.

[0149] Based on the container ID (i.e. the target container identifier), compare the port in database X with the port in the current mapping list to see if there is a change. If there is no change, proceed to step (3). If there is a change, proceed to step (8).

[0150] (8) Based on the container ID, update the contents of the mapping list with changed ports to database X, and write the items before the change to database TEMP (temporary database);

[0151] Update the changed port to database X;

[0152] Write the original data with modified ports from database X to database TEMP.

[0153] (9) Process the contents of the TEMP database, write the processed contents into a shell script, and delete the iptables port rules before the change.

[0154] The contents of the TEMP database, when followed by the iptables command with the -D option, are used to delete the specified rules on the DOCKER-USER chain;

[0155] Write the iptables commands from the TEMP database into a shell script;

[0156] Execute a shell script to delete the iptables port rules that were not changed.

[0157] (10) Use the iptables command to add the updated rules to the DOCKER-USER chain and execute step (3);

[0158] Write the contents of database X into a shell script and execute it; execute step (3);

[0159] Here, database X refers to the database X whose port information has been updated after the port change;

[0160] By following the steps above, we can dynamically analyze Docker container logs, monitor container port changes, and automatically add Docker firewall policies, thus improving efficiency and accuracy.

[0161] This example illustrates a configuration method and system for automatically adding firewall policies to Docker containers, as proposed in this invention. By analyzing container logs in real time and detecting changes in container ports, the method automatically adds firewall policies, improving efficiency and accuracy.

[0162] For example, the firewall policy configuration method provided in this application embodiment includes:

[0163] (Taking CentOS as an example):

[0164] 1) Start the container using Docker, map the log directory into the container, and record the container ID and corresponding port in database B.

[0165] Use the following command to create the log directory:

[0166] mkdir logs

[0167] Start the container, using the -v parameter to implement directory mapping. In the following example, / var / logs is the absolute path to the directory created in the previous step, / var / log is the log directory name in the CentOS 7 container, and centos7 is the image name:

[0168] docker run–d–v / var / logs: / var / mysql / log centos7

[0169] Use the `docker ps` command to view the mapping between container IDs and ports, and record the results in database B.

[0170] Check if the DockerChain service is running. If the service does not exist, proceed to step 3. If the service is running, proceed to step 7.

[0171] Execute the command `systemctl status DockerChain` to check if the DockerChain service is running. If the result contains "running", it is running and proceed to step 7. If the result contains "not be found", it means the service does not exist and proceed to step 3.

[0172] Retrieve the log file, extract information based on keywords, and record it in database B.

[0173] Read the contents of the log file on the host machine, and filter the log file for lines containing the keyword. The example listed below is a log sample containing the keyword "Failed password".

[0174] Aug 21 02:53:12bogon sshd

[4817] :pam_unix(sshd:session):session opened for user root by(uid=0)

[0175] Aug 21 02:54:08bogon sshd

[4817] :pam_unix(sshd:session):session closed for user root

[0176] Aug 21 02:54:12bogon sshd

[4872] :Failed password for rootfrom10.65.37.21port 55167ssh2

[0177] Aug 21 02:54:13bogon sshd

[4872] :Failed password for rootfrom10.65.37.21port 55168ssh2

[0178] Aug 21 02:54:14bogon sshd

[4872] :Failed password for rootfrom10.65.37.21port 55169ssh2

[0179] Aug 21 02:54:14bogon sshd

[4872] :Failed password for rootfrom10.65.37.21port 55170ssh2

[0180] Aug 21 02:54:15bogon sshd

[4872] :Failed password for rootfrom10.65.37.21port 55171ssh2

[0181] The above sample contains 5 lines with the "Failed password" field. Extract the time (Aug 21 02:54:12), IP address (10.65.37.21), username (root), and error message ("Failed password for root from 10.65.37.21 port 55167 ssh2") from the above log sample. Record these extracted fields into database B, as shown in Table 1.

[0182] Table 1

[0183]

[0184] 2) Analyze the log file, remove duplicates, and record the data in database B.

[0185] View the information in database B and mark multiple data entries with the same source IP within a short period of time;

[0186] In the marked sets of data, only the last record in each set is kept, and the remaining records with the same IP address in the same set are deleted.

[0187] As shown in Table 2, for a set of data where the source IP is 10.65.37.21, only the last record is kept and the first four records are deleted. The result after deletion is shown in Table 2, which is the deduplicated database.

[0188] Table 2

[0189]

[0190] 3) Based on the contents of database B, use the iptables command to add firewall rules on the DOCKER-USER chain and record the rules in database X.

[0191] Based on database B and referring to Table 3, extract the port and IP address, and pass them as parameters to the iptables command to generate the following command:

[0192] iptables-IDOCKER-USER-p tcp-s 10.65.37.21--dport 22-j DROP

[0193] The generated commands are recorded in database X, as shown in Table 3:

[0194] Table 3

[0195]

[0196] 4) Write the contents of database X into a shell script and register it with the system service. Bind it to the Docker service so that the DockerChain service starts automatically when Docker is restarted.

[0197] Write the iptables commands from database X into a shell script and run it. An example of the shell script content is as follows:

[0198] #! / bin / sh

[0199] iptables-IDOCKER-USER-p tcp-s 10.65.37.21--dport 22-j DROP

[0200] Save the above script as DockerChain.sh, grant the file execute permissions, and run the script:

[0201] chmod+x DockerChain.sh

[0202] sh DockerChain.sh

[0203] Register the DockerChain service as a system service and configure it to automatically run with the Docker service:

[0204] systemctl start DockerChain

[0205] systemctl enabled DockerChain

[0206] Get the current Docker container port mapping list and compare it with the ports in database X to see if there are any changes. If there are no changes, proceed to step 3; if there are changes, proceed to step 8.

[0207] To retrieve the current Docker port mapping list, use the command `docker ps --format "{{.ID}}:{{.Ports}}"`. Table 4 shows the Docker container port mapping list, which can be obtained using the command `docker ps --format "{{.ID}}:{{.Ports}}"`.

[0208] Table 4

[0209]

[0210] By comparing the corresponding container ID and the port after -> with the corresponding container ID and port in database X, we can check if there have been any changes. In Table 4, the port of container ID "b326de3af6ae" in the second row has changed from 22 to 8022. Since there is a change, proceed to step 8.

[0211] Based on the container ID, update the database X with the changes to the port in the mapping list, and write the previous entries to the database TEMP.

[0212] Based on the container ID, update the changed data to database X. In this case, update 8022 to entry 22 of the iptables entry for the container with ID "b326de3af6ae" in database X. The updated content of database X is shown in Table 5. Table 5 shows the results of database X after the port change.

[0213] Table 5

[0214]

[0215] Write the original data with modified ports from database X into database TEMP. Here, we write the row with ID b326de3af6ae. The contents of database TEMP are shown in Table 6.

[0216] Table 6

[0217]

[0218] Process the contents of the TEMP database, write the processed contents into a shell script, and delete the iptables port rules that were not changed.

[0219] To process the contents of the TEMP database, replace -I with -D after iptables to delete the specified rules on the DOCKER-USER chain, as shown in Table 7 below;

[0220] Table 7

[0221]

[0222] Write the iptables commands for the TEMP database into the shell script DelOldChain.sh, with the following content:

[0223] #! / bin / sh

[0224] iptables -D DOCKER-USER-p tcp-s 10.65.37.21--dport 22-j DROP

[0225] Execute a shell script to delete the port rules that were not changed:

[0226] chmod+x DelOldChain.sh

[0227] sh DelOldChain.sh

[0228] Use the iptables command to add the updated rule to the DOCKER-USER chain, and then proceed to step 3.

[0229] Write the contents of database X into the shell script DockerChain and execute it. The script content is as follows:

[0230] #! / bin / sh

[0231] iptables-IDOCKER-USER-p tcp-s 10.65.37.21--dport 8022-j DROP

[0232] Execute the DockerChain script;

[0233] sh DockerChain.sh

[0234] Proceed to step 3.

[0235] This application embodiment automatically adds firewall policies by analyzing Docker container logs in real time and parsing abnormal access IP addresses, without manual execution, thus improving efficiency and real-time performance. When the port of the Docker container changes, it can automatically update the firewall policy, improving the availability of the script. It can also promptly delete obsolete policies in the DOCKER-USER chain, avoiding policy redundancy.

[0236] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0237] Another embodiment of this application provides a firewall policy configuration apparatus for executing the firewall policy configuration method provided in the above embodiments.

[0238] like Figure 3 The diagram shown is a structural schematic of a firewall policy configuration device provided in an embodiment of this application. The firewall policy configuration device includes an acquisition module 301, a search module 302, a determination module 303, and a configuration module 304, wherein:

[0239] The acquisition module 301 is used to acquire the detection information of the target container, wherein the detection information of the target container includes at least the target container identifier and the target port information corresponding to the target container identifier;

[0240] The lookup module 302 is used to determine the preset port information corresponding to the target container identifier based on a pre-stored container mapping list; wherein, the pre-stored container mapping list includes at least the correspondence between container identifiers and port information;

[0241] The determining module 303 is used to determine port change information based on the target port information and the preset port information;

[0242] The configuration module 304 is used to determine the protection policy corresponding to the target container based on the port change information, and to configure the protection policy accordingly.

[0243] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0244] Some embodiments of this application obtain the detection information of the target container and determine the corresponding preset interface information according to the pre-stored container mapping list. Then, they analyze in real time whether the port of the target container has changed. When the port of the Docker container changes, the detection information of the target container can be automatically updated to the firewall policy, improving the availability of the script and enabling timely detection of containers with abnormal ports and timely updating of the firewall.

[0245] Another embodiment of this application further supplements the description of the firewall policy configuration device provided in the above embodiments.

[0246] Optionally, the device further includes a setup module, which is used for:

[0247] Obtain the mapping information between the container identifier and port information. This mapping information is used to map the container's log directory to a specified path.

[0248] The mapping information between container identifiers and port information is stored in the first database;

[0249] Based on the mapping information, obtain the container's log directory;

[0250] Determine the log file corresponding to the container based on the container's log directory;

[0251] The log file is parsed to obtain keyword information, which is then stored in the first database.

[0252] The container mapping list is determined based on the correspondence between container identifiers, port information, log files, and keyword information in the first database.

[0253] Some embodiments of this application analyze the logs of Docker containers, record abnormal access IP addresses, analyze abnormal IPs on the host machine, record them after deduplication, add the recorded information to the DOCKER-USER chain, and store the results of historical log analysis to obtain the container mapping list.

[0254] Optionally, modules are created for:

[0255] Start the Docker container;

[0256] Use the -v parameter to map the container's log directory.

[0257] Some embodiments of this application start containers using Docker, map log directories into containers, and record container IDs and corresponding ports in the database.

[0258] Optionally, modules are created for:

[0259] Based on the container's log directory, retrieve multiple data entries from the same client source address within a preset time period;

[0260] Multiple data entries are deduplicated to obtain the processed data;

[0261] Based on the processed data, obtain the log file corresponding to the container.

[0262] Some embodiments of this application reduce the storage space occupied by retaining only the last record in each group of marked data and deleting the remaining data with the same IP address in the same group.

[0263] Optionally, modules are created for:

[0264] The log file is parsed, and the keyword information corresponding to the keyword identifier is obtained based on the keyword identifier. The keyword identifier includes at least the client information, and the client information includes at least the client identifier and the client source address.

[0265] Based on the keyword information, determine the error log information corresponding to the keyword information;

[0266] The time, keyword information, and error log information of the log files are stored in the first database.

[0267] Some embodiments of this application can automatically analyze Docker container logs in real time. By analyzing frequently occurring special fields in the logs, the IP addresses of abnormal access can be extracted and added to the firewall protection policy. This achieves the purpose of dynamically protecting Docker containers by analyzing logs, thereby improving the security of Docker containers. Moreover, the firewall policy does not need to be manually executed, improving efficiency and real-time performance.

[0268] Optionally, a configuration module is used for:

[0269] Based on the port change information, obtain the client information from the first database;

[0270] Based on the target port information and client information, the protection policy corresponding to the target container is determined using iptables commands, and then configured according to the protection policy.

[0271] Some embodiments of this application can monitor changes in Docker ports and update modified ports to firewall policies in a timely manner, thereby improving script availability.

[0272] Optionally, the configuration module is used for:

[0273] Based on the port change information, the original protection policy was deleted.

[0274] Some embodiments of this application avoid policy redundancy and facilitate subsequent management by promptly deleting obsolete policies from the DOCKER-USER chain.

[0275] Regarding the apparatus in this embodiment, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0276] It should be noted that each of the implementable methods in this embodiment can be implemented individually or in any combination without conflict. This application does not limit this.

[0277] This application also provides a computer-readable storage medium storing a computer program thereon. When the program is executed by a processor, it can implement the operation of any of the methods corresponding to the firewall policy configuration methods provided in the above embodiments.

[0278] This application also provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operation of any of the methods corresponding to the firewall policy configuration methods provided in the above embodiments.

[0279] like Figure 4 As shown, some embodiments of this application provide an electronic device 400, which includes a memory 410, a processor 420, and a computer program stored on the memory 410 and executable on the processor 420. When the processor 420 reads the program from the memory 410 via a bus 430 and executes the program, it can implement any of the methods included in the above-described firewall policy configuration method.

[0280] Processor 420 can process digital signals and may include various computing architectures. For example, it may be a complex instruction set computer architecture, a reduced instruction set computer architecture, or an architecture that implements multiple instruction set combinations. In some examples, processor 420 may be a microprocessor.

[0281] Memory 410 can be used to store instructions executed by processor 420 or data related to the execution of instructions. These instructions and / or data may include code for implementing some or all of the functions of one or more modules described in the embodiments of this application. The processor 420 of this disclosure embodiment can be used to execute instructions in memory 410 to implement the methods shown above. Memory 410 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0282] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0283] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0284] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method of configuring a firewall policy, characterized by, The method, applied to terminal devices, includes the following: Multiple containers are installed on the terminal device, each container is associated with a client terminal, each container has its own log file to record the access distance of the client terminal, and each container is mapped to a specified path on the terminal device. The log file is parsed to obtain keyword information, and the keyword information is stored in the first database; Based on the contents of the first database, use the iptables command to add firewall rules on the Docker DOCKER-USER chain and record the rules in database X to obtain a pre-stored list of container mappings; Write the contents of database X into a shell script, register it with the system service, bind it to the Docker service, and the DockerChain service will start automatically when the Docker service is restarted; When monitoring whether the port of a container changes, the detection information of the target container is obtained, wherein the detection information of the target container includes at least the target container identifier and the target port information corresponding to the target container identifier; Based on a pre-stored container mapping list, determine the preset port information corresponding to the target container identifier; wherein, the pre-stored container mapping list includes at least the correspondence between container identifiers and port information; Based on the target port information and the preset port information, determine the port change information; Based on the port change information, a protection policy corresponding to the target container is determined, and the protection policy is configured accordingly.

2. The method of claim 1, wherein, The container mapping list is obtained in the following way: Obtain the mapping information between the container identifier and port information, which is used to map the container's log directory to a specified path; The mapping information between the container identifier and the port information is stored in a first database; Based on the mapping information, obtain the container's log directory; Based on the container's log directory, determine the log file corresponding to the container; The log file is parsed to obtain keyword information, and the keyword information is stored in the first database; The container mapping list is determined based on the correspondence between container identifiers, port information, log files, and keyword information in the first database.

3. The firewall policy configuration method according to claim 2, characterized in that, The mapping information for obtaining container identifier and port information, which is used to map the container's log directory to a specified path, includes: Start the Docker container; Use the -v parameter to map the container's log directory.

4. The firewall policy configuration method according to claim 2, characterized in that, The step of determining the log file corresponding to the container based on the container's log directory includes: Based on the container's log directory, retrieve multiple data entries from the same client source address within a preset time period; The multiple data entries are deduplicated to obtain the processed data; Based on the processed data, a log file corresponding to the container is obtained.

5. The firewall policy configuration method according to claim 4, characterized in that, The step of parsing the log file to obtain keyword information and storing the keyword information in the first database includes: The log file is parsed, and keyword information corresponding to the keyword identifier is obtained based on the keyword identifier. The keyword identifier includes at least client information, and the client information includes at least a client identifier and a client source address. Based on the keyword information, determine the error log information corresponding to the keyword information; The time, keyword information, and error log information of the log file are stored in the first database.

6. The firewall policy configuration method according to claim 2, characterized in that, The step of determining the protection policy corresponding to the target container based on the port change information, and configuring it according to the protection policy, includes: Based on the port change information, obtain the client information in the first database; Based on the target port information and the client information, the protection policy corresponding to the target container is determined using iptables commands, and then configured according to the protection policy.

7. The firewall policy configuration method according to claim 6, characterized in that, The method further includes: Based on the port change information, the original protection strategy is deleted.

8. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it can implement the configuration method of the firewall policy according to any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, characterized in that, when the program is executed by a processor, it can implement the configuration method of the firewall policy according to any one of claims 1-7.

10. A computer program product, said computer program product comprising a computer program, wherein, When the computer program is executed by a processor, it can implement the configuration method of the firewall policy according to any one of claims 1-7.

Images