Kubernetes環(huán)境下的Bastion安全實(shí)踐與GitHub Authorized Keys無縫集成指南【免費(fèi)下載鏈接】bastionSecure Bastion implemented as Docker Container running Alpine Linux with Google Authenticator DUO MFA support項(xiàng)目地址: https://gitcode.com/gh_mirrors/bast/bastion在Kubernetes集群管理中Bastion主機(jī)作為安全入口承擔(dān)著控制訪問和保護(hù)內(nèi)部資源的重要角色。本文將介紹如何在Kubernetes環(huán)境下部署和配置Bastion容器重點(diǎn)講解如何與GitHub Authorized Keys實(shí)現(xiàn)無縫集成為團(tuán)隊(duì)提供安全、便捷的訪問控制方案。圖1Bastion項(xiàng)目logo及核心功能展示為什么選擇Bastion容器Bastion項(xiàng)目是一個(gè)基于Alpine Linux的Docker容器提供了安全的堡壘機(jī)功能支持Google Authenticator和DUO雙因素認(rèn)證(MFA)。相比傳統(tǒng)的堡壘機(jī)部署方式容器化的Bastion具有以下優(yōu)勢(shì)輕量級(jí)基于Alpine Linux鏡像體積小資源占用低易部署可直接在Kubernetes集群中部署支持水平擴(kuò)展安全加固內(nèi)置多種安全措施默認(rèn)禁用不必要的轉(zhuǎn)發(fā)功能靈活集成支持多種認(rèn)證方式和第三方服務(wù)集成快速部署B(yǎng)astion到Kubernetes要在Kubernetes環(huán)境中部署B(yǎng)astion可通過以下步驟快速實(shí)現(xiàn)克隆項(xiàng)目倉庫git clone https://gitcode.com/gh_mirrors/bast/bastion進(jìn)入項(xiàng)目目錄cd bastion/examples/compose根據(jù)實(shí)際需求修改配置文件docker-compose.ymlbastion.env.example使用Kubernetes配置文件部署可基于docker-compose.yml轉(zhuǎn)換配置GitHub Authorized Keys集成Bastion支持通過SSH Authorized Keys Command與GitHub實(shí)現(xiàn)密鑰集成具體配置步驟如下1. 環(huán)境變量配置在bastion.env.example中設(shè)置以下環(huán)境變量SSH_AUTHORIZED_KEYS_COMMAND/path/to/your/script SSH_AUTHORIZED_KEYS_COMMAND_USERroot2. 配置授權(quán)命令腳本Bastion提供了默認(rèn)的授權(quán)命令腳本ssh-authorized-keys-command內(nèi)容如下if [ -n ${SSH_AUTHORIZED_KEYS_COMMAND} ] [ ${SSH_AUTHORIZED_KEYS_COMMAND} ! none ]; then echo - Enabling SSH Authorized Keys Command echo AuthorizedKeysCommand ${SSH_AUTHORIZED_KEYS_COMMAND} /etc/ssh/sshd_config echo AuthorizedKeysCommandUser ${SSH_AUTHORIZED_KEYS_COMMAND_USER} /etc/ssh/sshd_config fi3. 自定義GitHub密鑰獲取腳本創(chuàng)建自定義腳本從GitHub獲取用戶公鑰例如#!/bin/bash # 從GitHub API獲取指定用戶的公鑰 curl -s https://api.github.com/users/$1/keys | jq -r .[] | .key4. 掛載配置到容器在Kubernetes部署配置中確保腳本正確掛載volumes: - name: ssh-authorized-keys-command hostPath: path: ./scripts/ssh-authorized-keys-command containers: - name: bastion volumeMounts: - name: ssh-authorized-keys-command mountPath: /etc/init.d/ssh-authorized-keys-command readOnly: true安全增強(qiáng)配置除了GitHub密鑰集成外還可以通過以下配置增強(qiáng)Bastion的安全性雙因素認(rèn)證(MFA)Bastion支持Google Authenticator和DUO MFA配置文件位于pam.d/google-authenticatorpam_duo.conf.env登錄通知配置Slack通知實(shí)時(shí)監(jiān)控Bastion登錄情況圖2Bastion登錄活動(dòng)的Slack通知示例相關(guān)配置文件slack/pam-open_session-notification.json限制訪問來源通過Kubernetes NetworkPolicy限制只能從特定IP段訪問Bastion服務(wù)apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: bastion-policy spec: podSelector: matchLabels: app: bastion ingress: - from: - ipBlock: cidr: 192.168.0.0/16日常維護(hù)與監(jiān)控查看日志Bastion的日志配置位于sshd_config可通過Kubernetes日志功能查看kubectl logs -f bastion-pod-name更新配置修改配置后可通過以下命令滾動(dòng)更新Bastion部署kubectl rollout restart deployment/bastion監(jiān)控登錄活動(dòng)通過Slack通知或查看auth.log監(jiān)控登錄活動(dòng)及時(shí)發(fā)現(xiàn)異常訪問。總結(jié)通過本文介紹的方法您可以在Kubernetes環(huán)境中快速部署一個(gè)安全的Bastion容器并與GitHub Authorized Keys無縫集成實(shí)現(xiàn)基于GitHub用戶的訪問控制。結(jié)合雙因素認(rèn)證和登錄通知等功能可以為Kubernetes集群提供強(qiáng)大的安全防護(hù)。Bastion項(xiàng)目的更多配置選項(xiàng)和高級(jí)功能請(qǐng)參考項(xiàng)目中的README.md和docs/目錄下的文檔?！久赓M(fèi)下載鏈接】bastionSecure Bastion implemented as Docker Container running Alpine Linux with Google Authenticator DUO MFA support項(xiàng)目地址: https://gitcode.com/gh_mirrors/bast/bastion創(chuàng)作聲明：本文部分內(nèi)容由AI輔助生成（AIGC），僅供參考