Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
How to build/ops websites safety (2020-12-10)
Search
Daiji Hirata
December 10, 2020
Business
0
120
How to build/ops websites safety (2020-12-10)
ウェブサイト運用にともなうリスクと安定運用のコツ
2020.12.10 シックス・アパート オンラインミニセミナー スライド
Daiji Hirata
December 10, 2020
Tweet
Share
More Decks by Daiji Hirata
See All by Daiji Hirata
WebCMS 概観 MTDDC Meetup TOHOKU 2025
hirata
0
290
MTDDC Meetup TOKYO 2024 Keynote
hirata
1
680
MTDDC Meetup TOHOKU 2024 Keynote Speech
hirata
1
700
MTDDC Meetup Tokyo 2023 Keynote
hirata
0
920
MTDDC Meetup Tokyo 2022 Keynote
hirata
0
91
MTDDC meetup Tokyo 2021 Keynote
hirata
0
1.4k
How to build a Robust Website for Peak Traffics (2021-02-12)
hirata
0
95
MTDDC Meetup Tokyo 2020 Keynote
hirata
0
210
MTDDC Meetup Tokyo 2019 Closing Session
hirata
0
1.4k
Other Decks in Business
See All in Business
「みんな、笑顔になぁれ」を実現する 職種混合開発組織の目標設定・評価の改善事例
daitasu
0
230
【営業職】中途採用向け会社説明資料(テックファーム株式会社)
techfirm
0
420
Spice Factory Inc. Culture Deck
spicefactory
0
10k
行動指針
fint_recruit
0
840
Corporate Story (GA technologies Co., Ltd.)
gatechnologies
0
180
テオリア・テクノロジーズ:About Us
theoriatec2024
1
35k
ヘルスベイシス_会社説明資料_v3.4
yasudashoyo
1
63k
『ふりかえる力』を育み、メンバーの自走力を高める 1 on 1 / 1-on-1 sessions to foster self-reflection
tbpgr
1
1k
株式会社10X - Company Deck
10xinc
89
1.5M
定義のない仕事 / Undefined Work
nrslib
10
4.2k
「使いこなせないかも…」を超えて、BackLogを日常にするまでの話(JBUG Live版)
sho_okawara
0
150
ペイジェント採用資料
paygent
0
19k
Featured
See All Featured
Building Applications with DynamoDB
mza
96
6.6k
A Tale of Four Properties
chriscoyier
160
23k
BBQ
matthewcrist
89
9.8k
Become a Pro
speakerdeck
PRO
29
5.5k
Learning to Love Humans: Emotional Interface Design
aarron
273
40k
Dealing with People You Can't Stand - Big Design 2015
cassininazir
367
27k
Designing Experiences People Love
moore
142
24k
Optimizing for Happiness
mojombo
379
70k
Fight the Zombie Pattern Library - RWD Summit 2016
marcelosomers
234
17k
RailsConf 2023
tenderlove
30
1.2k
The Cost Of JavaScript in 2023
addyosmani
53
8.9k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
26
3k
Transcript
γοΫεɾΞύʔτ ฏా େ࣏ ΣϒαΠτӡ༻ʹͱͳ͏ϦεΫͱ҆ఆӡ༻ͷίπ ΣϒαΠτΛ҆৺ͯ͠׆༻͢ΔͨΊʹ͓͖͍ͬͯͨ͜ͱ
ͻΒ͍ͨͩ͡ 4JY"QBSU %JSFDUPS $50 !IJSBUB
ࠓͷ • ΣϒαΠτӡ༻্ͷϦεΫͱݪҼ • جຊతͳରࡦ • ରࡦͷҰྫɺެ։αʔόͷ • ͦͷଞɺؾΛ͚ͭΔ͜ͱ
ΣϒαΠτͷϦεΫ͍Ζ͍Ζ • αΠτͷվ᜵ɺͬऔΓ • αΠτͷμϯ • ใ࿙Ӯ • ౿ΈʹΘΕ͍ͯͨ •
ߋ৽͕Ͱ͖ͳ͘ͳͬͨ
αΠτͷվ᜵ɺͬऔΓ • ใͷૢ࡞ • ϚϧΣΞ͕͞Ε͍ͯͨ • ѱҙͷ͋ΔϓϩάϥϜΛΫϥΠΞϯτʹ࣮ߦͤ͞Δ • ϑΟογϯάٗʹΘΕ͍ͯͨ •
ݸਓใΫϨδοτΧʔυใΛ౪·ΕΔ
None
ෛͷ࿈ • ϚϧΣΞ / ϑΟογϯάʹΘΕΔ • ϒϩοΫϦετʹొ͞ΕΔ • Safe Browsing
ػೳͰαΠτ͕දࣔ͞Εͳ͘ͳΔ…
αΠτͷμϯ • αΠτ͕ਅͬനʹͳͬͨ • 404 Not Found φκͷΤϥʔը໘
ใ࿙Ӯ • αʔόʹอଘ͍ͯͨ͠ݸਓใ͕… • ·ͩެ։͍ͯ͠ͳ͍ͣͷ PDF ϑΝΠϧ͕…
౿Έʹ͞Ε͍ͯͨ? ඪతܕ߈ܸʹΘΕͨྫ • Βͳ͍ϑΝΠϧ͕͔ࣾΒΞοϓϩʔυ͞Ε͍ͯͨ • Βͳ͍αʔό͔ΒͷΞΫηεͰμϯϩʔυ͞Ε͍ͯͨ • Βͳ͍ϑΝΠϧ͕ࣾ֎͔ΒΞοϓϩʔυ͞Ε͍ͯͨ • ࣾͷPC͔ΒφκͷΞΫηε͕…
ߋ৽͕Ͱ͖ͳ͍ • CMS ͷཧը໘ʹϩάΠϯͰ͖ͳ͍ • αʔόͷΞΧϯτ͕Θ͔Βͳ͍
͞·͟·ͳݪҼ • ֎෦͔ΒͷͳΜΒ͔ͷΞΫγϣϯ (߈ܸ) • ނো • ୯७ͳϛε • ෦൜ߦ
• ͳʹ͍ͯ͠ͳ͍ͷʹ……
جຊతͳରࡦͷߟ͔͑ͨ • ݪҼΛ༧͠ɺͦΕͧΕͷରࡦΛߟ͑Δ • ϦεΫΛࣄલʹݮΒ͢ • ͠ൃੜͨ͠ͱ͖ͷϦΧόϦʔํ๏Λࣄલʹ༻ҙ͓ͯ͘͠ • ӡ༻ʹؾΛ͏ •
αʔόɺΞϓϦέʔγϣϯΛ҆શʹอͭ • ेͳϦιʔεΛख͢Δ • ීஈ͔ΒϦεΫʹඋ͑Δ
ҰൠతͳΣϒαΠτͰͷߟ͔͑ͨ • ҰൠͷใఏڙͷͨΊͷΣϒαʔό • ίʔϙϨʔταΠτͳͲ • ߋ৽ਵ࣌ɺσβΠϯมߋͳͲසൟͰͳ͍ • ड͚Δͷ͍߹ΘͤϑΥʔϜఔ
ҰൠతͳΣϒαΠτͰͷߟ͔͑ͨ • ެ։༻αʔόͱΞϓϦέʔγϣϯ༻αʔόΛ͢Δ • CMS αʔόҰൠ͔ΒΞΫηεͰ͖ͳ͍Α͏ʹɺ੍ݶ͢Δ • ΞΫηε੍ݶɺωοτϫʔΫͷ • ެ։༻αʔόʹɺඞཁͳΞϓϦέʔγϣϯͷΈઃஔ͢Δ
• ੩తίϯςϯπͷΈͩͱɺ͔ͳΓ҆શ
010111……… ެ։ྖҬ CMS 1ͷαʔόʹͯࠞ͢ࡏ html, image, css, js, etc.
ެ։༻αʔό CMS ެ։ྖҬ 010111……… ެ։༻αʔόͱ CMS Λ͢Δ
ެ։༻αʔόͷ • αΠτΛ੩తίϯςϯπͱͯ͠४උ͠ɺެ։༻αʔόʹసૹ͢Δ • MT ͩͱϓϥάΠϯΛར༻͢Δ͜ͱ͕Ұൠత • Uploader, SmartSyncPack, Movable
Type Premium (SiteSync) • MT Ϋϥυʹඪ४Ͱαʔό৴Λ༻ҙ͍ͯ͠Δ • సૹઌͱରԠ͢Δϓϩτίϧʹҙ • FTPS, SFTP, rsync, S3 (AWS) ͳͲ
ެ։༻αʔό CMS ެ։ྖҬ 010111……… ඇެ։ྖҬ ৴ ࠶ߏங (੩తϑΝΠϧߏங)
৴ػೳͷϝϦοτ • ৴ઌΛෳ༻ҙ͢Δ͜ͱͰɺεςʔδϯάͷΑ͏ʹར༻Ͱ͖Δ • ίϯςϯπΛͯ͠ཧ͢Δ͜ͱ͕Ͱ͖Δ • େنαΠτͷҰ෦͚ͩΛ MT ΫϥυͰཧ͢Δ •
෦ຖʹ৴Λ͚Δ
ެ։༻αʔό ඇެ։ྖҬ ৴ ֬ೝ༻αʔό ৴ CMS
ެ։༻αʔό CMS ඇެ։ྖҬ Ұ෦ͷྖҬʹ͚ͩ৴
CMS ͷΞΫηε੍ݶηΩϡϦςΟڧԽ • IP ΞυϨεͷ੍ݶ • ύεϫʔυอޢ • WAF ͷར༻
CMS ͷӅṭ • CMS ΞϓϦέʔγϣϯͷΞΫηεΛ੍ݶ͢Δ • ϗετͷӅṭ • ϓϥΠϕʔτωοτϫʔΫʹઃஔͯ͠ VPN
ܦ༝ͰΞΫηε • ެ։αʔόͷίϯςϯπ৴Ҏ֎ΛڐՄ͠ͳ͍ • ֎෦ͷτϥϑΟοΫͷࢹ͕༰қʹ ౿ΈʹͳΔϦεΫΛܰݮͰ͖Δ
ެ։༻αʔό CMS VPN ͳͲͰΞΫηεΛ੍ݶɾཧ ৴ (Ұํ) ֎෦͔Βͷ௨৴ःஅ 010111………
ެ։αʔόͷߏྫ • Apache • SSI htaccess ͍͍ͨ • Amazon
S3 • + CDN • + CDN + WAF + DDoS ରࡦ
ެ։༻αʔόΛηΩϡΞʹ • ΞϓϦέʔγϣϯͷઃஔΛߦΘͳ͍ɺ੍͘͠ݶ͢Δ • PHP ͷར༻εΫϦϓτͷઃஔܧଓϝϯςφϯεͰ͖Δ͔Ͳ͏͔ • SSI .htaccess
Θͳ͍ͳΒɺS3 ͷར༻ࢹʹೖΔ • ϑΥʔϜɺݕࡧͳͲαʔϏεΛར༻͢Δ͜ͱΛߟ͑Δ • ಠࣗΞϓϦέʔγϣϯαʔόΛͯ͠ CORS ReverseProxy Ͱͷӡ༻ߟ͑Δ
ެ։༻αʔό iframe ͰΈࠐΈ
ެ։༻αʔόΛηΩϡΞʹ • ΞϓϦέʔγϣϯͷઃஔΛߦΘͳ͍ɺ੍͘͠ݶ͢Δ • PHP ͷར༻εΫϦϓτͷઃஔܧଓϝϯςφϯεͰ͖Δ͔Ͳ͏͔ • SSI .htaccess
Θͳ͍ͳΒɺS3 ͷར༻ࢹʹೖΔ • ϑΥʔϜɺݕࡧͳͲαʔϏεΛར༻͢Δ͜ͱΛߟ͑Δ • ಠࣗΞϓϦέʔγϣϯαʔόΛͯ͠ CORS ReverseProxy Ͱͷӡ༻ߟ͑Δ
ΑΓҙ͢Δ͜ͱ • ނোࣄނʹඋ͑ͨߏ • ೋॏԽ…ϗετɺωοτϫʔΫɺσʔληϯλ • γεςϜͷఆظతͳϝϯςφϯε • ϛυϧΣΞΞϓϦέʔγϣϯͷΞοϓσʔτɺઃఆͷ֬ೝ •
ϩάͷ֬ೝ • ఆظతͳόοΫΞοϓ • όοΫΞοϓͷೖखੑɺੈ • ϦετΞखॱͷ֬ೝτϨʔχϯά
ࣗͰΔͷ͕େมͩͱࢥͬͨΒ • ϚωʔδυαʔϏε SaaS ͷ CMS Λར༻͢Δ • Movable Type
Ϋϥυ൛ • αʔό৴ػೳΛඪ४උ • MovableType.net • αʔϏεͱͯ͠ɺ͞·͟·ͳϦεΫʹྀͯ͠ӡӦ͍ͯ͠·͢
͝੩ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠