I-HTTPS ne-VPN azikuqinisekisi iphakethe oyifakayo

Ukuvuselelwa kuyahluleka, futhi isiphakamiso osukwini silandela umkhondo ojwayelekile: ithrafikhi idlula kwi-VPN, ngakho ukulandwa kufanele kuthembeke, futhi ukuhlolwa kwesiginesha kuyekwa ukuze kudlulwe iphutha. Imibono emibili ehlukene ihlanganiswe emshweni owodwa. Ukubethela kuvikela indlela phakathi kweziphetho ezimbili; ukuqinisekisa kunquma ukuthi amabhayithi avela kumshicileli obuwuhloso. Ithuneli linikeza okokuqala futhi alisho lutho ngokwesibili.

Uphawu ngokuvamile iyiphutha lokuqinisekisa kusibungu esisodwa, endaweni yokugcina eyodwa, kuyilapho konke okunye kuvuselelwa ngokujwayelekile. Leso simo sesivele sisho ukuthi indlela yenethiwekhi iyasebenza nokuthi ukungezwani kumayelana nokwethenjwa.

Izilawuli ezimbili eziphendula imibuzo ehlukene

Ukuvikeleka kokuthutha kuphendula ukuthi ubani okwelinye uhlangothi lwalokhu kuxhumana nokuthi ngabe othile endleleni angayifunda noma ayishintshe. Ukuqinisekisa iphakethe kuphendula ukuthi ngabe le nto ishicilelwe yisiphathimandla osisethile, futhi kufanele imelane nokulandwa ngesibuko ongasilawuli.

Lemibuzo ihlangana emaphethelweni kuphela. Isitifiketi esifanele esibukweni sikhombisa ukuthi isibuko yisibuko; asikhombisi ukuthi isibuko siphethe okuqukethwe komshicileli okungashintshiwe. Iphakethe elisayiniwe likhombisa ukuthi umshicileli ulisayinile; alikutsheli ukuthi inethiwekhi yaletha inguqulo entsha noma ukuthi indawo yokugcina oyikhombile yileyo evunywe inhlangano yakho.

Isimo sokwehluleka abantu abasidalayo ngokucisha ukuhlola ukulahlekelwa unomphela kwesiqinisekiso sesibili, esikhundleni sokulandwa okukodwa okuphumelelayo. Lokho kushintshana akubonakali kuze kufike usuku lapho kubalulekile.

I-apt iqinisekisa ini ngempela

Imodeli ye-APT iwuchungechunge lwengqolobha oluqinisekisiwe. Imethadatha yokukhishwa esayiniwe iholela ngesibalo sokuqinisekisa ezinkombeni zamaphakethe, futhi lezo zinkomba ziholela ngesibalo sokuqinisekisa kumafayela amaphakethe ngamanye. Ukuqinisekisa uchungechunge yikho okwenza isibuko singathenjwa kodwa sisebenziseke: isibuko singanikeza noma yini esiyifunayo, futhi isiginesha yemethadatha inquma ukuthi i-APT iyakwamukela yini.

Lokhu ngamabomu akufani nokuhlola isiginesha yomgcini kuyo yonke iphakethe efakiwe, futhi umehluko uyachaza ukuthi kungani «iphakethe lisayiniwe» kanye «ingqolobha iqinisekisiwe» kusetshenziswa esikhundleni somunye emibikweni yephutha ngenkathi kusho izinto ezihlukene.

apt-get update
apt-cache policy
apt-config dump | grep -iE 'AllowInsecure|AllowDowngrade'

Funda umphumela wokuvuselelwa, hhayi ikhodi yokuphuma kuphela. I-APT isho indawo yokugcina emethadatha yayo yehlulekile, futhi lelo gama iwumngcele okufanele uphenywe. Indawo yokugcina emakwe njengethenjwayo ngaphandle kokuqinisekisa isiginesha, noma ukubhala ngaphezulu kwendawo yokugcina engaphephile, yisinqumo sokumisa umhleli othile asithathile futhi okufanele akwazi ukusichaza.

Ukusha kuphinde kube yisici esihlukile. Ifayela lemethadatha elisayinwe ngokufanele lingaba lidala kunalelo owalibona ngesonto eledlule, yingakho imethadatha yokukhishwa inosuku lokuphelelwa, futhi yingakho inkinga yewashi kuklayenti ingakhipha amaphutha okuqinisekisa abukeka njengezinkinga zokhiye.

I-dnf5 ihlola ini ngokwehlukana

Uhlangothi lwe-RPM luveza izinkinobho ezimbili ezihlukene, futhi ukuzihlanganisa kukhipha isigaba esifanayo sephutha kolunye uhlangothi. Enye ilawula ukuthi amafayela amaphakethe kufanele abe nesiginesha esivumelekile; enye ilawula ukuthi imethadatha yendawo yokugcina kufanele isayinwe. Zingasethwa ngokuzimela, futhi uhlelo lungaqina kokunye lube mnene kokunye.

dnf5 config-manager --dump 2>/dev/null | grep -iE 'gpgcheck|repo_gpgcheck'
rpm -q --qf '%{NAME} %{SIGPGP:pgpsig}\n' bash

Umbuzo wephakethe ukhombisa ukuthi imethadatha yesiginesha yekhophi efakiwe ibukeka kanjani, okuwukuhlola kweqiniso okuwusizo ngokumelene nefayela lokumisa elithi liqinile. Engakutsheli kona inqubomgomo esekwayo yokwabiwa, futhi yiyo okufanele uyilandele esikhundleni somyalelo ojwayelekile othi «vula i-GPG» ovela enkundleni.

Lapho abaphathi ababili behluka khona, umehluko ungowokwakhiwa hhayi uphawu lokuthi omunye ubuthakathaka. Bobabili baqinisekisa okuqukethwe komshicileli; babeka isiginesha ezindaweni ezihlukene ochungechungeni.

Ithuneli lengeza ini futhi alengezi ini

I-VPN inganikeza umzila odingekayo, igcine ithrafikhi yokuvuselela ngaphandle kwenethiwekhi yokufinyelela engathenjwa, futhi yehlise lokho okubonwa umgadli wasendaweni. Lezi zinzuzo zangempela zokusebenza, futhi akukho nokukodwa okuwukuqinisekiswa komshicileli.

I-HTTPS yengeza isiqinisekiso sayo, futhi sincane kunalokho okuzwakala. Iqinisekisa isiphetho se-TLS oxhume kuso. Uma leso siphetho siyisibuko, uqinisekise isibuko, hhayi okuqukethwe kwengqolobha esikunikezayo. Leli yikho kanye ikesi okwadalelwa lona uchungechunge lwemethadatha esayiniwe.

Asikho kulezi zilawuli esithembisa ukutholakala. Inethiwekhi ingala ukuletha, futhi into eqinisekisiwe ayiyona ngokuzenzakalela entsha kakhulu. Sebenzisa inqubomgomo yokusha yomphathi wamaphakethe uqobo esikhundleni sokucabanga ngokukhona kwesithonjana sengidi.

Hlonza umngcele ohlulekile

Shono isigaba ngaphambi kokushintsha noma yini: ukuxazululwa kwe-DNS, i-proxy noma umzila, ubunikazi besiphetho se-TLS, ukuqinisekiswa kwengqolobha, ukuhlolwa kwesiginesha sephakethe, noma ukufakwa. Ngakunye kunomumo wephutha nomnikazi ohlukile.

Ukulungisa umzila wenethiwekhi akufanele kuhlanganise ukumemezela ukhiye wokugcina ongaziwa njengothenjwayo, ukushaya indiva izitifiketi, noma ukwamukela ukumisa kwendawo yokugcina ongakucelanga. Uma ukhiye ushintshwe ngempela, ukwabiwa noma umnikazi wendawo yokugcina ushicilela ukhiye omusha ngesiteshi ongakuqinisekisa, futhi yilokho ukulungiswa okufanele kusetshenziswe.

Bhala ukuthi yimuphi umngcele ohlulekile nokuthi ungubani umnikazi wawo. Ukwehluleka kokuvuselela okulandelayo kuzoba komunye umngcele, futhi ukuba noluhlu kukwenza kube ukuhlolwa kwemizuzu emihlanu esikhundleni sengxabano enye yokuthi ithuneli lenza ukuvuselela kuphephile yini.