Ku bw'impanuka .env Amabanga cyangwa AWS Urufunguzo rwa GitHub rusange Repo: Impamvu Gusiba Idosiye Ntabihisha¶

Kumenya amasegonda icumi nyuma yo kwiruka git push origin main (cyangwa guhinduranya ububiko bwihariye kuri Public) ko ibyo wiyemeje birimo inyandiko isobanutse .env dosiye, AWS AKIA... Kugera Urufunguzo nurufunguzo rwibanga, GufunguraAI / Anthropic API urufunguzo, umurongo sk_live_... ikimenyetso cyerekana umusaruro, PostgreSQL / MongoDB base base URI hamwe nijambobanga, cyangwa idafite ibanga $HOME/.ssh/id_ed25519 urufunguzo rwigenga ni ibintu bitanu byihutirwa byumutekano byihutirwa. Automated credential-gusarura botnets ubudahwema gutora rubanda ** GitHub Events Firehose (api.github.com/events) ** na clone gushya gushya byiyemeje ** mumasegonda 1.5 kugeza 4 git push kurangiza **. Ikirushijeho kuba kibi, hafi ya buri muterimbere utera ubwoba akora ikosa rimwe ryica: basiba i .env dosiye mugace, ongeraho .env Kuri .gitignore, hanyuma usunike icya kabiri wiyemeje "remove .env" cyangwa "oops". ** Gusunika icyemezo cya kabiri gisiba .env nta kintu gihishe **: ibanga risobanutse rikomeza gusomwa 100 ku ijana iteka imbere mubyemezo byabanje;git log -p), kandi niyo waba uhatira-gusunika (git push --force) hejuru y'ishami, kwiyemeza kutabigenewe (dangling blob) ikomeza kugerwaho kumugaragaro binyuze muri URL ya GitHub itaziguye kandi ihishe Pull Gusaba kugeza igihe byahanaguwe neza. Niba ibyangombwa byamenyekanye bimaze gukoreshwa nabagabye igitero kugirango bakoreshe incungu, gushimuta domaine yawe ya DNS, cyangwa gufunga umukode wawe wigicu, baza abajyanama bacu. incungu hamwe nibisubizo bya malware, izina rya domaine gushimuta, DNS yarangiye, no gufata urubuga, na Google Workspace cyangwa Microsoft 365 yihariye ya domaine admin gufunga. Niba kumeneka ibyemezo bigira ingaruka kumutekano wibitaro byabarwayi, kugenzura inganda zumubiri, cyangwa ibikorwa remezo byoherejwe byihutirwa, hamagara numero yihutirwa yawe (911 muri Amerika no muri Kanada, 112 hirya no hino mu muryango w’ubumwe bw’ibihugu by’Uburayi, 999 mubwongereza) cyangwa reba ububiko mpuzamahanga bwa nimero yihutirwa.

Kora ubu¶

1. ** SHAKA, UKORESHEJE, KANDI UREBE buri banga ryerekanwe kumurongo utanga konsole Yambere - mumasegonda 120 yambere - mbere yo guta isegonda imwe yiruka git amategeko **: Iyo ibanga rimaze gukora ku bubiko rusange bwa GitHub, GitLab, cyangwa Bitbucket mu masegonda 3, ** fata urwo rufunguzo nk'urwabya burundu kandi rumaze kuba mu maboko y'abateye mu buryo bwikora **. Nta mubare wa git reset --hard, git push --force, cyangwa gusiba ububiko bushobora gusiba urufunguzo muri data base ya scraper bot yamaze gukuramo ibyo wiyemeje kumwanya wa kabiri # 2. Injira muri AWS IAM, Stripe, OpenAI, konsole yububiko, cyangwa igenamiterere rya GitHub SSH nonaha na ** Gukuraho / Gusiba / Kuzuza urufunguzo ako kanya **.
2. ** Kugenzura Igicu cyawe cyo Kwishyuza no Kugenzura Ibitabo (AWS CloudTrail, GCP Cloud Audit Logs, Stripe Logs) ku idirishya hagati yawe git push na urufunguzo rwawe rwo gukuraho **: Automatic cryptomining bots ikoresha yamenetse AWS_ACCESS_KEY_ID (AKIA...) ibyangombwa mumasegonda 30 kugeza kuri 90 kugirango azunguruke ntarengwa-kwota GPU ingero (p4d.24xlarge / g5.48xlarge) hirya no hino mu turere twa AWS twihishe (ap-east-1, me-south-1, af-south-1) no gukora inyuma ya IAM abakoresha cyangwa Lambda gutsimbarara ku buryo biguma imbere muri konte yawe ya AWS na nyuma yo gusiba urufunguzo rwasohotse.
3. ** NTUKIGERE usunika isegonda "Delete .env" kwiyemeza - mubyukuri, kwandika "delete secret" cyangwa "remove password" mubutumwa bwo kwiyemeza bukurura bots scraper bots **: Ibihumbi nibihumbi byinyandiko-iterabwoba-abakinyi babaza cyane cyane GitHub Shakisha ubutumwa bwiyemeje burimo "remove .env", "delete key", "oops", na "remove credentials", hanyuma ukande umwe wiyemeje gusubira mumateka kugirango wiba urufunguzo.
4. ** Ongera wandike amateka yose yububiko bwa Git ukoresheje git filter-repo (cyangwa BFG Repo-Cleaner) gucukumbura dosiye cyangwa kugabanya ijambo ryibanga kuva buri gikorwa cyamateka, igiti, na tag **: git filter-branch guteshwa agaciro kumugaragaro n'umushinga Git; koresha git filter-repo --invert-paths --path .env (to nuke dosiye kuva mubikorwa byose) cyangwa git filter-repo --replace-text expressions.txt (gusimbuza ijambo ryibanga ryihariye hamwe ***REMOVED*** imbere kode ya dosiye udasiba dosiye).
5. ** Imbaraga-gusunika amashami yose na tagi (git push origin --force --all), KANDI uhanagura GitHub ya seriveri-kuruhande rwihishwa ()dangling commits) **: Dore ibanga abaterankunga benshi batazi: na nyuma yo kwiruka git filter-repo na git push --force, ** Seriveri ya GitHub ituma abakera biyemeza SHA muzima mubintu byabo cache (git cat-file) **, bivuze ko umuntu wese wanditse inyuguti 40 yiyemeje SHA kuva mubikorwa rusange API arashobora kureba github.com/user/repo/commit/<OLD_SHA>. Turasobanura hepfo uburyo bwo guhita dusiba dangling wiyemeje gukora ukoresheje GitHub Inkunga / API cyangwa mugusiba no kongera ububiko.
6. ** Shyira hafi pre-commit scaneri y'ibanga (gitleaks cyangwa trufflehog) imbere .git/hooks/pre-commit mbere yo kwandika undi murongo wa code **: A 10-isegonda gitleaks protect --staged mbere yo kwiyemeza kugenzura igenzura buri murongo wateguwe kuri mudasobwa yawe igendanwa git commit mbere ibanga rishobora kuva muri mashini yawe.

Igiti cyemezo: guhita, kuzunguruka, hamwe na Git amateka yohanagura¶

Kora iki gikorwa cyakazi muburyo bukurikirana (Kuraho BWA MBERE -> Kugenzura Kwihangana KWA KABIRI -> Gukuraho Amateka ya Gitatu):

flowchart TD
    Start["Ibanga ryasunitswe kuri repo rusange (.env, AWS / GCP Urufunguzo, DB Ijambobanga, Stripe / Urufunguzo rwa OpenAI, cyangwa Urufunguzo rwa SSH)"] --> Step1["MINUTE 0 KUGEZA 2"]

    Step1 --> SecretType{"Ni ubuhe bwoko bw'impamyabumenyi bwari imbere mu kwiyemeza?"}

    SecretType -->|"Urufunguzo rw'Ibikorwa Remezo (AWS AKIA, Konti ya serivisi ya GCP JSON, Azure SP)"| CloudAudit["MINUTE 2 KUGEZA 10: Reba CloudTrail / Ibikorwa Byibikorwa -> Kurangiza Rogue EC2 / Kubara Ingero mu Turere twose -> Siba Abakoresha IAM batabifitiye uburenganzira / Uruhare / amasomo ya STS"]

    SecretType -->|"Ububikoshingiro URI / Ijambobanga (Postgres, MySQL, MongoDB, Redis, Supabase)"| DBAudit["MINUTE 2 KUGEZA 10: Hindura DB Ijambobanga ryabakoresha + Kwica Ihuza Rikora (pg_terminate_backend) + Funga itsinda ryumutekano wa Firewall kuri IP yemewe gusa"]

    SecretType -->|"API Token cyangwa SSH Urufunguzo (Stripe, OpenAI, GitHub PAT, Slack, Private SSH Urufunguzo)"| TokenAudit["MINUTE 2 KUGEZA 10"]

    CloudAudit --> RepoVisibility{"MINUTE 10 KUGEZA 20: Nigute Ushaka Gukuraho Ububiko bwa GitHub?"}
    DBAudit --> RepoVisibility
    TokenAudit --> RepoVisibility

    RepoVisibility -->|"Byihuta 100% Cache-Ihanagura (Ntakibazo Cyingenzi / Amateka Yinyenyeri Kubika)"| NukeRepo["1. Siba ububiko bwose kuri GitHub Igenamiterere. 2. Koresha git filter-repo Muburyo bwo Gusukura Amateka. 3. Kurema Repo Nshya & Gusunika Amateka Yeza (Ako kanya Kurimbura Byose Cashe Yiyemeje SHAs)"]

    RepoVisibility -->|"Ugomba Kubika Repo Ihari, Ibibazo, PR, & Forks"| RewriteRepo["1. Koresha git filter-repo (--hindura-inzira cyangwa --isimbuza-inyandiko). 2. Koresha git gusunika - imbaraga - zose & --tags. 3"]

Icyiciro cya 1: Umunota 0 kugeza 2 - Urupapuro rwo gukuraho ako kanya Urupapuro rwabigenewe¶

Kora ** ntabwo ** fungura terminal kugirango urwanye git rebase mugihe urufunguzo rwawe rwo gukora ruracyakora. Kanda neza kuri nyirubwite yibasiwe hepfo hanyuma wice ibyangombwa mbere:

Icyiciro cya 2: iminota 2 kugeza 10 - Kugenzura niba Abagabye igitero Bamaze Kurema Inyuma (AWS / Igicu kirimo)¶

Niba wasohotse .env dosiye yarimo urufunguzo rwa ** AWS (AKIA...) **, ** Google Cloud Service Service JSON **, cyangwa ** Umuyobozi wa Azure Service **, gusiba urufunguzo rwasohotse ni kimwe cya kabiri cyintambara. Ugomba kugenzura ko bot yikora itakoresheje ayo masegonda 90 kugirango ushireho imbaraga muri konte yawe yibicu:

Igenzura rya 6-AWS Nyuma yubugenzuzi bwubucamanza¶

1. ** Reba AWS CloudTrail -> Event history kuri API zose zahamagaye zakozwe zasohotse Access Key ID**:
2. Fungura ** AWS CloudTrail Console -> Amateka y'ibyabaye **.
3. Hindura ibishakisha biva kuri * Soma-gusa * kuri Access key ID hanyuma wandike ibimenetse AKIA... umugozi.
4. Reba ibyabaye byose byinjiye kuva umunota wirutse git push. Shakisha byumwihariko: CreateUser, CreateAccessKey, AttachUserPolicy, CreateRole, AssumeRole, GetSessionToken, RunInstances (EC2), RequestSpotInstances, CreateFunction (Lambda), cyangwa SendEmail (SES spam).
5. ** Kuraho ikintu icyo aricyo cyose cyigihe gito STS amasomo yatanzwe nuwo mukoresha **:
6. Ndetse na nyuma yo gusiba an AKIA... kwinjira urufunguzo, niba uwagabye igitero yahamagaye sts:GetSessionToken mbere yo gusiba urufunguzo, by'agateganyo **ASIA... Ikimenyetso Ikimenyetso kigumaho amasaha agera kuri 36. **
7. Kwica ibikorwa byose byigihe gito STS ibimenyetso kuri uriya mukoresha wa IAM ako kanya, jya kuri IAM -> Users -> [Leaked User] -> Permissions -> Add inline policy hanyuma ukande Revoke sessions (ifatanye neza Deny * politiki kubimenyetso byose byatanzwe aho aws:TokenIssueTime ni kare kuruta ubu.).
8. ** Reba IAM -> Users na IAM -> Roles kuri konte nshya yinyuma yinyuma **:
9. Gutondeka Abakoresha IAM bose kuri ** Igihe cyo kurema **. Siba umukoresha wese utamenyereye (admin-backup, sys-monitor, support-bot) no kugenzura Trust relationships tab kuruhare rwa IAM kugirango umenye neza ko uwagabye igitero atongeyeho ID ID ya konte ya AWS yo hanze ("Principal": {"AWS": "arn:aws:iam::999999999999:root"}) nk'umuyobozi wizewe.
10. ** Koresha AWS Resource Explorer cyangwa EC2 Global View kugenzura Uturere twose 30+ AWS Uturere twihishe **:
11. Abateye ntibakunze gutangiza ingero zo muri us-east-1 aho uzabibona kumwanya wawe. Ahubwo, baratangiza p4d, g5, cyangwa c6i.32xlarge ingero muri **ap-southeast-3 (Jakarta) **, **me-central-1 (UAE) **, **il-central-1 (Tel Aviv) **, cyangwa **sa-east-1 (São Paulo) **.
12. Fungura EC2 Console -> EC2 Global View (isikana buri karere gashoboye mumeza imwe) na ** Kurangiza ** ingero zose zitemewe.
13. ** Fungura AWS Inkunga yo Kwishura Byihuse niba ingero mbi zarangije fagitire **:
14. Niba bot yazamutse $8,000 ya EC2 GPU ingero mbere yuko ubirangiza, ** ntugahagarike umutima **: iyo umaze kubona konti, gusiba urufunguzo, gushoboza imizi / IAM MFA, hanyuma ukuraho urufunguzo muri GitHub, fungura Konti ya ** AWS hamwe na Billing Support Case ** isobanura impanuka ya GitHub itunguranye n'intambwe zawe zo gukosora. AWS isanzwe itanga ** inshuro imwe yinguzanyo yo kubabarira inguzanyo ** kubwimpanuka ya GitHub yamenetse impanuka itsinda ryabo rishinzwe umutekano rimaze gusuzuma ububiko rifite isuku.

Icyiciro cya 3: Kuki Gusiba Idosiye Mubyemezo bishya byatsinzwe - nuburyo bwo kwandika neza amateka hamwe git filter-repo¶

1. Kubera iki git rm .env && git commit -m "delete .env" ntacyo bimaze rwose¶

Git ni umugereka-gusa ibikubiyemo-byandikirwa dosiye yububiko (Directed Acyclic Graph / DAG by'imihigo, ibiti, n'ibikoresho bya blob): - Dufate ** Kwiyemeza A1B2C3** yongeyeho .env (Blob 998877). - Dufate ko nyuma yiminota 2 wirutse git rm .env, Ongeraho .env Kuri .gitignore, hanyuma usunike ** Kwiyemeza D4E5F6**. - Mugihe umuntu ushakisha * dosiye * kurutonde rwa page ya GitHub ntashobora kubona .env, ** Iyemeze A1B2C3 na Blob 998877 baracyari 100 ku ijana byububiko. ** Umuntu wese wiruka git clone gukuramo Blob 998877, umuntu wese ukanze ahanditse ** "Yiyemeje" ** kuri GitHub arashobora gukanda A1B2C3 gusoma ibyawe .env dosiye mumyandiko isanzwe, nibikoresho byikora (trufflehog git https://github.com/user/repo) gusikana buri cyemezo cyamateka mumasegonda 2.

2. Intambwe ku yindi: Gusiba Idosiye cyangwa Ibanga Ikurikiranyabihe mu mateka Yose Ukoresheje git filter-repo¶

Umushinga wa Git na GitHub urasaba kumugaragaro git-filter-repo (isimbuye buhoro, ikunda kwibeshya git filter-branch kandi ni byinshi byoroshye kuruta BFG Repo-Cleaner).

1. ** Shyira git-filter-repo** (Ifata amasegonda 5):

   # On macOS (Homebrew):
   brew install git-filter-repo
   
   # On Linux / Windows (via pip / apt):
   pip3 install git-filter-repo
   

2. ** Kora kopi yumutekano yububiko bwububiko bwaho mbere yo kwandika amateka **:

   cp -r $HOME/projects/my-repo $HOME/projects/my-repo-backup
   cd $HOME/projects/my-repo
   

3. (Icyitonderwa: Niba umaze kwimura ibyemewe .env dosiye hanze, menya neza ko kopi isukuye ya .env ni /tmp/.env.safe hanze ya repo, kubera git filter-repo izahanagura .env kuva mububiko bwawe bukora.) *
4. ** Hitamo Ihitamo A (Siba Inzira Yose Idosiye Inzira nka .env cyangwa id_rsa) CYANGWA Ihitamo B (Kugabanya imirongo yihariye y'ibanga Imbere muri dosiye ya kode) **:
5. ** Ihitamo A: Kuraho burundu .env (cyangwa config/secrets.json) uhereye kuri buri cyemezo cyamateka **:

   git filter-repo --invert-paths --path .env --force
   

   • (Kubera iki --invert-paths? Nta --invert-paths, git filter-repo --path .env ikomeza GUSA .env agasiba ibindi byose. Gukomatanya --invert-paths --path .env abwira Git kubika ibintu byose URETSE .env hirya no hino mubikorwa, amashami, na tagi.) *
6. ** Ihitamo B: Gumana dosiye ya kode (app.py / config.js), ariko reba neza ibanga rikomeye ryibanga muri verisiyo yamateka **: Kora dosiye /tmp/secrets-to-scrub.txt ikubiyemo umugozi umwe wibanga (cyangwa regex) kumurongo:

   AKIAIOSFODNN7EXAMPLE==>REDACTED_AWS_KEY
   sk_live_51NzExampleSecretKey999==>REDACTED_STRIPE_KEY
   regex:postgres:\/\/non_at_chars@==>postgres://REDACTED_DB_CREDENTIALS@
   

   Noneho wiruke git filter-repo --replace-text:

   git filter-repo --replace-text /tmp/secrets-to-scrub.txt --force
   shred -u /tmp/secrets-to-scrub.txt 2>/dev/null || rm -P /tmp/secrets-to-scrub.txt
   

7. ** Ongeraho .env Kuri .gitignore ntuzongere rero kubikora iminota 5 uhereye none **:

   echo ".env" >> .gitignore
   echo "*.pem" >> .gitignore
   git add .gitignore
   git commit -m "chore: update gitignore rules"
   

8. ** Ongera wongere GitHub yawe ya kure (git filter-repo gukuraho nkana origin nk'igenzura ry'umutekano) no guhatira-gusunika amashami yose na tagi **:

   git remote add origin git@github.com:YOUR_USERNAME/YOUR_REPO.git
   git push origin --force --all
   git push origin --force --tags
   

Icyiciro cya 4: Umutego Wihishe GitHub Cache Umutego (Dangling Commits) nuburyo bwo kubisukura¶

Hano haribintu bikomeye byubucamanza byanditse muri ** GitHub's Docs (* Gukuraho amakuru yoroheje mububiko *) **: - Iyo wirutse git filter-repo na git push origin --force --all, buri cyemezo mububiko bwawe kibona ** ikirango-gishya 40-inyuguti SHA-1 hash **, hamwe nuwawe main ishami ryerekana ryimuka mumateka mashya asukuye. - ** HOWEVER, inyuma ya GitHub seriveri yo kubika ntabwo ihita ikusanya imyanda (git gc --prune=now) bishaje, bidafite ishingiro SHA. ** - Ibyo bivuze ko niba igitero cyabateye cyanditse kera gukora hash (urugero, a1b2c3d4...) uhereye kumugaragaro GitHub Ibikorwa API mugihe wasunitse bwa mbere, ** barashobora gufungura https://github.com/YOUR_USERNAME/YOUR_REPO/commit/a1b2c3d4... muri mushakisha iyariyo yose hanyuma urebe ibyawe .env dosiye na NYUMA yo guhatira-gusunika amateka asukuye. ** Ikibabaje kurushaho, niba ibanga ryaragaragaye imbere muri ** Gusaba **, refs/pull/12/head ituma ibyo byiyemeje bigerwaho burundu.

Nigute ushobora gusenya cashe / dangling yiyemeje kuri seriveri ya GitHub nonaha:¶

1. ** Uburyo bwa 1 (Ako kanya, 100% Guhanagura Byuzuye - Ibyiza niba repo idafite Ibibazo bikomeye / PRs / Inyenyeri) **:
2. Jya mububiko bwawe kuri GitHub -> Settings -> Kanda hasi ((Danger Zone) -> Kanda Delete this repository.
3. Kora ububiko-bushya bubitse hamwe nizina rimwe kuri GitHub hanyuma usunike isuku yawe git filter-repo ububiko bwaho kuri (git push -u origin main).
4. Gusiba ububiko kuri GitHub ** bihita bisenya imbuga rusange za rubanda za kera za cashe ziyemeje SHAs ** (404 Not Found).
5. ** Uburyo bwa 2 (Kubungabunga Inyenyeri, Ibibazo, na PR - Ukoresheje GitHub Inkunga / Cache Gukuraho) **:
6. Banza, fata ** nyayo 40-inyuguti SHA hash ** yiyemeje kera yarimo ibanga (reba git reflog mububiko bwawe bwububiko cyangwa imeri yawe imenyesha ya GitHub).
7. Fungura ** Inkunga ya GitHub (support.github.com. Igikoresho cya GitHub cyifashishijwe gikoresha seriveri ako kanya git gc cache yogukuraho itesha agaciro urubuga rwerekanwe hamwe nibintu bidafite aho bihuriye no gusiba ububiko bwawe.
8. ** Menyesha abo mukorana / abo mukorana bose git clone gishya (NTIBIZIGEZE) git pull) **:
9. Bwira buri muterimbere kumurwi wawe: ** "Ntukiruke git pull hanyuma usunike. "** Niba umukozi mukorana wakuruye nabi yiyemeje mbere git pull (ihuza amateka ashaje yanduye namateka mashya yongeye kwandikwa) no gusunika, ** bazasunika ibyasibwe .env iyemeze gusubira kuri GitHub. ** Buri wese ukorana agomba gusiba ububiko bwaho hanyuma agakoresha bundi bushya git clone, cyangwa kwiruka git fetch origin && git reset --hard origin/main.

Icyiciro cya 5: Kurinda ejo hazaza gutemba (Gitleaks Mbere yo Kwiyemeza Hook & GitHub Gusunika Kurinda)¶

Fata amasegonda 60 nonaha kugirango bidashoboka imibare bidashoboka kongera gukora ibanga:

1. ** Gushoboza GitHub kubuntu "Push Protection for Yourself" kuri konte yawe yose ya GitHub **:
2. Jya kuri ** GitHub Settings (umwirondoro wawe bwite, hejuru iburyo) -> Code security and analysis (cyangwa Code security) **.
3. Kanda kuri Secret scanning -> Gushoboza Push protection for yourself.
4. Hamwe nibi byafunguye, igihe cyose wirutse git push kuva kuri mudasobwa iyo ari yo yose kugeza kuri ** ububiko rusange rusange cyangwa bwigenga, seriveri ya GitHub igenzura packfile yawe yinjira * mbere yo kwemera gusunika: niba ibonye urufunguzo rwa AWS, urufunguzo rwa OpenAI, urufunguzo rwa Stripe, urufunguzo rwa SSH, cyangwa ikimenyetso cya Slack, ** GitHub yanze ko git push burya muri terminal yawe mbere yuko kwiyemeza bigenda. **
5. ** Shyira gitleaks nk'ahantu pre-commit fata kuri mudasobwa yawe igendanwa **:

   # Install gitleaks:
   brew install gitleaks   # (or download binary on Linux/Windows)
   
   # Add a pre-commit hook inside your repository (.git/hooks/pre-commit):
   cat << 'EOF' > .git/hooks/pre-commit
   # /usr/bin/env bash
   gitleaks protect --verbose --redact --staged
   if test $? -ne 0; then
     echo "COMMIT BLOCKED BY GITLEAKS: High-entropy secret or API key detected in staged changes."
     exit 1
   fi
   EOF
   chmod +x .git/hooks/pre-commit
   

Inomero zihutirwa zo mukarere hamwe na protocole yikigo¶

Niba impanuka ya GitHub itunguranye iganisha ku kwinjira bitemewe mu makuru yihariye ()PII / PHI), sisitemu yubuzima, cyangwa ibikorwa remezo bya leta, kurikiza protocole yo kumenyesha kutubahiriza amategeko:

• ** Amerika na Kanada **:
• ** Ubuzima bwihutirwa-Umutekano / Ibikorwa Remezo Byibanze **: Hamagara 911 niba kutubahiriza ibikorwa remezo bigira ingaruka kubikorwa byibitaro cyangwa kugenzura umutekano wumubiri.
• ** Ikigo gishinzwe umutekano n’ibikorwa remezo (CISA) & FBI (IC3) **: Niba abagabye igitero bakoresheje urufunguzo rwibicu rwasohotse kugirango basibe amakuru cyangwa bakoreshe porogaramu zangiza, raporo kuri ** CISA (1-844-Say-CISA / cisa.gov/report) ** hamwe na ** FBI Ikigo gishinzwe kurega ibyaha kuri interineti (ic3.gov) **.
• ** SEC, FTC, & Umushinjacyaha mukuru wa Leta Kumenyesha amakuru yo kutubahiriza amakuru **: Niba CloudTrail / ububiko bwinjira bwamakuru bwerekana ko aderesi ya IP itabifitiye uburenganzira yageze kubakiriya bwite (PII) cyangwa inyandiko z'ubuzima (HIPAA ePHI.
• ** Ikigo cya Kanada gishinzwe umutekano wa cyber **: Hamagara **1-833-CYBER-88 (1-833-292-3788) ** cyangwa kumenyesha amakuru yihohotera munsi PIPEDA kuri ** Ibiro bya Komiseri w’ibanga muri Kanada (OPC) **.
• ** Ubwongereza **:
• ** Ibikorwa byihutirwa : Hamagara 999 (cyangwa 101 / Uburiganya 0300 123 2040 hamwe na ** Ikigo cyigihugu gishinzwe umutekano wa cyber / NCSC kuri ncsc.gov.uk).
• ** Ibiro bya Komiseri ushinzwe amakuru (ICO - Amasaha 72-UK UK GDPR Window) **: Niba ibyangombwa byamenyekanye byemerewe kubona amakuru atemewe kubatuye mubwongereza, ** Ingingo ya 33 yu Bwongereza GDPR ** isaba kumenyesha amakuru yamenyekanye ku makuru yihariye kuri ** ICO (0303 123 1113) mu masaha 72 ** yo kumenya kurenga.
• ** Umuryango w’ubumwe bw’ibihugu by’i Burayi **:
• ** Ibikorwa byihutirwa **: Hamagara 112 mu bihugu byose bigize Umuryango w’ubumwe bw’ibihugu by’Uburayi.
• ** GDPR Ingingo 33 DPA), mugihe ibyingenzi / byingenzi munsi ya ** EU NIS2 Amabwiriza ** ahura na ** amasaha 24-yo-kuburira hakiri kare igihe ntarengwa cyo gutanga amakuru ku gihugu cyabo CSIRT (BSI mu Budage, ANSSI mu Bufaransa, ACN mu Butaliyani) kubintu bikomeye bya cyber.
• ** Ositaraliya na Nouvelle-Zélande **:
• ** Ibikorwa byihutirwa **: Hamagara 000 muri Ositaraliya cyangwa 111 muri Nouvelle-Zélande.
• ** Ikigo gishinzwe umutekano wa cyber muri Ositaraliya (ACSC) & Kumenyesha amakuru Kumena (OAIC) **: Hamagara **1300 CYBER1 (1300 292 371) ** kubisubizo byabaye, no gusuzuma inshingano zo kumenyesha munsi ya ** Ibiro bya Komiseri ushinzwe amakuru muri Ositaraliya (OAIC) Kumenyekanisha amakuru yamenyekanye (NDB) gahunda ** cyangwa ** Amategeko y’ibanga ya Nouvelle-Zélande 2020 (Privacy Commissioner) **.
• ** Ubuhinde na Aziya-Pasifika **:
• ** Ibikorwa byihutirwa **: Hamagara 112 mu Buhinde (cyangwa 1930 kuri cybercrime).
• ** CERT-Mubiteganijwe Amasaha 6 Amabwiriza yo Gutanga Raporo (Ubuhinde) **: Munsi ya ** Itsinda ryabatabazi byihutirwa rya mudasobwa (CERT-In) ** icyerekezo (No. 20(3)/2022-CERT-In), uburenganzira butemewe bwo kubona ibicu / IT cyangwa amakuru yamenetse bigira ingaruka kumiryango mubuhinde bigomba kumenyeshwa **incident@cert-in.org.in mu masaha 6 ** yo gutahura.

Ibibazo bikunze kubazwa¶

Nasibye .env dosiye hanyuma usunika icyemezo gishya nyuma yamasegonda 30 nyuma yikosa ryanjye - ndacyakeneye guhinduranya urufunguzo rwa API hamwe nijambobanga ryibanga?¶

Nibyo, 100 ku ijana - hinduranya urufunguzo rumwe ako kanya nta kurobanura. Amasomo yumutekano wa cyber hamwe na telemetrie yo muri GitHub Ibanga rya Scanning yemeza ko ama bots yo gusarura ibyangombwa byikora bikurikirana imigezi rusange ya GitHub (api.github.com/ibikorwa) mugihe nyacyo no gukuramo ibyemezo bishya byasunitswe imbere Amasegonda 1.5 kugeza 5. Ikirushijeho kuba kibi, gusunika icyemezo cya kabiri gisiba .env Kureka Byose .env dosiye yicaye burundu mumateka yambere yiyemeje gutandukana - na bots nyinshi zishakisha byimazeyo gusiba .env dosiye. Iyo ibanga rimaze gusunikwa mububiko rusange nubwo isegonda 1, ryangirika burundu; gukuraho no kuzunguruka ibyangombwa kuri progaramu ya dashboard nicyo kintu cyonyine kikurinda.

Bite ho niba ububiko bwari repo GITHub repo igihe niyemeje .env dosiye, kandi ndashaka kuyisukura mbere yo gushyira repo kumugaragaro icyumweru gitaha?¶

Niba ububiko bwari 100 ku ijana Abikorera igihe cyose (kandi nta porogaramu ya gatatu ya CI / CD itizewe yari ifite), bots scraper kumurongo rusange wa GitHub Events API ifite ntabwo wabonye ibanga ryawe. Ariko, ntugasibe gusa `.env` mukwiyemeza gushya hanyuma uhindure repo kuva Private to Public. Mugihe uhinduye ububiko bwihariye kuri Public, its amateka yose yiyemeje gushushanya ihinduka rusange - na bots ihita isikana ibyemezo byose bishaje muri repo rusange. Mbere yo gushyira repo yihariye kumugaragaro, haba: (1) Kwiruka git filter-repo --hindura-inzira - inzira .env kwambura dosiye mubikorwa byose byamateka (hanyuma uzenguruke urufunguzo uko byagenda kose kugirango wimenyereze neza), CYANGWA (2) Gukoporora dosiye zisukuye mububiko bushya-bushya, kora git init kubwisuku 1-kwiyemeza amateka yambere, hanyuma utangaze ububiko bushya.

Kuki AWS yahise ifata politiki yitwa AWSCompromisedKeyQuarantineV2 kumukoresha wanjye IAM, kandi kuki nkomeje kwishyurwa?¶

Kuberako AWS ifatanya na GitHub Ibanga rya Scanning, igihe cyose an AKIA ... urufunguzo rugaragara mubikorwa rusange bya GitHub, sisitemu yumutekano yikora ya AWS irabimenya muminota mike, ifungura itike yingoboka, kandi ifata politiki iyobowe AWSCompromisedKeyQuarantineV2 (cyangwa V3) kuri uriya mukoresha wa IAM. Iyo politiki ya karantine ihagarika ibikorwa bigaragara biteje akaga nko gutangiza ibishya ec2: Ibintu cyangwa gusiba indobo S3 - ariko ntabwo irangiza EC2 ingero uwagabye igitero yamaze gutangiza mumasegonda 60 yambere mbere yuko politiki ihurira, ntanasiba abakoresha inyuma ya IAM cyangwa by'agateganyo STS amasomo igitero kimaze kurema. Ugomba gukomeza gusiba intoki urufunguzo rwasohotse, reba EC2 Reba Isi mu turere twose kugirango duhagarike ingero mbi, no kugenzura Igicu impinduka za IAM zitemewe.

Ni irihe tandukaniro riri hagati git filter-repo na BFG Repo-Cleaner, kandi ni ukubera iki ntagomba gukoresha git filter-branch?¶

git filter-ishami ni umurage ushaje shell inyandiko yubatswe muburyo bwambere bwa Git itinda cyane kububiko bunini, byoroshye kubeshya (gusiga backup refs in refs / umwimerere / ibyo biracyafite amabanga yawe.), kandi noneho ucapisha umuburo wo gutesha agaciro Git akubwira kutayikoresha. Byombi git-muyunguruzi-repo (byanditswe muri Python kandi byemejwe kumugaragaro nabashinzwe kubungabunga Git na GitHub) na BFG Repo-Isukura (byanditswe muri Java / Scala) koresha 10x kugeza 100x byihuse kandi wandike neza ibyakozwe byose, ibiti, na tagi. git-muyunguruzi-repo muri rusange ihitamo uyumunsi kuko ihindura nubwo wiyemeje kugenzurwa ((`HEAD`) udasabye kwiyemeza kubanza.

Nigute umuntu ashobora kubona ibyo nasibye kuri GitHub nyuma yo kwiruka git filter-repo na git push --force?¶

Muri Git, `git push --force` gusa ivugurura ishami ryerekana ishami (`refs/heads/main`) kwerekeza kumurongo mushya wanditse wiyemeje; irakora ntabwo uhite usiba ibintu bishaje bitavuzwe ("dangling") gukora ibintu bibitswe kuri seriveri yinyuma ya GitHub. Niba bot yanditseho inyuguti 40 SHA hash kumasezerano yawe yambere mugihe yakubise ibyabaye rusange API, ikagenda neza kuri https://github.com/ nyirubwite/repo/commit/ <40-char-SHA> Azakomeza kwikorera imfubyi yiyemeje kuva mubintu bya GitHub kugeza igihe gukusanya imyanda bitangiye. Kugirango nuke iyo cashed reba ako kanya, haba gusiba ububiko kuri GitHub hanyuma ubisubiremo muri repo yawe isukuye, cyangwa gutanga ibyangano byiyemeje SHA kuri Inkunga ya GitHub (`support.github.com`) kuri ako kanya seriveri-kuruhande rwihishwa.

Byagenda bite niba umuntu yamaze gukanda "Fork" mububiko rusange bwanjye mbere yuko niruka git filter-repo?¶

Iyi niyo mpamvu Intambwe ya 1 ihora ikuraho kandi ikazunguruka ibyangombwa kumurongo utanga: kwiruka git filter-repo n'imbaraga-gusunika mububiko bwawe bwite Ntabwo yongeye kwandika ibyemezo imbere yundi muntu wigenga y'ububiko bwawe (keretse niba usibye ububiko bwababyeyi bwawe bwose hanyuma ukabaza GitHub Inkunga yerekeye amakuru yoroheje mumashanyarazi). Umaze gukuraho urufunguzo rwa AWS / API hanyuma ukazenguruka ijambo ryibanga ryibanga, kopi iyo ari yo yose ishaje .env dosiye yicaye imbere mugice cya gatatu cyurugero cyangwa ububiko bwibibabi bihinduka umurongo wapfuye, udafite umumaro winyuguti utagishoboye kugera kubikorwa remezo byawe.

Kuyobora¶

• Incungu na malware: kubuza guhita no gukira
• Kwiba izina rya domaine, DNS yarangiye, no gufata urubuga
• Google Workspace cyangwa Microsoft 365 yihariye ya domaine admin gufunga no gutabara DNS
• Kuroba no konte zangiritse: gufunga byihutirwa
• Impanuka rm -rf cyangwa Shift-Gusiba kuri Linux, macOS, cyangwa Windows: guhita usoma gusa
• Imibare yihutirwa ukurikije igihugu

Inkomoko nubuyobozi¶

• GitHub Inyandiko Yumutekano Yemewe (docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository): * Gukuraho amakuru Yunvikana Mububiko (git filter-repo, BFG Repo-Cleaner, Dangling Yiyemeje Cache Gusukura, hamwe no Gusikana Ibanga Gusunika)
• Serivisi za Amazone (AWS) Agatabo gashinzwe gusubiza ibibazo byumutekano (docs.aws.amazon.com/security/): * Gusubiza AWS IAM Yerekanwe Urufunguzo (AWSCompromisedKeyQuarantineV2, Kwambura by'agateganyo STS Amasomo binyuze aws:TokenIssueTime, na CloudTrail Ubugenzuzi bw'Ubucamanza) *.
• Ikigo cy'igihugu gishinzwe ubuziranenge n'ikoranabuhanga (NIST) (Amerika): * Inyandiko idasanzwe 800-61 Ibyah 2: Umutekano wa Mudasobwa Ushinzwe Gukemura & SP 800-57: Icyifuzo cyo Gucunga Ibyingenzi (Kwemeza Credential Revocation na Cryptographic Rotation) *.
• Fungura umushinga wumutekano wurubuga (OWASP). Gitleaks/TruffleHog, na Ephemeral Runtime Yibanga Injection) *.
• Ikigo gishinzwe umutekano n’ibikorwa remezo (CISA).