Ukulayisha kabusha isitifiketi se-Nebula akuzange kushintshe i-IP: nansi imbangela
Ukulayisha kabusha kufunda kabusha ubufakazi bomsukeli kuphela lapho ikheli le-overlay lihlala lifanayo. Ukushintsha ikheli kusho ukuqala kabusha noshintsho lwenethiwekhi, hhayi umzamo omusha.
Ukhipha isitifiketi esisha somsukeli ngekheli le-overlay elihlukile, usikopisha phezu kwefayela elidala, uthumela ukulayisha kabusha, futhi umsingathi uyaqhubeka uphendula ekhelini ebelinekho ngaphambili. Umjaho wokuqala uwukucabanga ukuthi ukulayisha kabusha kwehlulekile noma kufundwe ifayela elingalungile. Ngokuvamile akukho kokubili okwenzekile: inqubo esebenzayo yagcina ngamabomu ubunikazi eyayinabo kakade, ngoba okungena esikhundleni kwashintsha into ukulayisha kabusha okungenakukwazi ukuyisebenzisa.
Ukusekelwa kokulayisha kabusha kwe-PKI ku-Nebula kubhalwe phansi ngalowo mkhawulo, futhi kulula ukuwushiya lapho idokhumenti efanayo ibonisa ukuthi ukulayisha kabusha kuyasebenza kwezinye izinguquko.
Ukulayisha kabusha kufunda kabusha ini ngempela
Isitifiketi somsukeli akusona nje ubufakazi njengokhiye we-SSH. Sithwala ikheli le-overlay, igama lomsukeli, ubulungu beqembu nesikhathi sokusebenza, futhi konke lokhu kuhlanganiswe isignesha ye-CA. I-daemon isebenzisa lokho kuqukethwe okusayiniwe ukunquma ukuthi izethula kanjani nokuthi yimiphi imithetho esebenza kuyo.
Ukulayisha kabusha kuvumela inqubo ukuthi ithathe ubufakazi obuvuselelwe ngaphandle kokuwisa amathaneli ayo, okuyinto eyigugu ekuzungeziseni okujwayelekile: ikheli elifanayo, igama elifanayo, amaqembu afanayo, ukuphelelwa kwesikhathi kamuva. Umkhawulo uwukuthi ubunikazi kufanele buhlale bufana. Shintsha ikheli le-overlay futhi indlela yokulayisha kabusha ayikwazi ukulisebenzisa, ngoba ikheli liyingxenye yalokho okuzibophezele kukho uhlelo olusebenzayo.
Ngakho-ke ukuziphatha okukubonile uwumkhawulo obhalwe phansi owenza umsebenzi wawo, hhayi ukwehluleka okuthule. Ifayela elikudiski lisha; ubunikazi obusemkhunjini budala; inqubo ayinayo indlela esekelwe yokuxazulula lowo mehluko ngaphandle kokuqala kabusha.
Ikheli, igama namaqembu kuwubunikazi obubodwa
Kuyasiza ukucabanga ngesitifiketi njengerekhodi elilodwa hhayi njengeqoqo lezinkambu ongazihlela ngokwehlukana. Ukuhambisa ikheli akufani nokushintsha ukuthanda, ngoba ikheli livela ekuhlelweni kontanga kwabanye osukeli, ekubopheni kwezinsizakalo nasezimisweni ezibhalelwe ubunikazi.
| Field | What changes when you replace it |
|---|---|
| Overlay address | Peers that pinned the old address, service bindings, and any rule written against it |
| Host name | Name-based policy and the identities other hosts expect to see |
| Groups | Which access rules match, even if the address stays identical |
| Validity window | Nothing structural, which is why renewal reloads cleanly |
Amaqembu afanelwe umugqa wawo ngoba adala inguqulo ethulile yalokho kudideka. Umsukeli ogcina ikheli lakhe kodwa ashintshe amaqembu angafinyelela ezinye izinsizakalo ngemva kokuqala kabusha, futhi ukuhlolwa okwenza kuphela i-ping ekhelini elidala kuyobonakala kuphilile ngokuphelele kuyilapho izinqumo zokufinyelela zishintshile ngaphansi kwayo. Hlola insizakalo eyodwa elawulwa umthetho, hhayi ukufinyeleleka kuphela. Lowo ngumehluko phakathi kokuqinisekisa ithaneli nokuqinisekisa umgomo.
Qhathanisa isitifiketi esilayishiwe nokungena esikhundleni
Ngaphambi kokucabanga ukuthi i-daemon yishaya indiva ifayela, funda kokubili. Phrinta isitifiketi osihlosile ukusilayisha futhi uqinisekise izinkambu ocabanga ukuthi uzishintshile, bese uqinisekisa ukuthi ukuhlelwa okusebenzayo kukhombisa leyo ndlela hhayi ikhophi kwenye indawo.
nebula-cert print -path /etc/nebula/host.crt
systemctl status nebula
ps -o args= -p $(pgrep -f 'nebula -config' | head -1)Izimpikiswano zenqubo zibaluleke kakhulu kunalokho abantu abakulindele. Iyunithi edlulisa i--config /etc/nebula/config.yml ifunda okufakiwe kwe-pki.cert yalelo fayela, futhi isitifiketi esifakwe kusikhombisi sesikhashana asithinti lutho. Hlola indlela esemugqeni womyalo osebenzayo, hhayi indlela esedokhumentini oyilandele. Uma kokubili kuhlukile, uthole inkinga ngaphandle kokuthinta isitifiketi nhlobo.
Uma isitifiketi esisha sinekheli elihlukile futhi inqubo igcine elidala, manje unencazelo esikhundleni semfihlakalo. Yiqale kabusha uma lokho kwamukeleka, futhi ubheke ushintsho lwekheli njengoshintsho lwenethiwekhi oluhleliwe hhayi olwenzeka ngengozi.
Ushintsho lwekheli ushintsho lwenethiwekhi
Luhlele njengoba ungahlela ukuhambisa umshini. Abanye osukeli kungenzeka bagxilise ikheli elidala ekuhlelweni kwabo, izinsizakalo zingabopheka kulo ngokusobala, futhi imithetho yodonga lomlilo ingase ibhalelwe lona. Ukushintsha isitifiketi kuhambisa umsukeli, futhi ukuhambisa umsukeli kwenza okucatshangwayo kwenye indawo kungabi nasisekelo.
Gcina indlela yesibili yokuphatha ivulekile ngenkathi wenza lokhu, ngoba ukuxhumana kwe-overlay kungenzeka kube yikho okukuphazamisayo. Ukwenza lokhu phezu kwethaneli osezokuliphula kuyindlela evamile yokuguqula ushintsho lwemizuzu emihlanu lube wukuvakasha endaweni.
Ukuthi ukuqala kabusha kwamukeleka kuncike kulokho okwenziwa umsukeli, futhi lowo umbuzo wokuhlela hhayi wobuchwepheshe. Okungeyona into yokuzikhethela ukuvuma isidingo sokuqala kabusha esikhundleni sokuthumela ukulayisha kabusha okwesihlanu.
Hoxisa ubufakazi obudala ngokwehlukana
Ukufaka okungena esikhundleni kumshini oyedwa kushiya wonke ontanga besathemba ubufakazi abubonayo kakade. Uma isizathu soshintsho kwakuwukuhlukunyezwa, ubunikazi obudala kufanele buhoxiswe ngohlobo lokuthembana noma uhlu lokuvimbela ukuze ontanga bakwenqabe ngempela.
Lesi isinyathelo esihlukile esinokuqinisekisa kwesokwalo: qinisekisa kusuka komunye umsukeli ukuthi ubunikazi obudala abusasebenzi, esikhundleni sokucabanga ukuthi ifayela elisha lenze umsebenzi. Idokhumenti yokuhlela ye-PKI ye-Nebula ihlanganisa izilungiselelo ezingalayishwa kabusha kanye nomkhawulo wekheli ochazwe lapha, futhi kufanelekile ukuyifunda yonke ngaphambi kokuzungezisa noma iyiphi into ebheke ekukhiqizeni.