MySQL ta VPN: tabbatar da uwar garken, ba kawai ɓoyewa ba
Ɓoye zuwa ga uwar garken da ba daidai ba har yanzu ba daidai ba ne. Kwatanta darajar ssl-mode, sannan gudanar da haɗi da ke ambaton uwar garken da kuka nufa kuma ya tabbatar da hakan.
Kuna ajiye haɗi zuwa 10.20.4.15, VPN ɗin ya faɗi, kuma abokin ciniki har yanzu yana haɗawa. Wannan ba labari mai daɗi ba ne. Adireshi mai zaman kansa wuri ne a cikin kowane mahallin tuƙi da kuke ciki, kuma yawancin cibiyoyin sadarwa suna amfani da irin wannan jeri. Abokin ciniki ya isa uwar garken MySQL, kawai watakila bai isa naku ba.
Gyaran yana da rabi biyu, kuma ɗaya ne kawai daga cikinsu game da hanyar sadarwa. Rike haɗin a hanyar da aka nufa, kuma sa abokin ciniki ya tabbatar da uwar garken da yake magana da ita. Rabin farko shine inda VPN ke taimakawa; rabin na biyu dole ne a daidaita shi.
An ɓoye zuwa me, daidai?
TLS yana kare tattaunawar daga duk wanda ke tsakiyar, kuma ba ya faɗin komai game da wanda ƙarshen ke da’awar shi ne sai abokin ciniki ya tabbatar. Takardar shaidar da ta inganta a gaban hukuma amintacciya tana tabbatar da cewa takardar ta fito daga wannan hukuma. Ba ta tabbatar da cewa an bayar da takardar don sunan uwar garken da kuke son isa ba, kuma waɗannan tambayoyi ne daban-daban.
Wannan ba gibin ka’ida ba ne. Ƙofofin kamawa, kurakurai na VRF da ba daidai ba da tsare-tsaren adireshi masu haɗuwa duk suna samar da uwar garken da ke shirye sosai don yin shawarwari TLS da ku. Idan abokin ciniki yana buƙatar ɓoyewa kawai, zaman yana da sirri kuma an nufa shi zuwa ga bayanan da ba daidai ba.
Don haka tambayar da ta dace ba ita ce shin haɗin an ɓoye shi ba, amma shin an ɓoye shi zuwa ga asalin da kuke nufa. A cikin abokin ciniki na MySQL, wannan bambanci yana rayuwa gaba ɗaya a cikin saitin ssl-mode.
Darajar ssl-mode biyar a aikace
Akwai darajoji biyar, kuma ɗaya ne kawai daga cikinsu ke amsa tambayar wannan littafin. Tebur ɗin yana lissafa abin da kowannensu ke tabbatarwa a zahiri, maimakon abin da sunansa ke nunawa.
| Mode | What it guarantees |
|---|---|
DISABLED | No TLS at all; everything on the wire is readable |
PREFERRED | Tries TLS and falls back to plaintext when the account and server allow it, so it is not a fail-closed requirement |
REQUIRED | Refuses to connect without TLS, and does not validate the certificate |
VERIFY_CA | Validates the server certificate against the configured CA and does not check the hostname |
VERIFY_IDENTITY | Validates the CA and checks that the certificate names the host the client used |
Layi na ƙarshe ne kawai ke amsa tambayar wannan labarin. PREFERRED ya cancanci a lura da shi da kansa, saboda abokin ciniki da ke faɗuwa cikin shiru zuwa rubutu bayyananne ya fi wanda ya ƙi: kuna tsammanin kuna da ɓoyewa kuma rikodin fakiti bai yarda ba.
Haɗin da za ku iya gudanarwa yau
Umurnin da ke ƙasa shine siffar da za a yi amfani da ita, tare da masu riƙe wuri biyu: sunan bayanan da aka amince da shi da fayil ɗin CA da aka samu ta hanyar da aka amince da ita. Bai kamata a ɗauki ɗaya daga cikin su daga abin da uwar garken ke bayarwa a tuntuɓar farko ba.
mysql --host=db.corp.example --user=app_reader \
--ssl-mode=VERIFY_IDENTITY \
--ssl-ca=/approved/path/ca.pem --password--password ba tare da daraja yana neman shigarwa, wanda ke kiyaye sirrin daga jerin ayyuka da kuma daga tarihin shell ɗinku. Wata ƙaramar al’ada ce mai babbar riba a kan manyan mashigai na tsalle da aka raba, inda layin umarni ke bayyane ga sauran masu amfani.
Lokacin da wannan ya kasa, rubutun kuskure yana bambanta lamuran fiye da hankali. Gazawar CA tana nufin sarkar ba ta inganta ba kuma ya kamata ku duba wace CA ce ta sanya hannu kan takardar uwar garken. Gazawar sunan uwar garken tana nufin sarkar tana da kyau kuma sunan bai dace ba, wanda yawanci yana nufin kun haɗa zuwa uwar garken daidai da sunan da ba daidai ba maimakon zuwa uwar garken da ba daidai ba.
Bayyanar faɗakarwa ba hujja ba ce cewa an riga an watsa kalmar sirri, kuma haɗin da ya kasa bai tabbatar da cewa babu abin da ya bar abokin ciniki ba. Idan kuna sake gina wani abin da ya faru a baya, gano abokin ciniki, daidaitonsa, ƙarin tabbatarwa da matakin da ya kasa. Kimanta fallasa daga saƙon kuskure na ƙarshe hasashe ne.
Lokacin da sunan ya fito daga rami
Tura tashar jiragen ruwa na gida yana karya tabbatar da asali ta hanyar da ke ba mutane mamaki. Idan kun tura tashar jirgin ruwa ta gida zuwa bayanan kuma ku haɗa zuwa localhost, abokin ciniki yana tabbatar da takardar a kan localhost, kuma ba a bayar da takarda don wannan sunan ba. Haɗin na iya zama lafiyayye kuma tabbatarwar zai kasa duk da haka, wanda shine tabbatarwar da ke aiki yadda aka nufa.
Akwai amsoshi biyu na gaskiya. Ba uwar garken da aka tura suna da zai warware zuwa adireshin loopback kuma ya bayyana a takardar uwar garken, ko yi amfani da sunan uwar garken daga farko zuwa ƙarshe domin abokin ciniki ya tabbatar da ainihin asali. Na farko yana da sauƙi ga masu haɓakawa kuma yana buƙatar aikin takarda; na biyu ya fi sauƙin tunani kuma sau da yawa shine tsoho mai kyau don sarrafa kansa. Kashe tabbatarwa don turawar ta yi aiki yana jefar da dukiyar da kuke ƙoƙarin ƙarawa.
Karɓa sharuɗɗa uku ne
Rubuta gwajin karɓa a matsayin maganganu uku daban-daban: haɗin ya yi amfani da hanyar da aka nufa, an buƙaci ɓoyewa maimakon fifita, kuma an tabbatar da asalin uwar garken a kan kayan amintacce. Alamar VPN kore ba ta kafa ɗaya daga cikinsu ba.
Ga abokan ciniki na GUI da MariaDB, duba takardun mai siyar da kansa maimakon ɗauka cewa rubutun tuta yana canjawa. Takardun MySQL game da haɗin da aka ɓoye sun shafi bambance-bambance tsakanin yanayi da buƙatar rarraba CA, kuma ita ce tunani da za a duba kafin canza layin haɗin samarwa.