SECURING INTERNAL SERVICES IN A DISTRIBUTED ENVIRONMENT
Disclosed herein are methods, systems, and processes to secure internal services in a distributed computing environment. A service packet that includes a service call from a source appliance is intercepted at a server. A determination is made that the service call is for an internal service provided by the source appliance and includes client information with client process properties. The service packet is demultiplexed. A determination is made that rule attributes associated with the internal service match the client process properties. The client information is removed from the service packet and the service call is forwarded to the server.
1 .- 20 . (canceled)
21 . A computer-implemented method comprising:
intercepting a service call initiated by a client process of a client, wherein
the service call is a request for an internal service,
the internal service is provided by a server,
the service call comprises an identifier, and
the identifier identifies the internal service;
determining whether one or more rules of a plurality of rules are specified for the identifier;
in response to a determination that the one or more rules are specified for the identifier,
processing one or more attributes of the one or more rules, and
forwarding the service call to the server, if the processing indicates that the forwarding the service call is allowable; and
in response to a determination that none of the plurality of rules are specified for the identifier,
forwarding the service call to the server.
22 . The computer-implemented method of claim 21 , further comprising:
retrieving one or more client process properties of a plurality of client process properties associated with the client process from kernel memory.
23 . The computer-implemented method of claim 21 , wherein
the identifier is a port identifier or a port number.
24 . The method of claim 22 , wherein
the plurality of client process properties comprise a user context, a user group context, a client program name, a parent process name, or a terminal type.
25 . The computer-implemented method of claim 22 , further comprising:
forwarding the service call to the server if each attribute of the one or more attributes of at least one rule matches a corresponding client process property of the one or more client process properties.
26 . The computer-implemented method of claim 25 , further comprising:
generating a reject notification if at least one client process property of the one or more client process properties does not match each attribute; and
sending the reject notification to the client.
27 . The computer-implemented method of claim 26 , wherein
a first attribute of the one or more attributes of a first rule of the one or more rules corresponds to a first client process property of the one or more client process properties, and
a second attribute of the one or more attributes of a second rule of the one or more rules corresponds to a second client process property of the one or more client process properties.
28 . The computer-implemented method of claim 22 , wherein
the plurality of rules are part of a rule set,
the rule set is part of a service call filter module, and
the service call filter module is part of a kernel.
29 . The computer-implemented method of claim 28 , further comprising:
accessing the rule set to determine whether the internal service identified by the identifier is unprotected or protected.
30 . The computer-implemented method of claim 29 , wherein
the internal service is protected if the rule set comprises at least one rule of the plurality of rules for the identifier specified in the service call, and
the internal service is unprotected if the rule set does not comprise at least one rule of the plurality of rules for the internal service specified in the service call.
31 . The method of claim 30 , further comprising:
forwarding the service call to the server if
the internal service is unprotected, or
each attribute of the at least one rule matches the corresponding client process property of the one or more client process properties.
32 . The computer-implemented method of claim 21 , wherein
the client and the server are deployed in an appliance.
33 . The computer-implemented method of claim 21 , further comprising:
in response to the determination that the one or more rules are specified for the identifier,
rejecting the service call, if the one or more rules indicate that the service call should not be forwarded to the first server.
34 . The computer-implemented method of claim 21 , further comprising:
the service call is intercepted by a service call filter module executing in a kernel,
the service call filter module comprises a rule set that is stored in the kernel memory, and
the forwarding the service call to the server is performed without accessing kernel memory.
35 . A non-transitory computer readable storage medium storing program instructions executable to perform a method comprising:
intercepting a service call initiated by a client process of a client, wherein
the service call is a request for an internal service,
the internal service is provided by a server,
the service call comprises an identifier, and
the identifier identifies the internal service;
determining whether one or more rules of a plurality of rules are specified for the identifier;
in response to a determination that the one or more rules are specified for the identifier,
processing one or more attributes of the one or more rules, and
forwarding the service call to the server, if the processing indicates that the forwarding the service call is allowable; and
in response to a determination that none of the plurality of rules are specified for the identifier,
forwarding the service call to the server.
36 . The non-transitory computer readable storage medium of claim 35 , wherein the method further comprises:
retrieving one or more client process properties of a plurality of client process properties associated with the client process from kernel memory, wherein
the plurality of client process properties comprise a user context, a user group context, a client program name, a parent process name, or a terminal type;
forwarding the service call to the server if each attribute of the one or more attributes of at least one rule matches a corresponding client process property of the one or more client process properties;
generating a reject notification if at least one client process property of the one or more client process properties does not match each attribute; and
sending the reject notification to the client.
37 . The non-transitory computer readable storage medium of claim 35 , wherein the method further comprises:
accessing the rule set to determine whether the internal service identified by the identifier is unprotected or protected, wherein
the plurality of rules are part of a rule set,
the rule set is part of a service call filter module,
the service call filter module is part of a kernel,
the internal service is protected if the rule set comprises at least one rule of the plurality of rules for the identifier specified in the service call, and
the internal service is unprotected if the rule set does not comprise at least one rule of the plurality of rules for the internal service specified in the service call; and
forwarding the service call to the server if
the internal service is unprotected, or
each attribute of the at least one rule matches the corresponding client process property of the one or more client process properties.
38 . The non-transitory computer readable storage medium of claim 35 , wherein the method further comprises:
in response to the determination that the one or more rules are specified for the identifier,
rejecting the service call, if the one or more rules indicate that the service call should not be forwarded to the first server.
39 . The non-transitory computer readable storage medium of claim 35 , wherein the method further comprises:
the service call is intercepted by a service call filter module executing in a kernel,
the service call filter module comprises a rule set that is stored in the kernel memory, and
the forwarding the service call to the server is performed without accessing kernel memory.
40 . A computer-implemented method comprising:
intercepting, by a service call filter module executing in a kernel, a service call initiated by a client process of a client executing in a first portion of a first user space of a first appliance, wherein
the service call is a request for a service comprising an identifier that identifies the service, and
the service call filter module comprises a rule set;
determining whether the service is an internal service, wherein
the internal service is provided by a first server executing in a second portion of the first user space of the first appliance;
in response to a determination that the service is the internal service,
determining whether one or more rules of a plurality of rules are specified for the internal service identified by the identifier, wherein
the determining is performed by the service call filter module accessing the rule set, and
in response to a determination that the one or more rules are specified for the internal service identified by the identifier,
determining whether to forward the service call to the first server by applying the one or more rules to the service call, and
forwarding the service call to the first server, if the one or more rules indicate that the service call should be forwarded to the first server; and
in response to a determination that the service is not the internal service, forwarding the service call to a second appliance, wherein
the service is another service that is provided by a second server executing in a portion of a second user space of the second appliance, and
the service call is forwarded to the second appliance without applying any of the plurality of rules to the service call.