I-DNS ye-VPN iyasebenza, kodwa amagama e-.local asahluleka: ngubani owaxazululayo?

Amamashini amabili ku-VPN eyodwa, igama elilodwa lomsingathi, futhi yinye kuphela yawo elixazululayo: umehluko ngokuvamile awusona umhubhe kodwa ukuthi iyiphi isixazululi eyaphendula. Kudeskithophu ye-Linux lelo gama lingadlula kusishintshi sesevisi yamagama, kusistub se-systemd-resolved, noma kusixazululi esalethwa uhlelo lokusebenza, futhi ngasinye sisebenzisa umthetho waso kulelo suffixi elifanayo. Umthetho uhlukana khona kuleso suffixi, ngoba i-.local ayilona ilebula elingathathi hlangothi. Thola ukuthi uhlelo oluhlulekayo luthatha yiphi indlela ngempela ngaphambi kokushintsha ukulandelana okusetshenziswa yikho konke.

Izixazululi ezimbili, izimpendulo ezimbili ezihlukene

Ukusesha kwendabuko kwe-glibc kudlula kulayini we-hosts: ku-nsswitch.conf futhi kubuza imoduli ngayinye ngokulandelana kuze kuphendule eyodwa. Iklayenti elikhuluma ne-systemd-resolved ngokusebenzisa isilaleli se-stub libuza inqubo eyodwa esikhundleni salokho, futhi leyo nqubo isebenzisa inqubomgomo yokuxhumana ngakunye kanye nezehlakalo zayo ezikhethekile. Uhlelo lokusebenza oluletha isixazululi salo noma oluxhumanisa umtapo wezincwadi okwenza lokho lungadlula kokubili. Ngakho igama elilodwa lomsingathi lingaba nabanikazi abathathu kumashini oyedwa, futhi munye kuphela wabo owaziyo ukuthi i-VPN yayihlose ukuthini.

Khomba umnikazi ngaphambi kokushintsha noma yini, ngoba isixazululo sihlukile komunye nomunye wabathathu. Isiphequluli nethuluzi lomugqa womyalo kudeskithophu efanayo kungase kungavumelani ngokusemthethweni, futhi lokho kungavumelani kuwumkhondo, hhayi iphutha. Uma isiphequluli sixazulula igama kanti ithuluzi alikwazi, ulungisa indlela yesixazululi hhayi indlela ye-VPN. Qinisekisa indlela ngokwehlukana, ukuze iphutha lokuhambisa lingadidaniswa nephutha lesevisi yamagama. Uma kokubili kuvumelana, iphutha lingaphezulu komsingathi futhi ukucushwa kwesixazululi lapha akukufanele ukunye ukuhlelwa.

Umyalo upi owabuza isixazululi sakho ngempela

Imiyalo emibili yokufunda kuphela iphendula imibuzo ehlobene, futhi ukuyiqhathanisa kuthola indawo yenkinga ngokushesha kunokufunda ukucushwa. Sebenzisa igama langempela langaphakathi futhi gcina umphumela uyimfihlo, ngoba amarekhodi angaphakathi ahlala engaphakathi. Sebenzisa kokubili kuseshini efanayo lapho uhlelo oluhlulekayo lusebenza khona:

getent ahosts files.corp.local
resolvectl query files.corp.local
resolvectl status

Okokuqala kubuza ngamamoduli acushiwe, okuyikho okuhlangenwe nakho uhlelo olujwayelekile. Okwesibili kubuza ngqo i-systemd-resolved futhi kubika isixhumanisi, iphrothokholi kanye neseva ephendulile. Ukubuza iseva yenkampani ngekheli kufakazela kuphela ukuthi iseva inerekhodi, ngoba akusho lutho mayelana nokuthi uhlelo lokusebenza lwake lwayibuza yini. Funda isixhumanisi esithwala i-VPN kanye nezizinda ezizibanga, bese uqhathanisa lolo hlu nemvume yegama elihlulekayo.

Kungani i-.local idlula indawo yakho ye-unicast

isithenjwa se-systemd-resolved sithi amagama anamalebula amaningi aphela nge-.local ngokuvamile aya ku-DNS ye-multicast uma i-mDNS ivuliwe, esikhundleni se-DNS evamile ye-unicast. I-RFC 6762 ibekela lelo gama indawo ye-multicast yasendaweni, ngakho indawo yenkampani ingaba nerekhodi elilungile elingakaze libuzwe ngaleyo suffixi. Umhubhe ungaqondisa kahle isixazululi futhi wehlulwe umncintiswano. I-ping ephumelelayo evela kusikhashana ayisho lutho mayelana nokusesha okusanda kwenzeka.

Kukhona okuhlukile okubhaliwe, futhi kuxazulula iningi lalezi zehlakalo: uma isixhumanisi simemezela leyo suffixi njengesizinda sokusesha noma isizinda sokuhambisa, i-daemon iyigcina endleleni ye-unicast futhi yeqa icala elikhethekile le-multicast. Leyo inqubomgomo yokuxhumana ngakunye hhayi ukuthanda komhlaba wonke. Amamashini amabili aneseva ye-VPN efanayo angaziphatha ngendlela ehlukile uma iphrofayela yamanethiwekhi eyodwa imemezela isizinda kanti enye ingasichazi, ngakho funda iphrofayela esebenzayo hhayi leyo okhumbula ukuthi wayihlela.

Okuhlukile okuncane kunqoba ukuhlelwa kabusha komhlaba wonke

Esizindeni esikhona ongakwazi ukusishintsha igama, cela abanikazi besixazululi ne-VPN ukuthi bamemezele isizinda kusixhumanisi esisithwalayo. Ukufakwa kwesizinda sokuhambisa kuleyo suffixi eyodwa kanye nekheli leseva elihlosiwe kuwushintsho oluncane olumnikazi oqanjiwe, futhi luhlala nesixhumanisi hhayi efayeleni elihlelwe ngesandla.

Lidlula nokunqanyulwa, ngoba inqubomgomo yesixhumanisi isetshenziswa futhi lapho isixhumanisi sibuya. Ukuhlela i-nsswitch.conf eyabiwe kuyindlela ekhangayo futhi ebiza kakhulu, ngoba ishintsha ukuziphatha kokusesha kwawo wonke amagama kumashini, kuhlanganise nokutholwa kwasendaweni. Ukukhubaza i-daemon ye-multicast nakho akulingani: kususa ukuziphatha kwasendaweni ngaphandle kokufundisa noma yisiphi isixazululi ngendawo yenkampani. Uma isevisi intsha hhayi yefa, yibeke ngaphansi kwesizinda esingaphansi esilawulwa yinhlangano yakho futhi weqe ukuncintisana ngokuphelele. Khetha okuhlukile okuncane uma igama libekwe kufirmware noma linyathelisiwe kulebula, futhi khetha isizinda esingaphansi esisha uma usalawula iklayenti.

Yini okufanele ifakazelwe ngemuva koshintsho

Fakazela isixazululo ngokusesha kohlelo lokusebenza uqobo hhayi ngethuluzi olifakele ukuhlola, futhi sula noma yisiphi isikhashana esingase siphendule esikhundleni salo. Bese uqinisekisa indlela yesixazululi kanye nesixhumanisi esinikeze impendulo. Ekugcineni hlola ukuthi ukutholwa kwasendaweni kuziphatha njengangaphambi koshintsho, ngoba iphrinta eyeka ukuvela iyingxenye abantu abayiqaphela ekugcineni. Le miyalo emithathu ihlola igama, indlela kanye nobuwena be-TLS ngalolo landelano:

getent ahosts files.corp.local
resolvectl query files.corp.local
curl -sv --max-time 5 https://files.corp.local/ 2>&1 | head -n 20

Ikheli elilungile elinesitifiketi esingalungile lisahlulekisa iklayenti eliqinile, ngakho hlola igama uhlelo lokusebenza olilindele uma ukuxazulula kusebenza. Qinisekisa ukuthi isevisi yamukela ukuxhumana okuvela ekhelini le-VPN hhayi kuphela ebangeni lehhovisi. Bhala ububanzi besizinda, iseva kanye nomnikazi emibhalweni yoxhumano. Uma kungenjalo, umuntu olandelayo ohlangabezana nalokhu kwehluleka uzothatha ukuhlelwa komhlaba wonke okugwemile manje.