Architecture Decision Record
← Misalan rikodin shawara

Ajiyar sirri

Abubuwan da ke ciki:

Taƙaitawa

Matsala

Muna buƙatar adana sirri, kamar kalmomin sirri, maɓallan sirri, tokens na tantancewa, da sauransu.

Wasu daga cikin sirrin an tsara su ne ga mai amfani. Misali, mai haɓaka mu yana son ya iya amfani da wayar hannunsa don neman kalmar sirrin wani sabis.

Wasu daga cikin sirrin an tsara su ne ga tsari. Misali, bututun isar da mu na ci gaba yana buƙatar ya iya neman bayanan shiga na ɗaukar girgijenmu.

Shawara

Bitwarden don sirrin da aka tsara ga mai amfani

Vault na HashiCorp don sirrin da aka tsara ga tsari.

Matsayi

An yanke shawara. A buɗe muke ga sababbin madadin idan suka taso.

Cikakkun bayanai

Zato

Don wannan manufa, da yanayinmu na yanzu, muna daraja sauƙin da aka tsara ga mai amfani, kamar aikace-aikacen wayar hannu masu amfani.

  • Muna son tabbatar da saurin samun dama cikin sauƙi a kan tafiya, kamar ga mai haɓaka da ke yin aikin injiniyan aminci na tsari lokacin kira.

  • Muna son iya raba wasu sirri tsakanin zaɓaɓɓun mutane, kamar tawaga.

Ba ma ƙoƙarin warwarewa don mai samarwa ɗaya, kamar adana dukkan sirri kawai a Amazon ko Azure ko Google.

Ba ma son hanyoyi na ɗan lokaci kamar “ka tuna shi” ko “rubuta shi a takarda” ko “ka gano hanyarka ta adanawa”.

Tsarin tsaronmu don wannan manufa yana yarda da amfani da masu sayarwa COTS masu daraja, kamar kayan aikin sarrafa kalmar sirri na SaaS.

Ƙuntatawa

A yanzu muna son wani abu mai sauƙi wato babu buƙatar rubuta lamba, babu buƙatar shigar da sabobi, babu buƙatar babban alƙawari, babu buƙatar daidaita kowa.

Ra’ayoyi

Mun yi la’akari da:

  1. Masu sarrafa kalmar sirri na shirye-shirye da aka tsara ga mai amfani: LastPass, 1Password, Bitwarden, Dashlane, KeePass, pass, GPG, da sauransu.

  2. Masu sarrafa kalmar sirri na COTS da aka tsara ga tsari: AWS KMS, Vault na HashiCorp, EnvKey, Secret Server na Thycotic, Devolutions Password Server, Confidant na Lyft.

  3. Hanyoyin da aka tsara ga rabawa: amfani da takardar Google da aka raba, ko tashar Slack da aka raba, ko kundin hanyar sadarwa da aka raba, da sauransu.

  4. Hanyoyi marasa fasaha na ɗan lokaci, kamar tunawa, rubuta takarda, ko dogara ga kowane mai amfani ya gano hanyarsa.

Hujja

Bitwarden, LastPass, 1Password, da Dashlane duk kayayyakin kasuwanci ne na shirye-shirye.

  • Irin siffofi iri ɗaya ga masu amfani, tawagogi, ƙungiyoyi, da sauransu.

  • Iyawar kwamfuta ta tebur don Windows da Mac, da iyawar wayar hannu don Android da iOS.

  • Ƙarin burauza don Chrome da Firefox, don cike fom ta atomatik, da sauransu.

Bitwarden yana da fa’idodi biyu fiye da sauran:

  • Bitwarden buɗaɗɗen tushe ne, wanda ke nufin za a iya bitar tsaronsa ta abokan aiki kuma kamfanin yana samun yabo sosai daga masu haɓakawa masu mai da hankali kan tsaro.

  • Labaran ma’aikatan manhaja suna bayyana fifiko mai girma ga Bitwarden fiye da sauran.

Misalin rubutu mai kyau na yau da kullum: https://jcs.org/2017/11/17/bitwarden

Misalin shafin kaɗa ƙuri’a gefe-da-gefe na yau da kullum: https://stackshare.io/stackups/bitwarden-vs-dashlane

Mun jinkirta KeyPass, pass, GPG, da sauransu domin akwai ƙarin sarƙaƙiya. Dukan waɗannan suna kama da kyawawan mafita ga masu amfani na fasaha. GPG yana da kyau musamman ga masu amfani na fasaha da ke son iyawar umarni a tsarukan da yawa.

Mun jinkirta KMS domin yana da daurewa ga mai samarwa ɗaya.

Mun zaɓi Vault don buƙatun da aka tsara ga tsari, domin bitar-bitar suna da kyau mai ban mamaki, kuma domin HashiCorp yana da kyakkyawan tarihin manhaja da tallafi masu inganci.

Mun hana hanyoyin rabawa kamar ta takardu da aka raba, tashoshi da aka raba, kundin hanyar sadarwa da aka raba, da sauransu. Waɗannan ba sa samar da ingancin tsaro da muke so.

Mun hana hanyoyin marasa fasaha na ɗan lokaci, domin duk mun yarda cewa ba hanyar ci gaba ta dogon lokaci ba ce.

Tasiri

Masu haɓakawa na iya buƙatar bin diddigin sirri a wurare biyu: Bitwarden don samun dama da aka tsara ga mai amfani, da Vault don samun dama da aka tsara ga tsari.

Mai alaƙa

Shawarwari masu alaƙa

Shawarar wane sabar CI/CD dole ne ta haɗa da shaidar iyawa don samun damar sirri.

Za mu buƙaci yanke yadda za a sarrafa sirrin, ta fuskar manufofi, jujjuyawa, ƙungiyoyi, da sauransu.

Buƙatu masu alaƙa

Sirrin zai kasance yana da buƙatu masu alaƙa don bin ƙa’ida, bincike, da shigar da ma’aikata/fitar da ma’aikata na HR.

Kayayyakin da aka samar masu alaƙa

Muna sa ran za mu iya fitar da wasu sirri zuwa sauye-sauyen muhalli.

Ƙa’idoji masu alaƙa

Mai sauƙin sakewa.

Mai sauƙin yin a layi ɗaya wato yana da sauƙi a yi amfani da nau’ikan masu sarrafa kalmar sirri iri-iri.

Mai arha a gwada wato akwai gwaji kyauta kuma babu alƙawari.

Bayanan kula

Bayanan kimantawa a nan. Bayanan duk sharhi ne na jama’a a dandalolin tattaunawa na devops daban-daban.

Vault na HashiCorp

Vault shi ne ainihin abin da kuke so a nan.

Amma kar ku jefa Vault kai tsaye cikin samarwa, ku kafa shi a muhallin gwaji da farko, domin takardun HashiCorp na iya zama marasa isa ko da kayayyakinsu suna da ban mamaki.

Lokacin koyo mai tsayi sosai kuma kafa shi ba abu ne mai sauƙi ba.

Saitin farko ɗan wahala ne. Duk da haka ya cancanci hakan, kuma al’umma za ta goyi bayansa isa don ku wuce.

Takardu marasa kyau amma akwai jagorori da yawa a intanet na mutane da ke kafa shi kuma idan kuka haɗa wasu daga cikinsu za ku sami saiti mai aiki.

Saitin farko ya ɗauki wasu gyare-gyare da helm charts ɗinsu (vault da consul). Ko da yake a fasaha za ku iya amfani da wasu back-ends da yawa, ba na ba da shawara ba sosai. Back-end/consul na iya zama ƙanƙanin gaske idan ba ku da bayanai masu yawa da za ku adana.

Tabbas ku saba/ku san amfani da CLI, domin GUI ya fi kama da tashar shaidar-ra’ayi/tallace-tallace ga bugun kamfanin su.

Gaskiyar cewa ba za ku iya “cika shi” kawai ba abin damuwa ne. Misali idan kuna da fagage 5 dole ne ku ƙara kowane fage da hannu ga kowane abu. Don haka ba kamar ku ayyana fagage a gaba ga wani rukuni na musamman ba, ku cika waɗannan fagage ga duk abubuwan da ke cikin rukunin, ya fi kama da “kuna samar da komai a kowane lokaci”, wanda (a ganina) abin damuwa ne.

Wataƙila kuna so ku duba goldfish a matsayin UI a saman vault. Yana sauƙaƙa sa tawagarku su yarda da shi. Suna da nuni (demo) ma. 1. Kafa consul. 2. Kafa vault da ke nuni zuwa consul. 3. Kafa goldfish da ke nuni zuwa vault. 3. Kafa wani cron job don gudanar da consul snapshot don ajiyar madadin.

LastPass

LastPass Teams. Muna amfani da shi, yana da samfura na musamman, ACL, babu abin da ya ɓace a ganina.

Na aiwatar da LastPass a ƙungiyata kuma ina ba shi C+/B-. Babbar matsalar kwanan nan ita ce rashin aminci. A cikin kwanaki 90 da suka gabata an sami sa’o’i da yawa da aka tilasta vaults zuwa yanayin kan-layi-a-kashe. Wannan bai dace da ƙungiyata ba domin muna da, a zahiri, kalmomin sirri 4,000+ da aka adana a cikin manyan kundin da aka raba 20+. Kamar yadda kuke tunani da kalmomin sirri masu yawa haka wasu kaɗan aƙalla ana sabunta su ko ƙara su kullum. Muna da shirin DR idan matsaloli sun ci gaba fiye da sa’a ɗaya ko biyu: wani rubutu yana sa hannu kuma yana ɓoye zubar CSV na vault kowane dare wanda za a iya shigo da shi cikin keepass.

LastPass ya yi tsaiko na hidima da ba a bayar da rahoto ba: shiga “yana aiki” amma ba ya ɗauko shafuka, wasu siffofi na bazuwar sun lalace a allon gudanarwa, kuma ba ya raba maɓallai yadda ya kamata ga sababbin manyan kundin da aka raba. Ina da takamaiman mai amfani na ‘key push’/ajiyar madadin wanda yake cikin kowace ƙungiya. Yawanci shiga a matsayin wannan mai amfani yana gyara kowace matsalar raba maɓalli amma ba lokacin da hidima ta tabarbare ba duk da abin da shafin matsayi ya faɗa...

Don haɗewa yana iya zama mai sauƙi idan kuna da ACL masu kyau da samfurin mafi ƙarancin izini misali idan mai amfani yana da karatu & rubutu da karatu kawai a kan shigarwa ko kundi sai ya sami izinin karatu kawai. Abin takaici ACL na ƙungiyata ba su fi kyau ba don haka na ƙare da amfani da API na samarwa na JSON da ~layuka 500 na python saboda yanayin dogaro na ɗaruruwan ACL ɗinmu bai dace da samfurin mafi ƙarancin izini ba. Na ƙare da samun duk ACL da mai amfani yake ciki kuma na yi wani nau’in tafiya ta dogaro.

Idan tsarin ACL ko ƙungiyarku an riga an gina shi da samfurin mafi ƙarancin izini a zuciya kayan aikin daidaita AD/LDAP na Windows zai yi aiki da kyau.

Ku tuntuɓi tawagar tallace-tallacensu kuma za su iya ba ku gwajin Enterprise mai tsawo. Ku tabbata kun fahimci iyakokinsa sosai kafin ku yanke. Mun sami wahalhalun girma da yawa amma banda katsewa ko tabarbarewa a gefen sabar ya kasance mai santsi sosai.

Bitwarden

Bitwarden yana da kyawawan kayan aiki a kewaye da shi (WebUI, CLI, Wayar hannu, Tebur). Ana iya ɗaukarsa da kai kuma yana da sauƙin kafawa. Takardu masu kyau sosai kuma kayan aikin da PrivacyTools ke ba da shawara.

EnvKey

https://www.envkey.com/ SaaS ne. Mai sauƙin aiwatarwa, haɗawa da sarrafawa sosai.

Siffofi:

  • Kare maɓallan API da bayanan shiga.

  • Kiyaye saiti daidai a ko'ina.

  • Gudanar da saiti da sirri mai wayo, ɓoye-daga-ƙarshe-zuwa-ƙarshe.

  • Hana raba mara tsaro da yaɗuwar saiti.

  • Haɗa cikin mintuna.

Iyawa:

  • Sarrafa saiti da matakan samun dama na duk aikace-aikacenku, muhallai, da tawagogi a wuri ɗaya.

  • Saita kowane muhallin ci gaba ko sabar da sauya muhalli ɗaya kawai.

Fa’idodi:

  • Shafin gida mai kyau.

  • Bayyananniyar ƙimar da ake bayarwa.

  • Aikace-aikacen yanar gizo mai kyau na gani.

  • Kyawawan bayanan misali misali Algolia, AWS, Datadog, GitHub, Stripe, da sauransu.

  • Na yi magana da wanda ya kafa na mintuna 30 game da kamfanin, UI, da sauransu. Dane yana da masaniya, mai gaskiya game da fa’idodi/rashin fa’idodi, kuma abokin tarayya mai yiwuwa.

  • Kamfanin a zahiri kamfanin Y Combinator ne na yau da kullum, mai wanda ya kafa 1. Ya tara $120K a 2018-01.

  • Mai da hankali yana kan kai wa siffofin kamfanoni, musamman komawa daga ɗaukar EnvKey a girgije zuwa ko dai a cikin gida ko BYOC.

  • Yiwuwar hanyar gaba ta fara da EnvKey don sauƙin amfani, sannan daga baya (ko a layi ɗaya) ƙara Vault.

Confidant na Lyft

https://lyft.github.io/confidant/

Confidant sabis ne na sarrafa sirri na buɗaɗɗen tushe wanda ke ba da ajiya mai sauƙin amfani da samun damar sirri ta hanyar tsaro, daga masu haɓakawa a Lyft.

Tantancewar KMS: Confidant yana warware matsalar tantancewa ta kaza-da-ƙwai ta amfani da AWS KMS da IAM don ba matsayin IAM damar samar da tokens na tantancewa masu tsaro waɗanda Confidant zai iya tabbatarwa. Confidant kuma yana sarrafa kyautar KMS don matsayin IAM ɗinku, wanda ke ba matsayin IAM damar samar da tokens da za a iya amfani da su don tantancewa tsakanin sabis, ko don aika saƙonni masu ɓoye tsakanin sabis.

Ɓoyewa a hutu na sirri masu nau’i: Confidant yana adana sirri ta hanyar ƙari-kawai a DynamoDB, yana samar da maɓallin bayanai na KMS na musamman ga kowane bita na kowane sirri, ta amfani da ɓoyayyen rubutu na Fernet mai daidaitaccen maɓalli kuma tantacce.

Mu’amalar yanar gizo mai sauƙin amfani don sarrafa sirri: Confidant yana ba da mu’amalar yanar gizo ta AngularJS da ke ba masu amfani na ƙarshe damar sarrafa sirri, taswirar sirri zuwa sabis da tarihin canje-canje cikin sauƙi.

Devolutions Password Server

https://server.devolutions.net/

Tsare, sarrafa, da sa ido kan samun damar asusun da zaman da ke da gata.

Cikakken vault na kalmar sirri mai tsaro sosai wanda ke ba ku damar sarrafa samun damar asusunku masu gata, yayin da kuma yake inganta ganuwar hanyar sadarwa gabaɗaya ga masu gudanar da tsari kuma yana ba masu amfani na ƙarshe ƙwarewa mara matsala.

Siffofi: vault na kalmar sirri na ƙungiya na tsakiya, vault na sirri na mai amfani, mai sarrafa kalmar sirri, allurar bayanan shiga, haɗewa da Active Directory, ikon shiga bisa matsayi, tantancewa mai matakai biyu, shirye ga kamfanoni, hana IP, iyawar gudanarwa, mai samar da kalmar sirri ta atomatik, samun dama ta aikace-aikacen wayar hannu, tarihin kalmar sirri, rahotannin samun dama, faɗakarwar imel.

  • yana goyon bayan ɓoye bayanai

  • yana goyon bayan tsare-tsaren tantancewa da yawa ciki har da LDAP, O365, da masu amfani na Gida TARE da goyon bayan MFA daga tushe da yawa

  • ma’ajiyoyi/vaults da yawa tare da ikon shiga mai cikakken bayani ga tawagogi da yawa

  • UI na yanar gizo na zamani

  • vaults na sirri na bayanan shiga da haɗi don bayanan shiga/haɗin sirri

  • aikace-aikacen wayar hannu don IOS/Android

  • rajistan bincike ga kowace shigarwa, wa/me/yaushe tare da tambaya na zaɓi na dalilin da yasa suke samun dama

  • samfura masu keɓancewa (ko da yake suna goyon bayan ɗaruruwan nau’ikan haɗi na asali)

  • ƙarin siffofi masu yawa da abokin ciniki mai kauri na Windows/Mac (Remote Desktop Manager) da za ku iya daidaitawa da shi wanda ke faɗaɗa zaɓuɓɓuka sosai...haɗi da danna ɗaya

  • farashin bai yi muni ba - har zuwa masu amfani 15 $500 a shekara ne ga sabar kalmar sirri

Secret Server na Thycotic

https://thycotic.com/products/secret-server/

Siffofin sigar cikin-gida:

  • Cikakken iko kan tsarukan tsaro da kayayyakin more rayuwa na ƙarshe-zuwa-ƙarshe

  • Ɗora manhaja a cibiyar bayananku ta cikin-gida ko misalin girgijenku na sirri

  • Cika wajibai na doka da ƙa’ida da ke buƙatar duk bayanai da tsarukan su kasance a cikin gida

Siffofin sigar girgije:

  • Tsarin manhaja-a-matsayin-sabis yana ba ku damar yin rajista kuma ku fara nan take

  • Iya faɗaɗuwa mai sassauci yayin da kuke girma

  • Sarrafawa da maimaitawa da Azure ke isarwa tare da SLA na samuwa 99.9%

Ra’ayin masu amfani:

  • Mun kasance muna amfani da wannan samfurin. An keta shi cikin sauƙi sosai kuma ƙa’idodin suna aiki ne kawai ga masu wayo. Masu rago ko wawaye za su iya lalata shi cikin sauƙi a yankin tawaga. Ana iya tattaunawa kan farashi lokacin da kuke magana da su.

  • Kuna iya gudanar da shi ta amfani da SQL express da akwatin Win 7.

  • Arha.