推理服务的访问控制Access Control for an Inference Service
Access Control for an Inference Service
决定谁能调你的模型服务、以什么身份调、能用多少、事后能不能查。Decides who may call your model service, in what identity, within what budget, and whether it can be traced afterwards.
第一道控制是监听地址而不是密码：Ollama 官方文档写明服务默认绑定 127.0.0.1:11434，用 OLLAMA_HOST 改绑定地址就会把它开放给网络；该文档没有为这种暴露提供鉴权方案。
鉴权通常要往外放一层：官方给出的暴露方式是「通过 Nginx 之类的代理服务器」，也就是由反代、网关或云 IAM 承担身份与配额，而不是推理进程自己做。
可分的维度有四个：身份（谁能调）、配额与限流（能用多少）、审计（谁在什么时候调了哪个模型）、隔离（不同用途不同 key，避免一个泄漏全线受影响）。
在通用安全框架里这些落在防护面：NIST 网络安全框架用 IDENTIFY、PROTECT、DETECT、RESPOND、RECOVER 五个职能组织控制项，访问控制属于 PROTECT。
内网可达不等于安全：能连到端口就能提交提示词，也能把服务当算力消耗点或数据外带通道用。
The first control is the bind address, not a password. Ollama's FAQ states the server binds 127.0.0.1:11434 by default and that changing OLLAMA_HOST exposes it on the network; the same document offers no authentication for that exposure.
Authentication normally sits one layer out. The documented way to expose the server is behind a proxy such as Nginx, so identity and quotas are handled by the reverse proxy, gateway or cloud IAM rather than by the inference process itself.
Four dimensions are worth separating: identity (who may call), quota and rate limits (how much they may use), audit (who called which model when), and isolation (separate keys per purpose, so one leak does not affect everyone).
In general security vocabulary this sits on the protective side: the NIST Cybersecurity Framework organises controls into IDENTIFY, PROTECT, DETECT, RESPOND and RECOVER, and access control belongs to PROTECT.
"Internal network only" is not a security property. Anything that can reach the port can submit prompts, spend compute on your bill, and read your system prompt.
一个没有鉴权的推理端口，同时是三样东西：别人替你付费的算力、绕过你应用层校验的入口、以及不需要拿到 key 就能读你系统提示词的位置。控制点越早，事后能解释的空间越大。An unauthenticated inference endpoint is three things at once: someone else's pay-as-you-go compute, a route around the checks in your application layer, and a way to read your system prompt without ever holding a key. The earlier you place the control, the more you can explain afterwards.
谁能动我的模型服务
回到名词地图看第5站的其他 33 个词 →Back to the map: the other 33 terms in station 5 →