Me ƙofar yanar gizo da aka kutse za ta iya isa har yanzu?
Ƙofar yanar gizo tana iyakance abin da baƙo ke buɗewa, ba abin da uwar garke da aka kutse za ta iya haɗawa ba. Bita biyu, teburin iko da umarnin auna isa.
A ce an kutse uwar garken ƙofar yayin da takardar shaidarta har yanzu tana aiki. Duk ƙa'idar da ta tsara waɗanne shafuka baƙo zai iya nema tana nan da aiki, kuma babu ɗaya daga cikin waɗannan ƙa'idojin da ke tauye haɗin da maharin yanzu ya buɗe daga wannan uwar garke zuwa yankin cibiyar bayanai. Wannan gibin shi ne dalilin da ya sa wurin shiga na yanar gizo kawai ba daidai yake da cibiyar sadarwa da aka raba ba. Waɗannan ikirari biyu suna buƙatar bita daban-daban, daga wuraren farawa daban-daban, kafin a iya yin ɗaya daga cikinsu da gaskiya.
Ikirari biyu, kuma ɗaya kawai daga cikinsu yana farawa daga baƙo
Ikirari na farko game da mutum ne: baƙo mai burauza da ingantaccen zaman zai iya buɗe aikace-aikace ɗaya ba wani abu ba. Wurin shiga na yanar gizo kawai yana amsa wannan ikirarin da kyau, domin baƙo yana samun shafi maimakon hanya. Wannan amsar ta cancanci a riƙe ta, kuma ita ce kawai ikirarin da yawancin zane-zane ke rubutawa.
Ikirari na biyu game da wani ɓangare ne: ana ɗauka cewa ƙofar, ko tsarin aikace-aikacen da ke bayanta, yana ƙarƙashin ikon wani. Daga wannan zato tambayar ta canza daga waɗanne URL aka yarda zuwa waɗanne wurare da asali tsarin zai iya isa har yanzu.
Ikirarin biyun suna da masu su daban, suna bayar da hujjoi daban, kuma suna gazawa dabam. Ƙungiyar asali za ta iya nuna na farko da gwajin zama; na biyu yana buƙatar manufar cibiyar sadarwa, bitar asusun sabis da kula da uwar garke. Tsarin da ke rubuta rabin baƙo kawai yana kama da cikakke a kan faifan bita kuma siriri a lokacin wani lamari, domin kulawar da ke da muhimmanci bayan kutse ba ta taɓa kasancewa cikin iyaka ba. Ambaci wane ikirari kowane iko ke tallafawa, in ba haka ba za a ba da ƙa'idar ƙofa ɗaya ga duka biyun.
Sabis ɗin kuɗaɗen da aka yi aiki, da hanyoyi biyu da yake rasa
Ɗauki sabis ɗin kuɗi: ƙofar jama'a a 10.60.4.10 tana tabbatar da ma'aikata kuma tana tura buƙatun da aka amince zuwa mai sauraron aikace-aikace a tashar 8443, kuma wannan aikace-aikacen yana isa mai sauraron PostgreSQL ɗaya a 10.60.4.20:5432 a matsayin rawar expenses_app. Ba a nufin ma'aikata su sami gama-gari na shiga ciki. A cikin aiki na yau da kullum tsarin yana ba da hanyar shiga ta musamman ta aikace-aikace ba tare da wallafa mai sauraron cibiyar bayanai a ko'ina ba. Adiresoshin suna da muhimmanci, domin kowane gwaji daga baya a cikin wannan labarin yana ambaton su.
Yanzu cire ƙofar daga rukunin amintattu. Waɗanne wurare 10.60.4.10 zai iya isa da zarar tsarinsa na maharin? Tacewar URL da ta tauye baƙi ba ta ce komai ba game da haɗin da uwar garken ƙofar ke buɗewa zuwa yankin cibiyar bayanai.
A maimakon haka cire tsarin aikace-aikacen, kuma ikon yana canza siffa: rawar expenses_app, sabis ɗin da wannan uwar garke zai iya isa, da fayilolin da wannan asusu zai iya karantawa. A duka biyun ƙofar gaba za ta iya zama ta yanar gizo kawai yayin da iyakar baya ba ta nan. Don haka alamar da ke kan ƙofar gaba ba amsa ba ce ga ɗaya daga cikin tambayoyin biyu.
Zana ikon da kowane ɓangare ke da shi a zahiri
Yarjejeniyar da aka rubuta a matsayin izini da ake nufi tana yawan maimaita tsarin gare ku. Rubuta ta a matsayin ikon da ake riƙe, gwajin da ke karyata wuce gona da iri, da mai wannan gwajin, sannan kowane layi ya zama abin gwadawa. Wannan tebur shawara ce ga misalin da ke sama, ba da'awar samfur ba:
| Component | Authority it actually holds | Check that proves the denial | Owner of the check |
|---|---|---|---|
| Identity provider | Issues assertions and session cookies, and holds no network path of its own | A request to the application URL without a session is redirected to the login page | Identity team |
| Public gateway host | TCP reachability to whatever its routing table and egress rules permit | An egress rule drops 10.60.4.20:5432 and the probe reports the port filtered | Network platform team |
| Application role | SQL privileges granted to expenses_app inside the expenses database | A privilege query shows no ownership or create right on any other schema | Application team |
| Database listener | Accepts connections only from the source ranges named in its host-based rules | A connection from an unlisted address is refused before authentication | Database administrator |
| Management path | Administrative access reserved for patching, monitoring and recovery | A staff workstation cannot reach the administrative port or jump through it | Platform owner |
Mallaka tana bin ikon. Ƙungiyar asali ce ta mallaki ikirari, ƙungiyar dandalin cibiyar sadarwa ce ta mallaki hanyoyi, ƙungiyar aikace-aikace ce ta mallaki rawar cibiyar bayanai, mai kula da cibiyar bayanai yana mallaki mai sauraro da ƙa'idodinsa na tushen uwar garke, kuma mai dandalin yana mallaki matakin gudanarwa. Ƙin da ba shi da mai shi jimla ce a cikin takarda ba iko ba.
Rabin kuma yana hana ƙidaya sau biyu. Takunkumin tasha ba zai iya bayyana damar tebur ba, kuma rawar cibiyar bayanai ba za ta iya hana uwar garke buɗe soket zuwa yankin da ba shi da alaƙa ba.
Lissafa abin da ƙofar za ta iya isa maimakon ɗauka
Da'awar iyaka ba ta fi lissafin da ke bayanta ba. A uwar garken ƙofar, umarni uku sun rufe zaɓin hanya, gwajin rayuwa da manufar fita:
ip route get 10.60.4.20
nc -zv 10.60.4.20 5432
sudo nft list chain inet filter outputKaranta fitarwar a wannan tsari. Hanyar tana gaya ko ana zaɓin 10.60.4.20 ko a'a daga wannan uwar garke; gwajin yana gaya ko mai sauraro yana amsawa; jerin ƙa'idoji yana nuna ko manufa tana tsayar da fakitin ko babu abin da ya taɓa kasancewa a hanyarsa.
Maimaita lissafin daga uwar garken aikace-aikacen. Daga nan gefen cibiyar bayanai tambaya ɗaya ce da aka gudanar a matsayin rawar aikace-aikacen:
psql -h 10.60.4.20 -U expenses_app -d expenses -c 'select rolname, rolsuper, rolcreatedb from pg_roles'Haɗi mai nasara a ƙarƙashin rawar da ba za ta iya karanta wani tsari ba sakamako ne daban daga haɗi mai nasara a ƙarƙashin rawar mai shi. Na biyu ne kawai bincike.
Rubuta ƙin yarda, sannan ka saka kwanan wata ga bitar
Ana rubuta karɓa a matsayin sakamako ba manufa ba: zaman ma'aikaci ba zai iya isa mai sauraro ba, uwar garken ƙofar ba zai iya isa yankin da ba shi da alaƙa ba, kuma rawar aikace-aikacen ba za ta iya ƙirƙirar cibiyar bayanai ba. Kowanne gwaji ne daban da ke da mai suna da kwanan wata.
Riƙe sa ido, faci da dawo da aiki ana isa ta hanyar gudanarwa da aka tsara musu. Iyakar da ke toshe mai ita ma tana zama katsewa, kuma amsar farko da aka saba yi ga wannan katsewar ita ce a sake faɗaɗa ƙa'idar. Jagorar kewayen CISA tana neman a iyakance shiga ciki da fita zuwa tashoshi da ka'idojin da aka tabbatar, gami da zirga-zirga tsakanin cibiyoyin sadarwa na ciki, wanda shi ne alkiblar da bayan ke farawa da yawancin zane-zane ke watsi da ita.
Saka kwanan wata ga bitar kuma ambaci mai ita. Sake gudanar da lissafi da tambayar dama bayan kowane canji a hoton ƙofar, teburin hanya ko rawar aikace-aikacen.