I-Fail2ban esangweni le-VPN: ikulungisa ini futhi ingakulungisi ini

Yonke insizakalo evezekile ithola iseluleko esifanayo: beka i-fail2ban kuyo. Esangweni le-VPN leso seluleko asisoze sibe yiphutha futhi asanele, futhi ukuyiphatha njengophawu lokuqinisa yikho okwenza abantu bagcine ngokuba nejele (jail) elingavimbeli lutho olusizayo. I-Fail2ban ifunda amarekhodi okuphahlazeka oyikhombisa wona futhi icela i-backend yokuphoqelela ukuthi ivimbele imithombo efanayo. Lonke inani layo lincike ekutheni iyiphi indawo yokuqinisekisa eyakha irekhodi, ukuthi ikheli elikuyo liyiklayenti langempela, nokuthi kwenzekani kubo bonke abanye abangemuva kwalelo kheli.

Iyini i-fail2ban ngokomshini

Isihlungi sihambisa imigqa kumalogi, ijele libala ukufana ngomthombo ngamunye, futhi isenzo sisebenzisa ukuvinjelwa nge-backend yothango lomlilo. Izingxenye ezintathu ezinyakazayo, futhi ngayinye ingaba nephutha ngokwayo.

Akukho kwezintathu okuthinta indlela yokuqinisekisa: i-fail2ban isabela ebufakazini ngemva kwesigameko futhi ayikaze iqinisekise ugunyaziwe ngokwayo. Ngakho ijele lingasebenza ngokuhlanzekile kuyilapho indawo eliyishoyo ihlala ivezwa ngendlela efanayo nangaphambili.

Isilaleli somhubhe akuyona ifomu lokungena

Isilaleli se-OpenVPN esivikelwe nge-tls-auth noma nge-tls-crypt silahla amaphakethe angenakho ukuvikelwa komhubhe wokulawula ngaphambi kokuba ukucubungula kwe-TLS okuvamile kuqale. Isihloli esingakaze sibe nokhiye asikhi lutho isihlungi sakho esingakubala. Ukuqinisekisa ngesitifiketi kunezela elinye isango, ngoba awekho iphasiwedi okufanele iqagelwe. Iphrojekthi ye-Fail2ban ibhala imodeli evamile eqhutshwa yimalogi, futhi isihlungi se-VPN esijwayelekile asiguquli iphakethe elingaqinisekisiwe libe umcimbi wokwehluleka onengqondo.

Uma isango lamukela izitifiketi kuphela, indaba ye-brute-force oyivikelayo ingase ingabikhona nhlobo kulelo chweba.

Ngakho uvikela yiphi indawo?

Umhleli ofanayo uvame ukuveza izinto ezintathu ezahlukene: isilaleli somhubhe, ingosi yephrofayela yeklayenti noma yokuzisiza, kanye nekhasi lokuphatha. Ingosi nekhasi lokuphatha zinefomu lephasiwedi futhi zikhiqiza imigqa yamalogi isihlungi esingayibala. Umhubhe ungakhiqiza amaphutha okuxhawula kuphela anencazelo ehluke ngokuphelele. Hlanganisa ijele nendawo, hhayi ngegama lomkhiqizo.

Ijele elilodwa elibheka ilogi engalungile libi kunejele elingekho, ngoba lidala ukuzethemba ngaphandle kokumboza. Qondisa isihlungi sokungena emaphutheni okuxhawula omhubhe futhi isibali sizokhala kuzihloli ezingakaze zibe nokhiye, kuyilapho ukuhlaselwa kwephasiwedi kungosi kungabalwa. Funda umugqa wamalogi isihlungi esiwuhambisayo ngaphambi kokuthemba inombolo yejele.

Ukunikezwa komthombo yisixhumanisi esibuthakathaka

Ukuvinjelwa kuhle ngokulingana nekheli elikukhomba. Uma insizakalo ingemuva kwe-proxy ephambene yendawo, ikheli leklayenti kumalogi lingase libe yi-proxy, futhi ukulivimbela kususa wonke umuntu. Ukuthemba isihloko esidluliselwe sisuka emthonbeni ongathembekile kunikeza umhlaseli amandla okuvimba amakheli angahleliwe. Ku-UDP amakheli emithombo angakhohliswa, ngakho ukuwabala kudinga ukuqaphela okukhulu kunokubala ukungena kwe-TCP okuqediwe.

Bhala indlela yokunikezwa komthombo ku-README yejele, ngoba isihloko esidluliselwe sisuka ku-hop engathembekile siguqula ukuvinjelwa sibe isikhali.

Izindleko ezingabenzi zingabanye abantu

Izisebenzi ezimbalwa ngemuva kwe-NAT yasehhovisi elilodwa zabelana ngekheli elilodwa, ngakho iphasiwedi eyodwa endala egciniwe ingakhiya ihhovisi lonke uma umkhawulo weqiwe. Ilogi ibonisa umthombo owodwa kanye ne-akhawunti eyodwa ehlulekile, hhayi ukuphazamiseka kwehhovisi lonke.

Ukuvinjelwa okufushane kanye nemikhawulo elinganiselayo kunciphisa lokho, futhi indlela ebhaliwe yokukhipha ukuvinjelwa inciphisa umthwalo wosekelo uma kwenzeka noma kunjalo. Ikheli ngu-isignali eqinile, hhayi ubunikazi, futhi umuntu ovula ithikithi uzochaza ukuphazamiseka, hhayi umkhawulo.

Nini okufanele kusetshenziswe, futhi nini okufanele kulungiswe okunye

Kusebenzise uma kunokwehluleka kokungena ku-inthanethi kwangempela, okunokunikezwa, okuphindaphindayo endaweni oyilawulayo, futhi uma i-backend yokuphoqelela iyihlanganisa ngempela leyo ndawo. Lungisa okunye uma inkinga iwumgomo obuthakathaka wemibhalo yokungena, ikhasi lokuphatha elivezwe ku-inthanethi, noma i-akhawunti engena ngempumelelo ngoba yephulwa. Ukuvinjelwa akukwazi ukulungisa nokukodwa kwalokho, futhi akukwazi ukumunca ithrafikhi esivele yagcwalisa i-uplink yakho. Leyo nkinga yokugcina ingeyaphezulu, ingeyomuntu ongahlunga ngaphambi kokuba amaphakethe akufinyelele.

Gcina ijele ngalinye liboshelwe endaweni eyodwa, buyekeza okuhle okungamanga, futhi linganisa umsebenzi wokuqinisekisa ogwemile esikhundleni senani lamakheli avinjelwe.