I-TLS, ukungena kunethiwekhi kanye namalungelo e-SQL kuphendula imibuzo ehlukene
Ukubethela uxhumano, ukuvumela umthombo kanye nokunikeza ithebula kuyizinqumo ezintathu. Zihambise ngokulandelana ngaphambi kokubuza ukuthi i-TLS ingathatha indawo ye-VPN yini.
Omunye uphakamisa ukunikeza iklayenti ukungena ku-PostgreSQL ukuze isicelo sezindleko sihambe sibethelwe kusukela ekuqaleni kuze kube sekupheleni. Umlawuli wesizindalwazi udinga isikhathi sangempela se-SQL, futhi omunye uphakamisa ifomu lewebhu esikhundleni salokho. Zombili iziphakamiso zixazulula inkinga engafanele, ngoba akukho okwaqala emsebenzini iklayenti eliwenza ngempela. Hambisa izinqumo ezintathu ngokulandelana futhi umbuzo wokuthi i-TLS ingathatha indawo ye-VPN uzoziphendula wona.
Qala emsebenzini odingwa yiklayenti
Bhala ukuthi iklayenti kufanele kufinyelele ini. Ukuthumela isicelo, ukufunda umugqa owodwa wombiko nokwenza umbuzo osheshayo kuyimisebenzi emithathu ehlukene enezimo ezintathu zobungozi ezihlukene.
Bese ubhala ukuthi ubani owenza isicelo. Iklayenti, umsizi wosekelo kanye nomlawuli abakwazi ukushintshana ngisho bethinta ithebula elifanayo. Umehluko unquma ukuthi iklayenti kufanele libone ingakanani ulimi lwemibuzo.
Ipheshana lezimpendulo linquma isixhumanisi. Konke ngemuva kwalokho ukusetshenziswa, futhi iningi lezingxoxo mayelana nokubethela liyizingxoxo mayelana nokuthi yisiphi isixhumanisi esikhethiwe.
Izilawuli ezintathu, izinqumo ezintathu
I-TLS eqinisekisiwe ivikela uxhumano futhi inquma ukuthi yiziphi izazisi ze-TLS ezamukelwayo. Ukungena kunethiwekhi kunquma ukuthi yimiphi imithombo engafinyelela kumlaleli. Ukwelashwa kwesizindalwazi kwelungelo kunquma ukuthi iyiphi indima engasebenzisa iziphi izinto nezenzo.
Akukho kokuthathu okuthatha indawo kwezinye, okuvezwa ngokucacile yithebula.
| Control | What it decides | What it leaves open |
|---|---|---|
| Authenticated TLS | Connection protection and which TLS identities are accepted | Which tables a database user may touch |
| Restricted network entry | Which sources reach the listener | Whether an authenticated user should run a given statement |
| Database authorization | Which objects and actions a role may use | Whether the connection arrived by an approved path |
Funda umugqa othembele kuwo ngaphambi kokususa omunye. Iningi lalezi zakhiwo lehla ngoba isilawuli sathathwa njengokuthile esikhundleni sokumiswa.
I-SQL eqaqile igcina inqubomgomo yesizindalwazi inesibopho
Ngoxhumano oluqaqile olugunyaziwe, gcina kokubili ukuqinisekiswa kobuwena besevisi kanye nenqubomgomo yokufinyelela ehlosiwe. Ukuvula i-TLS kwenza ukuxhumana okubethelwe kutholakale; akukwenqabi lokungabethelwanga ngaphandle uma ukumiswa kokufinyelela kukusho lokho ngezinto ze-hostssl.
Lowo mehluko kufanele uhlolwe ekumiseni okusebenzayo hhayi kusifanekiso. Iseva enikeza i-TLS futhi yamukela umbhalo ocacile akusona isakhiwo iningi elicabanga ukuthi lisisebenzisile. Funda imithetho yokufinyelela bese ubona ukuthi yiziphi izingxenye ezikudinga ngempela. Lokho kuhlola okukodwa kwehlukanisa iseva ekwazi ukubethela neyeva ebethelwe kuphela.
Sebenzisa izindima ezinamalungelo adingwa ngumsebenzi kuphela, futhi uhlole ubunikazi, ubulungu obuzuzwe kanye nezimvume ezinikezwe kabanzi. Isakhiwo samalungelo e-PostgreSQL ingumngcele wegunya lezinto zesizindalwazi.
I-VPN ingakhawulela ukuthi yimaphi amadivayisi afinyelela kusevisi ngaphambi kokwenzeka kokufakazelwa kwesizindalwazi, futhi isango lokungena lingenza okufanayo. Akukho kubona okususa isidingo sokunakekela ingxenye eveziwe, sokuphatha ubufakazi kanye nokukhawulela ukusetshenziswa kwezinsiza.
Izitifiketi zeklayenti ubufakazi, hhayi i-ACL
Isitifiketi sekhayenti singangeza imfuneko ngesikhathi sokuxhumana. Ukumiswa kwe-clientcert kungafuna isitifiketi esethenjwayo futhi, kwimodi eqinile, ubudlelwano phakathi kwegama lesitifiketi nomsebenzisi wesizindalwazi.
Lokho kungubufakazi obuqinile. Akulona uhlu lwezigunyazo, futhi akwenzi iseva ingabonakali, ngoba ingxenye eyamukela uxhumano isacubungula ukuhamba kwenethiwekhi nokuxhawulana. Ukuphatha isitifiketi njengohlu lokufinyelela kushiya izimvume zangempela zingathintwanga. Futhi ijwayele ukwandisa ukusatshalaliswa kwezitifiketi, okuyinto edala inkinga elandelayo.
Isitifiketi esiqinile esixhunywe endimini enamalungelo amaningi ngokweqile siveza umlawuli oqinisekiswe kahle. Hlola indima ngaphambi kokugubha isitifiketi.
Khetha isixhumanisi esincanyana uma kufanelekile
Ngesicelo sezindleko, indawo yokugcina yohlelo evuma isicelo, eqhawula imithetho yebhizinisi futhi ibuyisela umphumela ovunyelwe walowo msebenzisi imelela umsebenzi kangcono kune-akhawunti evamile ye-SQL.
Bese uhlelo lusebenzisa ubuwena yalo olulinganiselwe lwesizindalwazi, futhi iklayenti alitholi ulimi lwemibuzo njengesici. Leyo indawo encane enezindlela ezimbalwa zokwenza iphutha.
Lokhu ukukhetha kwesakhiwo hhayi isimangalo sokuthi ikhodi yohlelo iphephile ngokuzenzakalela. Leyo khodi kufanele iqinisekise abayibizayo, igunyaze isenzo ngasinye futhi iqinisekise okokufaka kwayo, futhi izimvume zayo zesizindalwazi zisabalulekile.
I-SQL eqaqile ihlala ilungile kubantu namathuluzi amsebenzi wabo ogunyaziwe ewadingayo. Khawulela leso sakhiwo ngezindima, ububanzi benethiwekhi kanye nemikhawulo yokusebenza, futhi uyeke abanye amaklayenti agcine isixhumani esincanyana. Ukuhlanganyela kwalezi zinhlanga ezimbili endimini eyodwa iyindawo lapho izingxoxo ziqala khona.