Kariyar DDoS

Kariyar DDoS mai hawa-hawa, don haka hari ɗaya matsalar shafi ɗaya ce kawai

Ana shawo kan hare-haren cunkoso a gefen hanyar sadarwa, ana tace hare-haren matakin hanyar sadarwa kafin su iso, kuma duk abin da ya kai ga uwar garken ana killace shi a cikin kejin matakin kwayar tsarin shafin da aka nufa. Matakai da yawa, kowannensu na yin aiki daban, don haka harin da aka nufa ga shafi daya ba zai zama matsalar katsewar aiki ga shafukan da ke gefensa ba. Wannan shi ne samfurin kariya da muka gina don dandamalin da ke karbar bakuncin shafuka sama da 700,000 a duk duniya, kuma matakin kariya na asali yana aiki a kowane tsari. Samuwa: tsarin kayyade amfani da rumbun adana bayanai na kowane shafi yana kan ci gaban kirkira a halin yanzu kuma ba a fara samunsa ba tukuna. Duk sauran abubuwan da aka bayyana a nan suna aiki a yau.

Fara kyauta Duba farashi

3matakan ragewa: hanyar sadarwa, gefe, uwar garke
700,000+shafukan da aka karɓi bakuncinsu a duka duniya
An haɗakeɓancewa ta asali, WAF da takaita sauri
99.99%Tabbacin lokacin aiki

Mai matakai daban-daban bisa tsari, domin guda daya ba zai taba wadatarwa ba

Ambaliyar ruwa mai yawa (volumetric flood), ambaliyar manhaja ta L7, da harin cinye haɗi a hankali matsaloli ne daban-daban guda uku. Muna kula da kowannensu a inda ya fi sauƙi da sauri don shawo kansa — a gaban rukuni (upstream of the fleet), a bakin iyaka (edge), da kuma cikin keji.

Matakin hanyar sadarwa (L3/4)

Kariyar DDoS ta matakin mai bada sabis tana tace kwararar layin sadarwa kafin ta isa ga tawagar ma'aikatanmu, kafin wannan zirga-zirgar ta taba amfani da kowace kafa, NIC ko zagayen CPU a kan na'urar da rukunin yanar gizonku ke aiki a kai. Ga bayanan martaba na hadari na gaba da na kamfanoni, Cloudflare Magic Transit da Spectrum suna mika wannan tace zuwa ga zirga-zirgar da ba ta HTTP ba.

Matsayin aikace-aikace (L7) a gefen hanyar sadarwa

Wata hanyar sadarwa ta gefe da ake sarrafawa tana gaban kowane shafi. Tana shanye kwararar HTTP mai yawa, tana gudanar da L7 WAF, tana amfani da iyakance yawan buƙatu ga kowane shafi, kuma tana amfani da sarrafa manhajar bot da ƙalubalen da ake sarrafawa don raba ainihin baƙi daga zirga-zirgar na'ura mai sar kanta — duk kafin buƙata ta isa asali.

Kashin uwar garke

LiteSpeed Enterprise tana amfani da takaita haɗin kai da buƙatun tare da iyakokin haɗin kai ga kowane IP, Imunify360 tana sarrafa bangon kariya na hanyar sadarwa tare da kariya daga harin karfi-da-yaji da tacewar kyakkyawan sunan IP, kuma iyakokin shigar da ayyuka na CloudLinux LVE suna kayyade adadin buƙatun da ke gudana a lokaci guda da shafi guda ɗaya zai iya buɗewa.

Keɓewa ga kowane shafi

LVE yana kayyade CPU, RAM, IO, IOPS, tsare-tsaren ayyuka da ayyukan shiga ga kowane shafi daban. Duk wani kwararar zirga-zirga da ya wuce matakan sama ana takaita shi a cikin kejin shafin da aka nufa, don haka matsin da yake haifarwa yana tsayawa ga wannan shafin maimakon ya bazu a duk fadin sabar.

Kangewa ita ce makasudin

Yawancin katsewar ɗaukar nauyin shafi (hosting) yayin hari ba sa faruwa ne saboda harin ya kai ga inda aka nufa ba. Suna faruwa ne saboda yawan amfani da albarkatun na’ura da abin da aka nufa yake yi yana hana sauran abubuwan da ke kan uwar garken (server) aiki. Wannan shi ne yanayin gazawar da aka ƙera wannan tsarin don kawar da shi.

Kowane shafi yana aiki a cikin kejin albarkatun CloudLinux LVE na kansa — shafin da aka kai wa hari ana takaita shi a iyakarsa ta kansa, kuma shafukan da ke makwabtaka suna rike albarkatun da iyakokinsu suka ba su tabbaci.
CageFS tana ba kowane mai masauki keɓantaccen duba na tsarin fayil, don haka harin da ya tsananta ya zama ƙoƙarin kutse ana tsare shi maimakon ya shafi sauran masu masauki.
CloudLinux MySQL Governor yana daidaita amfani da rumbun adana bayanai ga kowane shafi, don haka ambaliyar matakin aikace-aikace da ke cika tambayoyin da ba a adana ba ba za ta iya saukar da rumbun adana bayanan ga kowa a kan sabar ba.
Ma'aikatan LiteSpeed LSAPI na kowane shafi suna iyakance ne ta hanyar iyakokin LVE na wannan shafin, don haka ambaliyar buƙatu ba za ta iya haifar da ayyukan PHP marasa iyaka ba.
Iyakokin haɗin kowane IP da takaita saurin haɗi na LiteSpeed suna kare hare-haren jinkirin haɗi da gajiyar da haɗi a uwar garken yanar gizo, ba a manhaja ba.

Cache shine mai rage girgiza wanda yawancin masu masauki ke mantawa

Bukatar da tafi arha a wajen sarrafawa ita ce wadda bata taba shafar PHP ko MySQL ba. Ma'ajiyar bayananmu mai matakai biyu tana nufin babban bangare na ambaliyar bukatu a matakin aikace-aikace ana amsa su ne ta hanyar adana bayanan da ba sa canzawa maimakon asalin sabar ku tayi aiki.

LSCache, wanda shi ne ma'ajiyar cikakken shafi ta LiteSpeed Enterprise, yana bayar da shafukan da aka ajiye ba tare da kiran PHP ko ma'adanar bayanai (database) ba — saboda haka maimaita buƙatun URL iri ɗaya yana ɗaukar ɗan ƙaramin kaso na abin da zai kashe a kan rukunin kayan aiki na asali.
Wurin ajiye bayanan abu na Redis na kowane shafi yana rage yawan karanta rumbun adana bayanai don shafukan da lallai dole ne su kasance masu canzawa.
Ajiye bayanai a gefe na Cloudflare yana amsa buƙatu a yankin maziyarta, don haka tarin cunkoson ababen hawa yana watsewa a cikin hanyar sadarwa ta gefe maimakon taruwa a asali guda ɗaya.
Shafukan kwando, biyan kuɗi, asusuna, nonce da zama an cire su daga ma'ajiyar cache ta asali, don haka ƙarfafawa a ƙarƙashin lodi ba ya taɓa lalata ciniki.
Ana daidaita sharewa a duk sassan biyu daga madannin sarrafawa guda ɗaya, don haka ƙara yawan ɓoyayyen ma'aji yayin wata matsala ba zai bar ku da tsofaffin shafuka daga baya ba.

Daga sigina zuwa aiki, ta atomatik

Sauƙaƙawa ba tikitin tallafi ba ne. Alamomi suna ciyar da injin manufofi wanda ke daidaita kowannensu zuwa matakin aiwatarwa, sanarwar abokin ciniki da kuma — inda zai yiwu — gyara mai sarankai, tare da yin rikodin kowane canji.

Tsangantawa mai sauyawa

Lokacin da alamar DDoS ta tashi, injin tsarin yana amfani da sauƙaƙawar Cloudflare da iyakance yawan zirga-zirga ga kowane shafi, kuma zai iya ƙara tsaurara iyakokin LVE na wannan shafin kai tsaye. Lokacin da alamar ta wuce, iyakokin za su sake sassauta. Mataki-mataki, mai iya juyawa, kuma ana yin rikodin kowane mataki.

An takaita, ba a kashe ba

Idan wani hari yana barazana ga asalin shafin (origin), shafin zai koma yanayin 'throttled' — ƙarin tsauraran iyakokin LVE da takaita saurin shiga (rate limiting), tare da cewa shafin yana nan a raye kuma yana aiki. Yanayin throttled yana komawa daidai da kansa da zarar matsin ya kau; wannan ba dakatarwa ba ce.

Iyakancewar LVE ta asali mai sarankai

A karkashin injin manufofi, LVE yana kayyade amfani da CPU, IO da aiki ga kowane shafi ta asali kuma ta atomatik. Shine layin farko da ke aiki a ko da yaushe, yana aiki ko an riga an bayyana zirga-zirgar a matsayin hari ko a'a.

Cikakken tarihin bincike

Kowane sauyi na tilastawa yana yin rikodin dalilinsa, ko na atomatik ne ko kuma ma'aikata ne suka fara shi, da kuma shaidar da ke bayansa. Ana sanar da ku abin da ya canza da yadda za a warware shi, kuma ana iya daukaka kara kan kowane mataki.

Abin da ke ciki, da kuma abin da kuke saya idan haɗari ya ƙaru

Kariyar tushe ba na zaɓi ba ne, saboda shafin da aka kai wa hari ko aka kutsa yana barazana ga maƙwabtansa, martabar uwar garkenmu da kewayon IP ɗinmu. Akwai kariya mafi ƙarfi don shafukan da bayanin haɗarinsu ke buƙatar hakan.

An haɗa a cikin kowane tsari: keɓancewar LVE da CageFS, takaita haɗin gwiwa da buƙatun LiteSpeed, bangon kariya na hanyar sadarwa tare da kariya daga kutsen brute-force da tacewar martabar IP, proaktif WAF, da duba malware.
Akwai su a matsayin ƙarin abubuwa: ingantaccen sarrafa bot, manyan matakan kariya na DDoS, ingantattun ƙa'idodin WAF, fifikon sikanin da keɓaɓɓun ƙa'idodin firewall.
Ana kuma sayar da shi a matsayin ƙarin haɓakawa idan kuna buƙata: tsabtace cutar kwamfuta da gyara da dannawa ɗaya, don yanayin da harin ya kasance murfi ne na ɓarna maimakon manufar kanta.
Ana samun ingantaccen kariya na matakin sadarwa ta hanyar Cloudflare Magic Transit ko Spectrum don ayyukan manyan kamfanoni da masu babban haɗari.

Hawaye masu ban mamaki da gaske

Karuwar cunkoson bayanai sau da yawa alama ce kawai. Hanyar sarrafa sigina guda da take kula da ambaliyar bayanai tana kuma kama kutsen da ke haddasa su, domin a rarraba matsalar yadda ya dace maimakon kawai a shanye ta.

Kowane shafin da muke ɗaukar nauyinsa ana bincikar sa a kowace rana don gano ƙwayoyin cuta (malware), kuma WAF mai ɗaukar matakin kariya na toshe hanyoyin cin gajiyar da aka sani kafin a samar da facin gyara ga matsalar tsaron da ke akwai — hanyar da shafi kan zama kayan aikin kai hari na wani.
Ana kayyade yawan saƙonnin da ake aikawa daga kowane shafi kuma ana sa ido kan hauhawar yawan saƙonni, yawan saƙonnin da suka dawo, shiga jerin masu toshewa, da korafe-korafe, ta yadda za a gano shafin da aka kutsa ciki mai aika saƙonnin banza a cikin mintuna kaɗan maimakon sai bayan an toshe shi.
Ana duba cutar malware da zamba da ake zargi tare da Google Safe Browsing, PhishTank da SURBL/APWG, kuma ana danganta su da sakamakon binciken bincike kafin a yanke shawarar aiwatarwa.
Yin amfani da albarkatun na'ura ba bisa ƙa'ida ba da crypto-miners suna bayyana a matsayin kuskuren LVE CPU da IO da aka yi rikodin su a kowane shafi, wanda ke rage saurin wanda ya aikata hakan ta atomatik.
Kowane sigina yana sauka a Abuse Desk guda ɗaya a cikin sashin kula na admin — an tattara shi, an cire kwafi sannan an saita masa muhimmanci — maimakon a cikin kayan aiki guda huɗu da ba su da alaƙa da juna.

Tambayoyin da aka Fi Yi

Idan aka kai hari kan wani shafi a kan sabar tawa, me zai faru da nawa?

Manufar tsarin ita ce killacewa. Kowane shafi yana aiki a cikin kejin sa na CloudLinux LVE tare da kayyadaddun CPU, RAM, IO, IOPS, hanyoyin gudanarwa da hanyoyin shiga, ra'ayin tsarin fayil na CageFS na kansa, da kuma kayyade ma'ajiyar bayanai a kowane shafi ta hanyar MySQL Governor. Shafin da aka kai wa hari ana takaita shi a iyakarsa maimakon ya cinye dukkan na'urar, kuma iyakokin haɗin kai ga kowane IP na LiteSpeed suna kayyade adadin uwar garken yanar gizo da zai iya rikewa. An tsara killacewar ne a matakin kernel, ba wai an saita shi ga kowane abokin ciniki ba.

Kariyar DDoS tana ciki, ko kuwa ƙarin abu ne?

An haɗa ainihin tushe a kowane tsari: keɓancewar LVE da CageFS, takaita haɗin gwiwa da buƙatun LiteSpeed, bangon kariya na hanyar sadarwa, binciken WAF da malware mai faɗakarwa, tare da shawar Cloudflare edge da tace hanyar sadarwa a matakin mai bada sabis a gaban dukkan rundunar. Mun haɗa shi ne saboda ba za mu iya barin kariyar rundunar mu a matsayin zaɓi ba. Babban sarrafa bot, manyan matakan DDoS, ingantattun dokokin WAF da dokokin bangon kariya na musamman kari ne na ƙari ga rukunonin yanar gizo da ke buƙatarsu.

Shin za ku cire rukunin yanar gizo na daga intanet idan aka kai masa hari?

Kasancewa abin harin DDoS yana nufin kariya ta Cloudflare tare da kayyade adadin buƙatu na kowane shafi, sannan — idan harin yana barazana ga uwar garken asali ne kawai — yanayin 'throttled': ƙa'idodin LVE masu tsauri yayin da shafin ke ci gaba da aiki da ba da sabis. Yanayin takaitawa yana komawa daidai da kansa da zarar matsin ya kau. Ana ajiye dakatarwa ne kawai don rashin biyan kuɗi ko kuma tabbatar da cin zarafi, kuma ko a lokacin, shafin yana nuna shafin jira mai ɗauke da tambarin kamfani da takamaiman dalili maimakon shafi da ya lalace.

Shin ambaliyar layin aikace-aikace har yanzu tana shafar rumbun adana bayanai na?

Ba don wani abu da ake bayarwa daga cache ba. LSCache yana amsa buƙatun shafi da aka ajiye a cache ba tare da kiran PHP ko MySQL ba, kuma Redis object cache na kowane shafi yana sauƙaƙa karatu don shafuka masu canzawa da gaske. Abin da ya rage yana iyakance ne ta hanyar iyakokin aikin LVE da na shigar da aiki na rukunin yanar gizonku da kuma takaita bayanan kowane shafi na MySQL Governor, don haka matsin bayanan daga shafi ɗaya ba zai iya shafar uwar garken ba. Shafukan Cart, checkout, my-account da na zama suna kasancewa ba tare da cache ba ta asali domin tsaurara tsaro kada ya taɓa lalata ciniki.

Kuna iya kare zirga-zirgar da ba ta HTTP ba?

Ee, a matakin hanyar sadarwa. Kariyar DDoS na matakin mai ba da sabis tana tace kwararar L3/4 a sama da rundunar mu ba tare da la'akari da ƙa'ida ba, kuma don ci-gaba ko buƙatun kamfanoni Cloudflare Magic Transit da Spectrum suna mika rangwame na matakin gefe zuwa zirga-zirgar da ba ta HTTP ba.

Ta yaya zan san an kai hari da kuma abin da kuka yi a kai?

Ana yin rikodin kowane canjin aiwatarwa tare da dalilinsa, ko na na'ura ne ko kuma ma'aikata ne suka fara shi, da kuma shaidar da ke bayansa. Ana sanar da ku abin da ya canza da kuma abin da zai warware shi, ana iya daukaka kara kan kowane mataki, kuma ana yin rikodin binciken ayyuka masu alfarma don hanyar bin ka'idodinku. Ana tattara sakonni a wuri guda na Abuse Desk maimakon su kasance a warwatse a cikin kayan aiki daban-daban.

Zan iya gwada wannan kafin in biya?

Ee. Bakuncin Footprint-Free yana farawa ne da gwajin kwanaki 14 ba tare da katin banki ba wanda ya shafi har zuwa shafuka 5 — babu bayanan biyan kuɗi, babu wani alƙawari. Tsare-tsaren suna da goyon bayan garantin dawo da kuɗi na kwanaki 30 ba tare da gardama ba, sauya sheƙa kyauta, kuma babu ɗaurewa ga mai bayar da sabis.

Masu dangantaka

Kariya wacce tuni take aiki yayin da zirga-zirga ta iso

Tace hanyar sadarwa, shanye matsala a gefe, daidaita saurin uwar garke da kuma killace kowane shafi na aiki tun daga lokacin da kuka kaddamar — babu abin da za a daidaita, babu abin da za a kunna a tsakiyar matsala. Fara da gwajin kwanaki 14 ba tare da katin banki ba, wanda ke da tabbacin mayar da kudi na kwanaki 30 da sauye-sauyen shafi kyauta.

Fara kyauta