ENS:Security solution of the edge cloud

I. Host security (Security Center)

Alibaba Cloud Security Center is a multifunctional security service that leverages cloud-native technology, years of cloud security and defense experience, and cutting-edge technology. Security Center provides various features such as cloud asset management, baseline check, proactive defense, security hardening, configuration assessment, and security status visualization. Security Center can detect risks in real time such as configuration risks, compliance risks, vulnerabilities, AccessKey pair leaks, and identity and permission management risks. Security Center can also defend against malicious behavior such as ransomware, mining viruses, trojans, and webshells, and attacks such as web page tampering. For more information about Security Center, see Product Overview.

Security capabilities of Security Center supported by ENS

Activate and deploy Security Center

1. Purchase Security Center:

   You can purchase Security Center on the Security Center buy page of the Alibaba Cloud official website. Security Center provides multiple editions of basic protection services and value-added services to meet your security requirements in different scenarios. You can purchase the suitable edition and value-added services based on your security requirements. For more information, see Purchase Security Center.

2. Install the Security Center agent on the ENS instance:

   Security Center can protect your Edge Node Service only after you install the Security Center agent on your ENS instance. The Security Center agent is a software component that can be installed on instances to collect and analyze logs and data, and monitor and detect threats on the instances.

   1. Before you install the Security Center agent, make sure that your Edge Node Service instance can access the Internet.

   2. Log on to the ENS instance and run the agent installation command as the administrator or root user.

      1. Installation command for Linux

         wget "https://aegis.alicdn.com/download/install/2.0/linux/AliAqsInstall.sh" && chmod +x AliAqsInstall.sh && ./AliAqsInstall.sh -k=v342lk

      2. Installation command for Command Prompt in Windows

         powershell -executionpolicy bypass -c "(New-Object Net.WebClient).DownloadFile('http://aegis.alicdn.com/download/install/2.0/windows/AliAqsInstall.exe',$ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath('.\AliAqsInstall.exe'))"; "./AliAqsInstall.exe -k=Az481e"

3. Check whether the Security Center agent is installed.

   After you install the Security Center agent on an instance, Security Center downloads the agent-related files to the instance and starts the processes of the Security Center agent. You can view the status of the Security Center agent in the Security Center console or the status of the processes to check whether the Security Center agent is installed.

   As shown in the following figure, the Edge Node Service instance is displayed on the Host page in the Security Center console.

   

   Note

   The computing power of the edge cloud is distributed to edge nodes outside the central cloud. Therefore, the instance is displayed as a Server Outside Cloud in the Security Center console.

II. Network security within an edge node

1. Security group

A security group acts as a virtual firewall provided by Edge Node Service on edge nodes, which controls inbound and outbound traffic for ENS instances. You can configure inbound rules for a security group to control traffic to ENS instances in the group and outbound rules to control traffic from the ENS instances.

The following figure shows the workflow of a security group.

1. Create a security group:

   Creating a security group in the edge cloud is different from creating one in the central cloud. You only need to specify the security group name when you create a security group in the edge cloud. Such security group does not belong to any edge node or virtual private cloud (VPC). The security group and its rules apply to all edge nodes and VPCs.

   

2. Add security group rules:

   • Security group rules control inbound and outbound traffic for ENS instances. You can use security group rules in various scenarios, such as to allow or deny specific network traffic, close ports, restrict traffic of specific protocols, and configure access permissions on applications.

   • You can add security group rules when you create a security group or later.

3. Add an ENS instance to a security group:

   When you create an ENS instance, you can specify only one security group for the instance. After that, you can add the ENS instance to more security groups on the Instances page in the ENS console. For an ENS instance that is associated with multiple security groups, all security group rules of the security groups are automatically sorted and work together with the default access control rules of the security groups to control traffic for the ENS instance. The security group rules are processed in a specific order. The processing continues until a rule is matched.

4. Manage security group rules:

   • Improper configurations of security group rules can result in serious security risks. You can manage rules in a security group based on your business requirements to ensure network security of ENS instances in the security group.

   • You can modify the inbound and outbound rules of a security group on the details page of the security group. After you modify a security group rule, the modification applies to all ENS instances that are added to the security group on all edge nodes.

III. Security O&M (Bastionhost)

Bastionhost is a system O&M and security audit platform that is provided by Alibaba Cloud. Bastionhost allows you to manage O&M permissions and operations and play back recordings of O&M operations in a centralized manner. This way, you can identify the users who perform specific O&M operations, manage permissions, and audit O&M operations. Bastionhost makes asset management efficient, O&M responsibilities clear, and O&M events traceable, and helps enterprises meet the requirements for classified protection. For more information about Bastionhost, see Product Overview.

Capabilities of Bastionhost supported by ENS

The O&M of Edge Node Service resources requires the Enterprise Dual-engine Edition of Bastionhost to implement unified management of edge cloud assets based on the proxy mode of the network domain feature.

Activate and deploy Bastionhost

1. Purchase Bastionhost:

   You can purchase Bastionhost on the Bastionhost buy page of the Alibaba Cloud official website. Security Center provides multiple editions of Bastionhost to meet your O&M requirements in different scenarios. For more information, see Apply for a free trial of Bastionhost.

2. Manage Edge Node Service instances:

   After you purchase Bastionhost, you can manage assets in the Bastionhost console.

   1. Create a network domain:

      • Bastionhost runs on the central cloud. The computing power of the edge cloud is distributed across edge nodes outside the central cloud. Therefore, the ENS instance is not interconnected with the internal network of VPC where Bastionhost resides. We recommend that you use the network domain feature of Bastionhost when you perform O&M on Edge Node Service instances.

      • You can create a network domain, configure a proxy server, and then add an Edge Node Service to the network domain in the Bastionhost console. This way, you can perform O&M operations on the instance by using Bastionhost.

      • On the Network Domain page, click Create Network Domain, set the Connection Mode parameter to Proxy, and then configure Primary Proxy Server.

        

      • Configure the following parameters for the primary proxy server: Proxy Type, Server Address, Server Port, Host Account, and Password. Valid values of Proxy Type: SSH Proxy, HTTP Proxy, and SOCKS5 Proxy.

        

   2. Import an Edge Node Service instance in Assets:

      • On the Hosts page, select Import Other Hosts and click Create Host to add an ENS instance.

      • In the Create Host panel, configure the Operating System, Host IP Address, Hostname, and Network Domain parameters.

      • If you set the Network Domain parameter to Proxy, set the Host IP Address parameter to an internal IP address. If you set the Network Domain parameter to Direct Network (Direct Connection), set the Host IP Address parameter to a public IP address.

        

   3. Create a host account in Assets:

      After you import an ENS instance as a host, find the instance on the Hosts page and click Create Host Account in the Actions column. In the panel that appears, configure the Protocol, Logon Name, Authentication Type, and Password or Key parameters.

      

   4. Authorize users to manage the host in Users:

      After you import the instance as a host, choose Users > Users, and authorize a RAM user to manage the host.

      

   5. Choose Asset O&M:

      After you log on to the Bastionhost console as the RAM user authorized, choose Asset O&M > Host O&M to view the hosts on which you are authorized to perform O&M operations. Find the host that you want to manage and click Remote Connection.

      

IV. Attack protection (Anti-DDoS Proxy)

Anti-DDoS Proxy is a proxy-based service that is provided by Alibaba Cloud to mitigate volumetric and resource exhaustion DDoS attacks. Anti-DDoS Proxy can protect servers that are deployed on Alibaba Cloud, on third-party clouds, and in data centers. If volumetric DDoS attacks are launched against your service that is added to Anti-DDoS Proxy, Anti-DDoS Proxy forwards traffic to the anti-DDoS scrubbing centers by using DNS resolution for scrubbing and forwards only service traffic to the origin server.

For more information about Anti-DDoS Proxy, see What is Anti-DDoS Proxy?

Capabilities of Anti-DDoS Proxy supported by ENS

Alibaba Cloud provides the following services based on the region where your servers are deployed:

• Anti-DDoS Proxy (Chinese Mainland): protects servers deployed in the Chinese mainland. Anti-DDoS Proxy (Chinese Mainland) uses eight Border Gateway Protocol (BGP) lines at the Tbit/s level to protect servers against volumetric DDoS attacks. Anti-DDoS Proxy (Chinese Mainland) provides Anti-DDoS Proxy (Chinese Mainland) instances of the Profession and Advanced mitigation plans.

• Anti-DDoS Proxy (Outside Chinese Mainland): protects servers deployed outside the Chinese mainland. Anti-DDoS Proxy (Outside Chinese Mainland) mitigates DDoS attacks by using distributed near-origin traffic scrubbing capabilities and all available mitigation capabilities.

Activate and deploy Anti-DDoS Proxy

1. Purchase Anti-DDoS Proxy:

   You can purchase Anti-DDoS Proxy on the Anti-DDoS page. For more information, visit the Anti-DDoS product page.

2. Add services:

   1. Use domains

      After you add the domain name of a website to Anti-DDoS Proxy, Anti-DDoS Proxy assigns a CNAME to the website. You must change the DNS record to map the domain name to the CNAME. This way, service traffic can be switched to Anti-DDoS Proxy for protection.

      

   2. Use ports

      To use Anti-DDoS Proxy to protect your non-website services, such as client-based applications, you must create port forwarding rules. Then, Anti-DDoS Proxy scrubs traffic that is destined for your services and forwards only service traffic to your origin server based on the port forwarding rules.

      

3. Verify the configuration:

   After you add a domain name or a port to an Anti-DDoS Pro or Anti-DDoS Premium instance, Anti-DDoS Pro or Anti-DDoS Premium forwards the packets received by the port to the port of the origin server. To ensure service stability, we recommend that you verify whether the forwarding configurations take effect on your computer before the inbound traffic is rerouted to Anti-DDoS Pro or Anti-DDoS Premium.