Ithunge lwe-SSH le-QGIS PostGIS: gcina igama leseva le-TLS

Ithunge liyaphakama, i-QGIS iyaxhuma, futhi ukungena kuyafa ngephutha lesitifiketi elisho i-127.0.0.1 esikhundleni sengqalasizinda yesizindalwazi. Isinyathelo esilandelayo esihehayo ukukhulula sslmode, okuthulisa ukuhlola futhi kulahle isiqinisekiso sobunikazi obukufuna ekuqaleni. Inkinga yangempela ukuthi imbobo yasendaweni negama leseva kugcinwa endaweni eyodwa. Umugqa wesevisi we-libpq uyahlukanisa, ngakho isokhethi iya embotsheni edlulisiwe ngenkathi i-TLS isaqinisekisa igama eliphrintiwe kusitifiketi.

Ikhasimende licabanga ukuthi lixhuma kuphi

Ngaphansi kwe-sslmode=verify-full, i-libpq iqhathanisa isitifiketi esethulwa iseva negama lomsingathi eliceliwe. Lapho lelo gama liyikheli le-loopback, ukuqhathanisa kuyehluleka nakuba isitifiketi sisebenza kumsingathi wangempela wesizindalwazi. Ukudlulisela kwe-SSH kushintsha ukuthi iyiphi isokhethi ethwala amabhayithi, hhayi ubunikazi ikhasimende okufanele likulindele. Lapho le mibono emibili ihlukaniswa, iphutha alisabonakali njengokonakala kwe-TLS.

Ukudlulisela akusona isigunyazo futhi. I-PostgreSQL isasebenzisa imithetho yayo ekuxhumaneni okwenziwa iseva ye-SSH, ngakho gcina isendlalelo sokuthutha nesendlalelo sesizindalwazi zihlukene ngaphambi kokushintsha noma yini.

Bopha ukudlulisela ku-loopback kuphela

Isilaleli kufanele sibe khona emshinini we-QGIS hhayi kwenye indawo. Ukusho ngokucacile i-127.0.0.1 kuyisigcina kude nezinye izixhumanisi, kanti ikheli lokubopha elishiyiwe lingaveza imbobo ngaphandle kuye ngokulungiselelwa kwesango lekhasimende le-SSH.

ssh -N -L 127.0.0.1:15432:127.0.0.1:5432 [email protected]

Indawo yokuphela ngemva kwekholoni yesibili ixazululwa ohlangothini lweseva ye-SSH, ngakho lesi sibonelo sicabanga ukuthi i-PostgreSQL isemsingathini ofanayo ne-sshd; isizindalwazi esikweminye imshini sidinga lelo kheli nezimvume zalo. Qala isikhathi ngokuthi -N, ukuze kungavulwa igobolondo, ungathinti ukuqinisekiswa kokhiye womsingathi, futhi uqinisekise ukuthi isilaleli siyavela ngaphambi kokusola i-QGIS. Uma imbobo isivele isetshenziswa, ukudlulisela kuhluleka ekuqaleni hhayi ngesikhathi sombuzo.

Faka igama nesokhethi kumugqa wesevisi owodwa

Ifayela lesevisi livumela ukuxhumana okufanayo ukuthwala igama lokuqinisekisa nendawo yokuphela yesokhethi ehlukile. Gcina umugqa lapho i-libpq ibheka khona amasevisi, noma khomba PGSERVICEFILE kulo.

[gis-via-ssh]
host=db.geo.example
hostaddr=127.0.0.1
port=15432
dbname=gisdb
user=gis_reader
sslmode=verify-full
gssencmode=disable
sslrootcert=/path/to/approved-root.crt

Lapha host igcina ubunikazi obusetshenziswa ekuhloleni isitifiketi ngenkathi hostaddr ithumela amaphakethe embotsheni ye-loopback edlulisiwe, futhi kokubili kuyadingeka ukuze leli hlelo lisebenze. gssencmode=disable ibalulekile kuma-build okungebona lokho ayezoxoxa kuqala ngokubethelwa kwe-GSSAPI, ngoba leyo ndlela ishaya indiva izilungiselelo ze-TLS ezisanda kusethwa. Khomba isevisi ngegama kusuka kudingilogi yokuxhumana ye-PostgreSQL ye-QGIS futhi unikeze iphasiwedi ngomtumo ojwayelekile, hhayi ngaphakathi kwefayela elabiwe. Amagama nemigwaqo angenhla ayizindawo zokubamba; wafakele amanani akho agunyaziwe.

Yini i-PostgreSQL esayihlola ngemva kwethunge

Iseva ibona ukuxhumana okuvela kumsingathi we-SSH, i-loopback kuleli hlelo, futhi ikufanisa ngokulandelana nemithetho yokuqinisekisa esekelwe kumsingathi. Indima yakho esizindalwazini kusamele iqinisekise, futhi ukungena nge-SSH akunikezi ubunikazi besizindalwazi ngokwakho. Qinisekisa lokho iseva ekukholelwayo, hhayi lokho ikhasimende elikucabangile.

psql "service=gis-via-ssh" -c "select inet_server_addr(), current_user"

Vala isikhathi sokudlulisela uma umsebenzi usuqediwe; umugqa wasendaweni uyeka ukusebenza futhi akukho okunye okushintshayo. Indlela eyodwa eya esizindalwazini akuyona i-VPN yekhasimende lonke le-GIS, futhi ukuyiphatha njenge-VPN yikho okwenza ukuxhumana okulandelayo kuxilongwe ngokungalungile.