Ukuxhumanisa i-QGIS ne-PostGIS ngemuva kwe-VPN: isinyathelo ngesinyathelo

I-QGIS ifunda noma yimuphi umzila ofinyelelwa abahlinzeki bayo bedatha, ngakho i-VPN exhunyiwe iyingxenye kuphela yokuhlela. Umhubhe unikeza ideskithophu umzila kanye nenqubomgomo yokuxazulula amagama; iphrojekthi isadinga indawo yokugcina yensizakalo, iphrothokholi yomhlinzeki kanye nobufakazi bokuthi insizakalo izokwamukela. Lezi izindawo ezintathu ezihlukene, futhi ukuthayipha isilaleli esivamile se-VPN kunkambu yedathabhasi akusikho neyodwa yazo. Le mhlahlandlela ilandela isendlalelo esisodwa se-PostGIS kusukela kufomu le-QGIS kuze kufike umugqa obuyiselwe futhi isho umngcele osetshenziswa yisinyathelo ngasinye.

Qala ngesendlalelo, hhayi nge-VPN

Uhlobo ngalunye lwesendlalelo lufinyelela uhlobo oluhlukile lwendawo yokugcina. Isendlalelo se-PostGIS sivula ukuxhumana kwe-PostgreSQL nomphathi, imbobo, idathabhasi kanye nendima. Isendlalelo se-WMS noma se-WFS sithola i-URL yensizakalo bese sihlaziya idokhumenti yamakhono. Ifayela le-shapefile ekwabelaneni kwenethiwekhi lidinga kuphela umzila wefayela ongavulwa uhlelo lokusebenza. Njengoba lezi ziyizindlela ezintathu ezihlukene, iphrojekthi engenalutho ayikutsheli lutho kuze kube yilapho wazi ukuthi iyiphi oyilungisayo.

Buza umsebensi we-GIS ngendawo yokugcina, imbobo, ubunikazi obudingekayo kanye nenqubomgomo yokufinyelela esebenza ku-akhawunti yakho. Gcina igama lomphathi wensizakalo linjengoba lakhishwa uma ukusetshenziswa kuncike kwi-DNS yangasese noma ekuhloleni igama kusitifiketi. Ukusebenzisa kabusha ikheli lomphathi elikopishwe ekuxhumaneni okugciniwe komunye umsebenzisi kuyindlela eshesha kakhulu yokufinyelela umshini ophendulayo kodwa ogcina idathabhasi endala.

Imizila, izinsiza ezivunyelwe kanye nokuxazululwa kwamagama kungokwalowo ophethe i-VPN. Ifomu lomthombo wedatha alikwazi ukufaka umzila ongakaze uthunyelwe yiphrofayili yomhubhe, futhi alikwazi ukwandisa inqubomgomo yesango. Lapho umphathi exazululwa futhi imbobo iphendula, uhlangothi lwenethiwekhi lwenkinga luphelile.

Faka indawo yokugcina yangasese ekhishwe umsebensi

Ifomu le-PostgreSQL ku-QGIS likhombisa izinkambu i-libpq ezilindelayo, ngakho ligcwalise ngokulandelana okufanayo nokuxhumana komugqa womyalo. Insizakalo nomphathi bathatha umshini wedathabhasi, imbobo ithatha isilaleli esivulwa ngempela yiseva, futhi idathabhasi ithatha ikhathalogi ethile esikhundleni sokuhlala kwayo kuseva. Gcina iphasiwedi ekucushweni kokuqinisekisa hhayi efayeleni lephrojekthi, ukuze iphrojekthi eyabiwe ingathwali ubufakazi.

Hlukanisa amagama amabili ngaphambi kokuthayipha noma yini. Igama lesango likumklami we-VPN futhi igama ledathabhasi liku-QGIS, futhi akuvamile ukuba umphathi oyedwa.

VPN gateway:   vpn.gis.lab.example       (profile only, not a data source)
Database host: db.gis.lab.example:5432   (PostGIS service)
Database name: gis_prod
TLS mode:      verify-full

Uma idathabhasi isemshini omunye ngemuva kwesango, igama elifomini kufanele kube yilowo mshini. I-DNS yangasese ngomhubhe yiyo eyenza igama lisebenze, futhi iphrojekthi exazulula kuphela uma ixhunyiwe iyaziphatha kahle hhayi ukugcina kabi.

Gcina imodi ye-TLS yedathabhasi ihlukile kumhubhe

I-SSL egameni lomkhiqizo we-VPN ichaza umhubhe, hhayi isikhathi sedathabhasi. I-QGIS idlulisela imodi ye-SSL ye-PostgreSQL ku-libpq, futhi leyo modi ilawula ukuthi iklayenti liqinisekisa isitifiketi seseva yini nokuthi lihlola igama lomphathi elikuyo yini. verify-fullyenza kokubili, yingakho iyimodi okufanele igcinwe uma isitifiketi sithwala igama lensizakalo.

Ukwethula imodi kuze kufike disable ngenxa yokuthi umhubhe usubethelwe kakade kususa ukuhlola kokuthi iseva oyifinyelele yiyo iseva oyicelile. Uma ukuqinisekisa kwehluleka, isizathu esivamile ukungafani kwamagama noma isitifiketi somphendulo esingekho, futhi kokubili kungalungiswa ngaphandle kokwenza ukuxhumana buthaka. Qondisa sslrootcert ku-CA eshicilelwa umsebensi futhi gcina igama lomphathi efomini lifana negama elikusitifiketi.

Umhubhe onomzila wangasese kanye nedathabhasi enesitifiketi esivumelekile kusengahluleka endimeni. Ubufakazi bokusebenza buhlukile kobufakazi be-VPN, futhi i-akhawunti eqinisekiswa esangweni ayinayo ilungelo elicashile ku-PostgreSQL.

Hlola umngcele ngamunye ngokulandelana futhi ufunde ukwehluleka kokuqala

Sebenza kusukela kuklayenti ukuya ngaphandle ngokulandelana okumisiwe: ukuxazululwa kwamagama, ukufinyeleleka kwe-TCP, i-TLS, ukuqinisekisa bese kuba umbuzo ngokwawo. Isinyathelo sokuqala esihlulekayo yisona kuphela okufanele sibikwe, futhi ukweqa phambili kulethela imilayezo yephutha evela emngceleni ongakafinyelelwa. Imiyalo emine ihlanganisa izinyathelo ezine zokuqala.

getent hosts db.gis.lab.example
nc -vz db.gis.lab.example 5432
psql "host=db.gis.lab.example port=5432 dbname=gis_prod sslmode=verify-full" -c 'select 1'
curl -sS 'https://wms.gis.lab.example/ows?service=WMS&request=GetCapabilities' | head -c 200

Impendulo engenalutho evela getent iyinkinga yokuxazulula, hhayi inkinga yedathabhasi. nc enqatshiwe noma ephelelwe yisikhathi isho ukuthi umzila noma umthetho we-firewall awukho, okuwukulungisa ohlangothini lwesango. Iphutha le-TLS elivela psql lisho ukuthi isitifiketi noma igama akulungile, kuyilapho password authentication failed lisho ukuthi ufinyelele i-PostgreSQL futhi inkinga ingubufakazi. Esendlalelo se-WMS, ucingo curl lubuyisela i-XML yamakhono i-QGIS ebezoyihlaziya, ngakho ikhasi lokungena le-HTML kulokho okukhiphiwe lichaza ngokushesha isendlalelo esingenalutho.

Iphutha le-PostgreSQL liyizindaba ezinhle uma liqhathaniswa nokuphelelwa yisikhathi. Likhombisa ukuthi indawo efinyelelwayo iphendulile, okuhambisa ithikithi lisuka eqenjini lenethiwekhi liya kumphathi wedathabhasi noma we-GIS. Ukugcina lowo mehluko embikweni konga umjikelezo owodwa.

Lapho iphrojekthi ivuleka ngezendlalelo ezingenalutho

Ngaphakathi kwe-QGIS, hlola umthombo ogciniwe wesendlalelo ngaphambi kokufaka noma yini futhi. Izici zesendlalelo zikhombisa intambo yokuxhumana eqondile egcinwe yiphrojekthi, futhi ukufakwa kokuxhumana okuphindiwe okunomphathi omdala kuyinsalela evamile evela kunethiwekhi yehhovisi yangaphambilini. Ukulayisha kabusha iphrojekthi ngemva kokulungisa ukuxhumana akuhlali kufunda kabusha umhlinzeki, ngakho susa isendlalelo bese usifaka futhi kusukela ekuxhumaneni okulungisiwe.

Bese uqinisekisa ukuthi ukucushwa kokuqinisekisa yikho okuxhunywe esendlalelweni, hhayi nje okukhona ohlwini. Isendlalelo esigcinwe ngokucushwa okunye kokuqinisekisa sehluleka buthule kuphaneli yesiphequluli kuyilapho ukuhlolwa psql okuzimele kuphumelela.

Lapho isendlalelo silayishwa, gcina iphrojekthi ngemizila ehlobene yamafayela kuphela futhi ugcine ukuxhumana kwensizakalo kuqanjwe ngendawo yayo yokugcina. Umuntu olandelayo ozuza iphrojekthi uzokwazi ukusho ukuthi yimuphi umphathi obekulindelekile isendlalelo esiphukile ngaphandle kokuvula ithikithi.