Iklayenti ledathabhezi lasekhaya ne-RDS eyimfihlo: kungani ukuxhumana kuphelelwa yisikhathi

Ikhompyutha ephathekayo yomthuthukisi iphelelwa yisikhathi lapho ixhuma ku-endpoint eyimfihlo ye-RDS, kuyilapho izifakazelo ezifanayo zisebenza zisuka kumsingathi we-bastion. Akukho okuwile. Indlela phakathi kwaleyo khompyutha nedathabhezi intula enye yezinto ezintathu: igama elixazululayo, umzila othwala ithrafikhi, noma umthetho weqembu lokuphepha ovumela umthombo idathabhezi eliwubona ngempela. Thola ukuthi iyiphi entekenteke ngaphambi kokushintsha ezinye ezimbili.

Funda ukwehluleka kusendlalelo esifanele

Ukuphelelwa yisikhathi akulona iphutha elilodwa. Igama elingaxazululeki lihluleka ngaphambi kokuba iphakethe lishiye umshini. Ikheli elingenamzila lithumela amaphakethe emgodini omnyama. Iphothi efihliwe yenza ukulinda okubukeka njengomsingathi ongafanele. Yenza izinyathelo ngokulandelana futhi ume esinyathelweni sokuqala esihlulekayo.

dig +short db.internal.example
nc -vz db.internal.example 5432

Uma igama libuyisela ikheli lomphakathi, noma lingabuyiseli lutho, umhubhe awukayona inkinga.

Uma igama lixazululeka futhi ukuhlolwa kwephothi kulenga, qhathanisa ikheli olixazululile nekhwele idathabhezi elibika lona. I-endpoint ephethwe ingaxazululeka ibe yikheli eliyimfihlo ngaphakathi kwe-VPC futhi ingabi lutho olusizayo ngaphandle kwayo, futhi ikheli elikopishwe ekusesheni kwakudala lizokhombisa umsingathi ongasaphenduli.

Hlukanisa umhubhe nomzila

Ukuxhuma i-VPN yeklayenti akuhambisi wonke ububanzi obuyimfihlo ngokuzenzakalela. Iphrofayela ithwala imizila edonswa yisevisi, futhi iklayenti lingafaka eminye yayo kuphela. Bheka ukuthi yimiphi imibandela iklayenti eliyenezele ngempela nokuthi ikheli ledathabhezi liwela kweminye yayo yini.

ip route get 10.20.40.15
ip addr show tun0

Umzila okhomba ku-interface yomhubhe uyadingeka; awanele, ngoba uhlangothi olukude kusamele lwamukele ithrafikhi.

Amaphrofayela omhubhe ohlukanisiwe awumthombo ojwayelekile walokhu kwehluleka okunguhinga. Ayasebenza kuhlelo lokusebenza okwenziwa ngalo iphrofayela futhi ashiya ububanzi bedathabhezi ngaphandle komhubhe, okukhiqiza ukuphelelwa yisikhathi okufanayo nalokho obekungakhiqizwa yi-firewall.

Qondanisa iqembu lokuphepha nomthombo wangempela

Iqembu lokuphepha le-RDS livumela imithombo, hhayi abantu. Kuye ngesakhiwo, umthombo kungaba yiphuli yamaklayenti e-VPN, ikheli eliyimfihlo le-bastion, noma ikheli le-NAT okuhunyushwa kulo ithrafikhi. Funda umthetho nomthombo wangempela wephakethe kanyekanye.

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0 \
  --query 'SecurityGroups[].IpPermissions'

Umthetho wekheli lasekhaya lekhompyutha eyodwa ephathekayo uyinkinga yokunakekela, hhayi umklamo wokufinyelela.

Uma i-VPN yeklayenti noma isango le-NAT lisendleleni, idathabhezi lingabona ikheli lomhumushi esikhundleni sekheli lomhubhe lomthuthukisi. Yingakho umthetho okopishwe ekusethweni kwe-bastion okusebenzayo ungahluleka kukhompyutha ephathekayo: izindlela zombili zivela emithonjeni ehlukene nakuba zombili zibukeka zingaphakathi.

Khetha indlela encane kuneyo ebanzi

Uma umthuthukisi oyedwa edinga idathabhezi elilodwa, ukudlulisela okususelwe kuseshini ngokuvamile kushibhile ukuphatha kune-VPN yonke yomhubhe wenethiwekhi. Iklayenti lasekhaya lixhuma kuphothi edlulisiwe, futhi ingxenye ekude yenza ukuxhumana nedathabhezi kusuka ngaphakathi kwenethiwekhi.

ssh -N -L 5432:db.internal.example:5432 bastion.internal.example

Gcina ukuqinisekiswa kwe-TLS kungagxambuki kuleyo mklamo. Iklayenti kusafanele liqinisekise isitifiketi seseva ngokuhambisana negama elilindele; iphothi edlulisiwe yasekhaya akusona isizathu sokucisha ukuqinisekiswa, futhi ukukucisha kufihla impela inkinga yobunikazi okufanele ibanjwe.

Ukukhetha phakathi komhubhe ogcwele nokudlulisela okuncane kuyisinqumo mayelana nobubanzi, hhayi mayelana nomdlalo wokuphepha.

Shiya indlela engaphindwa

Bhala phansi igama le-endpoint esikhundleni sekheli elixazululiwe, ububanzi bomthombo obuvunyelwa yiqembu lokuphepha, kanye nendima yedathabhezi esetshenziswa umthuthukisi. Lawa maqiniso amathathu achaza iningi lokuhluleka kwesikhathi esizayo ngaphandle kocingo. Faka nenguqulo yephrofayela yeklayenti, ngoba ushintsho lwephrofayela lungasusa umzila owawuthwelwe yindala.

Bese uhlola icala elibi kanye: iklayenti elingaphandle komthombo ogunyaziwe kusafanele lenqatshwe.

Idathabhezi eliyimfihlo elisebenza kuphela kumuntu elamisa lona akulona ukufinyelela okuyimfihlo; kuyisihloko esingabhaliwe esilindele ukutholwa futhi. Bhala indlela phansi, futhi umthuthukisi olandelayo uzokuthola indlela esikhundleni semfihlo.