Me ya sa binciken tashar (port scan) yake canzawa idan an gudanar da shi da sudo

Nmap ba koyaushe yake aika fakitin da kuke tsammanin kun nema ba. Sa’ad da babu raw sockets, yana maye gurbin binciken SYN na asali da binciken TCP connect, don haka gudanarwa a matsayin talaka da gudanarwa ƙarƙashin sudo na iya amsa tambayoyi daban-daban game da tashar ɗaya. Sakamakon yana kama da matsalar izini, kuma yawanci canjin hanya ne. Bayyana hanyar a fili ita ce hanya ɗaya tilo ta kwatanta gudanarwar biyu kwata-kwata.

Bincike biyu, tasha ɗaya, hanyoyin code daban-daban

Binciken SYN yana gina kan TCP da kansa, yana aika shi daga raw socket, kuma yana karanta amsar daga waya kafin stack ɗin TCP na kernel ya taɓa rubuta haɗin da ya cika. Binciken connect yana neman tsarin aiki ya buɗe socket na yau da kullum kuma yana ba da rahoton abin da connect() ya dawo da shi. Dukansu suna iya kiran tasha a buɗe, amma ɗaya ne kawai ke barin yunƙurin rabin-buɗe kuma ɗaya ne kawai ke ƙarƙashin manufofin matakin socket da ke da alaƙa da tsarin da ke aikawa.

Hanyar raw tana buƙatar CAP_NET_RAW, wanda shi ya sa binciken asali yake raguwa a hankali idan wannan ƙarfin babu. Mai ba da shawara kan dabarun bincike na Nmap da kansa ya rubuta maye gurbin: binciken connect shine madadin saboda baya buƙatar wani izini na musamman kwata-kwata. Canjin yana faruwa ba tare da gargaɗi ba a yawancin gudanarwa, kuma wannan shine abin da ke sa shi sauƙin karantawa da kuskure. Da zarar kun san akwai madadin, “buɗe a matsayin root, rufe a matsayin mai amfani” ya daina jin kamar kuskuren izini kuma ya fara jin kamar ma'auni biyu daban-daban.

Abin da sudo yake canzawa a cikin binciken

Ɗaga izini yana dawo da hanyar raw socket, kuma hakan yana canza fiye da hukuncin. Zaɓin tashar tushe, lokacin fakiti, halin sake aikawa da yadda ake rarraba amsa da aka tace duk suna zuwa daga code daban. Na'urar tsaka-tsaki da ke iyakance adadin SYN tana ɗaukar gudanarwar biyu ba daidai ba ko da mai masaukin manufa ɗaya ne.

Rubutun log a gefen manufa shima ya bambanta. Handshake da ya cika ana iya gani ga sabis ɗin da ga kowace lissafin socket, yayin da binciken rabin-buɗe da aka sake saitawa sau da yawa ba a gani. Idan ka kwatanta gudanarwa da mai masauki wanda kake karanta log ɗinsa kuma, wani ɓangare na bambancin da kake gani shine abin lura da kansa.

Rike hanyar a tsaye a duka gudanarwar biyu

Tilasta dabarar ɗaya a duka kira biyun kuma kwatancen zai fara yin ma'ana. Tutar -sT tana neman binciken connect a fili, -Pn tana cire gano mai masauki, -n tana cire warware suna, kuma -p ɗaya tana cire bambance-bambancen jerin tashoshi.

nmap -sT -Pn -n -p 8443 198.51.100.77
sudo nmap -sT -Pn -n -p 8443 198.51.100.77

Maye gurbin adireshin da tashar da mai masaukin da aka ba ka izinin gwadawa; kewayon takardun da ke sama misali ne, ba manufa ba. Idan gudanarwar biyu yanzu sun yarda, bambancin asali ya fito ne daga hanyar binciken. Idan har yanzu ba su yarda ba, wani abu ne ke rarraba zirga-zirgar, kuma sashe na gaba shine inda za ka duba.

Yanayin asusu ba tuta ce kawai ta izini ba

Turawar VPN na iya rarraba fakiti ta UID, ta cgroup, ko ta wata doka da ke da alaƙa da tsarin da ya buɗe socket ɗin. Sa'an nan zirga-zirgar root da ta mai amfani suna fita ta teburin hanyoyi daban-daban ko suna fuskantar jerin dokoki daban-daban, kuma babu wani tsari na hanyar bincike da zai daidaita su.

Bincika manufofin maimakon izini. A Linux, nftables yana bayyana hakan da meta skuid kuma iptables da daidaiton mai shi, kuma kowanne daga cikinsu na iya aika UID ɗaya ta rami yayin da ɗayan yana ci gaba da amfani da hanyar jiki ta asali.

sudo nft list ruleset | grep -n skuid
sudo iptables-save | grep -n uid-owner
ip rule show
ip route get 198.51.100.77

Tabbatar da binciken kafin ka kwatanta sakamako

Kafin ka yanke shawara, tabbatar da wane bincike ne ya gudana. Nmap yana ambaton dabarar a cikin fitarwarsa, kuma --reason yana ƙara hujja bayan kowace yanayi, wanda shine ɓangaren da yake gaya maka ko handshake ya cika da gaske.

nmap --reason -sT -Pn -n -p 8443 198.51.100.77
sudo nmap --reason -sS -Pn -n -p 8443 198.51.100.77
getcap "$(command -v nmap)"
capsh --print | grep -i net_raw

Gudanarwa biyu da ke ba da rahoton yanayi ɗaya saboda dalilai daban-daban ba sabani ba ne, kuma gudanarwa biyu da ke ba da rahoton yanayi daban-daban saboda dalili ɗaya suna nuni ga hanyoyi ko manufofi maimakon binciken. Rike manufa, tasha, sararin suna da lokaci daidai, sannan canza sauyi ɗaya a lokaci ɗaya. Gudanar da sabis ɗin a matsayin root ba shine gyaran rashin daidaituwar manufofi ba; bayyana manufofin da aka nufa ta hannun mai sabis ɗin shine gyaran.