Maxuu weli gaadhi karaa gateway web oo la jebiyey?
Gateway web wuxuu xaddidaa waxa booqdayuhu furo, ma aha waxa host la jebiyey gaadhi karo. Laba dib u eegis, shax awood iyo amarrada lagu cabbiro gaadhista.
Ka soo qaad in host-ka gateway-ga la jebiyey inta shahaadadiisu weli ansax tahay. Qaanuun kasta oo qeexayay bogagga uu booqdayuhu codsan karo wuu sii socdaa, oo midkoodna ma xaddido xiriirka uu weeraryahanku hadda ka furo host-kaas dhanka subnet-ka xogta. Farqigaas ayaa sabab u ah in barta gelitaanka web-keliya aysan ahayn isla sheegashada shabakad qaybsan. Labada sheegasho waxay u baahan yihiin dib u eegis gooni ah, laga bilaabo meelo kala duwan, ka hor inta aan midkoodna si daacad ah loo sheegi karin.
Laba sheegasho, oo midkood oo keliya ayaa ka bilaabma booqdayaha
Sheegashada koowaad waxay ku saabsan tahay qof: booqdaye leh browser iyo fadhi ansax ah wuxuu furi karaa hal codsi oo wax kale ma leh. Barta gelitaanka web-keliya si fiican ayay uga jawaabtaa sheegashadaas, sababtoo ah booqdayuhu wuxuu helaa bog halkii uu heli lahaa dariiq. Jawaabtaas waa mid mudan in la hayo, oo sidoo kale waa sheegashada kaliya ee ay diiwaangeliyaan badi jaantusyada.
Sheegashada labaad waxay ku saabsan tahay qayb: waxaa loo malaynayaa in gateway-ga, ama habka codsiga ee ka dambeeya, uu hoos yimaado qof kale kontoroolkiisa. Malahaas waxaa laga beddelaa su'aasha ah URL-yada loo oggol yahay mid ah goobaha iyo aqoonsiyada uu habku weli gaadhi karo.
Labada sheegasho waxay leeyihiin milkiilayaal kala duwan, waxay soo saaraan caddayn kala duwan, oo si madax-bannaan ayay u guuldaraystaan. Koox aqoonsi waxay ku tusi kartaa tan koowaad imtixaan fadhi; tan labaad waxay u baahan tahay siyaasad shabakadeed, dib u eegis akoon adeeg iyo kontoroolada host-ka. Naqshad diiwaangelisa keliya badhka booqdayaha waxay u muuqataa mid buuxa slide dib u eegis oo khafiif ah inta lagu jiro dhacdo, sababtoo ah kontoroolada muhiimka ah ka dib jabka weligood ma aysan ku jirin baaxadda. Magacow sheegashada ay taageerto kontorool kastaa, haddii kale hal qaanuun gateway ah labadaba ayaa lagu tirin doonaa.
Adeeg kharash oo la shaqeeyey, iyo labada dariiqo ee uu ku guuldaraysto
Qaado adeeg kharash: gateway dadweyne oo ku yaal 10.60.4.10 wuxuu xaqiijiyaa shaqaalaha wuxuuna u gudbiyaa codsiyada la ansixiyey dhageystaha codsiga oo ku yaal dekedda 8443, codsigaasna wuxuu gaadhaa hal dhageyste PostgreSQL oo ku yaal 10.60.4.20:5432 isagoo ah doorka expenses_app. Shaqaalaha looma jeedin inay helaan gelitaan gudaha guud. Hawlgalka caadiga ah naqshaddu waxay runtii bixisaa gelitaan u gaar ah codsiga iyada oo aan meelna lagu daabicin dhageystaha xogta. Cinwaannadu way muhiim yihiin, sababtoo ah baaritaan kasta oo dambe oo maqaalkan ku jira ayaa magacaabaya.
Hadda ka saar gateway-ga kooxda la aamini karo. Goobaha kee ayuu 10.60.4.10 gaadhi karaa marka habkiisu uu ka tirsan yahay weeraryahan? Shaandheynta URL ee xaddiday booqdayaasha waxba kama sheegto xiriirka uu host-ka gateway-ga u furo dhanka subnet-ka xogta.
Halkii, ka saar habka codsiga, oo awooddu qaab bay beddeshaa: doorka expenses_app, adeegyada uu serverkaas gaadhi karo, iyo faylasha uu akoonkaas akhriyi karo. Labada xaaladood albaabka hore wuxuu ahaan karaa web-keliya halka xadka backend-ku maqan yahay. Sidaas darteed calaamadda albaabka hore ma aha jawaabta mid ka mid ah labada su'aalood.
Khariidad awoodda ay dhab ahaan qabto qolo kastaa
Qandaraas loo qoray sida oggolaansho la qorsheeyey wuxuu u egtahay inuu naqshadda kugu celiyo. U qor sida awood la haysato, baaritaanka beeniya xad-dhaafka, iyo milkiilaha baaritaankaas, markaas saf kastaa wuu tijaabin karaa. Shaxan waa soo jeedin tusaalaha kore, ma aha sheegasho badeeco:
| Component | Authority it actually holds | Check that proves the denial | Owner of the check |
|---|---|---|---|
| Identity provider | Issues assertions and session cookies, and holds no network path of its own | A request to the application URL without a session is redirected to the login page | Identity team |
| Public gateway host | TCP reachability to whatever its routing table and egress rules permit | An egress rule drops 10.60.4.20:5432 and the probe reports the port filtered | Network platform team |
| Application role | SQL privileges granted to expenses_app inside the expenses database | A privilege query shows no ownership or create right on any other schema | Application team |
| Database listener | Accepts connections only from the source ranges named in its host-based rules | A connection from an unlisted address is refused before authentication | Database administrator |
| Management path | Administrative access reserved for patching, monitoring and recovery | A staff workstation cannot reach the administrative port or jump through it | Platform owner |
Milkiiluhu wuxuu raacaa awoodda. Kooxda aqoonsigu waxay leedahay sheegashooyinka, kooxda madal shabakaddu waxay leedahay dariiqyada, kooxda codsigu waxay leedahay doorka xogta, maamulaha xogtu wuxuu leeyahay dhageystaha iyo qaanuunnadiisa ku saleysan host-ka, milkiilaha madalkuna wuxuu leeyahay heerka maamulka. Diidmo aan milkiile lahayn waa jumlad dokument ah, ma aha kontorool.
Qaybintu waxay sidoo kale ka hortagtaa laba-jibbaar. Xaddidnaanta dekeddu ma sheegi karto mudnaanta shaxda, doorka xogtuna ma horjoogsan karo host inuu furayo socket dhanka subnet aan xiriir la lahayn.
Tiri waxa uu gateway-gu gaadhi karo halkii aad sheegan lahayd
Sheegashada xadku waxay la mid tahay inta ay le'eg tahay tirinta ka dambeysa. Host-ka gateway-ga, saddex amar ayaa daboolaya doorashada dariiqa, baaritaan nool iyo siyaasadda bixitaanka:
ip route get 10.60.4.20
nc -zv 10.60.4.20 5432
sudo nft list chain inet filter outputAkhri wax soo saarka isla nidaamkaas. Dariiqu wuxuu sheegayaa in 10.60.4.20 uu host-kaas ka doorto iyo in kale; baaritaanku wuxuu sheegayaa in dhageystahu jawaabo iyo in kale; liiska qaanuunnadu wuxuu muujinayaa in siyaasaddu xannibto baakadda ama aysan waligeed wax ku jirin dariiqeeda.
Ku celi tirinta host-ka codsiga. Halkaas dhanka xogtu waa hal weydiin oo lagu fuliyo doorka codsiga:
psql -h 10.60.4.20 -U expenses_app -d expenses -c 'select rolname, rolsuper, rolcreatedb from pg_roles'Xiriir guul leh oo hoos yimaada door aan akhriyi karin schema kale waa natiijo ka duwan xiriir guul leh oo hoos yimaada door milkiile. Kaliya tan labaad ayaa ah helitaan.
Diiwaangeli diidmooyinka, ka dib taariikh u dhig dib u eegista
Aqbaalku waxaa loo qoraa natiijooyin halkii ujeeddooyin: fadhiga shaqaaluhu ma gaadhi karo dhageystaha, host-ka gateway-ga ma gaadhi karo subnet aan xiriir la lahayn, doorka codsiguna ma abuuri karo xog. Mid kastaa waa baaritaan gooni ah oo leh milkiile magac leh iyo taariikh.
Hayso la-socodka, patch-ka iyo soo-celinta iyagoo la gaadhi karo dariiqa maamulka loo qorsheeyey. Xad sidoo kale xanniba milkiilahaagiisa wuxuu noqdaa carqalad, jawaabta koowaad ee caadiga ah ee carqaladaasna waa in qaanuunka mar kale la ballaariyo. Tilmaamaha wareegga CISA wuxuu codsanayaa in gelitaanka gudaha iyo dibadda lagu xaddido dekedo iyo borotokoolo la caddeeyey, oo ay ku jirto socodka u dhexeeya shabakadaha gudaha, taas oo ah jihada ka bilaabma backend oo ay badi jaantusyadu ka tagaan.
Taariikh u dhig dib u eegista oo magacow milkiilaheeda. Mar kale ordi tirinta iyo weydiinta mudnaanta ka dib isbeddel kasta oo ku yimaada sawirka gateway-ga, shaxda dariiqa ama doorka codsiga.