The Tale of Smokey and the Crypto Bandits How Okteto uses Falco to keep users happy and our platform healthy Ramiro Berrelleza October 28, 2020 ● Co-founder of Okteto ● Former architect @ Atlassian malicious actions without requiring human intervention Future Ideas The Tale of Smokey and the Crypto Bandits Ramiro Berrelleza October 28, 2020

synchronisation 3 network-dpdk The DPDK library 2 Cryptography 3 introduction-to-crypto-libraries Introduction to crypto libraries 3 openssl OpenSSL 3 gnutls GnuTLS 3 network-security-services-nss Network bind-9-dnssec-cryptography-selection BIND 9 DNSSEC cryptography selection 3 openssh-crypto-configuration OpenSSH crypto configuration 3 Level Path Navlink 3 troubleshooting-tls-ssl Troubleshooting TLS/SSL Cryptography Introduction to crypto libraries OpenSSL GnuTLS Network Security Services (NSS) Java cryptography configuration BIND 9 DNSSEC cryptography selection OpenSSH crypto configuration Troubleshooting

[Schneier2000] Software Complexity and Security, Bruce Schneier, March 15th 2000, Crypto- Gram Newsletter, < http://www.counterpane.com/crypto-gram-0003. html> . 5.4 [Wheeler2001] More Than a Gigabuck: Estimating

挂载加密卷 假如您在安装的时候创建了加密卷并设置了挂载点，在启动的时候每个这样的卷将会要求输入密码。 通过 dm-crypt 加密的分区，启动的时候会有下面的提示信息： Starting early crypto disks... part_crypt(starting) Enter LUKS passphrase: 提示的第一行，part 是底下分区的名称，如：sda2 或 md0。您也许想知道输入密码的具体 regular: use the usual partition types for your architecture # - lvm: use LVM to partition the disk # - crypto: use LVM within an encrypted partition d-i partman-auto/method string lvm # You can define the true # When disk encryption is enabled, skip wiping the partitions beforehand. #d-i partman-auto-crypto/erase_disks boolean false B.4.7.2 使用 RAID 分区 您可以使用预置来建立软 RAID 阵列。支持 RAID 等级 0、1、5、6 和 10，建立降级阵列

interfaces (cilium_host, cilium_net), an optional overlay interface (cilium_vxlan), Linux kernel crypto support and a userspace proxy (Envoy) Cilium creates the following networking objects. Prefilter: CONFIG_NET_CLS_BPF=y CONFIG_BPF_JIT=y CONFIG_NET_CLS_ACT=y CONFIG_NET_SCH_INGRESS=y CONFIG_CRYPTO_SHA1=y CONFIG_CRYPTO_USER_API_HASH=y CONFIG_CGROUPS=y CONFIG_CGROUP_BPF=y CONFIG_PERF_EVENTS=y Note Users CONFIG_INET_XFRM_MODE_TUNNEL=m CONFIG_CRYPTO_AEAD=m CONFIG_CRYPTO_AEAD2=m CONFIG_CRYPTO_GCM=m CONFIG_CRYPTO_SEQIV=m CONFIG_CRYPTO_CBC=m CONFIG_CRYPTO_HMAC=m CONFIG_CRYPTO_SHA256=m CONFIG_CRYPTO_AES=m Requirements for

MD5withRSA SHA1withDSA RawDSA ... Cipher ... HMAC ... Key agreement ... Algorithm context Native crypto EVP_MD_CTX_create EVP_Digestlnit_ex EVP_DigestUpdate EVP_DigestFinal_ex EVP_MD_CTX EVP_CIPHER_CTX Detection Environment (AIDE). • SM2, SM3, and SM4 are supported in the kernel cryptographic framework (crypto), allowing algorithm performance optimization using instruction sets such as AVX, CE, and NEON

encrypted using dm-crypt you will be shown the following prompt during the boot: Starting early crypto disks... part_crypt(starting) Enter LUKS passphrase: In the first line of the prompt, part is the regular: use the usual partition types for your architecture # - lvm: use LVM to partition the disk # - crypto: use LVM within an encrypted partition d-i partman-auto/method string lvm 81 APPENDIX B. AUTOMATING gpt # When disk encryption is enabled, skip wiping the partitions beforehand. #d-i partman-auto-crypto/erase_disks boolean false B.4.7.2 Partitioning using RAID You can also use preseeding to set up

挂载加密卷 假如您在安装的时候创建了加密卷并设置了挂载点，在启动的时候每个这样的卷将会要求输入密码。 通过 dm-crypt 加密的分区，启动的时候会有下面的提示信息： Starting early crypto disks... part_crypt(starting) Enter LUKS passphrase: 提示的第一行，part 是底下分区的名称，如：sda2 或 md0。您也许想知道输入密码的具体 regular: use the usual partition types for your architecture # - lvm: use LVM to partition the disk # - crypto: use LVM within an encrypted partition d-i partman-auto/method string lvm # You can define the true # When disk encryption is enabled, skip wiping the partitions beforehand. #d-i partman-auto-crypto/erase_disks boolean false B.4.7.2 使用 RAID 分区 您可以使用预置来建立软 RAID 阵列。支持 RAID 等级 0、1、5、6 和 10，建立降级阵列

如果在安装时创建了加密的卷，并为其指定了挂载点，那么在引导的时候会要求为每个这样的卷输入密 码。 对于使用 dm-crypt 来加密的分区，引导的时候会显示下面的提示信息： Starting early crypto disks... part_crypt(starting) Enter LUKS passphrase: 在提示的第一行，part 是底下分区的名称，例如：sda2 或 md0。您现在也许想知道具体是 regular: use the usual partition types for your architecture # - lvm: use LVM to partition the disk # - crypto: use LVM within an encrypted partition d-i partman-auto/method string lvm # You can define the gpt # When disk encryption is enabled, skip wiping the partitions beforehand. #d-i partman-auto-crypto/erase_disks boolean false B.4.7.2 使用 RAID 分区 您可以使用预置来建立软 RAID 阵列。支持 RAID 等级 0、1、5、6 和 10，建立降级阵列

如果在安装时创建了加密的卷，并为其指定了挂载点，那么在引导的时候会要求为每个这样的卷输入密 码。 对于使用 dm-crypt 来加密的分区，引导的时候会显示下面的提示信息： Starting early crypto disks... part_crypt(starting) Enter LUKS passphrase: 在提示的第一行，part 是底下分区的名称，例如：sda2 或 md0。您现在也许想知道具体是 regular: use the usual partition types for your architecture # - lvm: use LVM to partition the disk # - crypto: use LVM within an encrypted partition d-i partman-auto/method string lvm # You can define the gpt # When disk encryption is enabled, skip wiping the partitions beforehand. #d-i partman-auto-crypto/erase_disks boolean false B.4.7.2 使用 RAID 分区 您可以使用预置来建立软 RAID 阵列。支持 RAID 等级 0、1、5、6 和 10，建立降级阵列