ENS:ENS security architecture

Host-level security with Security Center

Alibaba Cloud Security Center uses cloud-native technologies and extensive security expertise to provide comprehensive host protection. It covers key areas such as cloud asset management, security configuration assessment, proactive defense, security hardening, and security visualization. It detects real-time risks, including configuration flaws, compliance issues, vulnerabilities, and leaked AccessKey pairs. It also defends against threats like ransomware, crypto-mining malware, trojans, webshells, and web page tampering. For a detailed introduction, see Security Center.

Security Center capabilities supported on ENS

Activate and deploy Security Center

1. Purchasing Security Center:

   You can purchase Security Center directly from the product page on the Alibaba Cloud official website. Security Center offers multiple editions and value-added services for different security needs. You can purchase the edition and services that best suit your needs. For more information, see Purchase Security Center.

2. Install the Security Center agent on an ENS instance:

   To protect an ENS instance with Security Center, install the Security Center agent on it. This lightweight agent collects host data to monitor and detect potential security threats.

   1. Before you install the Security Center agent, make sure that your Edge Node Service instance can access the internet.

   2. Log on to the ENS instance and run the installation command with administrator or root permissions.

      1. Installation command for Linux

         wget "https://aegis.alicdn.com/download/install/2.0/linux/AliAqsInstall.sh" && chmod +x AliAqsInstall.sh && ./AliAqsInstall.sh -k=v342lk

      2. Installation command for CMD on Windows

         powershell -executionpolicy bypass -c "(New-Object Net.WebClient).DownloadFile('http://aegis.alicdn.com/download/install/2.0/windows/AliAqsInstall.exe',$ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath('.\AliAqsInstall.exe'))"; "./AliAqsInstall.exe -k=Az481e"

3. Verify the installation:

   After installation, the Security Center agent downloads its components and starts the corresponding processes on your server. You can verify the installation by checking the agent's process status or by viewing its status in the Security Center console.

   The figure shows an ENS instance successfully added to the Hosts asset list in Security Center.

   

   Note

   An edge instance is displayed as a Server Outside Cloud in the Security Center console because its computing power is distributed across nodes outside the central Alibaba Cloud.

Network-level security: Security groups and network ACLs

1. Security groups

A security group acts as a virtual firewall for ENS, controlling inbound and outbound traffic for your ENS instances at the edge nodes. Inbound rules control incoming traffic, while outbound rules control outgoing traffic.

The workflow for using security groups consists of four steps:

1. Create a security group:

   The process of creating a security group for the edge cloud is different from creating one for the central cloud. When you create a security group for the edge cloud, you only need to specify a name for the security group. Security groups for the edge cloud do not belong to a specific node or VPC. The security group and its rules can take effect on any node and VPC globally.

   

2. Add security group rules:

   • Security group rules control the inbound and outbound traffic of ENS instances. You can use them for scenarios such as allowing or denying specific network traffic, blocking unnecessary ports, restricting traffic of specific protocols, and configuring application access permissions.

   • You can add security group rules when you create a security group or add them after the security group is created.

3. Add an ENS instance to a security group:

   When you create an ENS instance, you can add it to one security group. Later, you can add the instance to multiple security groups from the ENS instance list page as needed. To determine whether traffic can pass through an ENS instance, the rules of all associated security groups are aggregated, sorted by a fixed policy, and applied to the ENS instance along with the default access control rules. This process determines whether to allow or deny the traffic.

4. Manage security group rules:

   • Improperly configured security group rules can lead to serious security risks. You must manage security group rules as needed to ensure the network security of your ENS instances.

   • You can modify the inbound and outbound rules of a security group on its details page. After a rule is modified, it applies to all ENS instances in that security group across all edge cloud nodes.

Secure operations and auditing with Bastionhost

BBastionhost is an operations and maintenance (O&M) security and audit platform that provides centralized, secure access to your resources. It lets you manage permissions, control operations, and audit all activity through session recordings, ensuring that all actions are identifiable, controllable, and auditable. It helps enterprises manage numerous assets, clarify O&M responsibilities, trace incidents, and meet compliance requirements. For more information about Bastionhost, see Product Overview.

O&M Security Center for ENS:

To manage ENS resources, use the Enterprise Dual-Engine edition of Bastionhost, which supports the network domain proxy mode to achieve unified O&M control over edge assets.

Activate and deploy Bastionhost

1. Purchase Bastionhost:

   You can purchase Bastionhost from its product page on the Alibaba Cloud website. Bastionhost provides multiple editions to meet O&M security needs in different scenarios. For more information, see Activate a free trial.

2. Manage ENS instances:

   After you purchase a Bastionhost instance, you can manage it on the Bastionhost management page.

   1. Create a network domain:

      • Bastionhost runs on the Alibaba Cloud central cloud. Edge cloud computing power is distributed across nodes outside the central cloud. Therefore, edge cloud computing resources cannot connect to the internal network of the VPC where Bastionhost resides. We recommend using the network domain feature of Bastionhost to manage ENS instances.

      • You can configure a proxy server for your ENS assets. Then, in Bastionhost, you can create a network domain, add the proxy server, and add the assets to the network domain. This lets you perform O&M on the assets using Bastionhost.

      • On the Network Domain list page, you can create a network domain. Set the connection method to Proxy and configure the primary proxy server.

        

      • For the primary proxy server, configure the Proxy Type, Server Address, Server Port, Host Account, and Password. The Proxy Type can be SSH Proxy, HTTP Proxy, or SOCKS5 Proxy.

        

   2. Asset management - Import an ENS instance:

      • On the host list page, select Import Other Source Hosts, and then use the Create Host method to manage the ENS instance.

      • In the Create Host panel, you must configure parameters such as Operating System, Host IP, Hostname, and Network Domain.

      • If you set Network Domain to Proxy, set the host IP to an internal IP address. If you set Network Domain to Direct Connection, set the host IP to a public IP address.

        

   3. Asset management - Create a host account:

      After you import an ENS instance as a host asset, go to the Host list page. In the Actions column, click Create Host Account. Configure the Protocol, Logon Name, Authentication Type, and the corresponding Password or Key for daily O&M access.

      

   4. User management - Authorize a host:

      After importing a host, navigate to the User Management > Users page to grant a RAM user Operations and Maintenance (O&M) permissions on the host resource.

      

   5. Asset O&M:

      After logging in, an authorized RAM user can navigate to the Asset O&M > Host O&M page to view their authorized host resources. From there, they can perform O&M on the hosts using the Remote Connection method.

      

DDoS attack protection

Anti-DDoS is a proxy-based protection service from Alibaba Cloud. It mitigates volumetric DDoS attacks and resource exhaustion DDoS attacks. It supports the protection of servers on Alibaba Cloud, outside Alibaba Cloud, or in other clouds. After you connect your service to Anti-DDoS, if a large-volume DDoS attack occurs, Anti-DDoS uses DNS resolution to reroute the traffic to anti-DDoS scrubbing centers for traffic scrubbing. It then forwards only the clean traffic to your server.

For more information about Anti-DDoS Pro and Anti-DDoS Premium, see What is Anti-DDoS Pro and Anti-DDoS Premium?.

Anti-DDoS capabilities supported on ENS

Anti-DDoS Proxy is available in two versions based on the deployment region of your business servers: Anti-DDoS Proxy (Chinese Mainland) and Anti-DDoS Proxy (Outside Chinese Mainland).

• Anti-DDoS Pro: Suitable for services with servers deployed in the Chinese mainland. It uses unique T-level, eight-line Border Gateway Protocol (BGP) bandwidth resources in the Chinese mainland to defend against large-volume DDoS attacks for connected services. It provides Professional and Premium instance types.

• Anti-DDoS Premium: Suitable for services with servers deployed outside the Chinese mainland. It uses advanced, distributed, near-origin traffic scrubbing capabilities to provide unlimited, best-effort protection against DDoS attacks for connected services.

Activate and deploy Anti-DDoS

1. Purchase Anti-DDoS instance:

   You can purchase Anti-DDoS instance on the Anti-DDoS page. For more information, see: Anti-DDoS Proxy.

2. Access management:

   1. Website Config

      To protect a website, add its domain to Anti-DDoS. The service provides you with a CNAME record. You then update your domain's DNS settings to point to this CNAME record, which directs traffic through Anti-DDoS for protection.

      

   2. Port Config

      For non-website services (such as client applications), configure port forwarding rules. This ensures that traffic is first routed through Anti-DDoS for scrubbing before being forwarded to your origin server.

      

3. Verify the configuration:

   After successfully adding a website or port configuration, Anti-DDoS forwards requests sent to the protection IP to the corresponding port on your origin server. Before directing production traffic to Anti-DDoS, verify the forwarding configuration to ensure that legitimate traffic can reach your origin server correctly and to prevent service disruptions.