I-VPN iyaxhumana, kodwa i-SQL Server iyenqaba ukuqinisekiswa kwe-Windows

Amathuneli ayaphakama, amaseva ayaphendula ku-ping, futhi ukungena kudathabhethi kusahluleka ngephutha lokuqinisekisa. Leyo nhlanganisela ivamile ezixhumanisini ze-VPN futhi ayivamisile ukusho ukuthi inethiwekhi yephukile, ngoba isilaleli esifinyelelekayo nokungena okwamukelwe kuyimiphumela emibili ehlukene. Ubunikazi obanelise isango akubona ngempela ubunikazi obunikezwa iklayenti ledathabhethi. Ukuthola ukuthi iyiphi i-akhawunti efikile kuwumsebenzi wonke.

Uphawu: iseva efinyelelekayo, ukungena kunqatshiwe

Isikhathi sokulinda sikutshela ukuthi iphakethe alizange lifinyelele isilaleli. Iphutha lokuqinisekisa likutshela ukuthi isilaleli saphendula futhi sanqaba ubufakazi. Le mibiko emibili ikuthumela emaqenjini ahlukene, futhi ukuyixuba kuchitha usuku emthethweni wodonga lomlilo owawungakaze ube yinkinga.

Uma iphutha kuwukuhluleka kokungena, yeka ukubheka amachweba. Umbuzo osele ukuthi iklayenti lethule ubunikazi buni be-Windows, ingabe iseva samukela lobo bunikazi, nokuthi ngabe buxazululwe baba umsebenzisi wedathabhethi onemvume.

Ubunikazi obubili, ithuneli elilodwa

I-akhawunti ye-VPN iqinisekisa esangweni futhi ekufakweni okuningi iphelela lapho. Iklayenti ledathabhethi lethula ngokwehlukana ithokheni ye-Windows, ethathwe kunqubo eyisebenzisayo, noma ukungena kwe-SQL uma umucu wokuxhumana ukucela. Umsebenzisi we-VPN wendawo esangweni akanabo ubudlelwano nesizinda esisingatha i-SQL Server, futhi ithuneli aliwakhi lowo budlelwano.

Ukuxhuma umshini womuntu siqu ku-VPN nakho akukufaki esizindeni. Ukuqamba kabusha i-akhawunti yendawo nokufanisa iphasiwedi yayo nomsebenzisi wesizinda akuyona inqubo yokubhalisa, futhi kukhiqiza ithokheni isilawuli sesizinda esingeke siyemukele njengalowo msebenzisi.

Amanye amaklayenti omdabu wokufinyelela kude e-Windows angaphinda asebenzise ubufakazi be-VPN ezinsizeni zenethiwekhi uma iphrofayili yawo ihlelwe kanjalo. Lokho kuziphatha kungokweklayenti nephrofayili ethile, hhayi izixhumanisi ze-VPN ngokuvamile, ngakho-ke kuqinisekise kuklayenti elisetshenziswayo esikhundleni sokucabanga.

Funda imodi ecelwe iklayenti

Umucu wokuxhumana unquma ukuthi iklayenti lithatha iphi indlela yokuqinisekisa. Ukuphepha okuhlanganisiwe kusebenzisa ithokheni ye-Windows; ipheya lomsebenzisi nephasiwedi likhetha ukungena kwe-SQL. Lezi ziyimodi ezihlukene ekuhlelweni kweseva, futhi imodi eyodwa kuphela engavulwa emzamweni othile wokuxhumana.

Server=tcp:sql.lab.example,1433;Database=ops;Integrated Security=SSPI;Encrypt=True;TrustServerCertificate=False;

Ukuya ekungeneni kwe-SQL ngenxa yokuthi ukungena kwe-Windows kuhlulekile kuyisixazululo sesikhashana esifihla umbuzo wobunikazi, futhi ngokuvamile kudinga ukwakhiwa kokungena nephasiwedi entsha noma kunjalo. Uma ukufakwa kudinga ukuqinisekiswa kwe-Windows, gcina imodi bese ulungisa indlela yobunikazi. Ukungena kwe-SQL nakho kudinga izimvume zako, ngakho isixazululo sesikhashana sithenga i-akhawunti yesibili okufanele igcinwe.

Qinisekisa futhi ukuthi yiluphi uhlelo oluxhumayo. Isevisi esebenza njenge-akhawunti yesistimu, umsebenzi ohleliwe kanye newindi yombuzo esebenzisanayo kungethula amathokheni amathathu ahlukene kumshini owodwa, futhi elokugcina kuphela elihambisana nalokho umsebenzisi akubonayo lapho esebenzisa i-whoami.

Buza iseva ukuthi yini eyayibona ngempela

Iseva ingakutshela ukuthi yikuphi ukungena ekuqondile kanye nokuthi ukuxhumana kwaqinisekiswa kanjani. Sebenzisa umbuzo ngaphakathi kwesikhathi esiphenywayo, ngoba ukuxhumana okuphumelelayo kokunye komqondisi akufakazi lutho mayelana neklayenti elihlulekayo.

SELECT ORIGINAL_LOGIN() AS original_login,
       SUSER_SNAME() AS current_context;
SELECT auth_scheme, net_transport
FROM sys.dm_exec_connections
WHERE session_id = @@SPID;

Umugqa wokuqala uhlukanisa ukungena okuvule isikhathi nesimo sokuphepha esisebenza manje, futhi lezi ziyahluka ngaphansi kokuzenza omunye. Owesibili usho uhlelo lokuqinisekisa, ngakho i-KERBEROS, i-NTLM ne-SQL ziba amaqiniso abonakalayo esikhundleni sokuqagela. Ukuxhumana okubika i-NTLM lapho ubulindele i-Kerberos kuyinkinga yokuxazulula amagama noma ye-SPN, hhayi inkinga yephasiwedi.

Inombolo yephutha iyinciphisa nakakhulu. Isimo 5 ngokuvamile sisho ukuthi igama lokungena alizange lixazululwe nhlobo, isimo 8 ngokuvamile sisho ukuthi iphasiwedi ayifananga, futhi isimo 11 sisho ukuthi ubufakazi bamukelwe kodwa ukufinyelela kuseva kuhlulekile. Cela umqondisi isimo esikhundleni somyalezo wonke, ngoba umyalezo wodwa awucacile ngamabomu.

Lapho ubunikazi bufika futhi i-Kerberos isahluleka

Uma iseva ibona ubunikazi be-Windows obuhlosiwe futhi ukuqinisekisa okuhlanganisiwe kusahluleka, inkinga ukushintshana ngokwako. I-Kerberos idinga igama eliyinhloko lesevisi elibhalisiwe le-akhawunti yesevisi ye-SQL neklayenti elicela isevisi ngegama elihambisanayo. Ukuxhuma ngekheli le-IP akukwazi ukuhambisana ne-SPN esekelwe egameni, futhi i-alias ingahambisana kuphela uma nayo ibhalisiwe. Hlola igama elilotshwe yiklayenti kuqala kukho konke, ngoba ukuxhumana okusebenza ngegama lomsingathi futhi kuhluleke nge-IP kuchaza impela le nkinga.

Cela umqondisi ukuthi abuyekeze ubunikazi obubhalisiwe ne-akhawunti yesevisi esikhundleni sokwakha ama-SPN aphindwe kabili ngokuzama nokwephula. Ukubhaliswa okuphindwe kabili kukhiqiza ukwehluleka kwezikhathi ezithile okunzima ukukuxilonga kunenkinga yokuqala.

Ngemva kokuba ukuqinisekisa kusebenza, ukungena kusadinga umsebenzisi wedathabhethi nezimvume. Ukungena nge-VPN okuphumelelayo, ukungena nge-Windows okuphumelelayo kanye nemvume yokufunda ithebula elithile kuyimiphumela emithathu ehlukene, futhi ngayinye ifanele ukuhlolwa kwayo ngaphambi kokuvalwa kwethikithi.