I-MySQL nge-VPN: qinisekisa iseva, hhayi ukubethela kuphela

Ukubethela kuya kusiseva okungalungile kuseyiphutha. Qhathanisa amanani e-ssl-mode, bese ugijima uxhumano olusho iseva obuhlosiwe futhi okufakazela lokho.

Ugcinela uxhumano ku- 10.20.4.15, i-VPN iyawa, futhi iklayenti lisaxhuma. Lokho akuzona izindaba ezinhle. Ikheli langasese iyindawo ngaphakathi kwanoma yisiphi isimo sokuhambisa ohambayo, futhi amanethiwekhi amaningi asebenzisa ububanzi obufanayo. Iklayenti lifinyelele iseva ye-MySQL, mhlawumbe hhayi eyakho.

Ukulungisa kunezingxenye ezimbili, futhi eyodwa kuphela ekhuluma ngamanethiwekhi. Gcina uxhumano endleleni obuhlosiwe, futhi wenze iklayenti liqinisekise iseva elikhuluma nayo. Ingxenye yokuqala yilapho i-VPN isiza khona; ingxenye yesibili kufanele ilungiselelwe.

Kubethelwe kuphi, ngokunembile?

I-TLS ivikela ingxoxo kunoma ngubani ophakathi, futhi ayisho lutho mayelana nokuthi isiphetho sithi singubani, ngaphandle uma iklayenti likuhlola. Isitifiketi esiqinisekiswa ngumgwamanda othembekile sifakazela ukuthi isitifiketi savela kulo mgwamanda. Asifakazeli ukuthi isitifiketi sakhishwa ngeligama lesiseva obuhlose ukufinyelela kulo, futhi leyo yimibuzo ehlukene.

Lokhu akusona isikhala sethiyori. Amaphothali e-captive, amaphutha e-VRF engalungile kanye nezinhlelo zamakheli ezihlangana zonke zikhiqiza iseva esikulungele ngokuphelele ukuxoxisana ne-TLS nawe. Uma iklayenti lifuna ukubethela kuphela, isikhathi sesisondo siyimfihlo kodwa sibhekiswe kusizindalwazi esingalungile.

Ngakho umbuzo ofanelekile awukona ukuthi uxhumano lubethelwe yini, kodwa ukuthi lubethelwe yini kubunikazi obuhlosiwe. Kuklayenti ye-MySQL, lowo mehluko uhlala ngokuphelele kusilungiselelo se-ssl-mode.

Amanani amahlanu e-ssl-mode emisebenzini

Kunamanani amahlanu, futhi lilodwa kuphela lawo eliphendula umbuzo wale ncwadi. Ithebula libala okushiwo yilona ngalinye ngempela, hhayi okusikiselwa igama lalo.

ModeWhat it guarantees
DISABLEDNo TLS at all; everything on the wire is readable
PREFERREDTries TLS and falls back to plaintext when the account and server allow it, so it is not a fail-closed requirement
REQUIREDRefuses to connect without TLS, and does not validate the certificate
VERIFY_CAValidates the server certificate against the configured CA and does not check the hostname
VERIFY_IDENTITYValidates the CA and checks that the certificate names the host the client used

Ngumugqa wokugcina kuphela ophendula umbuzo kulesi sihloko. PREFERRED kufanele kuqashelwe ngokwakho, ngoba iklayenti eliwela buthule emibhalweni evamile libi kakhulu kunalelo eliyenqabayo: ukholelwa ukuthi unokubethela futhi ukuthwebula amaphakethe akavumelani.

Uxhumano ongalusebenzisa namuhla

Umyalo ongezansi uyisimo okufanele sisetshenziswe, ngezikhala ezimbili: igama lesizindalwazi eligunyaziwe kanye nefayela le-CA elitholwe ngesiteshi esigunyaziwe. Akukho kukho okufanele kuthathwe kulokho iseva ekunikeza kukho ekuxhumaneni kokuqala.

mysql --host=db.corp.example --user=app_reader \
  --ssl-mode=VERIFY_IDENTITY \
  --ssl-ca=/approved/path/ca.pem --password

--password ngaphandle kwenani licela okokufaka, okugcina imfihlo ngaphandle kohlu lwezigaba nangaphandle komlando we-shell yakho. Kungumkhuba omncane onenzuzo enkulu kumaseva okugxuma abiwe, lapho umugqa womyalo ubonakala kwabanye abasebenzisi.

Uma lokhu kwehluleka, umbhalo wephutha uhlukanisa izimo kangcono kunomqondo wangaphakathi. Ukwehluleka kwe-CA kusho ukuthi uchungechunge aluqinisekisi futhi kufanele ubheke ukuthi iyiphi i-CA esayine isitifiketi seseva. Ukwehluleka kwegama lesiseva kusho ukuthi uchungechunge lulungile futhi igama alihambisani, okusho ngokuvamile ukuthi uxhume kuseva efanele ngegama elingalungile, hhayi kuseva engalungile.

Ukuvela kombuzo akusona ubufakazi bokuthi iphasiwedi isivele ithunyelwe, futhi ukwehluleka koxhumano akufakazeli ukuthi akukho lutho olwaphuma kuklayenti. Uma wenza kabusha isigameko esedlule, khomba iklayenti, ukulungiselelwa kwalo, inyongezeko yokuqinisekisa kanye nesigaba esihlulekile. Ukulinganisa ukuchayeka kusuka kumyalezo wokugcina wephutha ukucabangela.

Uma igama livela emhubheni

Ukuhambisa iphothali yasendaweni kwephula ukuhlolwa kobunikazi ngendlela emangazayo abantu. Uma uhambisa iphothali yasendaweni kusizindalwazi futhi uxhuma ku- localhost, iklayenti liqinisekisa isitifiketi ngokuqhathanisa ne- localhost, futhi akukho sitifiketi esakhishwa salelo gama. Uxhumano lungase luphephe ngokuphelele futhi ukuqinisekisa kuseyohluleka, okuwukuhlola okusebenza ngendlela obekuhlosiwe.

Kunezimpendulo ezimbili eziqotho. Nikeza isiphetho esihambisiwe igama elixazulula kukheli le-loopback futhi elivela kusitifiketi seseva, noma sebenzisa igama lesiseva kusukela ekuqaleni kuze kube sekugcineni ukuze iklayenti liqinisekise ubunikazi bangempela. Eyokuqala ilula kubathuthukisi futhi idinga umsebenzi wesitifiketi; eyesibili ilula ukucabanga futhi ngokuvamile iyona ndlela efanele yokuzenzakalela. Ukucisha ukuqinisekisa ukuze ukuhambisa kusebenze kulahla isici obuzama ukusengeza.

Ukutholwa kuyizimo ezintathu

Bhala isivivinyo sokutholwa njengezitatimende ezintathu ezihlukene: uxhumano lusebenzise indlela ehlosiwe, ukubethela kwakudingeka hhayi ukuthandwa, futhi ubunikazi beseva baqinisekiswa ngokuqhathaniswa nempahla ethembekile. Isithonjana se-VPN esiluhlaza asimisi noma yisiphi salokho.

Kumaklayenti e-GUI nakwa-MariaDB, hlola imibhalo yomthengisi uqobo esikhundleni sokuthatha ukuthi isipelingi sefulegi siyadlula. Imibhalo ye-MySQL mayelana noxhumano olubethelwe ihlanganisa umehluko phakathi kwezimo kanye nemfuneko yokusatshalaliswa kwe-CA, futhi iyisithenjwa okufanele sihlolwe ngaphambi kokushintsha umucu woxhumano wokukhiqiza.

Izihloko ezihlobene