Uhlu lokuvimbela lwe-Nebula: lusabalalise ngokwakho, isibane ngeke sikwenze
Umugqa ohlwini lokuvimbela usebenza kuphela kumakhasimende awalayishile. Qhathanisa ukusabalalisa uhlu nokuzungezisa i-CA, bese uqinisekisa i-peer eliwenqatshiwe nelisebenzayo.
Ukuphoqelelwa kohlu lokuvimbela kuyisici somhambi owenza ukuhlola, hhayi sesitifiketi esihlolwayo. Umshini ongalayishanga umugqa awukaze uqhubeke wamukela ubunikazi, futhi akukho lutho ekuxhawuliseni okukuxwayisa ukuthi ama-peer amabili awavumelani. Isixazululo esishibhile nesibizayo sodaba olulodwa oludaluliwe siyahluka ngokufinyelela nangokubuyiselwa, ngakho khetha ngamabomu. Izigaba ezingezansi zihlanganisa okwenziwa umugqa, lapho kufanele ulethwe khona, nini ukuzungezisa kuyimpendulo engcono, nokuthi ungabufakazela kanjani ukuthi okukodwa kwakho kwasebenza.
Umgqa ohlwini lokuvimbela wenzani ngempela
Ukucushwa kwe-PKI kubala izigxivizo zeminwe okufanele umhambi azinqabe yize isitifiketi sisayinwe ngokufanele futhi singaphelelwanga isikhathi. Ukuphoqelelwa kwenzeka endaweni, ngokuhambisana nohlu umhambi alulayisha ngesikhathi isevisi iqala. Akukho lutho lomugqa oluhamba ngaphakathi kwesitifiketi, ngakho i-peer ayikwazi ukufunda isinqumo kusuka kudaba eliboniswayo. Kungakho isibane singenandima lapha: izibane zisiza ama-peer ukuthi atholane futhi zidlulise ithrafikhi lapho indlela eqondile ihluleka khona. Ziyisendlalelo sokuthola nokudlulisa, hhayi umzila wokusabalalisa ukucushwa.
Ukubuyekeza umshini owodwa kushintsha izinqumo zalowo mshini futhi kushiya yonke enye i-peer injengoba yayinjalo. I-peer ethemba isiphathimandla sokusayina futhi engakaze ibone umugqa ayinanasizathu sokunqaba noma yini. Ngakho ukuhlola ukuhoxiswa ngokubuka isibane akufakazeli lutho, ngoba ingxenye oyibukayo ayikaze icelwe ukuthi iphoqelele uhlu.
Khomba isitifiketi, hhayi idivayisi
Sebenzisa isigxivizo somunwe sodaba ofuna ukulunqaba, ngoba igama lomhambi, ilebula ledivayisi noma ikheli lamanje kukhomba umshini namuhla futhi okunye ngenyanga ezayo. Akukho kwalezi zintambo okuvela ohlwini lokuvimbela, futhi akukho okusinda ekufakweni kabusha. Phrinta isitifiketi, funda isigxivizo somunwe, futhi uqinisekise ukuthi singesodaba oluhoxiswayo hhayi esokumisela kwalo. Ukufunda womabili amafayela kubalulekile uma ukumisela sekukhishiwe, ngoba isitifiketi esidala nesisha kungabelana ngegama futhi kwehluke kuyo yonke enye inkambu.
Bhala phansi ukuthi yisiphi isigxivizo somunwe esavinjelwa nokuthi nini, ukuze ukucwaninga kwakamuva kwihlukanise ushintsho oluphelile koluhlosiwe. Qaphela futhi lokho umugqa ongakwenzi: awukususi isiphathimandla sokusayina, futhi akukuvimbeli isitifiketi sesikhathi esizayo esivela kuleso siphathimandla ekwamukelweni. Ukuvimbela isitifiketi somhambi nokushintsha isiphathimandla esonakele kuyimisebenzi ehlukene enemiphumela ehlukene.
nebula-cert print -path /etc/nebula/host.crt
pki:
blocklist:
- "a1b2c3d4e5f6"Kusabalalise njenganoma yikuphi okunye ukucushwa
Thatha uhlu njengokucushwa okunendlela yokuletha, hhayi njengefayela umuntu alihlela uma ekhumbula. Phusha uhlu oluphelele esikhundleni sokwehluka, ukuze umhambi oweqa ukubuyekezwa kwangaphambili ahlangane esikhundleni sokuqongelela izikhala. Incwadi ye-PKI ye-Nebula incoma khona lokho, futhi iseluleko sifanele silandelwe ngokwezwi nezwi esikhundleni sokuguqulwa sibe inqubo yamandla.
Qinisekisa ukuthi isevisi esebenzayo ilayishe kabusha okuqukethwe, hhayi nje ukuthi ifayela kudiski lishintshile. Landelela ukuthi imiphi imishini esebenzise ushintsho futhi ugcine uhlu olusele lubonakala kuze kube lungenalutho. I-laptop evalwe iviki iyi-peer engakaze ifunde isinqumo, futhi ingase ixhumeke kabusha isuka kunethiwekhi obekungabonwa muntu. Bhala phansi indlela yokuletha eduze kwesigxivizo somunwe, ngoba ukuhoxiswa okulandelayo kuyisebenzisa futhi kowokuqala yilapho inqubo ilungiswa khona.
Uhlu lokuvimbela noma ukuzungezisa isiphathimandla
Umgqa ohlwini lokuvimbela mncane: ubunikazi obulodwa buyeka ukusebenza futhi konke okunye kuyaqhubeka. Ukuzungezisa isiphathimandla sokusayina kubanzi: yonke isitifiketi esayikhishile ayisathenjwa, futhi wonke umhambi udinga idaba elisha nesisekelo esisha sokuthemba. Eyokuqala ukuhoxiswa okuqondiwe futhi eyesibili ukufuduka, ngakho zidinga izimvume ezihlukene namawindi okulungisa ahlukene. Ithebula libeka zombili ndawonye ngokufinyelela, umzamo nokubuyiselwa.
| Question | Blocklist entry | Authority rotation |
|---|---|---|
| What stops working | One identity | Every certificate from that authority |
| Fleet work | Push one file and confirm a reload | New credentials and a new trust anchor everywhere |
| Reversible | Yes, remove the line | No, the old authority stays distrusted |
| Fits | A lost or stolen device | A leaked authority key |
I-laptop elahlekile idinga uhlu lokuvimbela, ngoba ububanzi bomonakalo bungubunikazi obulodwa futhi ushintsho luyabuyiselwa uma uvimbele isigxivizo somunwe esingalungile. Ukhiye wesiphathimandla ophumile udinga ukuzungezisa, ngoba uhlu lokuvimbela alunakusiza ngezitifiketi ezingakakishwa. Phakathi kwaleyo mikhawulo, buza ukuthi idaba elidaluliwe lalingasayina okunye yini, ngoba isiphathimandla singaphezu komhambi oyedwa.
Bhala isinqumo ngaphambi kwesigameko, ngoba ukukhetha ngaphansi kwengcindezi kuvame ukuletha inketho ebanzi ngokuzenzakalela. Noma yimuphi umzila owuthathayo, umsebenzi osele uyafana: fakazela ukuthi ukuphoqelelwa kwenzeka kumakhasimende abalulekile. Ukubhala phansi isigxivizo somunwe nosuku ngaleso sikhathi kuyikho okwenza ubufakazi bube nokwenzeka kamuva.
Qinisekisa ukunqatshwa nokusele
Xhumana usuka kubunikazi obuviwe futhi uqinisekise ukwehluleka, bese uxhumana usuka ku-peer egunyaziwe futhi uqinisekise ukuthi isafinyelela lokho ekudingayo. Ushintsho olwephula wonke umuntu akulona ukuhoxiswa okuphumelelayo. Yenza kokubili kusuka kumaseshini amasha, ngoba isimo esigciniwe singafihla umphumela.
Hlola ukuthi iseshini esisunguliwe iyaphela yini ngemva koshintsho, futhi bhala phansi ukuziphatha kwenguqulo yakho nokucushwa kwakho esikhundleni sokucabanga ukuthi ukuhlela ifayela kuqeda okuthile. Inketho ye-disconnect_invalid ihlanganisa amaklayenti anezitifiketi eziphelelwe yisikhathi noma ezingavumelekile, ngakho qinisekisa ukuthi isebenza kanjani esimweni sakho ngaphambi kokuthembela kuyo. Uma ukuqedwa ngokushesha kuyisidingo, kuhlole lokho ngqo futhi ubhale phansi owukubonile. Bese uphinda ukuhlola ngemva kokuqalisa kabusha, ngoba umhambi ophoqelela uhlu kuphela kuze kube ukuqalisa kabusha okulandelayo unenkinga yokuletha eyafihlwa ukuhlola kokuqala. Isibane esinempilo sikutshela ukuthi ukuthola kuyasebenza, hhayi ukuthi i-peer ethile isebenzise inqubomgomo.