Isango lewebhu elihluliwe lingafinyelela kuphi namanje?
Isango lewebhu livimbela lokho umvakashi akwakhayo, hhayi lokho umphathi ohluliwe angakufinyelela. Izibuyekezo ezimbili, ithebula legunya kanye nemiyalo yokulinganisa ukufinyelela.
Ake sithi umphathi wesango lewebhu uhluliwe ngenkathi isitifiketi sakhe sisasebenza. Wonke umthetho owawulawula ukuthi iziphi zikhasi umvakashi angazicela usasebenza, futhi awukho kule mithetho ovimbela ukuxhumana okwamanje umhlaseli akwakhayo kusuka kuleyo mphathi ukuya kusubneti yedathabhezi. Yileli gebe elenza ukuthi indawo yokungena yewebhu kuphela ingabi isimangalo esifanayo nenethiwekhi ehlukanisiwe. Izimangalo zombili zidinga ukubuyekezwa okuhlukene, kusuka ezindaweni zokuqala ezihlukene, ngaphambi kokuba noma yisiphi sazo senziwe ngobuqotho.
Izimangalo ezimbili, futhi eyodwa yazo kuphela eqala kumvakashi
Isimangalo sokuqala sikhuluma ngomuntu: umvakashi onesiphequluli neseshini esebenzayo angavula uhlelo lokusebenza olulodwa futhi akukho okunye. Indawo yokungena yewebhu kuphela iyayiphendula kahle leyo nsimangalo, ngoba umvakashi uthola ikhasi hhayi umzila. Leyo mpendulo ifanele igcinwe, futhi iyisimangalo kuphela esibhalwa iningi lemidwebo.
Isimangalo sesibili sikhuluma ngengxenye: kucatshangwa ukuthi isango, noma inqubo yohlelo lokusebenza engemuva kwaso, ingaphansi kokulawulwa omunye umuntu. Kusukela kuleso sici umbuzo ushintsha usuka kokuthi yimaphi ama-URL avunyelwe ukuya kokuthi yiziphi izindawo nokuthi yikuphi ukuhlonza inqubo engakafinyeleli kukho namanje.
Izimangalo zombili zinabanikazi abahlukene, zikhiqiza ubufakazi obuhlukene, futhi zehluleka ngokuzimela. Ithimba lokuhlonza lingakhombisa esokuqala ngokuhlolwa kweseshini; esesibili sidinga inqubomgomo yenethiwekhi, ukubuyekezwa kwe-akhawunti yesevisi kanye nokulawula komphathi. Idizayini ebhala ingxenye yomvakashi kuphela ibonakala iphelele kusilayidi sokubuyekeza futhi ibe mncane ngesikhathi sesigameko, ngoba izilawuli ezibalulekile ngemuva kokuhlaselwa bezingakaze zibe semkhawulweni. Shono ukuthi isiphi isimangalo esisekelwa yisiphi isilawuli, kungenjalo umthetho owodwa wesango uzobalwa kuzo zombili.
Isevisi yezindleko esetshenzisiwe, kanye nezindlela ezimbili ehlulwa ngazo
Thatha isevisi yezindleko: isango lomphakathi ku-10.60.4.10 liqinisekisa abasebenzi futhi lidlulisa izicelo ezivunyiwe kumlaleli wohlelo lokusebenza kupothi 8443, futhi lolo hlelo lufinyelela kumlaleli oyedwa we-PostgreSQL ku-10.60.4.20:5432 njengendima ethi expenses_app. Abasebenzi akumele bathole ukufinyelela kwangaphakathi okuvamile. Ekusebenzeni okuvamile idizayini inikeza ngempela indawo yokungena eqondene nohlelo lokusebenza ngaphandle kokushicilela umlaleli wedathabhezi noma kuphi. Amakheli abalulekile, ngoba konke ukuhlolwa okulandelayo kulesi sihloko kuwasho.
Manje susa isango kusethi ethembekile. Yiziphi izindawo i-10.60.4.10 engafinyelela kuzo uma inqubo yayo isiphethwe umhlaseli? Isihlungi se-URL esasicindezela abavakashi asisho lutho mayelana nokuxhumana okuvulwa umphathi wesango ukuya kusubneti yedathabhezi.
Esikhundleni salokho susa inqubo yohlelo lokusebenza, futhi igunya lishintsha isimo: indima ethi expenses_app, izinsizakalo inqubo leyo engafinyelela kuzo, kanye namafayela akwazi ukuwafunda lelo akhawunti. Kuzo zombili izimo umnyango wangaphambili ungahlala uyingxenye yewebhu kuphela ngenkathi umngcele we-backend ungekho. Ngakho ilebula emnyango wangaphambili akusona impendulo kunoma yimiphi imibuzo emibili.
Dweba imephu yegunya eliphethwe yiqembu ngalinye ngempela
Isivumelwano esibhalwe njengezimvume ezihloselwe sihamba sindlela idizayini kuwe. Sibhale njengegunya eligciniwe, ukuhlolwa okuphikisa okweqile, kanye nomnikazi walokho kuhlolwa, bese umugqa ngamunye uba nokuhlolwa. Leli thebula liyisiphakamiso sesibonelo esingenhla, hhayi isimangalo somkhiqizo:
| Component | Authority it actually holds | Check that proves the denial | Owner of the check |
|---|---|---|---|
| Identity provider | Issues assertions and session cookies, and holds no network path of its own | A request to the application URL without a session is redirected to the login page | Identity team |
| Public gateway host | TCP reachability to whatever its routing table and egress rules permit | An egress rule drops 10.60.4.20:5432 and the probe reports the port filtered | Network platform team |
| Application role | SQL privileges granted to expenses_app inside the expenses database | A privilege query shows no ownership or create right on any other schema | Application team |
| Database listener | Accepts connections only from the source ranges named in its host-based rules | A connection from an unlisted address is refused before authentication | Database administrator |
| Management path | Administrative access reserved for patching, monitoring and recovery | A staff workstation cannot reach the administrative port or jump through it | Platform owner |
Ubunikazi bulandela igunya. Ithimba lokuhlonza liphethe izimangalo, ithimba lenkundla yenethiwekhi liphethe izindlela, ithimba lohlelo lokusebenza liphethe indima yedathabhezi, umqondisi wedathabhezi uphethe umlaleli kanye nemithetho yawo esekelwe kumphathi, futhi umnikazi wenkundla uphethe indawo yokuphatha. Ukwenqaba okungenamnini umusho osemqulwini, hhayi isilawuli.
Ukwehlukanisa kuvimbela nokubalwa kabili. Umkhawulo wepothi awukwazi ukuveza ilungelo lethabulu, futhi indima yedathabhezi ayikwazi ukuvimbela umphathi ekuvuleni isokhethi eya esubnetini engahlobene.
Bala ukuthi isango lingafinyelela kuphi esikhundleni sokukusho
Isimangalo somngcele sisebenza kuphela ngokulingana nokubalwa okungemuva kwaso. Kumphathi wesango, imiyalo emithathu ihlanganisa ukukhethwa komzila, ukuhlolwa okuphilayo kanye nenqubomgomo yokuphuma:
ip route get 10.60.4.20
nc -zv 10.60.4.20 5432
sudo nft list chain inet filter outputFunda okukhiphayo ngalolo hlelo. Umzila usho ukuthi i-10.60.4.20 ikhethwa yini kuleyo mphathi; ukuhlolwa kusho ukuthi umlaleli uyaphendula yini; uhlu lwemithetho lukhombisa ukuthi inqubomgomo iyawumisa yini iphakethe noma kwakungekho lutho olwake lwaba semzileni wawo.
Phinda ukubalwa kusuka kumphathi wohlelo lokusebenza. Kusukela lapho uhlangothi lwedathabhezi luwumbuzo owodwa owenziwa njengendima yohlelo lokusebenza:
psql -h 10.60.4.20 -U expenses_app -d expenses -c 'select rolname, rolsuper, rolcreatedb from pg_roles'Ukuxhumana okuphumelelayo ngaphansi kwendima engakwazi ukufunda esinye iskema kuwumphumela ohlukile kunokuxhumana okuphumelelayo ngaphansi kwendima yomnikazi. Kuphela okwesibili okuwukutholakala.
Bhala phansi ukwenqaba, bese ubeka usuku ekubuyekezeni
Ukwamukelwa kubhalwa njengemiphumela hhayi izinhloso: iseshini yomsebenzi ayikwazi ukufinyelela kumlaleli, umphathi wesango akakwazi ukufinyelela kusubneti engahlobene, futhi indima yohlelo lokusebenza ayikwazi ukwakha idathabhezi. Ngakunye ukuhlolwa okuhlukile okunomnikazi oshiwo nosuku.
Gcina ukuqapha, ukufaka izichibiyelo kanye nokubuyisela kufinyeleleka ngomzila wokuphatha owenzelwe wona. Umngcele ovimbela nomnikazi wawo uba ukuphazamiseka, futhi impendulo yokuqala evamile kuleyo siphazamiso ukuphinda unwebe umthetho. Umhlahlandlela womngcele we-CISA ucela ukuthi ukufinyelela okungena nokuphuma kukhawulwe emapothini nasezinhlelweni ezifanele, kuhlanganise nokuhamba phakathi kwamanethiwekhi angaphakathi, okuwukhombandlela oluqalwa yi-backend olushiywa imidwebo eminingi.
Beka usuku ekubuyekezeni futhi usho umnikazi waso. Phinda usebenzise ukubalwa kanye nombuzo wamalungelo ngemuva kwanoma yiluphi ushintsho kusithombe sesango, kuthebula lomzila noma endimeni yohlelo lokusebenza.