Ukuthunyelwa kwe-NFS okukhiyelwe ekhelini le-VPN: lokho okungakufakazeli
Umthetho wokuthumela uhlola ukuthi iphakethe livela kuphi; i-AUTH_SYS imemezela i-UID yasendaweni futhi i-Kerberos iqinisekisa umsebenzisi. Nquma ukuthi iyiphi edingwa yisevisi yakho yamafayela.
Umleli uthumela uhla lwemibhalo ekhelini le-VPN, ukufakwa kuyaphumelela, futhi umklamo ubhalwa phansi njengokuqinisekisiwe. Lokho umthetho owukhawulela ngempela ukuthi amaphakethe abonakala evela kuphi. Ukuthi umuntu ohola umsebenzi wefayela unguye ozibiza ngaye kuncike kumgangatho wokuphepha we-NFS, futhi ekuthumeleni okuningi kwalolu hlobo akekho oyishintshile esukela kokumisiwe.
Ubunikazi obuthathu bungavela esicelweni esisodwa
Uzakwethu we-VPN uthwala ubunikazi obhalisiwe njengesitifiketi sekhasimende noma ukhiye wozakwethu. Iphakethe le-IP langaphakathi lithwala ikheli lomthombo. Umsebenzi wefayela uthwala lobo bufakazi bomsebenzisi obunikezwa yindlela yayo ye-NFS. Umklamo othatha ikheli njengommeleli wabo bobathathu uthathe ngokuthula ingxenye okwakufanele iqinisekiswe.
| Identity | What it proves | What it does not |
|---|---|---|
| VPN peer | Which peer was accepted by the tunnel | Which user runs on that machine |
| Inner source address | Where the packet appears to originate | That only the intended client can use it |
| NFS credential | What the file service believes about the caller | Anything, if the flavour only asserts local IDs |
Ukubhala leyo migqa emithathu wukuzivocavoca konke. Ingxenye enkulu yengxoxo yokuthi ukuthunyelwa kuphephile yini iyawa lapho sekucaca ukuthi isiphi isilawuli sihlala kuwuphi umugqa.
Ubunikazi bekheli kuyincazelo yokuqaliswa
Isango lingabela uzakwethu owamukelwe ikheli lethubhu, noma ligunyaze isethi engaphansi eqondisiwe kuye. Ukuthi ukuqaliswa kwemva kwalokho kuyalilela iphakethe elinomthombo wangaphakathi ongowelinye ikhasimende kuyisici salokho kuqaliswa, futhi kufanele kuhlolwe esikhundleni sokucatshangelwa.
Ikhodi yeseva yendawo yomsebenzisi ye-Community yendabuko OpenVPN isibonelo ingalilela umthombo oxhumene nelinye ikhasimende ngaphambi kokuba iphakethe lilethwe ngedivayisi ye-TUN. Lokho kuwukuhlolwa kobunikazi bekheli okunenani langempela, futhi akukakabi ukuqinisekiswa komsebenzisi we-NFS, ngoba akusho lutho mayelana nokuthi iyiphi i-akhawunti eyenza umsebenzi.
Ukuhumusha komthombo kugugisa nalokho. Isango le-NAT lingethula ikhasimende ngalinye njengekheli elilodwa, bese kuthi umthetho wokuthumela ungakwazi ukwehlukanisa abantu abangemuva kwalo. Ukunemba okubonakalayo komthetho bese kuba inganekwane egcinwa umdwebo. Uma ukuthunyelwa kubalulekile, gcina ukukhetha amakheli kucacile esikhundleni sokuvumela umhumushi ukuthi anqume ukuthi ubani ubalwa njengobani.
Funda umgangatho wokuphepha ngaphambi kokwethemba ukuthunyelwa
Umhlahlandlela we-NFS we-Red Hat wehlukanisa i-sec=sys, esebenzisa ama-UNIX UID nama-GID endawo nge-AUTH_SYS, kusuka kumamodi e-Kerberos. I-krb5 yengeza ukuqinisekiswa komsebenzisi, i-krb5i yengeza ukuvikelwa kobuqotho, futhi i-krb5p yengeza ukuvikelwa kobumfihlo kuthrafikhi.
Ubufakazi be-AUTH_SYS buqukethe izinkambu ezifana ne-UID yomshayeli namakhodi eqembu, futhi i-RFC 5531 ixwayisa ngokucacile ukuthi lo mgangatho awunikezi ukuphepha ngokwawo futhi uncike ekuvikelweni kwangaphandle. Ukuwusebenzisa ngaphakathi kwe-VPN kunikeza ukuvikelwa kokuthutha futhi akushintshi lutho esitatimendeni esingaphakathi kwephakethe.
exportfs -v
showmount -e nfs.example.internalFunda umgangatho kuleyo okuphumayo ngaphambi kokufunda uhlu lwamakhasimende. Ukuthunyelwa okubonakala kukhawulelwe kungase kukhawulelwe ngekheli kuphela kuyilapho umshayeli ngamunye esamemezela noma iyiphi i-UID ayifunayo.
Khetha imodeli, bese ugcina izimvume
Khetha imodeli yokuqinisekisa yesevisi yamafayela efanele amakhasimende owaphathayo ngempela. I-Kerberos idinga ubunikazi nokufakwa kwesevisi ngemuva kwayo, ngakho ukushintsha inketho eyodwa yokufaka akuwona umfuduko futhi kuzokwehluleka nje kuze kube khona isizinda se-Kerberos, ama-principal namafayela e-keytab.
Kuzo zombili izimodeli, gcina izimvume zokuthumela kanye nokugunyazwa kwesistimu yamafayela okukhawulela lokho i-principal eqinisekisiwe engakwenza. Ukuqinisekisa kukutshela ukuthi ubani obuzayo; ukugunyaza kunquma ukuthi impendulo kufanele ibe yebo. Ukuhlanganisa lezi zimbili kusethingi eyodwa yindlela umfuduko ogcina ngokunikeza okungaphezu kwalokho okwakunikezwa ukucushwa kwakudala.
Sebenzisa umthetho wekheli ngenjongo yawo yangempela
Ukukhawulela isevisi emkhondweni ogunyaziwe nasemithonjeni kusabalulekile, kuhlanganise nenqubomgomo yokufaka yomleli lapho iphoyinti lokugcina le-VPN neseva ye-NFS zabelana ngomshini. Imithetho edlulisela ithrafikhi ayilawuli izicelo eziqondiswe kwisevisi esebenza endaweni kumleli ofanayo. Lesi sikhala sichaza inani elimangalisayo lokuthunyelwa okwakufanele kube yimfihlo. Hlola inqubomgomo yokufaka yasendaweni ngokusobala esikhundleni sokucabanga ukuthi imithetho yethubhu iyayimboza.
Hlola ukuthi esinye isixhumi noma isango elihumusha umthombo angeke likwazi ukuphumelelisa umthetho ngokungalindelekile, futhi kuthatha lokho njengesizathu sokuthola umsuka hhayi njengesitatimende sokuthi ukukhohlisa ikheli kuqinisekisa ukufakwa okusebenzayo.
Qhuba izimo zokwamukela ezintathu esikhundleni esisodwa. Qala ngekhasimende eligunyaziwe elisebenza njengomsebenzisi ogunyaziwe, bese uphinda kusuka kuzakwethu ongakaze agunyazwe, bese uzama into umsebenzisi ogunyaziwe angakavunyelwa ukuyenza. Bese ubuza ukuthi kushintshani uma ikhasimende eligunyaziwe lihlaselwa, ngoba ukuqinisekisa kokuthutha akwenzi zonke izinqubo kuleyo mshini zethembeke. Isitifiketi esebiwe kanye ne-akhawunti yasendaweni enelukuluku yizinkinga ezihlukene ezinokulawulwa okuhlukene.