Securing internal services in a distributed environment
Disclosed herein are methods, systems, and processes to secure internal services in a distributed computing environment. A service packet that includes a service call from a source appliance is intercepted at a server. A determination is made that the service call is for an internal service provided by the source appliance and includes client information with client process properties. The service packet is demultiplexed. A determination is made that rule attributes associated with the internal service match the client process properties. The client information is removed from the service packet and the service call is forwarded to the server.
1. A computer-implemented method, comprising:
intercepting a service packet at a target appliance, wherein
the service packet comprises a service call and is received from a source appliance;
determining whether the service call is for an internal service, for which at least one rule is defined in a rule set; and
in response to a determination that at least one rule is defined in a rule set for the internal service,
determining whether one or more attributes of the at least one rule match client information of the service packet, and
in response to a determination that one or more attributes of the at least one rule do not match client information of the service packet,
rejecting the service call.
2. The computer-implemented method of claim 1 , further comprising:
determining whether the service packet comprises client information; and
in response to a determination that the service packet does not comprise client information,
rejecting the service call.
3. The computer-implemented method of claim 1 , further comprising:
determining whether the service packet comprises client information; and
in response to a determination that the service packet comprises client information, retrieving the client information, wherein
the retrieving comprises demultiplexing the service packet.
4. The computer-implemented method of claim 1 , further comprising:
in response to a determination that one or more attributes of the at least one rule match the client information of the service packet,
removing the client information from the service packet, and
storing the client information in a client log.
5. The computer-implemented method of claim 1 , further comprising:
in response to a determination that one or more attributes of the at least one rule match the client information of the service packet,
forwarding the service call to a server deployed in the target appliance.
6. The computer-implemented method of claim 1 , wherein
the client information is retrieved from source kernel memory of the source appliance.
7. The computer-implemented method of claim 1 , wherein
the client information comprises one or more client process properties.
8. The computer-implemented method of claim 7 , wherein
the one or more client process properties comprise a user context, a user group context, a client program name, a parent process name, or a terminal type.
9. The computer-implemented method of claim 7 , wherein
each rule of the rule set comprises one or more attributes, and
each attribute of the one or more attributes corresponds to a client process property of the one or more client process properties.
10. The computer-implemented method of claim 1 , wherein
the service call comprises an identifier, and
the identifier identifies the internal service.
11. The computer-implemented method of claim 10 , wherein
the internal service is protected if the rule set comprises at least one rule for the identifier, and
the internal service is unprotected if the rule set does not comprise at least one rule for the identifier.
12. A non-transitory computer readable storage medium storing program instructions executable to:
intercept a service packet at a target appliance, wherein
the service packet comprises a service call and is received from a source appliance;
determine whether the service call is for an internal service, for which at least one rule is defined in a rule set; and
in response to a determination that at least one rule is defined in a rule set for the internal service,
determine whether one or more attributes of the at least one rule match client information of the service packet, and
in response to a determination that one or more attributes of the at least one rule do not match client information of the service packet,
reject the service call.
13. The non-transitory computer readable storage medium of claim 12 , further storing program instructions executable to:
determine whether the service packet comprises client information; and
in response to a determination that the service packet does not comprise client information,
reject the service call.
14. The non-transitory computer readable storage medium of claim 12 , further storing program instructions executable to:
determining whether the service packet comprises client information; and
in response to a determination that the service packet comprises client information, retrieve the client information, wherein
retrieve the client information comprises demultiplexing the service packet.
15. The non-transitory computer readable storage medium of claim 12 , further storing program instructions executable to:
in response to a determination that one or more attributes of the at least one rule match the client information of the service packet,
remove the client information from the service packet, and
store the client information in a client log.
16. The non-transitory computer readable storage medium of claim 12 , further storing program instructions executable to:
in response to a determination that one or more attributes of the at least one rule match the client information of the service packet,
forward the service call to a server deployed in the target appliance.
17. The non-transitory computer readable storage medium of claim 12 , wherein
the service call comprises an identifier, and
the identifier identifies the internal service.
18. The non-transitory computer readable storage medium of claim 17 , wherein
the internal service is protected if the rule set comprises at least one rule for the identifier, and
the internal service is unprotected if the rule set does not comprise at least one rule for the identifier.
19. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to
intercept a service packet at a target appliance, wherein
the service packet comprises a service call and is received from a source appliance,
determine whether the service call is for an internal service, for which at least one rule is defined in a rule set, and
in response to a determination that at least one rule is defined in a rule set for the internal service,
determine whether one or more attributes of the at least one rule match client information of the service packet, and
in response to a determination that one or more attributes of the at least one rule do not match client information of the service packet,
reject the service call.
20. A computer-implemented method, comprising:
intercepting a service call, wherein
the service call is a request by a client for provision of a requested internal service;
determining whether the requested internal service is a protected internal service, wherein
the protected internal service is an internal service for which at least one rule is defined in a rule set;
in response to a determination that the internal service is the protected internal service,
generating a service packet by multiplexing client information and information specified in the service call, wherein
the client information comprises one or more client process properties, and forwarding the service packet; and
in response to a determination that the internal service is not the protected internal service,
forwarding the service call.