Ukungena kwe-VPN okukodwa kukhompyutha eyabiwe: ubani omunye uthola umzila?
Ukungena kwe-VPN kuqinisekisa umuntu oyedwa; umzila ewufakayo ungububanzi obuhlukile. Qhathanisa amathaneli ehost yonke, ngomsebenzisi ngamunye nangohlelo lokusebenza kumshini owabiwe.
Ukwabelana ngesiteshi somsebenzi kuveza umbuzo okhompyutha yomsebenzisi oyedwa engadingi ukuwuphendula: lapho umuntu oyedwa eqinisekisa ithaneli, ubani omunye angayisebenzisa? Ukungena kukhombisa umuntu, futhi umzila ofakiwe uchaza ububanzi, futhi lezi zinto ezimbili azisinto esisodwa. Phakathi kwazo kukhona uhlelo lokusebenza, ukulungiselelwa kwekliyenti kanye nalokho okudingwa yisevisi yangasese ngokwayo. Ukuqhathanisa izindawo zokuphoqelela iyona ndlela yokuqala yokuphendula umbuzo ngaphandle kokuqagela.
Ukungena okukodwa, ububanzi obuningi
Ukuqinisekisa kuphendula ukuthi ubani wamukelwe. Umzila uphendula ukuthi yimaphi amaphakethe angaphuma ngethaneli. Ukugunyaza kuphendula ukuthi iyiphi isevisi ezokwamukela ukuxhumana okuvelayo, futhi akukho kokuthathu okusho okulandelayo.
Ithaneli lehost yonke iyisimo esijwayelekile futhi lenza igebe libonakale. Umzila usetafuleni le-kernel, ngakho inqubo ngayinye esebenzisa lelo tafula ingafinyelela inethiwekhi yangasese, kuhlanganise naleyo eqalwa umsebenzisi ongakaze abone ingxoxo ye-VPN. Lokhu akusona isiphambeko sethaneli; lokhu kusho umzila wesistimu yonke. Isevisi yangasese isengase yenqabe ukuxhumana, ngakho ukufinyeleleka negunya kudinga izimpendulo ezihlukene.
Ukubhala imibuzo emine ngaphambi kokuhlola kuvimbela ukubuyekezwa ekuthelekeni komunye wayo.
Umgcele ukuphi ngempela
Izinhlelo ezine zihlanganisa imishini eminingi: ithaneli lehost yonke, ukuxhumana komsebenzisi ngamunye, uhlu lwezimvume zohlelo lokusebenza ngalunye kanye nendawo yamagama enethiwekhi noma umshini wokufanekisa ohlukile.
Ngakunye kubeka indawo yokuphoqelela endaweni ehlukile, futhi ukwehluka kubaluleke kakhulu kunezincazelo. Ukuxhumana komsebenzisi ngamunye kuphoqelelwa izimvume zephrofayela, hhayi isikrini sokungena sedeskithophu. Uhlu lwezimvume zohlelo lokusebenza luphoqelelwa ngaphakathi kwekliyenti, elinquma ukuthi lizothwala ini. Indawo yamagama noma i-VM iphoqelela emngceleni we-interface, ngakho inqubo engaphakathi ayikwazi ukubona umzila wehost nakancane. Inani lezikrini zokungena kumshini alisho lutho nganoma yiluphi lwazo.
| Arrangement | Enforced by | Who can use the path |
|---|---|---|
| Host-wide tunnel | The routing table | Any local process using that table |
| Per-user connection | Profile permission list | Only the listed accounts |
| Per-app allowlist | The VPN client itself | Only the selected applications |
| Namespace or VM | The interface boundary | Only processes inside it |
Ukufunda itafula umugqa ngomugqa kukhombisa ukuthi umbuzo wangempela awukho ekutheni ukuhlukaniswa kukhona, kodwa ukuthi kusetshenziswe kuphi.
Qhathanisa izindawo ezine zokuphoqelela
Ku-Linux itafula lemizila liyinto yokuqala okufanele ihlolwe, ngoba ithaneli lehost yonke livela lapho kanti indawo yamagama ayiveli. Ukusebenzisa ukusesha njengomsebenzisi wesibili yisinyathelo abantu abasishiyayo; impendulo ihluka kuleyo abayithola njengabo uqobo, futhi lokho kuchaza umbiko.
Izikhathi ezimbili ezilandelayo zibheka inqubomgomo hhayi ukuhamba kwemizila. Umthetho we-firewall ohambisana ne-UID usebenza ekuxhumaneni okukhiqizwe endaweni, ngakho ungahlukanisa abasebenzisi ababili kuhost eyodwa ngisho nalapho bobabili babelana ngomzila. Iphrofayela yokuxhumana enohlu lwezimvume olucacile iphoqelelwa umphathi wenethiwekhi lapho ivulwa. Akukho ukuhlola okudinga ukuthi ithaneli lishintshwe, ngakho kufanelekile ukukwenza ngaphambi kokuklama kabusha noma yini.
ip route get 10.40.2.10
sudo -u bob ip route get 10.40.2.10
nmcli connection show vpn-work | grep -i permission
sudo nft list ruleset | grep -n skuidUma ukusesha kwesibili kukhombisa umzila wethaneli, umngcele awukho lapho umklamo wawucabanga khona.
Imithetho yemihlangano yesikhathi esisodwa iwukulawula okuhlukile
Amasango avamise ukukhawulela ukuthi ingaki imihlangano i-akhawunti eyodwa engayigcina, futhi lowo mkhawulo awuhlangene nabasebenzisi basendaweni. Ukhawulela i-akhawunti, ngakho umuntu wesibili ongena ngobunikazi obufanayo angagcina ithaneli lomuntu wokuqala.
Funda ukwehluleka ngaphambi kokucabanga ukuthi inkinga yokuhlukaniswa yasendaweni. Umkhawulo wemihlangano udala ukuphuka esangweni, kanti inkinga yobubanzi idala ithaneli elisebenzayo kodwa elingakuthwali ukuxhumana komunye umsebenzisi. Lezi zimpawu ezimbili ziholela ekulungiseni okuhluke ngokuphelele. Gcina umyalezo onembile wekliyenti, ngoba uvamise ukusho umthetho. Cela umnikazi wephrofayela inqubo yokusebenza evunyiwe esikhundleni sokweqa umkhawulo.
Umshini wokufanekisa awukhululi muntu kulowo mthetho futhi wengeza umklamo wawo wenethiwekhi nobunikazi.
Hlola umongo okukhathaza wona
Hlola umsebenzisi nohlelo lokusebenza okuhlosiwe, bese uhlola umongo okufanele wenqatshwe. Ukubuyekezwa okufakazela kuphela ukuthi iphasiwedi yokuqala iyasebenza kuhlole ukuqinisekisa futhi akukho okunye.
sudo -u bob curl -sS -m 5 https://intranet.internal/health
wg show
ss -tnp | grep -E ':443|:51820'Bhala indawo yokuphoqelela eduze komphumela ngamunye: itafula lemizila, umthetho we-UID, imvume yephrofayela noma inqubomgomo yemihlangano yesango. Lelo rekhodi lenza ushintsho olulandelayo lubuyekezwe. Futhi livimbela umbuzo ofanayo ukuvuleka kabusha njalo lapho othile ebona isikrini sesibili sokungena. Ukufinyeleleka akusona isigunyazo, futhi akukho kokubili okuwukuhlukaniswa.