Isango lakho le-VPN likhungethwe: okwembulwa ngempela
Isango le-VPN elihlakisiwe libona ngaphakathi kumhubhe walo, kodwa lokho akukhona ukuphatha yonke iseshini. Hlukanisa ithrafikhi, ukufinyelela kanye nezimfihlo ezigciniwe ngaphambi kokubuyisela.
Isango le-VPN sitholakala ekugcineni komhubhe eliwuvikelayo, okusho ukuthi siqeda lokho kubethela esikhundleni sokukudlulisa. Uma umhlaseli elawula umsingathi, umhubhe uyaqhubeka ubonakala uphilile ngaphandle kuyilapho umshini ophakathi ungathembekile. Umbuzo owusizo awukho wokuthi ingabe konke kuyahlukaniswa. Umbuzo ngukuthi lowo msingathi wayengabona ini, wayengafinyelela kuphi, futhi yiziphi izimfihlo ezazigcinwe kuwo ngempela. Lezi zimpendulo ezintathu zihluke kakhulu, futhi indlela yokusabela ihluke kanye nazo.
Isango siqeda umhubhe, ngakho sibona ngaphakathi kuwo
Ukubethela kwi-VPN kuhamba ngokugxuma ngokugxuma, futhi isango yilokho kugxuma. Sisusa ungqimba lwangaphandle, sisebenzisa inqubomgomo futhi sidlulisa iphakethe langaphakathi, ngakho iphakethe ngalinye elithwalwayo likhona ngendlela efundekayo emqondweni walowo msingathi ngesikhathi esithile. Lokho kuwukuklama hhayi iphutha. Yingakho ukukhungethwa kwesango kuyisigameko esihlukile ekukhungethweni kombhalo wokubethela womhubhe.
Into yokuqala umhlaseli ayitholayo yisikhundla: ikhono lokubuka ithrafikhi ethwalwayo, ukushintsha ukudluliswa, noma ukuphendula esikhundleni se-backend. Lokho akuthola kamuva kuncike kumsingathi, futhi lapha abantu bakhulisa ngokweqile. Ukufinyelela esangweni kuphela akunikezi izikhiye zesesheni ye-TLS yesiphequluli, ngoba azikaze zibe sesangweni.
Ukuchayeka okuthathu okungalingani ngosayizi
Hlukanisa umbuzo kube ithrafikhi ethwalwayo, izinhlelo ezingafinyeleleka kanye nezimfihlo ezigciniwe, bese uphendula ngakunye ngokwahlukana.
| Exposure | What the attacker gains | What does not follow |
|---|---|---|
| Carried traffic | Plaintext of whatever the tunnel forwards without its own encryption | Keys for TLS sessions that terminate at the application |
| Reachable systems | Whatever the backends accept from the gateway's address | Control of every connected client endpoint |
| Stored secrets | The specific keys, tokens and accounts present on that host | Possession of every client certificate or of a CA key |
Umugqa ophakathi yiwona odlulwayo. Isango ngokuvamile linomzila wokungena kumanethiwekhi angasese kanye nekheli lomthombo izinhlelo zangemuva esezilithembile, ngakho umbuzo othakazelisayo ngukuthi lezo zinhlelo zangemuva zivumela ini kusukela kulelo kheli. Inqubomgomo emincane yokufinyelela kwekhasimende iwukulawula okuhle, kodwa umhlaseli osemsingathini akakhawulelwe kusixhumi esisetshenziswa ikhasimende elijwayelekile.
Umugqa ophansi unquma ukuthi isigameko sithatha isikhathi esingakanani. Ukhiye wesiphakeli kanye nokhiye we-CA banemiphumela ehluke ngokuphelele, futhi kanjalo ne-akhawunti yokuphatha yasendaweni kanye nethokheni yokuqapha yokufunda kuphela.
I-HTTPS engaphakathi kumhubhe iseyi-HTTPS
I-TLS yohlelo lokusebenza iphelela kuhlelo lokusebenza, hhayi esangweni le-VPN, ngakho isango elikhungethiwe libona kuphela umbhalo obethelwe waleyo mifudlana. Lokho kuwumkhawulo wangempela walokho umhlaseli akutholayo, futhi kufanele kushiwo ngokucacile, ngoba isitatimende esiphambene sisabalalisa uvalo nezinqumo ezimbi. Izimo ezimbili ziyaphula lokho. Uma ingxenye yokuhlola enesitifiketi esithenjwayo isendleleni, isango lingabona umbhalo ocacile ngokokuklama. Uma indawo yokugcina yohlelo lokusebenza ngokwayo ikhungethiwe, umhubhe awusasebenzi.
Ngakho impendulo yokuthi babona ini inemibandela, futhi kufanele ibhalwe njengemibandela esikhundleni sokumenyezelwa njengesinqumo.
Yini okufanele ishintshe ngaphambi kokuthemba futhi
Ukwakha kabusha umsingathi kuyadingeka futhi akuvamisile ukwanele. Umhlaseli osaphethe i-akhawunti yokuphatha, ubufakazi bokusabalalisa noma ukhiye wokusayina angabuyisela umsingathi ngendlela ayifunayo. Ukubuyisela kufanele kuqale endleleni yokuphatha engathembeli kumshini okhungethiwe.
Ngaphambi kokunquma ukuthi yini ezoshintshwa, yenza uhlu lwalokho okwakukuwo. Izikhiye, ama-akhawunti wesevisi, amathokheni e-API, abasebenzisi basendaweni, imisebenzi ehleliwe, ubudlelwano bokuthembana kanye nomgudu wokusabalalisa konke kungabagadli, futhi ngakunye kunomnini okufanele akuqinisekise.
ss -lntup
getent passwd
crontab -l
ip route show table allLolo hlu luyindlela eshesha kakhulu yokubona ukuthi umsingathi wawunikezani nokuthi wawungafinyelela kuphi. Gcina ubufakazi kuqala, ngokwenqubo yomnini wokusabela, ngoba ukwakha kabusha kubhubhisa ngqo lokho uphenyo olukudingayo. I-NIST SP 800-61 Ukubuyekezwa 3 ibheka ukulungiselela, ukutholwa, ukusabela nokubuyisela njengezingxenye zenqubo eyodwa yengozi, hhayi njengomyalelo wokuqalisa kabusha.
Imingcele eyenza okulandelayo kushibhe
Imingcele emine kufanele yakhiwe ngaphambi kokuba uyidinge. Gcina indlela ezimele yokubuyisela engaqinisekisi ngokungena ngesango. Gcina igunya lokusayina lihlukile kumsingathi osebenza ithrafikhi. Khawulela ukuthi isango lingafinyelela kuphi, ukuze isango elikhungethiwe lingabi yinethiwekhi yokuphatha ekhungethiwe ngokuzenzakalela. Futhi bhala ukuthi ubani umnikazi wabo bonke ubufakazi, ukuze ukushintsha kube ucingo olulodwa esikhundleni sephrojekthi yezinto zakudala.
Akukho kulokhu okuvimbela ukukhungethwa. Kuyakunciphisa, futhi kwenza umehluko phakathi kweviki elibi nekota elibi.