Security operation and maintenance implementation method and device, electronic equipment and readable storage medium

Abstract

The invention provides a security operation and maintenance implementation method and device, electronic equipment and a readable storage medium, and the method comprises the steps: obtaining a work order application content, and generating access path information in a test environment based on the work order application content, and the access path information comprises a random high port number, account information and password information; and feeding back the IP address and the access path information of the test environment to the applicant. And performing etcd configuration of the corresponding production environment based on the work order application content, the access path information and the bastion host information, and generating a configuration file of the proxy component based on the etcd configuration. And after an access request sent by an applicant is obtained through the proxy component, account information and password information in the access request are verified based on the configuration file, and the access request is forwarded to the bastion host after verification is passed. According to the scheme, the random high port number, account information and password information are generated to realize access verification, so that the port of the bastion host is prevented from being directly exposed, and the risk of abnormal access is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device, electronic device and readable storage medium for implementing secure operation and maintenance. Background Art

[0002] Security operation and maintenance is an important part of ensuring the security of an organization's information technology infrastructure. Through security operation and maintenance, the purpose of defending against threats, protecting assets, and ensuring business continuity can be achieved. In the implementation of security operation and maintenance, the application of cloud servers is very common. Cloud servers can provide users with efficient, stable, and cost-effective computing storage services.

[0003] In the prior art, a reverse proxy is usually used in security operation and maintenance management to manage cloud servers by accessing the bastion host, so that the bastion host and cloud server can avoid exposing ports to the outside. However, in the existing method, the reverse proxy directly exposes the bastion host port, which may lead to abnormal access to the bastion host. Summary of the invention

[0004] In view of this, an object of the present invention is to provide a method, device, electronic device and readable storage medium for implementing secure operation and maintenance.

[0005] In order to achieve the above purpose, the technical solution adopted by the embodiment of the present invention is as follows:

[0006] In a first aspect, the present invention provides a method for implementing safe operation and maintenance, the method comprising:

[0007] Obtaining work order application content, and generating access path information in a test environment based on the work order application content, wherein the access path information includes a random high port number, account information, and password information;

[0008] Feedback the IP address and access path information of the test environment to the applicant;

[0009] Based on the work order application content, access path information and bastion host information, etcd configuration of the corresponding production environment is performed, and a configuration file of the proxy component is generated based on the etcd configuration;

[0010] After obtaining the access request sent by the applicant through the proxy component, the account information and password information in the access request are verified based on the configuration file, and the access request is forwarded to the bastion machine after the verification is passed.

[0011] In an optional implementation, the step of generating a configuration file of the proxy component based on the etcd configuration includes:

[0012] Monitor the etcd configuration through a configuration management tool, and after monitoring changes in the etcd configuration, combine the parameters in the etcd configuration into a configuration file for the proxy component;

[0013] Restart the proxy component to make the configuration file take effect.

[0014] In an optional implementation, the configuration file includes the high port number;

[0015] The step of obtaining the access request sent by the applicant through the proxy component includes:

[0016] Monitor the port with the high port number through the proxy component;

[0017] When an access request initiated by an applicant to the port with the high port number is monitored, the access request is received.

[0018] In an optional embodiment, the configuration file includes a source IP address;

[0019] The step of verifying the account information and password information in the access request based on the configuration file includes:

[0020] Obtaining a source IP address in the access request, and comparing the source IP address in the configuration file with the source IP address in the access request to see whether they are consistent;

[0021] If they are consistent, then check whether the account information in the configuration file is consistent with the account information in the access request;

[0022] If they are consistent, then check whether the password information in the configuration file is consistent with the password information in the access request. If they are consistent, it is determined that the verification is successful.

[0023] In an optional implementation, the bastion host information includes an IP address and a port of the bastion host, and the port corresponding to the high port number corresponds to the port of the bastion host;

[0024] The step of forwarding the access request to the bastion host after the verification is passed includes:

[0025] After the verification is passed, the access request is forwarded to the corresponding port of the bastion host based on the IP address and port of the bastion host.

[0026] In an optional implementation manner, the work order application content includes a validity period, and the method further includes:

[0027] Whether the validity period is reached is checked at preset intervals, and if so, the etcd configuration is deleted. After the etcd configuration is deleted, the configuration file becomes invalid.

[0028] In an optional implementation, the step of generating access path information in a test environment based on the work order application content includes:

[0029] Calling a proxy application in a test environment based on the work order application content;

[0030] The access path information is generated by the proxy application, and the format of the access path information is converted into a format that meets the requirements of the proxy component.

[0031] In a second aspect, the present invention provides a device for implementing safe operation and maintenance, the device comprising:

[0032] A generation module, used to obtain work order application content, and generate access path information in a test environment based on the work order application content, wherein the access path information includes a random high port number, account information, and password information;

[0033] A feedback module, used to feed back the IP address and access path information of the test environment to the applicant;

[0034] A configuration module, used to configure etcd for the corresponding production environment based on the work order application content, access path information and bastion host information, and generate a configuration file for the proxy component based on the etcd configuration;

[0035] The verification module is used to verify the account information and password information in the access request based on the configuration file after obtaining the access request sent by the applicant through the proxy component, and forward the access request to the bastion machine after the verification is passed.

[0036] In a third aspect, the present invention provides an electronic device, comprising a processor and a memory, wherein the memory stores machine executable instructions that can be executed by the processor, and the processor can execute the machine executable instructions to implement the secure operation and maintenance implementation method described in any one of the aforementioned implementations.

[0037] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method for implementing secure operation and maintenance as described in any one of the aforementioned implementation modes is implemented.

[0038] The embodiment of the present invention provides a method, device, electronic device and readable storage medium for implementing secure operation and maintenance. By obtaining the content of a work order application, access path information is generated in a test environment based on the content of the work order application, including a random high port number, account information and password information. The IP address and access path information of the test environment are fed back to the applicant. Based on the content of the work order application, the access path information and the bastion machine information, etcd configuration of the corresponding production environment is performed, and a configuration file of the proxy component is generated based on the etcd configuration. After obtaining the access request sent by the applicant through the proxy component, the account information and password information in the access request are verified based on the configuration file, and the access request is forwarded to the bastion machine after the verification is passed. This solution generates random high port numbers, account information and password information to achieve access verification, avoids directly exposing the port of the bastion machine, and reduces the risk of abnormal access.

[0039] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0041] Figure 1 A flowchart of a method for implementing secure operation and maintenance provided by an embodiment of the present invention;

[0042] Figure 2 for Figure 1 A flowchart of the sub-steps included in S11;

[0043] Figure 3 for Figure 1 A flowchart of the sub-steps included in S13;

[0044] Figure 4 for Figure 1 A flowchart of the sub-steps included in S14;

[0045] Figure 5 for Figure 1 Another flow chart of the sub-steps included in S14;

[0046] Figure 6 A functional module block diagram of a device for implementing secure operation and maintenance provided by an embodiment of the present invention;

[0047] Figure 7 This is a structural block diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0049] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0051] In the description of the present invention, it should be noted that the features in the embodiments of the present invention can be combined with each other without conflict.

[0052] See also Figure 1 , which is a flow chart of a method for implementing secure operation and maintenance provided by an embodiment of the present invention. The method for implementing secure operation and maintenance can be implemented by a secure operation and maintenance implementation device. The secure operation and maintenance implementation device can be implemented by software and / or hardware and can be configured in an electronic device. The electronic device can be a computer device, a server, etc. The detailed steps of the method for implementing secure operation and maintenance are described as follows.

[0053] S11, obtaining work order application content, and generating access path information in a test environment based on the work order application content, wherein the access path information includes a random high port number, account information, and password information.

[0054] S12, feeding back the IP address and access path information of the test environment to the applicant.

[0055] S13, based on the work order application content, access path information and bastion host information, etcd configuration of the corresponding production environment is performed, and a configuration file of the proxy component is generated based on the etcd configuration.

[0056] S14, after obtaining the access request sent by the applicant through the proxy component, the account information and password information in the access request are verified based on the configuration file, and the access request is forwarded to the bastion machine after the verification is passed.

[0057] In this embodiment, the work order application content can be obtained based on the filling operation of the applicant on the system. For example, the applicant can fill in the content in the work order system or other form system, and the filled content includes the production environment, reason, source IP address and validity period. Among them, the production environment refers to the production environment of the applicant, the reason can be a textual reason for accessing the bastion host, the source IP address refers to the current IP address of the applicant, and the validity period refers to the validity period set for this application, for example, it can be 4 hours, 1 day, 7 days, etc.

[0058] The work order application content needs to be reviewed. The work order application content can be sent to leaders at all levels for multiple review. After all the reviews are passed, the subsequent operations can be performed. If there are links that have not been reviewed, the application will be closed and the process will end directly.

[0059] When the work order application content is reviewed and approved, access path information is generated in a test environment based on the work order application content. The access path information is provided to the applicant to instruct the applicant to access according to the provisions of the access path information.

[0060] Among them, the access path information is generated in the test environment, which is used to perform various tests before the software is released to the production environment, such as unit testing, integration testing, performance testing, etc. This environment allows developers and testers to find and modify errors in the software without affecting actual users. The test environment usually simulates the configuration of the production environment, and the data in the test environment is usually simulated or copied from the production environment and desensitized to ensure the effectiveness and security of the test.

[0061] The above-mentioned production environment refers to the environment in which the software is officially run. It is oriented towards end users. The data in the production environment is actual business data and is crucial to the operation of the enterprise.

[0062] See also Figure 2 When generating access path information in a test environment based on the work order application content, this can be achieved in the following ways:

[0063] S111, calling a proxy application in a test environment based on the work order application content.

[0064] S112, generating access path information through the proxy application, and converting the format of the access path information into a format that meets the requirements of the proxy component.

[0065] In this embodiment, a script is written, and the script is used to call the agent application agent in the test environment with the work order application content as a parameter. After receiving the call request, the agent application generates a random high port number, such as a port number greater than 10000, and generates temporary account information and password information. The generated high port number, account information, and password information constitute the access path information.

[0066] In order to facilitate subsequent processing, the format of the access path information can also be converted into a format that meets the requirements of the proxy component, for example: user joe password$5$s6Subz0X7FSX2zON$r94OtF6gOfWlGmySwvn3pDFIAHbIpe6mWneueqt BOm / .

[0067] The work order application content and the generated access path information can be stored in a database, and the IP address and access path information of the test environment can be fed back to the applicant, for example, through SMS, email, application message, etc. In this way, after the applicant obtains the IP address and access path information of the test environment, it can subsequently initiate an access request based on the IP address and access path information of the test environment.

[0068] In addition, in this embodiment, the proxy application can also perform etcd configuration of the production environment based on the work order application content, access path information and bastion host information, that is, write the work order application content, access path information and bastion host information into the etcd configuration of the production environment. Specifically, the written information includes the source IP address, high port number, temporary account information, password information and the IP address and port of the bastion host.

[0069] Among them, etcd refers to a highly available key-value storage system in a distributed system, which is used to store key data in the distributed system and ensure the consistency of data between nodes in the cluster. Therefore, etcd configuration refers to the relevant configuration of the key-value storage system.

[0070] On this basis, through proxy components, such as haproxy, a configuration file is generated based on the etcd configuration. In this way, the corresponding source IP address can be limited based on the configuration file, and verification can be performed based on the account information and password information, and a high port number can be listened to.

[0071] When the applicant needs to access the corresponding application, the applicant can initiate an access request based on the access path information obtained. The proxy component can verify the access request based on the information in the configuration file, mainly including the verification of the account information and password information. If the verification is successful, the access request can be released, so that the applicant can access the bastion host. If the verification fails, the access request will be intercepted to prevent the bastion host from being illegally accessed.

[0072] The secure operation and maintenance implementation method provided in this embodiment generates random high port numbers, account information and password information to implement access verification, thereby avoiding direct exposure of the bastion host port and reducing the risk of abnormal access.

[0073] See also Figure 3 In this embodiment, after completing the etcd configuration, when generating the configuration file of the proxy component based on the etcd configuration, it can be achieved in the following ways:

[0074] S131, monitoring the etcd configuration through a configuration management tool, and after monitoring changes in the etcd configuration, combining the parameters in the etcd configuration into a configuration file of the proxy component.

[0075] S132: Restart the proxy component to make the configuration file take effect.

[0076] In this embodiment, the configuration management tool may be the Confd application, which is a lightweight configuration management tool mainly used for configuration file management in distributed systems. Its core function is to monitor configuration changes in the backend storage, generate configuration files based on the defined templates, and distribute them to all nodes in the system. Confd supports reading configuration parameters from named lines or environment variables and injecting them into templates to achieve automated configuration management. In practice, Confd is often used to simplify the configuration management process, especially in dynamic and distributed environments. For example, when it is necessary to respond quickly to configuration changes and avoid restarting services or containers, Confd can provide an effective solution.

[0077] Based on this, in this embodiment, the etcd configuration is monitored through the configuration management tool Confd. If the etcd configuration changes, the configuration management tool can accordingly combine the parameters in the etcd configuration into the configuration file of the proxy component. In this way, the proxy component can implement the corresponding source IP address limitation, specific account information, password information authentication, and monitoring of a port with a high port number based on the configuration file.

[0078] Thus, when the applicant initiates an access request, the step of obtaining the access request sent by the applicant through the proxy component can be implemented in the following way. Please refer to Figure 4 :

[0079] S141, monitoring the port with the high port number through the proxy component.

[0080] S142: When an access request initiated by the applicant to the port with the high port number is monitored, the access request is received.

[0081] As can be seen from the above, the configuration file includes a high port number, and the proxy component can monitor the port with the high port number based on the configuration file. Since the access path information fed back to the applicant includes the generated high port number, if the applicant initiates an access request in accordance with the regulations, the port pointed to by the access request should be the port corresponding to the high port number. Therefore, if the proxy component monitors the applicant to initiate an access request for the port with the high port number, the access request can be received through the port.

[0082] If the access request initiated by the applicant is not for the port corresponding to the high port number, it indicates that the access request does not comply with the rules, and the access request can be intercepted or not processed.

[0083] In this embodiment, a random high port number is generated and fed back to the applicant. In this way, it is possible to determine whether the access request initiated by the applicant is directed to the port corresponding to the high port number, thereby determining whether the access request complies with the rules to ensure that the bastion host is protected from illegal access.

[0084] After the proxy component listens to the access request for the port corresponding to the high port number, it receives the access request and verifies it based on the account information and password information in the configuration file. Figure 5 In this embodiment, this step can be implemented in the following way:

[0085] S143, obtain the source IP address in the access request, compare the source IP address in the configuration file with the source IP address in the access request to see if they are consistent, if they are consistent, execute the following S144, otherwise, execute the following S147.

[0086] S144, detecting whether the account information in the configuration file is consistent with the account information in the access request, if consistent, executing the following S145, otherwise, executing the following S147.

[0087] S145, detecting whether the password information in the configuration file is consistent with the password information in the access request, if consistent, executing the following S146, otherwise, executing the following S147.

[0088] S146, determine that the verification is passed.

[0089] S147, determining that the verification has not passed.

[0090] The work order application filled in by the applicant includes the source IP address, which is the applicant's current IP address. The final configuration file includes the source IP address, indicating that only access requests from the source IP address may be legal, and access requests from other sources are illegal.

[0091] Therefore, in this embodiment, the source IP address of the access request is first verified to detect whether it is consistent with the source IP address in the configuration file. If the two are consistent, the subsequent account information verification and password information verification are performed in sequence.

[0092] When all the above verifications are passed, it is determined that the final verification is passed.

[0093] If the access request is finally verified, the access request can be forwarded to the bastion host.

[0094] When configuring etcd, the bastion host information is written into the etcd configuration. The bastion host information includes the bastion host IP and port. The random high port number generated above corresponds to the port of the bastion host. After verification, the access request is forwarded to the corresponding port of the bastion host based on the bastion host IP address and port.

[0095] In this way, the authenticated access request can be successfully sent to the bastion host for processing without exposing the port of the bastion host, thereby ensuring the security of the bastion host.

[0096] The work order application filled in by the applicant includes a validity period, which can be used to control the access period to avoid illegal access caused by changes in the applicant's information or configuration.

[0097] Based on this, the security operation and maintenance implementation method provided in this embodiment may also include the following steps:

[0098] Whether the validity period is reached is checked at preset intervals, and if so, the etcd configuration is deleted. After the etcd configuration is deleted, the configuration file becomes invalid.

[0099] In this embodiment, the preset duration can be 1 minute, 10 minutes, etc. If the detection reaches the set validity period, the added etcd configuration will be deleted, so that the configuration file in the proxy component will become invalid. After the configuration file becomes invalid, the access request related to the configuration file will not be released, and the bastion host will no longer be accessible.

[0100] In this embodiment, by setting a validity period, the bastion host can be further protected from illegal access, thereby improving the security mechanism.

[0101] The security operation and maintenance implementation method provided in this embodiment has the advantages of convenience and compliance. The applicant can complete the application process and approval process on the smart terminal, and there are compliance and audit records when opening the bastion host permissions. The entire process can be automatically controlled and has validity period control, which can automatically open or close access rights to the bastion host. In addition, it has high security and ensures security by restricting the source IP address, verifying temporary account information and password information, etc.

[0102] Based on the same inventive concept, please refer to Figure 6 , shows a schematic diagram of the functional modules of the security operation and maintenance implementation device provided by an embodiment of the present invention. This embodiment can divide the functional modules of the security operation and maintenance implementation device according to the above method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules.

[0103] It should be noted that the division of modules in the embodiments of the present invention is schematic and is only a logical function division. There may be other division methods in actual implementation. For example, in the case of dividing each functional module according to each function, Figure 6 The safety operation and maintenance implementation device shown is only a schematic diagram of the device. The safety operation and maintenance implementation device may include a generation module, a feedback module, a configuration module and a verification module. The functions of each functional module of the safety operation and maintenance implementation device are described in detail below.

[0104] A generation module, used to obtain work order application content, and generate access path information in a test environment based on the work order application content, wherein the access path information includes a random high port number, account information, and password information;

[0105] It can be understood that the generation module can be used to execute the above S11. For the detailed implementation of the generation module, reference can be made to the above contents related to S11.

[0106] A feedback module, used to feed back the IP address and access path information of the test environment to the applicant;

[0107] It can be understood that the feedback module can be used to execute the above S12. The detailed implementation of the feedback module can refer to the above content related to S12.

[0108] A configuration module, used to configure etcd for the corresponding production environment based on the work order application content, access path information and bastion host information, and generate a configuration file for the proxy component based on the etcd configuration;

[0109] It can be understood that the configuration module can be used to execute the above S13. The detailed implementation of the configuration module can refer to the above content related to S13.

[0110] The verification module is used to verify the account information and password information in the access request based on the configuration file after obtaining the access request sent by the applicant through the proxy component, and forward the access request to the bastion machine after the verification is passed.

[0111] It can be understood that the verification module can be used to execute the above S14. The detailed implementation of the verification module can refer to the above content related to S14.

[0112] In a possible implementation, the above configuration module can be used to generate a configuration file in the following manner:

[0113] Monitor the etcd configuration through a configuration management tool, and after monitoring changes in the etcd configuration, combine the parameters in the etcd configuration into a configuration file for the proxy component;

[0114] Restart the proxy component to make the configuration file take effect.

[0115] In a possible implementation, the configuration file includes the high port number; the verification module obtains the access request in the following manner:

[0116] Monitor the port with the high port number through the proxy component;

[0117] When an access request initiated by an applicant to the port with the high port number is monitored, the access request is received.

[0118] In a possible implementation, the configuration file includes a source IP address; the verification module is used to implement verification in the following manner:

[0119] Obtaining a source IP address in the access request, and comparing the source IP address in the configuration file with the source IP address in the access request to see whether they are consistent;

[0120] If they are consistent, then check whether the account information in the configuration file is consistent with the account information in the access request;

[0121] If they are consistent, then check whether the password information in the configuration file is consistent with the password information in the access request. If they are consistent, it is determined that the verification is successful.

[0122] In a possible implementation, the bastion host information includes the IP address and port of the bastion host, and the port corresponding to the high port number corresponds to the port of the bastion host; the above-mentioned verification module is used to implement forwarding in the following manner:

[0123] After the verification is passed, the access request is forwarded to the corresponding port of the bastion host based on the IP address and port of the bastion host.

[0124] In a possible implementation manner, the safe operation implementation device further includes a detection module, which can be used to:

[0125] Whether the validity period is reached is checked at preset intervals, and if so, the etcd configuration is deleted. After the etcd configuration is deleted, the configuration file becomes invalid.

[0126] In a possible implementation, the generation module is used to generate access path information in the following manner:

[0127] Calling a proxy application in a test environment based on the work order application content;

[0128] The access path information is generated by the proxy application, and the format of the access path information is converted into a format that meets the requirements of the proxy component.

[0129] See also Figure 7 , is a block diagram of an electronic device provided in an embodiment of the present invention, the electronic device may be a computer device, a server, etc., and the electronic device includes a memory, a processor, and a communication module. The memory, the processor, and the communication module are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components may be electrically connected to each other via one or more communication buses or signal lines.

[0130] The memory is used to store programs or data. The memory may be, but is not limited to, random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), etc.

[0131] The processor is used to read / write data or programs stored in the memory and execute the security operation and maintenance implementation method provided by any embodiment of the present invention.

[0132] The communication module is used to establish a communication connection between the electronic device and other communication terminals through the network, and is used to send and receive data through the network.

[0133] It should be understood that Figure 7 The structure shown is only a schematic diagram of the structure of the electronic device. The electronic device may also include Figure 7 More or fewer components as shown, or with Figure 7 Different configurations are shown.

[0134] Furthermore, an embodiment of the present invention also provides a computer-readable storage medium, which stores machine-executable instructions. When the machine-executable instructions are executed, the security operation and maintenance implementation method provided in the above embodiment is implemented.

[0135] Specifically, the computer-readable storage medium can be a general storage medium, such as a mobile disk, a hard disk, etc. When the computer program on the computer-readable storage medium is executed, the above-mentioned security operation and maintenance implementation method can be executed. Regarding the process involved when the computer-readable storage medium and its executable instructions are executed, reference can be made to the relevant description in the above-mentioned method embodiment, which will not be described in detail here.

[0136] In summary, the security operation and maintenance implementation method, device, electronic device and readable storage medium provided by the embodiments of the present invention obtain the work order application content, and generate access path information in the test environment based on the work order application content, including random high port numbers, account information and password information. Feedback the IP address and access path information of the test environment to the applicant. Based on the work order application content, access path information and bastion machine information, etcd configuration of the corresponding production environment is performed, and a configuration file of the proxy component is generated based on the etcd configuration. After obtaining the access request sent by the applicant through the proxy component, the account information and password information in the access request are verified based on the configuration file, and the access request is forwarded to the bastion machine after the verification is passed. This solution generates random high port numbers, account information and password information to achieve access verification, avoids directly exposing the port of the bastion machine, and reduces the risk of abnormal access.

[0137] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for implementing safe operation and maintenance, characterized in that: The method comprises: Obtaining work order application content, and generating access path information in a test environment based on the work order application content, wherein the access path information includes a random high port number, account information, and password information; Feedback the IP address and access path information of the test environment to the applicant; Based on the work order application content, access path information and bastion host information, etcd configuration of the corresponding production environment is performed, and a configuration file of the proxy component is generated based on the etcd configuration; After obtaining the access request sent by the applicant through the proxy component, the account information and password information in the access request are verified based on the configuration file, and the access request is forwarded to the bastion machine after the verification is passed.

2. The method for implementing safe operation and maintenance according to claim 1, characterized in that: The step of generating a configuration file of a proxy component based on the etcd configuration includes: Monitor the etcd configuration through a configuration management tool, and after monitoring changes in the etcd configuration, combine the parameters in the etcd configuration into a configuration file for the proxy component; Restart the proxy component to make the configuration file take effect.

3. The method for implementing safe operation and maintenance according to claim 1, characterized in that: The configuration file includes the high port number; The step of obtaining the access request sent by the applicant through the proxy component includes: Monitor the port with the high port number through the proxy component; When an access request initiated by an applicant to the port with the high port number is monitored, the access request is received.

4. The method for implementing safe operation and maintenance according to claim 1, characterized in that: The configuration file includes a source IP address; The step of verifying the account information and password information in the access request based on the configuration file includes: Obtaining a source IP address in the access request, and comparing the source IP address in the configuration file with the source IP address in the access request to see whether they are consistent; If they are consistent, then check whether the account information in the configuration file is consistent with the account information in the access request; If they are consistent, then check whether the password information in the configuration file is consistent with the password information in the access request. If they are consistent, it is determined that the verification is successful.

5. The method for implementing safe operation and maintenance according to claim 1, characterized in that: The bastion host information includes the IP address and port of the bastion host, and the port corresponding to the high port number corresponds to the port of the bastion host; The step of forwarding the access request to the bastion host after the verification is passed includes: After the verification is passed, the access request is forwarded to the corresponding port of the bastion host based on the IP address and port of the bastion host.

6. The method for implementing safe operation and maintenance according to claim 1, characterized in that: The work order application content includes a validity period, and the method further includes: Whether the validity period is reached is checked at preset intervals, and if so, the etcd configuration is deleted. After the etcd configuration is deleted, the configuration file becomes invalid.

7. The method for implementing safe operation and maintenance according to claim 1, characterized in that: The step of generating access path information in a test environment based on the work order application content includes: Calling a proxy application in a test environment based on the work order application content; The access path information is generated by the proxy application, and the format of the access path information is converted into a format that meets the requirements of the proxy component.

8. A device for implementing safe operation and maintenance, characterized in that: The device comprises: A generation module, used to obtain work order application content, and generate access path information in a test environment based on the work order application content, wherein the access path information includes a random high port number, account information, and password information; A feedback module, used to feed back the IP address and access path information of the test environment to the applicant; A configuration module, used to configure etcd for the corresponding production environment based on the work order application content, access path information and bastion host information, and generate a configuration file for the proxy component based on the etcd configuration; The verification module is used to verify the account information and password information in the access request based on the configuration file after obtaining the access request sent by the applicant through the proxy component, and forward the access request to the bastion machine after the verification is passed.

9. An electronic device, characterized in that: It includes a processor and a memory, the memory stores machine executable instructions that can be executed by the processor, and the processor can execute the machine executable instructions to implement the security operation and maintenance implementation method described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the secure operation and maintenance implementation method as described in any one of claims 1 to 7 is implemented.

Images