Isango lakho le-VPN lisadinga indlela yokufaka izibuyekezo

Umhubhe usebenza kubo bonke abangemuva kwawo, isango lihambisa ithrafikhi yabo, nokho umshini ngokwawo awukwazi ukufaka isibuyekezo sokuphepha. Lesi yisimo esijwayelekile senkinga: imvume yokudlulisa yanikezwa amaklayenti, futhi izixhumanisi zokuphuma zesango ngokwazo azange zifakwe ohlelweni. Umphathi wamaphakethe uvula amasokhethi akhe, kusukela esangweni, ebheke endaweni yokugcina angazange uyisho ndawo emthethweni we-firewall.

Ukuvala isango kuhle. Ukulivala ngokuqinile kangangokuthi liyeke ukuthola amapheshi kusinqumo esihlukile, futhi ngokuvamile kuyisinqumo esingahlosiwe.

Ukuphuma kwendawo akuwona ukudlulisa kwamaklayenti

Imithetho yokudlulisa ilawula amaphakethe afika avela kwenye indawo futhi aphuma ngesango. Ithrafikhi yesibuyekezo yesango ngokwalo ayihlangani nayo neze; iyakhiwa endaweni futhi ihamba ngomzila wokuphuma. Lowo mehluko uchaza ukuhluleka okubonakala kungenzeki kuyilapho ukufinyelela kwamaklayenti kusebenza kahle.

Futhi kuchaza igebe lomthetho elidlula izivivinyo, ngoba ukuhlola okusheshayo okuvela kukhompyutha ephathekayo ngemuva komhubhe kufakazela ukuthi iketanga yokudlulisa iyasebenza futhi akusho lutho ngezixhumanisi zomethuli ngokwakhe. Thatha isango njengezinto ezimbili: umhambisi onoketanga yokudlulisa nomethuli onoketanga yokuphuma. Zombili zidinga umbono, futhi ngokuvamile kuyodwa okubhalwayo.

Shono igama lesigaba esihlulekile

Amaphutha esibuyekezo abiza imingcele ehlukene, futhi ukubamba umthetho wechweba ngaphambi kokufunda ukuthi yikuphi okuhlulekile kudla intambama. Igama lendawo yokugcina elingaxazululeki liwumbuzo we-resolver, hhayi umbuzo wezokuthutha.

getent hosts deb.debian.org
curl -sSI https://deb.debian.org/debian/dists/stable/Release | head -n 1
apt-get -o Debug::Acquire::https=true update

Ukuphela kwesikhathi ngemuva kokusesha okuphumelelayo kuhambisa umbuzo kwezokuthutha: yiliphi ikheli, yiliphi ichweba futhi iyiphi iphrokhisi elungisiwe umphathi wamaphakethe ayezame ngempela. Ukuhluleka kokuqinisekisa kwe-TLS kuyinto yesithathu, ehluke ngokuphelele, futhi kusho ukuthi uxhumano lwasebenza kahle ngokwanele ukuxoxisana. Isikhalazo mayelana nokuqinisekiswa kwengqoqo yisigaba sesine, futhi siphathelene nemethadatha esayiniwe hhayi ukufinyeleleka. Izigaba ezine, izilungiso ezine ezihlukene, futhi i-ping ihlezi ichaza iphrothokholi eyodwa kuphela okungekho mphathi wamaphakethe oyisebenzisayo.

Funda uhlu lwemithombo ngaphambi kokwengeza umthetho

Bhala uhlu lwama-URI wemithombo wangempela kanye nokulungiselelwa kwephrokhisi okusebenzayo, hhayi leyo oyikhumbulayo. Umthetho obhalelwe i-HTTP elula awusizi lapho umthombo kuyi-HTTPS, futhi iphrokhisi eyaziwa yi-shell ingase ingabonakali kunsebenzo eqalwa ekusungulweni ngendawo ehlukile.

Incwadi yezokuthutha ye-HTTP ku-APT ihlanganisa izilungiselelo zephrokhisi zendawo kanye neziqondene ne-APT, kuhlanganise nokukhethwa ngomethuli ngamunye, futhi ukuthutha kwayo kwe-HTTPS kunezilungiselelo zokuqinisekisa zakho. Umzila othathwa yisiphequluli nomzila othathwa umphathi wamaphakethe yimizila ehlukene, ngisho emshinini ofanayo.

Qaphela imindeni yamakheli okuxazululwa kuyo imithombo. Umthetho ovumela i-IPv4 kuphela uzohluleka njalo kumethuli okuthi imithombo yawo ikhetha irekhodi le-AAAA, futhi iphutha libonakala njengelivela ngezikhathi, ngoba lincike ekutheni iyiphi impendulo efika kuqala.

Khetha umzila wokunakekela owodwa futhi unamathele kuwo

Kunezinketho ezintathu ezingavikeleka: ithrafikhi yokunakekela ngomhubhe, ngephrokhisi yesibuyekezo elawulwayo, noma ngokukhishwa okuqondile okuncane. Khetha eyodwa ngamabomu futhi wenze ukuthi i-resolver ivumelane nayo, ngoba ukwehlukaniswa lapho amagama exazululwa khona kolunye uhlangothi futhi izixhumanisi ziya kolunye kudala ukuhluleka okungekho muntu ongakuchaza.

Noma yini oyikhethayo, akumele ibe umzila wesipele ongenamkhawulo. Uma ithrafikhi yokuphuma eqondile ivinjelwe lapho umhubhe uphansi, ukukhishwa kokunakekela okuvumela konke buthule wushintsho lomthetho olufihlwe njengesilungiso. Gcina indawo yokugcina yesango ngokwalo kanye nezidingo ze-bootstrap esigabeni esihlukile ekufinyeleleni endaweni yokugcina, ngoba zikhomba ezindaweni ezihlukene futhi zihluleka ngezindlela ezihlukene, ngakho ukukhishwa okukodwa akukwazi ukumboza okunye.

Qinisekisa ngaphandle kokwenza buthakathaka ukuhlola

Sebenzisa ububanzi ngokusebenzisa i-firewall esivele inawo umthetho, esikhundleni sokwengeza umphathi wesibili ngoba incwadi ethile yayisebenzisa. Bese ugijima ukuvuselela kwemethadatha kanye nokwenziwa komsebenzi wamaphakethe kwangempela ngaphansi komthetho ogcinwayo, futhi ufunde umphumela hhayi isimo sokuphuma kuphela.

Ukuthutha okuphumelelayo akusona imvume yokukhulula ukuqinisekisa. Ukuqinisekiswa kwengqoqo kanye nobunikazi besiphaka se-TLS yiziqinisekiso ezihlukene, futhi ukucisha noma yikuphi kuzo ukuthulisa iphutha kushintsha lokho okuthembayo, hhayi lokho ongakufinyelela.

Qedela ngokuhlola ngamabomu isimo esingenawo umhubhe. Ukwazi ukuthi isango liziphatha kanjani ngaphandle komhubhe walo kuyingxenye yokuklama, ukukuthola ngesikhathi sokuphazamiseka akusikho. Yehlisa umhubhe, ugijime ukuvuselela kwemethadatha bese uqinisekisa ukuthi umethuli uhluleka ngendlela obuyihlose, hhayi ukuwa buthule emuva emzileni ovulekile. Gcina izifakazelo zendawo yokugcina kanye nephrokhisi ngaphandle kokuxilongwa okwabiwe, futhi ushiye inothi elisho ukuthi ngubani umnikazi womzila wesibuyekezo.