Kungani i-SQL Server ngokusebenzisa i-VPN isabuyela ku-NTLM?

Ukuxhumana kwakho kuyasebenza, ukungena kwamukelwa, futhi i-SQL Server isebenzisa i-NTLM ngenkathi wonke umuntu elindele i-Kerberos. Lowo mphumela awusona isici se-VPN, ngoba umhubhe unikeza indlela kuphela; isikimu sanqunywa igama iklayenti elalilicela, isihloko esibhalisiwe kudathabhezi kanye nethikithi iklayenti elakwazi ukulithola ngempela. Izimo ezintathu kufanele zibe khona ngasikhathi sinye, futhi iseshini ngokwayo isho ukuthi iyiphi eyehluleka. Funda lokho ngaphambi kokuthi othile ahlele igama lesihloko sesevisi.

Iseshini isho isikimu osithole ngempela

Isikimu sokuqinisekisa singesokuxhumana hhayi sesiphakeli noma somhubhe, ngakho ukuhlola kufanele kusebenze ngaphakathi kweseshini okukhathazayo. Sebenzisa umbuzo ongezansi kusuka kuklayenti elifanayo, ithuluzi ne-akhawunti eyakha umbiko, futhi ubhale igama lomgomo nokuthuthwa eceleni komphumela.

SELECT session_id, auth_scheme, net_transport, client_net_address, login_name
FROM sys.dm_exec_connections
WHERE session_id = @@SPID;

Umugqa ovela kuwindi le-SSMS lendawo kusiphakeli sedathabhezi uchaza ukuxhumana okuhluke ngokuphelele, ngakho umbuzo kufanele usebenze ohlangothini lweklayenti. Gcina okukhiphayo ngophawu lwesikhathi, ngoba umuntu olandelayo ozokufunda uzobuza ukuthi kuthathwe nini. Lapho izinhlelo eziningi zabelana ngephoyinti lokugcina elilodwa, thatha isampuli kusuka kwelinye ngalinye, ngoba umehluko womthombo wedatha phakathi kwezinhlelo ezimbili ngokuvamile uyindaba yonke.

Isimo sokuqala: ingabe igama lihambisana ne-SPN?

I-Kerberos iqinisekisa isevisi enegama, ngakho iklayenti licela ithikithi kudathabhezi lesihloko esisodwa esithile. Kumhlinzeki we-TCP ifomu elibhaliwe yi-MSSQLSvc/ elandelwa igama lomsingathi eligcwele futhi, ngesibonelo esizenzakalelayo, imbobo. Isibonelo esinegama sibhalisa i-MSSQLSvc/db01.corp.example:SQLPROD, lapho isijobelelo siyigama lesibonelo esikhundleni senombolo. Ukufinyelela kumsilalisi ngokusebenzisa isiteketiso, i-CNAME exazululwa kwenye indawo noma ikheli le-IP elingenalutho kushintsha igama eliceliwe, futhi isicelo esingenaso isihloko esihambisanayo asinalo ithikithi lokukubuyisela.

Yingakho uhlelo olulodwa lusebenza kunethiwekhi eyodwa bese lubuyela emuva kwelinye: impendulo ye-DNS, irekhodi lesiteketiso noma ukufakwa kwe-hosts kwashintsha igama elasetshenziswa yiklayenti. Qhathanisa igama eliceliwe nalokho okugcinwe kudathabhezi ngaphambi kokuthinta ukubhaliswa.

Isimo sesibili: ingabe i-SPN isekhawuntini efanele?

I-SPN kufanele ibe yekhawunti esebenzisa isevisi ye-SQL, hhayi yekhawunti yeklayenti futhi hhayi yento yekhompyutha ngengozi. I-SQL Server ingabhalisa ama-SPN ayo lapho iqala uma i-akhawunti yayo yesevisi inemvume yokuwabhala, okuyinto elula futhi echaza nokuthi kuvela kanjani ikhophi ngemva kokushintshwa kwe-akhawunti yesevisi.

Buza idathabhezi ngegama olilindele, bese ubalula lokho i-akhawunti enakho ngempela. Iyiphi into ephethe umbhalo kubaluleke kakhulu kunokuthi igama likhona yini endaweni ethile ehlathini. Ukungafani kusho ukuthi ukungena kwakungakaze kube yinkinga, futhi umhlahlandlela we-SPN we-Microsoft ubhala amafomu nezimo lapho umphathi wesizinda kufanele akhe umbhalo.

setspn -Q MSSQLSvc/db01.corp.example:1433
setspn -L CORP\svc-sql01

Ukungeza omunye umbhalo akulona ucwaningo oluphephile. Ikhophi noma ukubhaliswa okungqubuzanayo kungabhidliza amaklayenti ayesebenza, ngakho hlola ubunikazi ngaphambi koshintsho bese uphinda ukuhlole ngemva kwawo.

Isimo sesithathu: ingabe iklayenti lingalithola ithikithi?

I-SPN elilungile aliwusizo uma iklayenti lingakwazi ukufinyelela isilawuli sesizinda noma lingenaso isimo socwaningo olusebenzisekayo. Ukushintshana kudinga i-KDC ne-DNS ngokusebenzisa i-VPN, futhi umhubhe ohambisa kuphela imbobo ye-SQL wehluleka khona kuleli gxathu. Ukufinyeleleka kufanele kuhlolwe kusuka emshinini ofanayo nasekhawuntini efanayo, hhayi kusuka kuthango lomlilo olungaphambi kwabo.

Hlola inqolobane yamathikithi emshinini nangaphansi kwekhawunti esebenzisa uhlelo. Uhlu lwemishini yonke olusuka kuwindi eliphakanyisiwe alusho lutho ngesevisi esebenza njengomunye umsebenzisi, futhi inqolobane engenalutho yalowo msebenzisi iyinto etholakele hhayi ukuphazamiseka.

klist
klist -li 0x3e7

Bese unquma ukuthi ukubuyela emuva kungenza ini. Uma inqubomgomo idinga i-Kerberos, i-NTLM kufanele yenqatshwe ngokucacile, ngoba ukubuyela emuva buthule kuguqula iphutha lokumiswa kube ukuxhumana okusebenzayo okwephula imfuneko. Uma i-NTLM isamukeleka kwezinye izinhlelo, zisho ngamagama futhi uyeke ukuthatha yonke iseshini ye-NTLM njengesigameko.

Ukushintsha isiqalisi kungukuhluka okukodwa, hhayi ukulungiswa

Ukuqala i-SSMS ngaphansi kobunye ubufakazi kungelapha ubunikazi obuphumayo obungahlosiwe, okuyisigaba sangempela senkinga. Akufakazeli lutho ngegama lomgomo, ukubhaliswa noma indlela yethikithi, futhi akushintshi lokho okwamukelwa isiphakeli.

Gcina ukuqhathanisa kulawulwa: iphoyinti lokugcina elifanayo, umhlinzeki ofanayo, isimo sokusebenza esaziwayo, bese kuba ukuxhumana okusha okuhlola isikimu sakho. Qinisekisa ukungena okwamukelwe kanye nezimvume zaso zedathabhezi ngokwehlukana, ngoba ukufinyelela nokuqinisekisa kwehluleka ngezizathu ezihlukene.

Lapho i-Kerberos idingeka, bhala ukuthi kungani indlela yokuqala yabuyela emuva, sebenzisa ukulungiswa okukodwa bese usebenzisa umbuzo futhi kusuka kuklayenti elifanayo. Umbuzo ophumelelayo ngemva kokushintsha isiqalisi ubufakazi bokufinyelela, futhi akukabufakazi bokuthi imfuneko yokuqinisekisa yagcwaliseka.