Kungani ukhiye we-seva nemininingwane yokungena yomsebenzisi kufanele kube nabanikazi abahlukene

Ukhiye okufakazela ukuthi i-geyithiweyi yakho iyiyo ngokwayo kanye nemininingwane yokungena ethi umuntu angajoyina kokubili kuyizimfihlo, futhi lapho ukufana kuphela khona. Eyodwa yembula isevisi kuyo yonke iklayenti; enye yembula umsebenzisi oyedwa kuleyo sevisi. Ukuzihlanganisa kusindisa isinyathelo ngesikhathi sokusetha futhi kubiza ntambama ngesikhathi sehlakalo, ngoba ukulungiswa kwazo akusona isenzo esisodwa. Ukwehlukanisa kuyadina ukukusetha futhi kuyakhumbuleka uma kweqiwe.

Izimfihlo ezimbili, abanikazi ababili abahlukene

I-geyithiweyi igcina ukhiye oyimfihlo noma isitifiketi okungumsebenzi waso okuwukuphela kwaso ukufakazela ubunikazi baso ngesikhathi sokuxhawana. Ama-klayenti adinga impahla yomphakathi ehambisanayo ukuze ayiqinisekise, futhi awasidingi neze uhlangothi oluyimfihlo. Yilokho kungalingani okwenza ukuqinisekiswa kwe-seva kube nokwenzeka ngaphandle kokunikeza wonke umsebenzisi amandla okulingisa i-seva.

Impahla yomsebenzisi ihamba kolunye uhlangothi. Ukhiye oyimfihlo we-klayenti, isitifiketi se-klayenti noma iphasiwedi kukhombisa ukuthi lo muntu noma le divayisi ithole ukufinyelela. Kulindeleke ukuthi isatshalaliswe, ikopishwe phakathi kwamadivayisi, futhi ekugcineni ihoxiswe.

I-WireGuard yenza ukwehlukanisa kucace ngoba wonke umhlanganyeli unepheya lokhiye: ukhiye oyimfihlo we-seva uhlala ku-seva, futhi ifayela lokuhlela olunika umsebenzisi liqukethe ukhiye wakhe oyimfihlo kanye nokhiye womphakathi we-seva. Iphrofayela equkethe ukhiye oyimfihlo we-seva akuyona indlela emfushane, iwukuthi ukuhlaselwa okulindele ukwabiwa kwefayela.

Imibuzo emithathu enquma ukwehlukanisa

Buza ukuthi ngubani okufanele akwazi ukufunda imfihlo, ukuchayeka kungavumela ukuthi umhlaseli enze ini, nokuthi ukulungisa kuwukuhoxiswa okukodwa noma ukwakhiwa kabusha kwesevisi.

Uma umsebenzisi engayifunda futhi ifakazela ubunikazi be-geyithiweyi, impendulo yombuzo wesibili iwukuthi umhlaseli angalingisa i-seva yakho kuyo yonke iklayenti — umphumela omubi kunayo yonke, ngoba ama-klayenti aklanyelwe ukuthemba lobo bunjikazi. Uma ifakazela umsebenzisi oyedwa kuphela, ukuchayeka kunikeza ukufinyelela kwalowo msebenzisi ku-peer eyodwa, futhi ukuhoxiswa kuwumsebenzi ojwayelekile. Uma kungukhiye wesiphathimandla sesitifiketi, ukuchayeka kubi kakhulu kunakho kokubili, ngoba umhlaseli angakha ubunikazi okuthembwa kubo yibo bonke amaphoyinti okugcina.

Lezi zimpendulo ezintathu zikhiqiza umthetho wokugcina: ukhiye we-CA uhlala ngaphandle kwe-inthanethi noma ku-vault, ukhiye we-geyithiweyi uhlala ku-geyithiweyi, futhi okhiye babsebenzisi bahlala nabsebenzisi. Noma yikuphi ukuhlelwa okubeka kona kuthathu kudayirekhithri elilodwa ukuze kube lula kuguqula isinqumo saba yingozi engahlosiwe.

Okudingwa i-klayenti ngempela

I-klayenti idinga isitifiketi somphakathi noma ukhiye we-peer womphakathi, impahla ye-CA noma isigxivizo somunwe okufanele sithembeke kuso, ukhiye waso oyimfihlo, nemininingwane yephoyinti lokugcina. Lolu hlu alukho lutho olungokobunikazi obuyimfihlo be-geyithiweyi.

Imibhalo yilapho lokhu kuphuma khona. Umhlahlandlela othi kopisha idayirekhithri ye-seva bese ususa lokho ongakudingi usuvele wafundisa imodeli engalungile, ngoba ifayela elisala ngemuva kwesinyathelo sokususa akuvamisile ukuthi umuntu alihlole.

Hoxisa umsebenzisi oyedwa ngaphandle kokuthinta i-geyithiweyi

Ngoba ubunikazi bomsebenzisi bukhishwa ngokwahlukene, bungahoxiswa ngokwahlukene. Ukusetshenziswa okusekelwe kusitifiketi kuhoxisa isitifiketi se-klayenti futhi kusakaza uhlu lokuhoxiswa olubuyekeziwe; ukusetshenziswa kwe-WireGuard kususa umbhalo we-peer ekuhleleni kwe-seva. Akukho kulokhu okushintsha ukhiye we-geyithiweyi ngokwayo.

Gcina irekhodi lokukhishwa, ngaphandle kwalokho ngeke wazi ukuthi yibuphi ubunikazi okufanele buhoxiswe. Ithebula lokubala lanele, inqobo nje uma libala umuntu, idivayisi, inombolo yochungechunge noma ukhiye womphakathi nosuku, futhi inqobo nje uma kukhona umuntu ongumnikazi walo ngemuva kokuhamba komuntu owakha lona.

Imiyalo engezansi ihlola isitifiketi se-klayenti bese iyasihoxisa ngesiphathimandla sesitayela se-OpenSSL, okuwukhona lokho okugoqwa yi-easy-rsa:

openssl x509 -in client.crt -noout -subject -serial
openssl ca -config openssl.cnf -revoke client.crt
openssl ca -config openssl.cnf -gencrl -out crl.pem

Sakaza uhlu olusha noma kuphi lapho ama-klayenti ehlola khona, ngaphandle kwalokho ukuhoxiswa kuyinothi efayeleni elingashintshi lutho. Uma i-geyithiweyi yakho yamukela izitifiketi zeklayenti ngaphandle kokubheka uhlu lokuhoxiswa, shono lokho ngokucacile esikhundleni sokukhombisa ukuthi ukuhoxiswa kuyasebenza.

Gcina ama-backup ehlukene njengezimfihlo

Ingobo yokwakha kabusha iqukethe ngokufanele ukhiye we-geyithiweyi nempahla ye-CA, ngoba ngaphandle kokho ukubuyisela akukwazi ukuphinda kwakhe isevisi. Iphakethe lokusetha le-klayenti akufanele ikukho, futhi kokubili akufanele kugcinwe ndawonye. Bhala ibhendi yengobo ngayinye ngokuthi ngubani ongayiphethe, hhayi ngosuku eyakhiwe ngalo. Leyo bhendi yilokho umphathi okhathele akufunda ngaso ngehora lesibili ekuseni.

Lowo mehluko uphinde unqume ukuthi ngubani ongathola ngakunye. Ukuphatha i-geyithiweyi, ukukhipha ubunikazi bomsebenzisi nokufunda ama-backup kungamandla amathathu ahlukene, futhi umuntu odinga elilodwa akadingi ngokuzenzakalela amanye. Bhala lezo zimvume, bese uzihlola ngokumelene nalokho okugunyazwa yisitoreji sakho ngempela, ngoba ifa ledayirekhithri linikeza ngokuthulela okuningi kunalokho okuhlosiwe yinqubomgomo.