Fitar da NFS da aka kulle da adireshin VPN: abin da ba ya tabbatarwa
Dokar fitarwa na duba inda fakiti ya fito; AUTH_SYS yana bayar da UID na gida kuma Kerberos yana tabbatar da mai amfani. Yanke shawara wanda sabis ɗin fayil ɗinka yake buƙata.
Wani mai masaukin yana fitar da wani babi zuwa adireshin VPN, haɗin ya yi nasara, kuma ana rubuta zanen a matsayin wanda aka tabbatar. Abin da wannan dokar ke iyakancewa shi ne inda fakiti suke kamar sun fito. Ko mutumin da ke jagorantar aikin fayil ɗin shi ne wanda yake cewa shi ne ya dogara da yanayin tsaron NFS, kuma a yawancin irin waɗannan fitarwa babu wanda ya canza shi daga tsoho.
Zamantakewa uku na iya bayyana a buƙata ɗaya
Abokin VPN ɗin yana ɗauke da tabbataccen zamantakewa kamar takardar shedar abokin ciniki ko maɓallin aboki. Fakitin IP na ciki yana ɗauke da adireshin tushe. Aikin fayil ɗin yana ɗauke da duk wata shaidar mai amfani da tsarin NFS ɗinsa ya bayar. Zanen da ke ɗaukar adireshin a matsayin wakilin dukan ukun ya ɗauka a hankali sashen da ya kamata ya tabbatar.
| Identity | What it proves | What it does not |
|---|---|---|
| VPN peer | Which peer was accepted by the tunnel | Which user runs on that machine |
| Inner source address | Where the packet appears to originate | That only the intended client can use it |
| NFS credential | What the file service believes about the caller | Anything, if the flavour only asserts local IDs |
Rubuta waɗannan layuka uku shi ne dukan aikin. Yawancin muhawara kan ko fitarwa tana da aminci tana rushewa da zarar ya bayyana a wane layi kowane iko yake.
Mallakar adireshi wani bayani ne na aiwatarwa
Ƙofa na iya ba da adireshin rami ga abokin da aka karɓa, ko ya ba da izinin hanyar sadarwa mai turawa a gare shi. Ko aiwatarwar ta ƙi fakitin da tushensa na ciki na wani abokin ciniki ne, siffa ce ta wannan aiwatarwar, kuma ya dace a duba shi maimakon ɗauka.
Lambar uwar garken sararin mai amfani ta gargajiya ta Community OpenVPN misali na iya ƙin tushen da ke da alaƙa da wani abokin ciniki kafin a isar da fakitin ta na'urar TUN. Wannan duba ce ta mallakar adireshi mai ainihin amfani, kuma har yanzu ba tabbatar da mai amfani na NFS ba ne, domin ba ya faɗin komai game da wane asusu ne ke yin aikin.
Fassarar tushe tana lalata har da haka. Ƙofar NAT na iya gabatar da kowane abokin ciniki a matsayin adireshi ɗaya, sannan dokar fitarwa ba za ta iya bambanta mutanen da ke bayansa ba. Sai daiidancin dokar ya zama tatsuniya da zane ke riƙewa. Idan fitarwar tana da muhimmanci, riƙe adireshin a bayyane maimakon barin mai fassara ya yanke shawara wanene wakilin wanene.
Karanta yanayin tsaro kafin ka amince da fitarwar
Jagorar NFS ta Red Hat ta raba sec=sys, wanda ke amfani da UID da GID na UNIX na gida ta AUTH_SYS, da hanyoyin Kerberos. krb5 na ƙara tabbatar da mai amfani, krb5i na ƙara kariya ta ingancin bayanai, kuma krb5p na ƙara kariya ta sirri ga zirga-zirgar.
Shaidar AUTH_SYS tana ɗauke da filaye kamar UID na mai kira da bayanan ƙungiya, kuma RFC 5531 yana gargaɗi a fili cewa wannan yanayi ba ya ba da tsaro shi kaɗai kuma ya dogara da kariya ta waje. Gudanar da shi cikin VPN na ba da kariya ga jigilar kaya kuma ba ya canza komai a cikin iƙirarin da ke cikin fakitin.
exportfs -v
showmount -e nfs.example.internalKaranta yanayin a wannan fitarwar kafin ka karanta jerin abokan ciniki. Fitarwar da ta bayyana a iyakance tana iya iyakancewa da adireshi kaɗai alhali kowane mai kira yana bayar da duk UID da yake so.
Zaɓi tsarin, sannan ka riƙe izini
Zaɓi tsarin tabbatar da sabis ɗin fayil wanda ya dace da abokan cinikin da kake sarrafawa da gaske. Kerberos yana buƙatar zamantakewa da tura sabis a bayansa, don haka canza zaɓin haɗi ɗaya ba ƙaura ba ce kuma zai kasa kawai har sai yankin Kerberos, principal da keytab sun wanzu.
A ƙarƙashin kowane tsarin, riƙe izinin fitarwa da izinin tsarin fayil waɗanda ke iyakance abin da principal ɗin da aka tabbatar zai iya yi. Tabbatarwa tana gaya maka wanda ke tambaya; izini yana yanke shawara ko amsar ya kamata ta zama i. Haɗa waɗannan biyu cikin saiti ɗaya shi ne yadda ƙaura ke ƙarewa tana bayar da fiye da yadda tsohon tsarin ya bayar.
Yi amfani da dokar adireshi don ainihin manufarta
Iyakance sabis ɗin ga hanyar da aka amince da ita da tushe ya kasance da amfani, har da manufar shigar masauki lokacin da ƙarshen VPN da uwar garken NFS suke raba na'ura ɗaya. Dokokin da ke tura zirga-zirga ba sa kula da buƙatun da aka nufa zuwa sabis da ke gudana a cikin gida a kan wannan masaukin. Wannan gibin yana bayanin adadi mai ban mamaki na fitarwa da aka yi nufin su kasance na sirri. Duba manufar shigar gida a bayyane maimakon ɗauka cewa dokokin rami sun rufe ta.
Duba cewa wata hanyar sadarwa ko ƙofar da ke fassara tushe ba za ta iya cika dokar ba zato ba, kuma ɗauki hakan a matsayin dalilin tabbatar da asali ba iƙirarin cewa ƙirƙira adireshi yana tabbatar da haɗin da zai yi aiki ba.
Gudanar da gwaje-gwajen karɓa uku maimakon ɗaya. Fara da abokin ciniki da aka amince yana aiki a matsayin mai amfani da aka amince, sannan sake maimaitawa daga abokin da ba a taɓa amincewa ba, sannan gwada abin da mai amfani da aka amince bai ma da izinin yi ba tukuna. Bayan haka tambaya me zai canza idan an lalata abokin ciniki mai izini, domin tabbatar da jigilar kaya ba ya sa kowane tsari a wannan na'urar amintacce. Satar takardar shaida da asusun gida mai sha'awar sani matsaloli ne daban-daban da kulawa daban-daban.