Securing internal services in a distributed environment
Disclosed herein are methods, systems, and processes to secure internal services in a distributed computing environment. A service packet that includes a service call from a source appliance is intercepted at a server. A determination is made that the service call is for an internal service provided by the source appliance and includes client information with client process properties. The service packet is demultiplexed. A determination is made that rule attributes associated with the internal service match the client process properties. The client information is removed from the service packet and the service call is forwarded to the server.
1. A computer-implemented method comprising:
intercepting a service packet comprising a service call from a source appliance at a server;
determining that the service call is for an internal service provided by the source appliance;
determining that the service packet comprises client information with one or more client process properties;
demultiplexing the service packet;
determining that one or more rule attributes associated with the internal service match the one or more client process properties;
removing the client information from the service packet; and
forwarding the service call to the server.
2. The computer-implemented method of claim 1 , wherein
the client information is retrieved from source kernel memory of the source appliance.
3. The computer-implemented method of claim 2 , wherein
the one or more client process properties comprise a user context, a user group context, a client program name, a parent process name, or a terminal type.
4. The computer-implemented method of claim 1 , wherein
determining that the service packet comprises the client information with the one or more client process properties comprises determining whether at least one rule of one or more rules for the internal service is defined or specified in a rule set.
5. The computer-implemented method of claim 4 , wherein
each rule of the one or more rules comprises the one or more rule attributes, and
each rule attribute of the one or more rule attributes corresponds to a client process property of the one or more client process properties.
6. The computer-implemented method of claim 1 , wherein
the service call comprises an identifier, and
the identifier identifies the internal service.
7. The computer-implemented method of claim 4 , wherein
the internal service is protected if the rule set comprises at least one rule of the one or more rules for an identifier specified in the service call, and
the internal service is unprotected if the rule set does not comprise at least one rule of the one or more rules for the identifier specified in the service call.
8. A non-transitory computer readable storage medium storing program instructions executable to:
intercept a service packet comprising a service call from a source appliance at a server;
determine that the service call is for an internal service provided by the source appliance;
determine that the service packet comprises client information with one or more client process properties;
demultiplex the service packet;
determine that one or more rule attributes associated with the internal service match the one or more client process properties;
remove the client information from the service packet; and
forward the service call to the server.
9. The non-transitory computer readable storage medium of claim 8 , wherein the client information is retrieved from source kernel memory of the source appliance.
10. The non-transitory computer readable storage medium of claim 8 , wherein
the one or more client process properties comprise a user context, a user group context, a client program name, a parent process name, or a terminal type.
11. The non-transitory computer readable storage medium of claim 8 , wherein
determining that the service packet comprises the client information with the one or more client process properties comprises determining whether at least one rule of one or more rules for the internal service is defined or specified in a rule set.
12. The non-transitory computer readable storage medium of claim 11 , wherein
each rule of the one or more rules comprises the one or more rule attributes, and
each rule attribute of the one or more rule attributes corresponds to a client process property of the one or more client process properties.
13. The non-transitory computer readable storage medium of claim 8 , wherein
the service call comprises an identifier, and
the identifier identifies the internal service.
14. The non-transitory computer readable storage medium of claim 11 , wherein
the internal service is protected if the rule set comprises at least one rule of the one or more rules for an identifier specified in the service call, and
the internal service is unprotected if the rule set does not comprise at least one rule of the one or more rules for the identifier specified in the service call.
15. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
intercept a service packet comprising a service call from a source appliance at a server;
determine that the service call is for an internal service provided by the source appliance;
determine that the service packet comprises client information with one or more client process properties;
demultiplex the service packet;
determine that one or more rule attributes associated with the internal service match the one or more client process properties;
remove the client information from the service packet; and
forward the service call to the server.
16. The system of claim 15 , wherein
the client information is retrieved from source kernel memory of the source appliance, and
the one or more client process properties comprise a user context, a user group context, a client program name, a parent process name, or a terminal type.
17. The system of claim 15 , wherein
determining that the service packet comprises the client information with the one or more client process properties comprises determining whether at least one rule of one or more rules for the internal service is defined or specified in a rule set.
18. The system of claim 17 , wherein
each rule of the one or more rules comprises the one or more rule attributes, and
each rule attribute of the one or more rule attributes corresponds to a client process property of the one or more client process properties.
19. The system of claim 15 , wherein
the service call comprises an identifier, and
the identifier identifies the internal service.
20. The system of claim 17 , wherein
the internal service is protected if the rule set comprises at least one rule of the one or more rules for an identifier specified in the service call, and
the internal service is unprotected if the rule set does not comprise at least one rule of the one or more rules for the identifier specified in the service call.