When you use an API to read a file, ensure that you own the file and that its permissions are no more permissive than [object Object]. This helps prevent privilege escalation and similar security issues.
Software code or programs downloaded from external sources may pose risks. You must guarantee the security of their functions.
The security hardening measures listed in this document provide basic recommendations. You should re-evaluate the network security posture of the entire system based on specific service requirements. When necessary, consult industry best practices and security experts.
After installing the OS, if common users are configured, you can add [object Object] to the [object Object] file to prevent unauthorized privilege escalation.
Set the host umask to [object Object] or more restrictive on the host and in containers to enhance file security.
To set umask to [object Object]:
Log in to the server as the root user and edit the
[object Object]file.[object Object]Add
[object Object]to the end of the[object Object]file, then save and exit.Run the following command to apply the configuration.
[object Object]
Differences between official Docker images and the host OS may result in a mismatch between user definitions. This can lead to the creation of ownerless files during system or container operation.
You can find ownerless files on the host or in containers by running [object Object]. To mitigate security risks, create corresponding users and groups based on file UIDs and GIDs, or adjust existing UIDs and GIDs to match, thereby ensuring every file has a valid owner.
Monitor ports listening on all interfaces and identify unnecessary ports for immediate closure. You are advised to disable insecure services, such as Telnet and FTP. For details, see the related documents of the OS in use.
Protect the system against Denial of Service (DoS) attacks by implementing IP address restriction and rate limiting. Recommended methods include using the Linux iptables firewall and optimizing sysctl parameters. For details, see related documents.
Proper memory planning[object Object][object Object]
Users need to plan memory usage properly to ensure that it does not exceed system resource limits. Additionally, the retrieval service's feature base library is stored in DDR memory of the Ascend AI Processor. The feature dimensions and quantity during operations such as enrollment or query, as well as the use of temporary business memory and temporary system memory during computation, determine the total memory footprint. Excessive input can lead to device-side memory allocation failure errors. Currently, the maximum capacity supported by a single [object Object] instance depends on the specific device-side memory size of the Ascend AI Processor. The service side needs to plan the number of [object Object] instances based on actual requirements to prevent memory overrun scenarios.
OMP settings[object Object][object Object]
If you need to modify OMP-related configurations, evaluate system resource limits such as memory and thread count. Otherwise, exceptions may occur during operation. For example, you can set the concurrency level by setting [object Object]. For details about OMP settings, see the official OMP guide.
Interface usage[object Object][object Object]
Most retrieval interfaces use C-style input parameters. Therefore, you must ensure that the length of the input pointer is a valid value. Otherwise, exceptions may occur during operation.
Mutual conversion with [object Object][object Object][object Object]
The retrieval service provides mutual conversion with [object Object]. Ensure that the [object Object] output by [object Object] is not modified. Otherwise, it may cause [object Object] exceptions. The same applies to interfaces such as [object Object], [object Object], [object Object], and [object Object].