Sunayen VPN na sirri sun kasa? Kariyar DNS rebind ce ake zargi

A cikin LAN na ofis, sunan ciki yana amsawa nan take. Da zarar VPN ta tashi sai ya daina aiki, manhajar tana ba da labarin karewar lokaci, kuma ramin da kansa yana wuce da zirga-zirga ba tare da korafi ba. Abin da ya canza shi ne mai warwarewa, kuma wannan mai warwarewar yana da ra’ayi game da adireshi na sirri.

Kariyar rebind tana nan don ta dakatar da wata dabara ta musamman. Sunan sirri da aka wallafa da gangan yana kama da shi sosai, sai kariyar ta kunna.

Karanta amsar kafin ka karanta manufar

Tambayi sunan ga mai warwarewar da VPN ke turkawa da gaske, ba wanda kwamfutarka ke amfani da shi a gida ba. Kwatanta amsar da rikodin da kake tsammani, ka lura ko amsar babu kome, an ki, ko cike da adireshin jama’a da babu wanda ya shirya.

Alamun suna cin karo, don haka siffar amsar ce ke tantance ganewar asali. NXDOMAIN shine rikodin da ya bata, REFUSED shine ka’idar shiga, adireshin jama’a ga sunan ciki kuskure ne na manufa ko na DNS raba, kuma ingantaccen adireshin sirri da abokin ciniki ba zai iya amfani da shi ba wata matsala ce daban. Haɗin da aka ki ko roƙon da ya tsaya ba su tabbatar da kome da kansu, shi ya sa umarni na farko a kowane ɗayan waɗannan tikiti ya kamata ya zama bincike maimakon sake tadawa. Rubuta amsar kafin ka canza kome.

Abin da kariyar ke dakatarwa da gaske

DNS rebinding yana aiki ta hanyar canza abin da suna ke warwarewa zuwa gare shi bayan abokin ciniki ya riga ya amince da shi. Shafi yana lodawa daga sunan da mai hari ke sarrafawa, amsar tana juyawa zuwa adireshin sirri, kuma ana yaudarar burauzar ta yi magana da wani abu a cikin hanyar sadarwar gida da ba za ta taɓa karɓar haɗi kai tsaye da shi ba. Kariyar ita ce a ki amsoshin da ke nuni zuwa sararin sirri lokacin da ba a taɓa nemar da mai warwarewa ya yi hidimar sararin suna na sirri ba. Wannan rashin daidaito shi ne dukan harin.

dnsmasq yana rubuta irin wannan ɗabi’a daidai, tare da kebe ta kowane yanki. Shafin littafin jagora nasa yana bayyana rebind-domain-ok a matsayin hanyar ba da suna ga yankunan da za su iya mayar da irin waɗannan adireshi bisa doka. Karanta shi a matsayin alama cewa gyaran da aka yi niyya izini ne mai iyaka, ba maɓallin duniya ba.

Iyakance kebe ga sararin suna

Gyara sararin suna da farko, sannan kebe. Tabbatar sunan da ya kasa na wani yanki ne da ƙungiyar ke sarrafawa kuma ana kula da rikodin da gangan. Adireshin da ba a zata ba wanda kawai yayi kama da wani yanki na LAN da aka sani ya cancanci zato, ba kebe ba, don haka duba mai yankin kafin ka rubuta kowane izini.

# ask the resolver the VPN pushed, and show the full answer
dig +noall +answer db.corp.example @10.40.0.1
dig +short db.corp.example @10.40.0.1

# dnsmasq: what does the running configuration already allow?
grep -R 'rebind' /etc/dnsmasq.d /etc/dnsmasq.conf

Sannan ƙara mafi ƙarancin izini da zai rufe sunayen da aka yi niyya: yanki ɗaya, ko ƙaramin yanki ɗaya da aka wakilta, a cikin tsarin mai warwarewar da abokan cinikin VPN ke tambaya. Kashe kariyar ga kowane suna a wannan mai warwarewar yana cire kariyar ga dukansu lokaci ɗaya, har da sunayen da ba su taɓa buƙatar ta ba.

DNS raba yana cikin wannan shawarar. Idan ya kamata a amsa sararin suna na sirri a mai warwarewar ciki kawai, wallafa shi a can kuma daina yada shi zuwa masu warwarewa na jama’a, domin keben ya rufe hanya ɗaya maimakon kowace hanya.

Sake gwada albarkar da kariyar

Sake tambaya, sannan haɗa da sabis ɗin ka ga abin da abokin ciniki ke gani. Ingantacciyar amsa ta sirri tare da zaman da ke aiki yana nufin keben ya yi tasiri. Ingantacciyar amsa tare da zaman da ya tsaya yana nufin hanya ko asalin sabis ɗin ne abin zargi na gaba.

# the internal name and the public control should behave differently
dig +short db.corp.example @10.40.0.1
dig +short www.example.com @10.40.0.1

# and the service itself, with the certificate it presents
curl -sS -o /dev/null -w '%{http_code}\n' https://db.corp.example/health

Gwada sunan jama’a ta wannan mai warwarewar ma. Kariyar ya kamata ta ci gaba da aiki ga sunayen da ke wajen keben, kuma idan wannan binciken ya kasa, canjin ya fi abin da aka yi niyya faɗi. Kiyaye tabbatar da takardar shaida ba a taɓa shi ba duk tsawon lokaci, domin sunan da ke warwarewa daidai har yanzu dole ya dace da takardar shaidar da sabis ɗin ke gabatarwa.

Rubuta a cikin tikiti amsar da aka ki, yankin, mai warwarewar da wanda ya mallaki manufar. Wannan rikodin ne ke mai da wani ɓoyayyen katsewar ciki ya zama canjin tsari da wani zai iya dubawa.