Tunnel ɗin SSH na QGIS PostGIS: riƙe sunan uwar garke don TLS

Tunnel ɗin yana tashi, QGIS yana haɗi, kuma shiga yana mutuwa da kuskuren takardar shaida da ke ambaton 127.0.0.1 maimakon uwar garken rumbun bayanai. Mataki na gaba mai jaraba shi ne a sassauta sslmode, wanda ke yin shiru da binciken kuma ya watsar da tabbacin asalin da kuke so tun farko. Ainihin matsalar ita ce ana ajiye tashar gida da sunan uwar garke a fili ɗaya. Shigarwar sabis ɗin libpq tana raba su, don haka soket ɗin yana zuwa tashar da aka tura yayin da TLS ke tabbatar da sunan da aka buga a takardar shaida.

Abin da abokin ciniki yake tsammanin yana haɗawa da shi

A ƙarƙashin sslmode=verify-full, libpq yana kwatanta takardar shaidar da uwar garke ta gabatar da sunan uwar garken da aka nemi isa. Lokacin da wannan sunan ya zama adireshin loopback, kwatancen yana gazawa ko da takardar shaidar tana aiki ga ainihin uwar garken rumbun bayanai. Tura SSH yana canza wace soket ce ke ɗaukar bytes, ba asalin da abokin ciniki ya kamata ya yi tsammani ba. Da zarar an raba waɗannan ra'ayoyi biyu, kuskuren ya daina kama da matsala ta TLS.

Tura ba izini ba ce kuma. PostgreSQL har yanzu yana amfani da nasa ƙa'idoji ga haɗin da uwar garken SSH ke yi, don haka raba matakin jigila da matakin rumbun bayanai kafin ka canza wani abu.

Ku ɗaure tura zuwa loopback kawai

Mai sauraro ya kamata ya kasance a injin QGIS kuma babu wani wuri. Ambaton 127.0.0.1 a fili yana nisanta shi daga sauran mu'amaloli, yayin da adireshin ɗaure da aka bar yana iya fallasa tashar dangane da saitunan ƙofar abokin ciniki na SSH.

ssh -N -L 127.0.0.1:15432:127.0.0.1:5432 [email protected]

Ana warware manufa bayan hanjin biyu daga gefen uwar garken SSH, don haka wannan misalin yana ɗauka cewa PostgreSQL yana kan uwar garke ɗaya da sshd; rumbun bayanai a wata na'ura yana buƙatar wannan adireshin da izininsa. Fara zaman da -N don kada a buɗe kwasfa, bar tabbatar da maɓallin uwar garke, kuma tabbatar mai sauraro ya bayyana kafin ka zargi QGIS. Idan an riga an yi amfani da tashar, turar tana gazawa a lokacin farawa ba a lokacin tambaya ba.

Saka sunan da soket ɗin a shigarwar sabis ɗaya

Fayil ɗin sabis yana barin haɗin ɗaya ya ɗauki sunan tabbatarwa da wata manufar soket daban. Ajiye shigarwar inda libpq ke neman sabis, ko ka nuna PGSERVICEFILE zuwa gare ta.

[gis-via-ssh]
host=db.geo.example
hostaddr=127.0.0.1
port=15432
dbname=gisdb
user=gis_reader
sslmode=verify-full
gssencmode=disable
sslrootcert=/path/to/approved-root.crt

Anan host yana riƙe asalin da ake amfani da shi don binciken takardar shaida yayin da hostaddr ke aika fakiti zuwa tashar loopback da aka tura, kuma duka biyu ana buƙata don wannan tsari ya yi aiki. gssencmode=disable yana da mahimmanci a gine-ginen da in ba haka ba za su fara tattauna ɓoyewar GSSAPI, saboda wannan hanyar tana watsi da saitunan TLS da aka saita yanzu. Yi nuni ga sabis ɗin da suna daga tattaunawar haɗin PostgreSQL na QGIS kuma ba da kalmar sirri ta hanyar tambaya ta al'ada, ba a cikin fayil ɗin da aka raba ba. Sunaye da hanyoyin da ke sama masu riƙe wuri ne; maye gurbinsu da naka ƙimar da aka amince.

Abin da PostgreSQL ke bincika har yanzu bayan tunnel ɗin

Uwar garken tana ganin haɗi daga uwar garken SSH, loopback a wannan tsari, kuma tana daidaita shi da ka'idojin tabbatarwa na tushen uwar garke bisa tsari. Matsayin rumbun bayanai naka har yanzu dole ya tabbatar, kuma shigar SSH ba ta ba da asalin rumbun bayanai da kanta ba. Tabbatar da abin da uwar garken ta yi imani da shi maimakon abin da abokin ciniki ya ɗauka.

psql "service=gis-via-ssh" -c "select inet_server_addr(), current_user"

Rufe zaman turawa idan aikin ya ƙare; shigarwar gida ta daina aiki sannan babu wani abu da ya canza. Hanya ɗaya ta rumbun bayanai ba VPN ba ce ga dukan abokin ciniki na GIS, kuma ɗaukarsa haka shine yadda ake yin kuskuren gano haɗi na gaba.