September 2021
Beginner to intermediate
392 pages
12h 13m
Chinese
book
Google系统架构解密： 构建安全可靠的系统
by Heather Adkins, Betsy Beyer, Paul Blankinship, Piotr Lewandowski, Ana Oprea, Adam Stubblefield
Content preview from Google系统架构解密： 构建安全可靠的系统
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
25
第 3 章
示例分析：安全代理
撰写人：
Jakub Warmuz
、
Ana Oprea
、
Thomas Maufer
、
Susanne Landers
、
Roxana Loza
、
Paul Blankinship
和
Betsy Beyer
假设有个攻击者想要故意破坏你的系统，或者一位拥有特权账户的工程师无恶意地引
入了变更错误，产生了严重的后果。但因为你对系统了解很深，并且系统设计时考虑
了最小特权和可恢复性，所以前述情况对你的系统影响有限。在调查和执行事件响应
时，你可以确定问题的根本原因并采取适当的措施。
但这能代表你的组织吗？可能并不是所有的系统都符合这种情况，你需要一种让正在
运行的系统更安全且更不易停机的方法。安全代理就是其中一种做法。
3.1
生产环境中的安全代理
一般来说，代理可以用来满足新的可靠性和安全性需求，而无须对已部署的系统进行重大
更改。你不必修改现有系统，只需使用代理来路由原本直连系统的连接。代理还可以包含
满足新的安全性和可靠性要求的控件。在这个示例研究中，我们可以了解
Google
使用了
一组
安全代理
，以限制特权管理员意外或恶意地在生产环境中引起问题的能力。
安全代理是一个框架，允许授权人员访问或修改物理服务器、虚拟机或特定应用程序的状
态。在
Google
，我们使用安全代理来审阅
、批准和运行有风险的命令，而无须建立到系统
的
SSH
连
接。使用这些代理，可以对调试问题授予细粒度访问权限，或者限制机器重启。
安全代理代表网络之间的单点入口，是使我们能够执行以下操作的关键工具：
•
审查团队中的每项操作； ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.