Ngabe i-TLS wrapper ikunikeza inethiwekhi yangasese? Ngokuvamile cha

I-TLS ivikela umzila phakathi kwezigaba ezimbili futhi ayisho lutho mayelana nokuthi yiziphi izinsizakalo ezingaphakathi. I-wrapper ishintsha lowo mzila ube isidluliseli esisodwa esilungisiwe, somlaleli oyedwa, siya endaweni eyodwa. Umkhiqizo odayshwa njenge-SSL VPN uvamise ukwengeza isixhumi, ithebula lemizila kanye nemodeli yokufinyelela eduze kwesisekelo esifanayo. Ukudida lezi zinto ezimbili yikho okwenza umhubhe osebenzayo uthathwe njengokufinyelela kunethiwekhi.

Yini i-wrapper yensizakalo eyixhuma ngempela

I-wrapper ilalela embobeni yasendaweni futhi idlulisela okufikayo endaweni elungisiwe, kungaba umhlinzeki nombobo noma uhlelo lwasendaweni. Leyo ndawo iyikhethwa ngumuntu obhale ifayela lokulungisa, umlaleli oyedwa ngesikhathi. Ukufaka iphakethe akudali mizila, isixhumi esibonakalayo noma ukufinyeleleka kwanoma yini engabalwanga ngokucacile. Funda ukulungisa ngaphambi kwencazelo yephakethe, ngoba incazelo ihlanganisa isigaba sokusetshenziswa kanti ifayela lihlanganisa elakho.

Ngakho umbuzo owusizo mayelana ne-wrapper awukona ukuthi iyabhalisa yini, kodwa ukuthi yini emikhawulweni yomibili yochungechunge eyakha lona.

application -> local listener -> TLS connection -> remote listener -> configured backend

Funda lolo chungechunge kusukela ekulungiseni hhayi egameni lokumaketha. Umsheke ngamunye uyigxathu lenethiwekhi elihlukile elinekheli lalo kanye nemithetho yalo yokufinyelela.

Thola lapho umzila we-TLS uphela khona

Uma i-wrapper iqeda i-TLS, konke elikudluliselayo kuyisixhumanisi esisha esinezici ezintsha. Umfudlana ungaba umbhalo ocacile esigabeni sangasese, noma ungathwala enye iphrothokholi evikelwe ngaphakathi. Ukucabangela okukodwa kwalokho ngaphandle kokufunda ukulungisa kwe-backend yikho okwenza abantu bafinyelele esiphethweni sokuthi ungqimba lwangaphandle luvikela idatha engasayiboni. Igxathu elidluliselwe lifanelwe ukuhlolwa kwalo, ekhelini nase mbobeni walo.

Hlola umlaleli kanye ne-backend ngokwehlukana, ngoba ukuxhawula okuphumelelayo emnyango wangaphambili akusho lutho mayelana nensizakalo engemuva kwawo.

ss -ltnp | grep -F 443
openssl s_client -connect svc.example.net:443 -servername svc.example.net </dev/null | openssl x509 -noout -subject -dates

Umyalo wokuqala ukhombisa ukuthi iyiphi inqubo ephethe umbobo nokuthi ilalela ekhelini liphi. Owesibili uphrinta isitifiketi umthengi asithola ngempela, futhi lokhu ukuhlolwa kobunikazi okungeke kufakwe esikhundleni yinombolo yombobo.

Yini i-VPN egqagqayo eyengezayo i-wrapper engayenzi

I-VPN egqagqayo ifaka isixhumi, ithatha ubunikazi beziqalo ezikhethiwe futhi ihlangana nokugqagqa kanye nenqubomgomo yokufinyelela yomhlinzeki. Uhlelo lokusebenza ngalunye emshinini luzuza ngaphandle kokwazi ukuthi umhubhe ukhona. I-wrapper inikeza lokho kufinyelela kumlaleli oyedwa olungisiwe futhi iyeke lapho.

Ukungena kuyinto ehlukile futhi. I-VPN eqinisekisa umthengi isadinga ukugunyazwa okusho ukuthi umthengi angafinyelela kuphi, futhi i-wrapper eqinisekisa umlingani isadinga i-backend eqhuba izimvume zayo.

Kukhona inhlanganisela esemthethweni: iphrothokholi ye-VPN ethwelwa ngaphakathi kwe-wrapper ye-TLS phezu kwesakhiwo se-TCP esisekelwa ngamabomu. Lokho kubeka izingqimba ezimbili phezulu, futhi akwenzi i-wrapper ne-VPN kube uhlobo olufanayo lwento.

Qhathanisa umngcele ohlulekayo

Bhala ikheli langaphambili, umlaleli, ubunikazi bomlingani, umgomo we-backend kanye nokusebenza kohlelo ngaphambi kokushintsha noma yini. Bese uqhathanisa okufaniswayo: impumelelo ngokusebenzisa elinye igama lomhlinzeki noma umbobo akuqinisekisi ukuthi izimo zocingo lomlilo nesitifiketi zazifana.

Isicelo se-backend esenqatshiwe akufanele neze silungiswe ngokucisha ukuqinisekiswa kobunikazi bangaphambili. Lokho kushintsha ukwehluleka kokugunyazwa okutholakalayo ngokwehluleka kokuthembana okungatholakali.

curl -sv --resolve svc.example.net:443:203.0.113.10 https://svc.example.net/health 2>&1 | head -30

Ukubeka igama ekhelini elikhethiwe kwehlukanisa ukuxazululwa kwamagama nokufinyeleleka, futhi lokhu ngokuvamile kuyindlela esheshayo yokwazi ukuthi yikuphi kwalaba ababili okugobile.

Ukuqhathanisa okubalulekile kusho iziphetho ezivikelwe, umthwalo othwelwayo, izinhlelo ezisebenzisa wona kanye nemvume eqhutshwa endaweni. I-TLS inikela kulokho kuchaza ngaphandle kokukuphelelisa.