I-PostgreSQL nge-VPN: iyiphi ikheli lomthombo i-pg_hba ezolibona

Isilaleli, i-firewall kanye nomthetho wokuqala we-HBA ohambisanayo kuyizinqumo ezintathu. Hlola umthombo i-PostgreSQL ewuthola ngempela ngaphambi kokukhetha isiqalo.

I-PostgreSQL ayikwazi ukwazi ukuthi iklayenti likwi-VPN. Ithola ukuxhumana kwe-TCP kusuka kukheli kanye nesethi yezimpawu zokufakazela, bese inquma ukuthi izokwenzani ngazo. Ngakho ukwenza ukufinyelela kuncike kuthumbu kusho ukuhlela izinqumo ezintathu ezihlukene ukuze zivumelane, bese uhlola ikheli elilodwa iseva elibona ngempela esikhundleni salelo owalidweba kumdwebo.

Izinqumo ezintathu okungafanele zihlanganiswe

Lapho iseva ilalela khona kuyisinqumo esisodwa. Ukuthi yikuphi ukuhamba okungafinyelela kulelo kheli kungesibili, kwenziwa yi-firewall yomsingathi kanye nanoma yimuphi umngcele wenethiwekhi phambi kwayo. Ukuthi yikuphi ukuzazisa kwedathabhezi okungaqinisekiswa kusuka kumuphi umthombo kungesithathu, kwenziwa ku-pg_hba.conf.

Ngakunye kwawo kuqinisekiswa ingxenye ehlukene, futhi ngakunye kwehluleka ngomlayezo ohlukene. Ukuzihlanganisa engxoxweni yikho okwenza abantu bagcine ngokuhlela ifayela le-HBA ukulungisa inkinga ye-firewall. Zigcine ngokulandelana: isilaleli esingaboshiwe asikwazi ukufinyelelwa, iphothi elihlungiwe asikwazi ukuxhunywa kulo, futhi umthetho we-HBA unquma kuphela okwenzekayo ngemva kokuba ukuxhumana sekukhona. Uma ushintsho lungenawo umphumela, khomba ukuthi yisiphi sezingqimba ezintathu osishintshile ngempela.

Lapho iseva ilalela khona

Bopha ekhelini elinikezwe umshini ngempela, hhayi egameni le-interface:

listen_addresses = '10.20.0.30'

Idathabhezi ingaba ngemva kwesango le-VPN ingenawo i-interface yayo yethumbu, futhi yikho kanye okwenza ikheli libe yinto efanele ukuyisho. Ukushintsha lesi silungiselelo kudinga ukuqalisa kabusha okuphelele; ukulayisha kabusha akwanele.

Bese uhlunga iphothi, ngokuvamile 5432, kumsingathi nakuwo wonke umngcele ophambi kwayo. Ukubopha ekhelini langasese akusona ubufakazi bokwenqatshwa komphakathi, ngoba ukudluliswa kwephothi noma ukubalulwa kwekheli lefuu kusengaletha amaphakethe kuleso silaleli sangasese.

Ikheli i-HBA elibona ngempela

Ngokufinyelela okuhleliwe iseva ibona ikheli langaphakathi lethumbu lekliyenti ngayinye. Ngokuhunyushwa komthombo ibona ikheli elihunyushiwe lesango esikhundleni salelo, futhi iklayenti ngayinye iwela phezu kwalelo nani elilodwa. Hlola umthombo ngobufakazi bokuxhumana besive uqobo ngaphambi kokukhetha isiqalo esizovunyelwa.

Okokuthunyelwa osekuvele kusebenzisa i-TLS ne-SCRAM, isibonelo sokufinyelela kude esenziwe saba mncane ngamabomu sibukeka kanje:

hostssl appdb app_login 10.8.0.0/24 scram-sha-256
host all all 0.0.0.0/0 reject
host all all ::/0 reject

Lokho kuvumela indima eyodwa nedathabhezi elilodwa phezu kwe-TLS kusuka eqoqweni elishiwo, bese kwala okunye ukufinyelela kwe-TCP kude. Akusona isikhundla sefayela le-HBA eliphelele: gcina ukuphatha kwendawo, ukukopisha kanye nanoma yimuphi omunye umsebenzi ogunyaziwe, futhi beka imithetho emincane ngaphambi kwezimvume ezibanzi.

Uma ukuhunyushwa kusebenza, i-HBA ayikwazi ukwahlukanisa amaklayenti ngamakheli awo okuqala. Gcina ukwamukelwa kwenethiwekhi kuqinile futhi ufune izimpawu zokufakazela zedathabhezi zangempela, futhi ungakaze ushintshe ukuqinisekiswa kwe-trust nge-akhawunti yangempela.

Ukufana kokuqala kuyanqoba, ngaphandle kwesipele

I-PostgreSQL ifunda ifayela kusuka phezulu kuya phansi futhi isebenzisa irekhodi lokuqala elihambisana nokuxhumana. Akukho mzamo wesibili uma ukuqinisekiswa kwalelo rekhodi kwehluleka, ngakho imvume ebanzi yangaphambili yehlula ngokuthula ukwenqatshwa kwakamuva.

Lowo mthetho wokulandelana uyisizathu esivame kakhulu sokuthi ukwenqatshwa okubhalwe ngokucophelela kungaze kusebenze. Beka imithetho eqondile kuqala nemibanzi ekugcineni, bese ufunda ifayela njengokulandelana hhayi njengeqoqo. Umthetho owengeze phansi awusona isu, ungumbhalo. Wuhambe phezulu futhi ulayishe kabusha ngaphambi kokuphetha ngokuthi ifayela liyashaywa indiva.

Isithenjwa se-HBA sichaza kokubili ukulandelana kanye nomehluko phakathi kwamarekhodi e-host ne-hostssl, okubalulekile lapho inhloso yomthetho iwukuthi ukuxhumana kumele kube okubethelwe.

Ukulayisha kabusha, ukuqalisa kabusha kanye necala elenqatshiwe

Izinguquko ze-HBA zisetshenziswa ngokulayisha kabusha, futhi umbono we-pg_hba_file_rules ukusiza ukuthola amaphutha okuhlaziya. Lowo mbono uchaza okuqukethwe kwamanje kwefayela, hhayi ukuthi iseva esebenzayo ikulayishe ngempumelelo, ngakho uhlu oluhlanzekile akusona ubufakazi bokuthi imithetho emisha iyasebenza.

Izinguquko zesilaleli zidinga ukuqalisa kwayo kabusha, futhi lezi zenzo ezimbili kulula ukuzidida uma ushintsho lubonakala lungenawo umphumela.

Hlola ngamaseshini amasha: iklayenti eligunyaziwe eline-akhawunti ehlosiwe liyaxhumana, leyo akhawunti isuka endleleni engagunyaziwe ayixhumani, futhi ukuzazisa kwedathabhezi okungagunyaziwe kusahluleka kusuka ngaphakathi kwe-VPN. Lezo ziphumo ezintathu zihlukanisa umngcele wenethiwekhi nokugunyazwa kwedathabhezi, okuyiyo yonke inhloso yokugcina izinqumo zihlukene.

Izihloko ezihlobene