Me yasa shigarwar ku ta /etc/hosts ba ta isa DNS na VPN

Kun ƙara suna cikin /etc/hosts, kun haɗa VPN kuma kuna tsammanin rikodin zai bayyana ga kowa. Hakan ba ya faruwa, kuma mamakin yakan zo da alama ta biyu: sunan yana warwarewa a injin ku kuma yana gazawa a na abokin aiki, wanda yake kama da karyayyen sabis ɗin DNS na VPN kuma a zahiri fayil ɗin hosts yana yin daidai abin da aka tsara shi don yi. Fayil ɗin hosts saitin warware suna ne na gida, ba sabuntawar yanki ba, kuma babu wani abu a cikin haɗin VPN na yau da kullum da ke ɗaukar sa sama.

Hosts maye gurbi ne na gida, ba sabuntawar yanki ba

Fayil ɗin jeri ne na taswirori da ɗakunan karatu na sabis ɗin suna ke duba kafin, ko maimakon, tambayar uwar garken DNS. Layi kamar 10.40.0.20 build.corp.example yana canza abin da aikace-aikace a wannan injin ɗaya suka kammala. Ba ya ƙirƙirar rikodi, ba ya tafiya ta rami, kuma uwar garken DNS da ramin ke nuni zuwa gare shi ba shi da masaniyar wanzuwarsa.

Shi ya sa gazawar ba daidai ba ce. Abokin cinikin ku yana samun amsa daga fayil ɗin. Wani abokin ciniki yana tambayar uwar garken DNS na VPN, wanda ba ya mayar da komai, kuma aikace-aikacen yana ba da rahoton cewa sunan ba ya wanzu. Dukan injinan biyu suna yin daidai; ɗaya ne kawai ke da maye gurbin da ɗayan bai taɓa gani ba.

Umarni biyu, sassa biyu daban-daban

Hanya mafi sauri ta dakatar da wannan muhawara ita ce a bayyana bambancin a cikin umarni biyu, dukansu ana gudanar da su a abokin cinikin da ke da shigarwar hosts:

getent ahosts build.corp.example
dig @10.40.0.53 build.corp.example A

Na farko yana tambayar hanyar binciken tsarin kanta, wadda a tsarin glibc na yau da kullum ke karanta fayilolin gida kafin DNS. Na biyu yana aika tambayar DNS kai tsaye zuwa uwar garken da ke wannan adireshin kuma ba ya duba fayilolin gida ko kaɗan. Lokacin da na farko ya mayar da shigarwar ku kuma na biyu ya mayar da NXDOMAIN, kun tabbatar cewa rikodin ba ya cikin DNS kuma injin ku yana amsawa daga maye gurbi na gida.

Ana iya daidaita tsari, kuma yana da kyau a duba shi kafin ku kammala wani abu game da wani rarrabawa. Duba layin hosts: a cikin /etc/nsswitch.conf; hosts: files dns yana duba fayiloli da farko. Kada ku kwafi wannan misalin a kan tsarin da ke aiki kawai don canza tsari, domin tsarin gaske yakan lissafa ƙarin tushe da shigarwar sabis na sharadi waɗanda misalin ba ya ɗauke da su.

systemd-resolved yana ɓata gwajin

A tsarin da ke amfani da systemd-resolved, stub na gida kuma yana ba da sunaye daga bayanan hosts. Don haka tambayar 127.0.0.53 ba gwaji mai zaman kansa ba ne na uwar garken nesa, ko da yake yana kama da tambayar DNS kuma yana yin hali kamarta. Za ku iya tabbatar da abin da mai warwarewa ya sani da waɗanne uwar garken zai tambaya da:

resolvectl query build.corp.example
resolvectl status

Fitowar status tana ambaton uwar garken DNS ta kowace hanyar haɗi, kuma haka za ku gano ko hanyar haɗin VPN ta sami mai warwarewa ko a’a. Wannan tambayar ta bambanta da shigarwar hosts kuma ita ce da ta cancanci a yi lokacin da sunan sirri ya gaza ga kowane mai amfani maimakon ɗaya.

Aikace-aikace na iya ƙara wani Layer. Mai bincike da ke da nasa saitin DNS-over-HTTPS, kwantena da ke da nata tsarin mai warwarewa, ko mahallin gudanarwa da ke ajiye bincike a cikin ajiya tsawon rayuwar tsari kowanne na iya amsawa daban da tsarin. Gwada aikace-aikacen da kuke damu da shi maimakon ɗauka cewa umarni ɗaya yana bayyana kowane shiri a injin.

Me a zahiri ke raba suna a fadin VPN

Idan sunan sirri dole ya yi aiki ga kowa, yana buƙatar mai shi wanda mai warwarewa na kowa zai iya isa gare shi. Amsa mai tsabta ita ce a buga rikodin a cikin yanki da ake sarrafawa kuma a sa wannan yankin ya zama mai warwarewa ta hanyar DNS ɗin VPN da aka nufa. Sa’an nan rikodin yana da tushen gaskiya ɗaya, sawun dubawa da zagayowar rayuwa, kuma babu wanda zai tuna wace kwamfutar tafi-da-gidanka ke ɗauke da maye gurbi na gida.

Rarraba fayilolin hosts wata hanya ce ta halal, kuma sarrafa ƙarshen hanya ne ba sabis ɗin suna ba. Idan kun zaɓe shi, dole ne abin da ke sarrafa rundunar ya tura fayil ɗin, ya tsara sigarsa kuma ya cire shi, kuma ya kamata a kwatanta shi haka a cikin ƙira. “VPN yana kula da shi” ba bayanin wannan tsari ba ne.

Rijistar DNS mai motsi hanya ce ta uku, da nata izini, tabbatarwar sabuntawa da tsawon rayuwar rikodi. Ba ta fitowa daga shigarwar hosts, kuma ba ta fitowa daga abokin ciniki kawai ya haɗa ba, sai dai idan an saita uwar garke da abokin ciniki duka biyu don yin hakan. Rikodin da ke bayyana da kansa alama ce da cewa wani ya kunna sabuntawa masu aminci da abokin ciniki da ke yin rijista da kansa, kuma wannan tsarin ya dace a cikin rikodin ƙira ba a cikin zaren warware matsala ba. Idan babu wanda zai iya ambaton wanda ya mallaki wannan saitin, ɗauki rikodin atomatik a matsayin wanda ba a tabbatar ba kuma ka riƙe yankin da ake sarrafawa a matsayin tushen gaskiya.

Sunan da aka warware ba hanya ba ne

Warware suna da isarsu abubuwa ne daban, kuma tsohon taswirar gida ita ce hanyar gargajiya ta rikita su. Shigarwar hosts da ke nuni ga adireshin da ya ƙaura zai ci gaba da zaɓar tsohuwar uwar gida tun da daɗewa bayan an gyara DNS, kuma alamar tana kama da gazawar hanya a kan sunan da ke warwarewa da kyau.

Don haka lokacin da rahoton ya ce “sunan yana warwarewa amma sabis ɗin ba ya isa”, kwatanta binciken tsarin da tambayar kai tsaye zuwa uwar garken DNS na VPN, sannan duba adireshin da kuka samu da wanda sabis ɗin yake amfani da shi a zahiri. tushen systemd-resolved yana rubuta tushen gida da yake dubawa, kuma wannan shine taswirar da kuke buƙata don wannan kwatancen.

Sannan gyara maye gurbin ta hanyar mai shi. Cire layi daga fayil ɗin hosts ɗin ku ba ya wani abu ga kwamfutocin tafi-da-gidanka goma sha biyu waɗanda suka sami wannan layin daga rubutun turawa, kuma wannan ita ce sigar wannan matsalar da mutane suke da ita a zahiri.