Ping yana aiki amma SSH ya kasa ta VPN: wane mataki ya karye?
Wani gwaji mai cikakken bayani yana raba isar TCP, jigilar SSH, asalin mai masauki, shigar mai amfani da izinin zaman, don ku daina zato game da ramin.
Amsoshin ping da an ƙi shigar SSH na iya zama gaskiya a lokaci ɗaya, kuma ma'auratan ba sa zargin ramin. Amsoshin amsa-kuwwa da haɗin TCP zuwa tashar 22 gwaje-gwaje ne daban-daban da zaɓaɓɓun daban-daban, manufofi daban-daban da sau da yawa wurare daban-daban. Ɗauki gwajin SSH guda ɗaya da gangan, sannan ka ambaci matakin ƙarshe da ya kai. Wannan kayan tarihi ɗaya yana maye gurbin canje-canjen tsari goma sha biyu na hasashe.
Ɗauki gwaji ɗaya, ba zaman tona-toka ba
Gudu da abokin ciniki sau ɗaya tare da cikakken bincike, an kashe raba haɗin, da ƙayyadadden lokacin haɗi. Kashe rabawa yana da muhimmanci domin babban haɗin da aka riga aka tabbatar zai amsa don sabon gwajin kuma ya ɓoye gazawar da kake bibiya.
ssh -4 -vv -o ControlPath=none -o ConnectTimeout=10 [email protected]Ka riƙe manufa, dangin adireshi, hatimin lokaci da kuskuren ƙarshe marar ɓoye. Alamar IPv4 kuma tana nufin wannan gwajin ba ya ce komai game da hanyar IPv6 zuwa wannan suna, don haka kada ka yi gama-gari daga gare shi. Rubuta inda aka yi gwajin. Bincike a ƙofar VPN ba irin ra'ayin kwamfutar tafi-da-gidanka da ke bayanta ba ne, kuma yawancin sabani a cikin waɗannan tikiti suna zuwa ne daga haɗa biyun.
Mataki na ɗaya da na biyu: TCP kafin SSH
Iyakar farko ita ce isar da soket: adireshi, tasha da hanyar da fakitin ke bi da gaske. Idan haɗin TCP ba ya taɓa cika, babu wani abu a samansa tukuna, kuma makullin mai masauki da asusu ba su da muhimmanci.
nc -vz 10.90.4.20 22
ip route get 10.90.4.20
tcpdump -ni any 'host 10.90.4.20 and port 22'Haɗa rikodin da gwajin abokin ciniki. SYN da ke fita kuma babu abin da ke dawowa yana nuna tacewa, zaɓaɓɓu ko hanyar da ta ɓace a gefen nesa; amsa da sake saiti tana nuna wani abu da ke ƙi da gaske maimakon jefarwa. Iyaka ta biyu ita ce musayar ka'idar SSH kanta. Haɗin TCP da ya cika sannan ya tsaya ya wuce isa ya shiga tattaunawa, amsar uwar garke ko sarrafa fakiti. Wannan bincike ne daban, kuma a nan ne matsalolin da suka shafi girma suka fara yiwuwa.
Mataki na uku: waɗanne maɓalli suka amsa
Da zarar jigilar ta tashi, abokin ciniki yana tabbatar da maɓallin mai masauki na uwar garke. Ƙin a nan magana ce game da asali, ba game da ɓoyewa ba: abokin hulɗa ya gabatar da maɓalli wanda manufarka ba ta karɓa. Ka ɗauki hakan a matsayin sharadi na tsayawa kuma ka tabbatar a wajen tashar, ta hanyar na'ura ko ma'aikacin da ya sake gina mai masaukin. Share rikodin da aka adana don kawar da gargaɗin ita ce hanya mafi guntu da ya kamata ka ƙi, domin tana lalata shaidar cewa wani abu ya amsa ba tare da tsammani ba.
Idan da gaske an sake gina mai masaukin, cire tsohon rikodin ne kawai bayan an tabbatar da sabon sawun yatsa, kuma ka rubuta kwanan wata da dalili. Injiniyan na gaba zai haɗu da wannan gargaɗin kuma yana buƙatar wannan mahallin.
Mataki na huɗu da na biyar: asusu da izini
Tabbatarwa ita ce iyaka ta huɗu. Ƙin takardun shaidar yana nufin uwar garken ta yi la'akari da gwajin kuma ta ƙi shi; duba asusun, nau'in takardar shaidar da uwar garken ke karɓa da manufofin uwar garken kanta maimakon kalmar sirri ta VPN. Iyaka ta biyar ita ce izini bayan shiga mai nasara. Ana iya hana mai amfani da aka tabbatar da harsashi, umarni, ƙaramin tsari ko turawa gaba, kuma waɗannan ƙin suna kama da gazawa ga wanda ke karanta layin ƙarshe na abokin ciniki kawai.
| Last stage reached | What it proves | Where to look next |
|---|---|---|
| No TCP connection | No SSH transport exists | Address, port, route, selectors, filter, listener |
| TCP up, exchange incomplete | Reachability is not the blocker | Server response, negotiation, packet handling |
| Host identity rejected | The peer is not the expected host | Independently verified host key |
| User authentication rejected | The attempt reached authentication | Account, credential and server policy |
| Authenticated, session denied | Login succeeded, the operation did not | Shell, command or forwarding permission |
Tsaya bayan gwaje-gwajen kalmar sirri da suka gaza. Maimaita zato yana haifar da kullewa waɗanda daga baya suka yi kama da na biyu, gazawar da ba ta da alaƙa kuma suna ɗaukar lokaci fiye da tikitin asali.
Komawa baya da rikodin da kuke ajiyewa
Canza abu ɗaya a lokaci ɗaya, kuma rubuta abin da ka canza kafin ka sake gwadawa. Idan canji ya sa gwajin ya fi muni, mayar da shi nan take maimakon tara wani gyaran a kai. Maimaita aikin asali daga abokin ciniki da mahallin asali. Shiga mai nasara daga wata na'ura, a wani dangin adireshi, ba haifuwa ba ne kuma ba ya tabbatar da gyaran.
Tsaftace abin da kuke rabawa. Cikakken fitowar abokin ciniki na iya ɗauke da sunaye na ciki, lakabin asusu, hanyoyin maɓalli da masu gano maɓallin jama'a, don haka buga matakin ƙarshe maimakon bin sawu.