Ikheshi ngemuva kwe-VPN: i-HTTPS isakufihla ini

Ikheshi eduze kweseva ye-VPN izwakala njengomkhawulokudonsa wamahhala kubo bonke abangemva komhubhe. Akunjalo, ngoba amabhayithi adlula kulelo phuzu ahlala evikelwe yiseshini ye-TLS okuyizingxenye zayo isiphequluli kanye newebhusayithi. Isango le-VPN lisusa kuphela ukubethela kwalo kwangaphandle, hhayi lokho kohlelo lokusebenza. Nquma ukuthi iyiphi into ephindaphindayo ofuna ukuyisebenzisa futhi ngaphambi kokwengeza i-hardware.

Iseshini ye-TLS ingeyesiphequluli

Ku-HTTPS evamile isiphequluli sixoxisana ngokhiye newebhusayithi, futhi yonke irekhodi ngemuva kokuxhawulana ibethelwa leyo ngxenye yeziphetho. Isango le-VPN lixazulula umhubhe eliwakhe, bese lidlulisela amarekhodi e-TLS angenacala. Lingabona izindawo, isikhathi nomthamo, hhayi umugqa wesicelo noma umzimba wempendulo. Lowo umngcele okufanele ikheshi ngayinye iphile nawo.

Noma yikuphi ukuklama okwephula lokho ukuklama kokungenela kwe-TLS, nemiphumela yako siqu ekwethembeni izitifiketi nasekuphathweni kwamadivayisi.

I-CONNECT ingumhubhe, hhayi ikheshi

I-proxy eya phambili esobala ivamise ukuthola isicelo se-HTTP CONNECT bese idlulisela amabhayithi kuzo zombili izinhlangothi. Ukudlulisa yigama elibalulekile: iproxy ayihlaziyi ingxoxo ebethelwe.

curl -sSI -x http://proxy.example:3128 https://example.com/

Izihloko zempendulo zivela ekuphathweni kwe-proxy komhubhe, hhayi ekopishini yekhasi lekhasi. I-CONNECT ephumelelayo isho ukuthi indlela iyasebenza, hhayi ukuthi kukhona okugciniwe ukuze kusetshenziswe futhi. Ukuqondisa iphothi le-443 ekheshini nakho akukufundisi ukukhuluma i-TLS, ngoba ukugcina kukheshi kudinga imilayezo efundekayo. Ukuhlelwa kwekliyenti kufanele kusebenzise isilungiselelo se-proxy esobala esisekelwayo, hhayi ukuqondisa kabusha okungachazwanga.

Gcina kukheshi lokho okusebenzisayo, hhayi lokho okupheqululayo

Lapho okuqukethwe kungokwakho, iproxy ephambene ingaqeda i-TLS futhi igcine ngamabomu izimpendulo ezigunyaziwe. Lapho kungokwesitoreji samaphakethe, sebenzisa isibuko esisekelwa wuphrojekthi.

nginx -T | grep -n "proxy_cache"
curl -sSI https://mirror.example/pkg/index.json | grep -i -E "cache-control|age"

Umyalo wokuqala ukhombisa ukuthi indawo yekheshi ilungisiwe yini nokuthi isebenza kuphi, kanti owesibili ukhombisa imiyalelo yekheshi yomthombo ngento eyodwa. Ikheshi ehlanganyelwe kufanele ihloniphe ukusha, izilawuli zekheshi kanye nezakhiwo zesicelo ezihlukanisa izethulo; private futhi no-store kusho izinto ezihlukene futhi akukho okufanele kususwe ukuze kukhushulwe izinga lokushaya. Imithetho yekheshi ye-HTTP ibuye ikhawulele ukugcina izimpendulo ezingxenyeni eziqinisekisiwe, futhi yilapho khona ikhasi lomuntu siqu liba ukuchayeka kwedatha. Gcina iproxy igciniwe kumaklayenti agunyaziwe esikhundleni sokuveza i-relay evulekile.

Kala ukushaya, hhayi isikhathi

Isicelo sesibili esisheshayo asifakazi ukuthi ikheshi elsisha lenze okuthile, ngoba iziphequluli nezinhlelo zokusebenza zigcina ngokwazo ngamandla. Cela iproxy izibali zokushaya nokuphuthelwa futhi ubheke ukuhamba kwezimoto komthombo ngesikhathi sokuphinda okulawulwayo. Sebenzisa ukulanda okukodwa okuphindayo kwento eyaziwayo, kuqala ikheshi livuliwe bese lidlulwa, futhi uqhathanise amabhayithi anikezwe umthombo esikhundleni sesikhathi esedlule. Bese uhlola umngcele wokugunyazwa: insiza edinga ukungena akufanele inikezwe iklayenti elinye.

Rekhoda umsebenzi, ukhiye wekheshi kanye nenqubomgomo evumele ukusetshenziswa futhi. Ikheshi isinqumo sokwabelana ngedatha esigqoke ingubo yokuthuthukisa.