Indlela yokuthumela amalogi wedivayisi kumqoqi okude ngokuphepha

Idivayisi ingakhipha amalogi, umqoqi uhlala ngaphesheya kwe-inthanethi, futhi umbuzo wokuqala wonke umuntu awubuzayo ukuthi iyiphi ithuneli okufanele yakhiwe. Lolo hlaka luqala endaweni engafanele. Okunquma ukuthutha ifomethi idivayisi engayikhiqiza, ubuqiniso umqoqi azobamukela, kanye nencazelo ye-“kulethiwe” lapho isixhumanisi siwa. Bhala lezi zimpendulo ezintathu, futhi ukuthutha ngokuvamile kuzikhethela kona.

Qala ngalokho idivayisi engakukhipha

Ngokomkhuba kunezinhlobo ezintathu kuphela. Imicimbi ye-syslog ngayinye nge-UDP noma nge-TCP, ukulayisha kwe-HTTPS okuqinisekisiwe okwakhelwe ngaphakathi komkhiqizo, noma amafayela aphelele abhalwe kudiski okufanele asuswe. I-firewall ekwazi ukuthumela i-syslog ye-UDP kuphela ngeke ibe umthumeli we-TLS ngoba ungeze ithuneli; izoqhubeka ithumela amadathagramu angaqinisekisiwe, manje ngaphakathi kwemvilophu ebetheliwe.

Ngakho-ke qala ngokuhluza umthumeli: iphrothokholi, ukusekelwa kwe-TLS nokuthi iyiphi ilabhulali ye-TLS, ingaqinisekisa isitifiketi somqoqi yini, ingaveza isitifiketi sekhasimende yini, futhi ingabekezelela ukuqalwa kabusha kwesibhafa sokuthumela. Noma yini idivayisi engakwazi ukuyenza kufanele yenziwe ngenye into endleleni, futhi leyo nye into iba ingxenye yomklamo wakho.

I-TLS syslog: indlela emfushane kakhulu lapho iziphetho zombili ziyikhuluma

Uma idivayisi isekela i-syslog nge-TLS futhi umqoqi uyiphetha, sebenzisa lokho bese uma. Iphrothokholi yohlelo lokusebenza izivikela yona, umqoqi uqinisekisa umthumeli, futhi asikho isinyathelo esengeziwe okumayelana nokutholakala kwaso manje. Ugibe ukuthi i-“TLS syslog” ihlanganisa izinhlobonhlobo zezindlela zokuqalisa, futhi imihlahlandlela yamanje ye-syslog ephephile isidlule izinhlu zokubethela ezikufundisweni ezindala, yingakho umdluliseli osebenzayo uyaphuka ngemva kokuthuthukiswa kwelabhulali.

Ku-rsyslog, igama lemoduli yokuthutha lilodwa likutshela ukuthi usesiphi isikhathi: i-lmnsd_gtls igoqa i-GnuTLS, kuyilapho i-lmnsd_ossl igoqa i-OpenSSL futhi yilokho okuhlinzekwa amaphakethe amanje e-8.x. Isenzo sokudlulisa esinokuqinisekiswa kwesitifiketi sibukeka kanje, futhi amagama aqondile wamapharamitha kufanele aqinisekiswe ngokuqhathaniswa nenguqulo efakiwe:

action(type="omfwd" target="collector.example" port="6514" protocol="tcp"
       StreamDriver.Name="ossl" StreamDriver.Mode="1" StreamDriver.AuthMode="x509/name"
       StreamDriver.CAFile="/etc/pki/ca.pem"
       queue.type="LinkedList" queue.filename="fwdq" queue.maxDiskSpace="1g"
       queue.saveOnShutdown="on" action.resumeRetryCount="-1")

Qinisekisa iphoyinti lokugcina ngaphambi kokulungisa umthumeli. I-openssl s_client -connect collector.example:6514 -servername collector.example -CAfile /etc/pki/ca.pem -verify_return_error iyaphetha ukuxhawulana ngesandla ngochungechunge oluvumelekile noma ikutshela ngqo ukuthi yikuphi ukuhlola okwehlulekile. Hlola kusuka kudivayisi, hhayi kusuka kwikhompyutha yakho ephathekayo, ngoba isitolo sokuthembela sedivayisi yisona esibalulekile.

I-SFTP: ilungele amafayela, ayilungelanga imifudlana

Ukulethwa okusekelwe kumafayela kufanele amadivayisi abhala amalogi ajikelezayo futhi akwenzi okunye. Ukudluliswa nge-SSH kukunikeza okhiye bomsingathi, okhiye be-akhawunti ngayinye kanye nohlelo lwamafayela ongaluhlola, okuyindaba yethemba enengqondo yedivayisi engakwazi neze i-TLS. Kuyisinqumo esibi semifudlana yemicimbi, lapho “ifayela libhalwa njalo ngehora” kusho ukuthi ukuphazamiseka kukulahlekisela umsila wehora lamanje.

Gcina ukuqinisekiswa komsingathi kuvuliwe. Ukubiza kwebhetshi okukucisha ukuze kugwenywe isikhuthazo kucekela phansi ubuqiniso obukuphela obunakho ukuthutha:

sftp -b /etc/logship/batch -o BatchMode=yes -o StrictHostKeyChecking=yes      -o IdentitiesOnly=yes -i /etc/logship/id_ed25519 [email protected]

Phina ukhiye womsingathi ku-known_hosts we-akhawunti ngesikhathi sokulungiselela, khawulela i-akhawunti kudayirekhithri okuyiwa kuyo, futhi ukhethe uhlelo oluncane lwe-internal-sftp olune-chroot. Hlela nendaba yokuthumela kabusha: uma ifayela lithunyelwa futhi ngemva kokwehluleka okwengxenye, umqoqi kufanele ahlukanise ikhophi nefayela elisha, ngokuvamile ngokwegama kanye ne-checksum hhayi ngesikhathi sokufika.

Lapho isango lendawo noma ithuneli kuyimpendulo eqotho

Amanye amadivayisi akwazi ukukhuluma kuphela ifomethi okungekho muntu ofuna ukuyidalula. Kuleso simo umqoqi ogunyaziwe kunethiwekhi yedivayisi uqobo uthola ifomethi yemvelo futhi uyidlulisela phambili nge-TLS. Lowo umklamo osemthethweni, kodwa yiba nembe ngokuthi uthenga ini: ukubethela okuqala esangweni akukuvikeli emuva isigaba phakathi kwedivayisi nesango, ngakho leso sinyathelo sisadinga umngcele waso wokuthembela nokulawulwa kokufinyelela.

Ithuneli lesiza noma ledivayisi eliqondisiwe iyisinqumo esisinda kakhulu futhi silungile lapho umqoqi kufanele agcine ikheli eliyimfihlo futhi kufanele sithwale izinsizakalo eziningi, hhayi amalogi kuphela. Siletha ukuhlelwa kwamakheli, imithetho yokufinyelela, izindlela zokubuya kanye nomjikelezo wokuphila kwephoyinti lokugcina lethuneli. Futhi akulungisi iphrothokholi yangaphakathi: i-syslog ye-UDP ngaphakathi kwethuneli le-IPsec iseyinsizakalo yamadathagramu engenaso isiqinisekiso sokulethwa.

Noma yini oyikhethayo, gcina ugunyazo lomqoqi luncane kunokuthutha. Ubunikazi bethuneli bungobephoyinti lokugcina, futhi akusho lutho mayelana nokuthi iyiphi idivayisi engaphansi eyakhiqiza insimu ethile yegama lomsingathi kumyalezo.

Bhala isivumelwano sokulethwa ngaphambi kokuthumela

Ukubethela, ubuqiniso nokugcinwa kuphendula imibuzo ehlukene, futhi umugqa awuyona inqubomgomo yokugcina. Ngaphambi kokuthi ilogi yokuqala ishiye idivayisi, ncika ukuthi isiqinisekiso sisho ukuthini ngempela kulo mqoqi: kutholwe emthondweni, kwamukelwe ukucutshungulwa, noma kwabhalwa ngokuqinile endaweni yokugcina. Lezi iziqinisekiso ezintathu ezihlukene futhi eyokugcina kuphela eyesula ukuqalwa kabusha komqoqi.

Bese uphendula ngokubhaliwe imibuzo yokusebenza. Imicimbi engathunyelwanga ilindaphi, futhi ingabe leso sibhafa sibekezelela ukuphazamiseka kukagesi? Kwenzekani lapho sigcwala, futhi ubani owaziswayo? Ukuzama kabusha kukhawulwa kanjani, futhi izingxoxo zibonakala kanjani? Iyiphi insimu efakazela ubunikazi bomthumeli, uma kubhekwa ukuthi isinyathelo sokudlulisa singabhala kabusha igama lomsingathi?

Gcina umklamo mncane ngokwanele ukuba uchazwe esigabeni esisodwa: ukuthutha okusekelwayo okuncane kakhulu okuthwala imicimbi edingekayo, kanye nesitatimende esicacile ngeziqinisekiso esingazinikezi. Uma impendulo idinga izinyathelo ezimbili, shono lokho ku-runbook futhi unikeze isinyathelo ngasinye umnikazi.