I-TLS yendabuko, ukudluliswa kwe-SSH noma i-VPN yesevisi eyodwa yefu

Umbuzo awuvamile ukuthi kufanele kufihlwe into ethile phakathi kwemishini emibili yefu; umbuzo ukuthi yisiphi isixhumanisi osifihlayo nokuthi ubani ohlola ubunikazi bukabani. Ngiqala lezi zingxoxo ngesevisi hhayi ngomdwebo wenethiwekhi, ngoba isevisi isivele iyazi into eyidingayo. Imingcele emithathu ihlanganisa izimo eziningi: i-TLS yohlelo ngokwalo, imbobo eyodwa ye-TCP edluliswa nge-SSH, kanye nengqimba yokuhamba enezindlela enikeza wonke umhlanganyeli ikheli. Azihlelwa ngamandla, kodwa ngokuthi zihlanganisa malini inkinga.

Qala ngesevisi, hhayi ngenethiwekhi

Phuma ngaphandle kusukela kunqubo. Ikhuluma iphrothokholi iphi, yiliphi igama elizoqinisekiswa iklayenti, futhi ubani ovunyelwe ukuvula uxhumano nakancane? Lezi zimpendulo ezintathu zisusa izinketho ngokushesha kunanoma yiliphi ithebula lokuqhathanisa, futhi ukuhlelwa kwesevisi ngokwako ngokuvamile kuyaziphendula ngemizuzu embalwa.

Thatha i-API yangaphakathi encane esivele ihlinzeka nge-HTTPS embobeni engu-8443 nesitifiketi se-api.internal.example. I-ss -ltnp kusibungu ibonisa ukuthi ixhumene nani, futhi i-openssl s_client -connect 127.0.0.1:8443 -verify_hostname api.internal.example ibonisa ukuthi isitifiketi sisebenza yini egameni elizosetshenziswa ngempela yiklayenti. Uma kokubili kunempilo, isevisi ingavikela ukuhamba kwayo futhi kusale ukufinyeleleka kuphela. Leyo yinkinga encane kakhulu kunokwakha inethiwekhi.

Isinyathelo 1: ingabe isevisi iyazivikela?

Lena yinketho okufanele ithathwe uma ifanele, futhi ifanele kaningi kunalokho okucatshangwa amaqembu. Ukufihla kwesevisi kuhlanganisa yonke indlela phakathi kweklayenti neseva, kufaka phakathi wonke umgxumo ophakathi, okungekho mhubhe ozungeza ingxenye ephakathi ongakuthuthukisa. Setha igama elilindelekile nokuthembela ngokusobala esikhundleni sokuncika kulokho okutholakala ngengozi esitolo esizenzakalelayo sekhayenti.

Ukufihla nokufinyeleleka kuhlala kuyizilawuli ezihlukene, futhi ukuzihlanganisa yikho okuyenza le nketho iphambaneke. Isevisi ye-TLS kumsilaleli womphakathi ongenamkhawulo isamukela imizamo yoxhumano kunoma ubani, ngakho umsilaleli nemithetho yenethiwekhi kufanele kuchazwe ngokuzimela eqinisweni lokuthi umthwalo uvikisiwe. Bese uhlola ukuncika, ngoba i-API phezu kwe-TLS ayisho lutho mayelana nendawo yokuthola, imbobo yokuphatha noma isiteshi sokudlulisa esikhulu eceleni kwayo. Ngayinye idinga impendulo yayo, futhi umzalwane oyedwa ongavikelwe wanele ukwenza wonke umngcele ube inganekwane.

Isinyathelo 2: ingabe imbobo eyodwa ye-TCP iyisidingo sonke?

Lapho isidingo siyimbobo eyodwa ye-TCP ngempela, ukudluliswa kuyinto encane kakhulu esebenzayo. Ukudluliswa kwasekhaya kwe-SSH kuthwala leyo mbobo ngoxhumano oluvele lukhona oluqinisekisiwe.

Isimo yi-ssh -N -L 8443:127.0.0.1:8443 [email protected], futhi imininingwane ebalulekile ikheli lomgomo: i-127.0.0.1 ixazululwa ohlangothini olukude, ngakho uxhumano lwesevisi luvulwa kusukela ku-bastion hhayi kukhompyutha yakho ephathekayo. Bopha umsilaleli wasekhaya ngokuwuminyana njenge--L 127.0.0.1:8443:... ukuze ungashicileli isevisi kunethiwekhi yakho yasekhaya ngengozi. Ohlangothini lweseva, khawulela okungadluliswa yi-akhawunti esikhundleni sokuthembela ekuziphatheni kahle kweklayenti. I-PermitOpen, i-AllowTcpForwarding local kanye ne-GatewayPorts no ezizenzakalelayo yizilungiselelo ezintathu eziguqula i-relay ejwayelekile ibe isiteshi esithile.

Isivumelwano sincane kuzo zombili izinhlangothi. I-SSH ivikela isiteshi sayo, futhi umgxumo owengeziwe usuka ku-bastion uya kuhlelo olunye udinga ukuvikelwa kwayo. Isevisi elalela kuphela ku-loopback ye-bastion inokuchayeka okuhluke ngokuphelele kunaleyo efinyelelwa ngenye inethiwekhi, futhi ukudluliswa akukushintshi lokho. Gcina ukuqinisekisa nokuhlolwa kwe-TLS kohlelo esikhundleni sokuphatha umhubhe njengokubuyisela kwabo.

Lokhu kusebenza kahle kuxhumano olulodwa olunomnini oyedwa. Esikalini kuba uhlelo: ukungqubuzana kwembobo yasekhaya, ukugadwa, ukushintshwa kokhiye kanye nombuzo wokuthi ubani oqala kabusha ukudluliswa ngemuva kokuqalisa kabusha.

Isinyathelo 3: ingabe ukuhamba kwezindlela yisidingo sangempela?

Lolo hlu yizindleko ezithembekile zenketho encane kakhulu, futhi yingakho amaqembu ekugcineni eshintsha imiyalo embalwa yasemuva ekhohliwe ngokuthile okuphethwe. Ukushintsha akuyona i-VPN ngokuzenzakalela. Uma isidingo sisa yimbobo eyodwa ye-TCP, ukudluliswa okugadiwe okunomnini obhaliwe kushibhe ukusebenza kunezingqimba futhi kuhluleka ngezindlela ozibonayo. Linganisa ubunikazi bokusebenza ngaphambi kokulinganisa ubuhle.

Ukuhamba kwezindlela kuba impendulo efanele lapho ukuhamba kwezindlela kuyisidingo. Izinhlelo eziningi ezidinga ukuxhumana kwe-IP okuvamile, amaphrothokholi angakwazi ukuthwalwa ukudluliswa kwe-TCP, noma izinsizakalo ezihamba phakathi kwamasibungu — konke kukhombisa ohlangothini olulodwa.

Ingqimba yokuhamba inikeza abahlanganyeli ikheli nomzila, bese umsebenzi wangempela uqala: izigaba ezingagqagqani, ubunikazi bemizila, i-DNS, ukubhalisa, ukuhoxiswa kanye nokwenzekayo lapho uzakwabo enyamalala. Akukho kulokhu okuza nekheli. Uzakwabo owamukelwe engqimbeni naye akagunyaziwe ngokuzenzakalela kukho konke ukusebenza endaweni okuyiwa kuyo, ngakho ukuqinisekisa kwezinga lesevisi kusala.

Okukuphethe ngemuva kwalokho

Izinto ezimbili ziyingxenye yerekhodi olishiyayo. Eyokuqala ubunikazi obulindeleke ukuthi buqinisekiswe yiklayenti, ngoba umngcele ngamunye walena uncipha buthule lapho ukuhlolwa kwegama kukhululwa ukuze into ethile isebenze. Eyesibili isinyathelo sokususa: yikuphi ukhiye, muphi umthetho noma muphi umzila onyamalalayo lapho ukufinyelela kuphela, futhi ubani okwenzayo.

Lolu hambo luphela lapho luqale khona, esevisini. Khetha umngcele ohlanganisa ukuhamba kwangempela futhi oqinisekisa ozakwabo obuhlose ukuqinisekisa, bese ubhala ukuthi ukufinyelela kubuyekezwa, kuqashwe futhi kususwa kanjani. Isithenjwa se-OpenSSH yindawo yokuqinisekisa izinketho zokudluliswa ngaphambi kokuthembisa isivumelwano esincane. Uma ungeke ukwazi ukuchaza isinyathelo sokususa emshweni owodwa, umngcele mkhulu kunenkinga.