Cara Elastic Desktop Service (EDS) Enterprise memastikan keamanan jaringan - Elastic Desktop Service

Elastic Desktop Service (EDS) Enterprise menyediakan bandwidth publik untuk akses jaringan pengguna dan menerapkan langkah-langkah keamanan guna melindungi komputer cloud dari ancaman eksternal maupun internal. Untuk membantu Anda mengelola perilaku jaringan, EDS Enterprise menyediakan kebijakan grup keamanan dan kontrol nama domain guna mengatur akses jaringan pengguna.

01 Akses jaringan

1.1 Kebijakan grup keamanan

Elastic Desktop Service (EDS) Enterprise menyediakan kebijakan kontrol grup keamanan bagi administrator untuk mengelola izin akses jaringan komputer cloud dalam organisasi mereka. Kebijakan kontrol grup keamanan terdiri atas serangkaian aturan grup keamanan. Mirip dengan aturan grup keamanan Elastic Compute Service, Anda dapat mengatur arah aturan (inbound atau outbound), aksi (Allow atau Deny), prioritas, jenis protokol, range port, objek otorisasi (alamat IP atau Blok CIDR), serta deskripsi. Dengan menggabungkan aturan yang memiliki cakupan dan prioritas berbeda, administrator dapat menerapkan pendekatan daftar putih, hanya mengizinkan akses dari sumber tertentu.

Anda dapat menambahkan aturan kontrol grup keamanan inbound atau outbound untuk lebih mengontrol lalu lintas komputer cloud Anda. Berikut adalah contoh konfigurasi aturan kontrol grup keamanan:

Skenario 1

Secara default, semua akses outbound dari komputer cloud diizinkan. Anda dapat menambahkan aturan outbound berikut untuk hanya mengizinkan akses ke alamat IP tertentu:

Aturan 1: Tolak semua akses outbound. Contoh:
Direction
Policy
Priority
Protocol type
Port range
Authorization object
Outbound
Deny
2
All
-1/-1
0.0.0.0/0

Aturan 2: Izinkan akses ke alamat IP tertentu. Prioritas aturan ini harus lebih tinggi daripada Aturan 1. Contoh:

Direction	Policy	Priority	Protocol type	Port range	Authorization object
Outbound	Allow	1	Select the applicable protocol type.	Set an appropriate port range.	The IP address to allow access to, for example: 192.168.1.1/32.

Skenario 2

Dalam lingkungan VPC, Anda dapat menambahkan aturan inbound untuk mengizinkan akses dari alamat IP tertentu ke komputer cloud. Contoh:

Direction	Policy	Priority	Protocol type	Port range	Authorization object
Inbound	Allow	1	Select the applicable protocol type.	Set an appropriate port range.	The IP address to allow access from, for example: 192.168.1.1/32.

Skenario 3

Asumsikan Komputer Cloud A dikaitkan dengan Kebijakan A, dan Komputer Cloud B dikaitkan dengan Kebijakan B. Dalam lingkungan VPC, Komputer Cloud A dan Komputer Cloud B tidak dapat saling berkomunikasi karena semua akses inbound ditolak secara default. Anda dapat menambahkan aturan inbound berikut ke Kebijakan A dan Kebijakan B untuk mengaktifkan komunikasi jaringan di antara keduanya:

Pada Kebijakan A, tambahkan aturan inbound untuk mengizinkan akses dari Komputer Cloud B. Contoh:
Direction
Policy
Priority
Protocol type
Port range
Authorization object
Inbound
Allow
1
Select the applicable protocol type.
Set an appropriate port range.
IP address of Cloud Computer B.
Pada Kebijakan B, tambahkan aturan inbound untuk mengizinkan akses dari Komputer Cloud A. Contoh:
Direction
Policy
Priority
Protocol type
Port range
Authorization object
Inbound
Allow
1
Select the applicable protocol type.
Set an appropriate port range.
IP address of Cloud Computer A.

Default state: Disabled
Configuration responsibility: Customer
Cost: Free
Dependencies: None
Limitations:
- Rule quantity limit
  You can create up to 200 security group control rules.
- Limitations on inbound rules
  By default, a cloud computer allows all outbound access. Inbound access follows these principles:
  - Over the internet, a cloud computer does not support any inbound access. Even if you set an inbound security group rule to Allow, the rule does not take effect.
  - In a VPC environment, a cloud computer denies all inbound access by default. However, you can set an inbound security group rule to Allow to permit specific access requests.
Reference: Security Group Control

Procedure

Log on to the Elastic Desktop Service Enterprise console.
In the left-side navigation pane, choose O&M Management > Policy.
On the Policy page, click Create Policy.
On the Create Policy page, enter a Policy Name as prompted, configure the policy settings as needed, and then click OK.

In the Security Group Control section, click Add Rule. In the Add Rule dialog box, configure the following parameters and click OK.

Parameter	Description
Direction	Inbound: Controls whether to allow requests to the cloud computer. Outbound: Controls whether to allow requests from the cloud computer to other applications.
Policy	Allow: Permits the access request. Deny: Blocks the access request and drops the data packet without returning any information.
Priority	A value from 1 to 60, where a smaller value indicates a higher priority. Higher-priority rules take precedence.
Protocol type	TCP, UDP, ICMP (IPv4), and GRE are supported.
Port range	The port used by the application or protocol. When the selected protocol type is Custom TCP or Custom UDP, you can set a custom port. You can enter a specific port, such as `80`, or a port range, such as `1/80`. For more information, see Common Ports.
Authorization object	An IPv4 address range in CIDR format.
Description	A custom description for the rule.

1.2 Kontrol nama domain

Elastic Desktop Service (EDS) Enterprise menyediakan kebijakan kontrol nama domain yang memungkinkan administrator mengelola akses jaringan komputer cloud berdasarkan nama domain. Berbeda dengan kebijakan kontrol grup keamanan, kontrol nama domain menggunakan aturan DNS untuk mengelola akses berdasarkan nama domain. Untuk setiap aturan, Anda mengonfigurasi nama domain dan aksi (Allow atau Deny). Fitur ini juga mendukung karakter wildcard (*), yang secara signifikan menyederhanakan proses pengelolaan akses ke situs web dan layanan tertentu.

Sebagai contoh, untuk menerapkan kontrol akses detail halus terhadap domain yang tercantum dalam tabel berikut, Anda dapat mengonfigurasi aturan DNS seperti yang ditunjukkan.

Domain	Example	Access policy	Description
Second-level domain	`example.com`	Allow	When the cloud computer accesses `example.com`, the webpage opens normally.
Third-level domain	`writer.examplec.com`	Deny	When the cloud computer accesses `writer.example.com`, the web page displays a 404 error.
Third-level domain	`developer.example.com`	Allow	When the cloud computer accesses `developer.example.com`, the webpage opens successfully.
Fourth-level domain	`image.developer.example.com`	Deny	When the cloud computer accesses `image.developer.example.com`, the webpage displays 404.
	`video.developer.example.com`	Allow	When the cloud computer accesses `video.developer.example.com` and `guide.developer.example.com`, the web pages open correctly.
	`guide.developer.example.com`	Allow

Default state: Disabled
Configuration responsibility: Customer
Cost: Free
Dependencies: None
Limitations:
- Domain limitations
  To ensure that end users can use their cloud computers properly, the following reserved security domains are not subject to DNS rules. Access to these domains is always allowed. If you set the access policy for these domains to Deny, the rule will not take effect.
  - *.gws.aliyun
  - *.aliyun.com
  - *.alicdn.com
  - *.aliyunpds.com
  - *.aliyuncds.com
  - *.aliyuncs.com
- Operating system limitations
  Domain name access control rules apply only to cloud computers that run the Windows operating system.
- Rule quantity limit
  You can create up to 300 DNS rules.
Reference: Domain Name Control

Procedure

Log on to the Elastic Desktop Service Enterprise console.
In the left-side navigation pane, choose O&M Management > Policy.
On the Policy page, click Create Policy.
On the Create Policy page, enter a Policy Name as prompted, configure the policy settings as needed, and then click OK.

In the Domain Name Access Control (Formerly DNS Feature) section, click Add Rule. In the Add Rule dialog box, configure the following parameters and click OK.

Parameter	Description
Domain name	Enter the domain name for which you want to set DNS rules. You can add only one domain name at a time. The `*` wildcard character is supported.
Description	A custom description for the DNS rule.
Access policy	Select Allow or Reject. Catatan If you set multiple DNS rules with an access policy of Allow, you must also add a DNS rule with an access policy of Deny to serve as a fallback rule. When multiple DNS rules exist, the rule that is higher in the list takes precedence. You can move rules to adjust their priority.

02 Batas jaringan

2.1 Interkomunikasi jaringan kantor

Komputer cloud berjalan dalam grup keamanan yang dibuat secara otomatis bersama jaringan kantor (sebelumnya ruang kerja). Komputer tersebut tidak memiliki alamat IP yang menghadap ke publik atau port terbuka. Grup keamanan memblokir seluruh lalu lintas eksternal kecuali koneksi protokol ASP dari streaming gateway. Desain ini memastikan bahwa serangan jaringan eksternal tidak dapat mencapai komputer cloud. Mekanisme keamanan dasar Elastic Desktop Service (EDS) Enterprise ini tidak dapat dimodifikasi.

Secara default, grup keamanan juga mencegah komunikasi antar komputer cloud. Hal ini mencegah pengguna jahat menyerang komputer cloud lain dan menghentikan penyebaran infeksi dari komputer cloud yang telah dikompromikan ke komputer lain di jaringan internal. Administrator dapat mengaktifkan akses jaringan antar komputer cloud dalam jaringan kantor mereka sesuai kebutuhan bisnis. Jika Anda mengaktifkan akses ini, Anda dapat menggunakan kebijakan kontrol jaringan tambahan untuk mengurangi risiko keamanan terkait.

Default state: Disabled
Configuration responsibility: Customer
Cost: Free
Dependencies: None
Limitations: None
Reference: Enable Network Communication Between Cloud Computers in an Office Network

Procedure

By default, cloud computers within the same office network cannot communicate. To enable this communication, you can enable the Interconnectivity feature on the details page of the office network.

In the left-side navigation pane, choose Networks & Storage > Office Network.
In the top navigation bar, select a region.
On the Office Network page, click the office network ID of the target office network.
On the office network details page, find the Network Information section and turn on the Interconnectivity switch.