This is an automated email from the ASF dual-hosted git repository. wusheng pushed a commit to branch security-doc in repository https://gitbox.apache.org/repos/asf/skywalking.git
commit 095f0d5a8bae0b8a023629e289a7d9cb4776a8b1 Author: Wu Sheng <[email protected]> AuthorDate: Sat Oct 8 08:41:23 2022 +0800 Add Security Notice doc. --- docs/en/changes/changes.md | 1 + docs/en/security/README.md | 30 ++++++++++++++++++++++++++++++ docs/menu.yml | 2 ++ 3 files changed, 33 insertions(+) diff --git a/docs/en/changes/changes.md b/docs/en/changes/changes.md index eb9cba8c25..4ca4624d11 100644 --- a/docs/en/changes/changes.md +++ b/docs/en/changes/changes.md @@ -79,5 +79,6 @@ * Move general good read blogs from `Agent Introduction` to `Academy`. * Add re-post for blog `Scaling with Apache SkyWalking` in the academy list. * Add re-post for blog `Diagnose Service Mesh Network Performance with eBPF` in the academy list. +* Add **Security Notice** doc. All issues and pull requests are [here](https://github.com/apache/skywalking/milestone/149?closed=1) diff --git a/docs/en/security/README.md b/docs/en/security/README.md new file mode 100644 index 0000000000..4243cc6c5e --- /dev/null +++ b/docs/en/security/README.md @@ -0,0 +1,30 @@ +# Security Notice + +The SkyWalking OAP server and UI should run in a secure environment, such as only inside your data center. +OAP server, UI, and all agents deployment should only be reachable by the operation team only on default +deployment. + +All telemetry data are trusted. The OAP server **would not validate any field** of the telemetry data to avoid extra +load for the server. + +It is up to the operator(OPS team) whether to expose the OAP server, UI, or some agent deployment to unsecured +environment. +The following security policies should be considered to add to secure your SkyWalking deployment. + +1. HTTPs and gRPC+TLS should be used between agents and OAP servers, as well as UI. +2. Set up TOKEN or username/password based authentications for the OAP server and UI through your Gateway. +3. Validate all fields in the body of the traceable RPC(including HTTP 1/2, MQ) headers when requests are from out of + the trusted zone. +4. All fields of telemetry data(HTTP in raw text or encoded Protobuf format) should be validated and reject malicious + data. + +Without these protections, an attacker could embed executable Javascript code in those fields, causing XSS or even +Remote Code Execution (RCE) issues. + +For some sensitive environment, consider to limit the telemetry report frequency in case of DoS/DDoS for exposed OAP +and UI services. + +## appendix + +The SkyWalking [client-js](https://github.com/apache/skywalking-client-js) agent is always running our of the secured +environment. Please follow its [security notice] for more details. \ No newline at end of file diff --git a/docs/menu.yml b/docs/menu.yml index a87e597778..7b4dbb7b5f 100644 --- a/docs/menu.yml +++ b/docs/menu.yml @@ -209,6 +209,8 @@ catalog: path: "/en/protocols/readme" - name: "Query Protocol (GraphQL)" path: "/en/protocols/query-protocol" + - name: "Security Notice" + path: "/en/security/readme" - name: "Academy" catalog: - name: "Scaling SkyWalking server automatically in kubernetes"
