Upgrade to Pro — share decks privately, control downloads, hide ads and more …

アクイア認定サイトビルダー試験対策講座 第7回 セキュリティとパフォーマンス / Prep f...

アクイア認定サイトビルダー試験対策講座 第7回 セキュリティとパフォーマンス / Prep for exam Site Builder vol.7

More Decks by アクイアジャパン Acquia Japan

Other Decks in Programming

Transcript

  1. ΞΫΠΞೝఆαΠτϏϧμʔ ࢼݧରࡦߨ࠲γϦʔζ – ʮΞΫΠΞೝఆαΠτϏϧμʔ - Drupal 9ʯࢼݧ͸ɺίΞϞδϡʔϧ͓Αͼ֦ுϞδϡʔϧ Λ࢖༻ͯ͠DrupalαΠτΛߏங͢ΔϓϩϑΣογϣφϧ޲͚ͷࢿ֨Ͱ͢ɻ͜ͷࢼݧ͸ɺ DrupalαΠτϏϧμʔͷεΩϧɺ஌ࣝͷݕূΛ໨తͱͯ͠σβΠϯ͞Ε͍ͯ·͢ɻ –

    ຊ΢ΣϏφʔ͸ɺʮΞΫΠΞೝఆαΠτϏϧμʔ - Drupal 9ʯࢼݧͷग़୊ൣғΛ໢ཏͨ͠ɺ શ7ճͷࢼݧରࡦରࡦߨ࠲Ͱ͢ɻࢼݧ߹֨Λ໨ࢦ͢ํ͸΋ͪΖΜɺDrupalΛମܥతʹֶͼͨ ͍ํʹ΋͓͢͢ΊͰ͢ɻ – DrupalΛҰ௨Γૢ࡞ͨ͜͠ͱ͕͋ΔํΛର৅ͱ͍ͯ͠·͢ɻ·ͩDrupalΛ৮ͬͨ͜ͱ͕ແ ͍ํ͸ɺॳ৺ऀ޲͚DrupalνϡʔτϦΞϧಈըʢ೔ຊޠʣΛઌʹݟ͓ͯ͘ͱΑΓཧղ͕ਂ ·Γ·͢ɻ
  2. ϢʔβʔϖʔδͰઃఆ 1. ৽͘͠؅ཧऀϢʔβʔΛ࡞੒ 2. ϢʔβʔID͕“1”ͷΞΧ΢ϯτΛϒϩοΫ 
 ΞΫγϣϯʼબ୒͞ΕͨϢʔβʔΛϒϩοΫ ஫ҙ – ৽͍͠؅ཧऀΞΧ΢ϯτΛ࡞੒͢ΔલʹϢʔ

    βʔID͕“1”ͷΞΧ΢ϯτΛϒϩοΫͯ͠͠·ͬ ͨ৔߹ɺdrush user:unblock adminͰղআͯ͠΍ Γ௚͢ – ·ͨ͸ɺdrushͰ৽نϢʔβʔΛ࡞੒͢Δ 2. ϢʔβʔID “1”Λอޢ͢Δ αΠτΠϯετʔϧ࣌ʹ࡞੒͢Δ࠷ॳͷϢʔβʔͰɺϢʔβʔID͕“1”ͷΞΧ΢ϯτ͸ɺಛݖϢʔβʔͰɺ໾ׂ ʹΑΔݖݶͷνΣοΫ͕ߦΘΕ·ͤΜɻ͜ͷΞΧ΢ϯτID͕ෆਖ਼औಘ͞Εͨ৔߹ɺαΠτͷશͯͷݖݶΛಘΒ ΕΔͨΊɺϒϩοΫ͠·͢ɻ
  3. ݖݶϖʔδͰઃఆ 1. ಗ໊ϢʔβʔɺೝূࡁΈϢʔβʔͷྻΛ֬ೝ 2. ෆཁͳݖݶ͕෇༩͞Ε͍ͯΔ৔߹ʹ͸νΣοΫϘο ΫεΛ֎͢ 3. ϖʔδ࠷ԼͷݖݶͷอଘϘλϯΛΫϦοΫ ஫ҙ –

    ಛʹɺಗ໊Ϣʔβʔͷ৔߹ʹ͸ɺϗϫΠτϦετܗ ࣜͰͷݖݶ෇༩Λߦ͏ɻʢશ͘ݖݶͷͳ͍ঢ়ଶ͔ Βɺඞཁͳ΋ͷͷΈΛ෇༩ʣ 3. ෆཁͳݖݶ͕෇༩͞Ε͍ͯͳ͍͔֬ೝ͢Δ ؅ཧऀͰͳ͍ɺಗ໊Ϣʔβʔ΍ೝূࡁΈϢʔβʔʹෆཁͳݖݶ͕෇༩͞Ε͍ͯͳ͍͔ 
 ఆظతʹ֬ೝ͠·͢ɻ
  4. ηΩϡϦςΟΞοϓσʔτΛड͚Δํ๏ 1. ϝʔϧ௨஌ 
 Drupal.orgͰΞΧ΢ϯτΛ࡞੒͠ɺϚΠϖʔδ͔Β [Edit] > [My newsletters] ʹ͋Δ

    [Security announcements] ʹνΣοΫΛೖΕͯ [Save] ΛΫϦοΫ 2. RSSϑΟʔυ – Core: https://www.drupal.org/security/rss.xml – Contrib: https://www.drupal.org/security/contrib/rss.xml – Ξφ΢ϯε: https://www.drupal.org/security/psa/rss.xml 3. Twitter: @drupalsecurity 4. αΠτΛ࠷৽ͷঢ়ଶʹอͭ ηΩϡϦςΟΞοϓσʔτͷ৘ใΛৗʹऔಘ͠ɺαΠτͷঢ়ଶΛ࠷৽ʹอͭ͜ͱͰɺ 
 ੬ऑੑʹରԠ͠·͢ɻ
  5. <ࢀߟ৘ใ> DrupalͱϞδϡʔϧͷΞοϓσʔτํ๏ ௨஌͞ΕͨDrupalͷCoreͱίϯτϦϏϡʔτϞδϡʔϧͷΞοϓσʔτ৘ใΛ 
 ΋ͱʹɺιʔείʔυΛΞοϓσʔτ͢Δࡍ͸ҎԼͷखॱʹΑΓComposerͰߦ͍·͢ɻ ίϯτϦϏϡʔτϞδϡʔϧͷΞοϓσʔτखॱ 1. Ξοϓσʔτ͕ඞཁͳϞδϡʔϧΛ֬ೝ͢Δ 
 $

    composer outdated "drupal/*" ※ηΩϡϦςΟΞοϓσʔτ͸DrushͰ֬ೝՄೳ 
 $ drush pm:security 1. ର৅ϞδϡʔϧͷΞοϓσʔτΛߦ͏ 
 $ composer update drupal/modulename --with- dependencies ※ϝδϟʔΞοϓσʔτ(ྫɿ1.x ͔Β 2.x)ͷ৔߹͸requireίϚϯυ͕ඞཁ 
 $ composer require drupal/modulename:^2.0 1. σʔλϕʔεΛΞοϓσʔτ͢Δ 
 $ drush updatedb 2. ΩϟογϡΛΫϦΞ͢Δ 
 $ drush cache:rebuild Drupal CoreͷΞοϓσʔτखॱ 1. DBͱιʔείʔυͷόοΫΞοϓΛऔಘ͢ΔɻDB͸DrushίϚϯυͷ drush sql:dumpͰόοΫΞοϓΛ࡞੒Մೳɻ 2. αΠτΛϝϯςφϯεϞʔυʹ͢ΔʢߦΘͳ͍͜ͱ΋͋Δʣ 3. ϞδϡʔϧͷΞοϓσʔτΛߦ͏ʢӈهʣ 4. CoreͷΞοϓσʔτΛߦ͏ 
 $ composer update "drupal/core-*" --with-all- dependencies 5. σʔλϕʔεΛΞοϓσʔτ͢Δ 
 $ drush updatedb 6. ΩϟογϡΛΫϦΞ͢Δ 
 $ drush cache:rebuild 7. αΠτͷϝϯςφϯεϞʔυΛղআ͢Δ https://www.drupal.org/docs/updating-drupal/updating- modules-and-themes-using-composer https://www.drupal.org/docs/updating-drupal/updating- drupal-core-via-composer
  6. ຊ൪؀ڥͰ͸࡟আ͢΂͖ϞδϡʔϧɾϥΠϒϥϦ 1. DevelϞδϡʔϧ 
 ։ൃΛߦ͏ࡍ͸ඞਢͱ΋͍͑ΔϞδϡʔϧͰ͕͢ɺϢʔ βʔʹෆཁͳ৘ใΛ༩͑ͯ͠·͏ڪΕ͕͋ΔͨΊɺຊ൪Ͱ ͸ແޮԽ΋͘͠͸࡟আ͠·͢ɻ – ଟ༷ͳσόοάػೳ –

    μϛʔίϯςϯπͷ࡞੒ – Web Profiler(ύϑΥʔϚϯε౳෼ੳ) 2. Composerͷdrupal/core-devϥΠϒϥϦ 
 PHPUnit΍Behat౳ͷࣗಈςετΛDrupalͰߦ͏ͨΊͷϥΠ ϒϥϦͰ͢ɻ΋͠ɺςετΛ࣮ߦͰ͖ΔݖݶΛ࣋ͭϢʔ βʔ͕͍ͨ৔߹ɺෆਖ਼ʹ࣮ߦ͞ΕΔڪΕ͕͋Γ·͢ɻ 5. ։ൃ΍ςετؔ࿈ϞδϡʔϧɾϥΠϒϥϦΛ࡟আ͢Δ Drupalʹ͸։ൃ΍ςετΛิॿ͢ΔϞδϡʔϧ΍ϥΠϒϥϦ͕ଘࡏ͠·͢ɻ͔͜͠͠ΕΒ͸ 
 ຊ൪؀ڥͰ͸ෆཁͰ͋Γɺѱҙͷ͋Δ߈ܸΛՄೳʹ͢ΔڪΕ͕͋ΔͨΊɺ࡟আ͠·͢ɻ composer require࣌ʹ --dev ΦϓγϣϯΛ͚ͭΔ͜ͱͰɺຊ൪؀ڥͰ composer install --no-dev Λ࣮ߦ͢Δ͜ͱͰ։ൃϥΠϒϥϦΛഉআͰ͖ ·͢ɻ
  7. DrupalͷΩϟογϡྫ 1. Internal Dynamic Page Cache 
 ಗ໊ϢʔβʔɺೝূࡁΈϢʔβʔ૒ํʹରͯ͠Ωϟογϡ͞Εͨ ϖʔδΛ഑৴͢ΔɻʢύʔιφϥΠζ͞Εͨ෦෼Λআ͘ʣ 2.

    Internal Page Cache 
 ಗ໊Ϣʔβʔʹରͯ͠Ωϟογϡ͞ΕͨϖʔδΛDBʹอଘ͠ɺ ഑৴͢ΔɻΩϟογϡͷ༗ޮظݶ͸ 
 [؀ڥઃఆ] > [ύϑΥʔϚϯε] ͔Βઃఆɻ 3. Views Cache 
 ViewsͰ࡞੒ͨ͠Ϧετͷ݁ՌΛΩϟογϡ͢Δɻ ஫ҙ – ্هͷΩϟογϡ͸ඪ४Ͱ༗ޮԽ͞Ε͍ͯ·͕͢ɺ։ൃ࣌ʹແޮ Խͨ͠৔߹ͳͲ͸ɺϦϦʔεલʹ༗ޮԽ͢Δඞཁ͕͋Γ·͢ɻ – ଟ͘ͷΩϟογϡ͸Ϣʔβʔ͕ϩάΠϯ͍ͯ͠ΔͱແޮԽ͞Ε· ͢ɻ 1. Ωϟογϡͷઃఆ Drupalʹ͸ଟ༷ͳΩϟογϡγεςϜ͕͋Γ·͢ɻ͜ΕΒΛ༗ޮԽ͢Δ͜ͱͰɺϦΫΤετຖʹൃੜ͢Δෛՙͷߴ͍ॲཧ ʢDB઀ଓɺઃఆͷಡΈࠐΈɺϢʔβʔηογϣϯͷॳظԽ౳ʣΛܰݮͰ͖·͢ɻ
  8. CSSͱJSϑΝΠϧͷू໿ [؀ڥઃఆ]ʼ[ύϑΥʔϚϯε]ʼ[ଳҬ෯࠷దԽ] ͷνΣοΫϘοΫεʹνΣο ΫΛೖΕɺߏ੒Λอଘ 
 ஫ҙ CSSͱJSϑΝΠϧΛू໿ͷର৅ͱ͢ΔͨΊʹ͸ɺϑΝΠϧΛςʔϚ·ͨ͸Ϟ δϡʔϧͷ *.libraries.yml Ͱఆٛ͠ɺಡΈࠐ·ͤΔඞཁ͕͋Γ·͢ɻςϯϓ

    Ϩʔτʹ௚઀ϑΝΠϧ΁ͷϦϯΫΛهड़͢Δͷ͸όουϓϥΫςΟεͰ͢ɻ 2. CSSͱJSͷू໿ DrupalͰ͸ଟ਺ͷCSSϑΝΠϧͱJSϑΝΠϧΛऔΓѻ͍·͢ɻ 
 ͜ΕΒ͸ू໿͢Δ͜ͱͰ1ͭͷʢ·ͨ͸গ਺ͷʣϑΝΠϧͱͳΓɺϦΫΤετճ਺Λ࡟ݮͰ͖·͢ɻ ू໿લ 
 ໿100ϑΝΠϧ ू໿ޙ 
 3ϑΝΠϧ
  9. DrupalͷΩϟογϡʹؔ͢ΔҎԼͷهड़Ͱɺਖ਼͍͠΋ͷΛ͢΂ͯબ୒͍ͯͩ͘͠͞ɻ 
 ʢ2ͭબ୒͍ͯͩ͘͠͞ɻʣ 
 1. Drupalʹ͸Ωϟογϡػೳ͸ͳ͘ɺ֎෦ͷCDN౳ͰϖʔδΛΩϟογϡ͢Δඞཁ͕͋Δɻ 2. DrupalͷΩϟογϡػೳ͸Varnish౳ͷΩϟογϡαʔόʔ͕ͳͯ͘΋ར༻Ͱ͖Δɻ 3. ೝূࡁΈϢʔβʔʹΑΔϦΫΤετͰ͸ɺΩϟογϡ͸͢΂ͯແޮԽ͞ΕΔɻ

    4. Drupalʹ͸ඪ४ػೳͰΩϟογϡػೳ͕͋Δ͕ɺΠϯετʔϧ௚ޙ͸ແޮԽ͞Ε͍ͯΔͨΊɺຊ൪ެ։લʹ༗ޮԽ͢Δ ඞཁ͕͋Δɻ 5. ϖʔδશମͷΩϟογϡͷଞʹɺಈతϖʔδͷҰ෦෼ΛΩϟογϡ͢Δ͜ͱ͕Ͱ͖Δɻ ࿅श໰୊3 ਖ਼ղɿ2, 5