Me ya sa jerin FTP ke ratsewa bayan ƙofar VPN da ke yin NAT
Shiga da PWD suna yin nasara yayin da LIST da RETR ke tsayawa lokacin da NAT ke sake rubuta kawunan kawai. Duba inda mataimakin FTP ya kamata ya zauna da yadda ake gyara yanayin passive.
Shiga yana aiki, PWD yana aiki, sannan LIST yana ratsewa har abokin ciniki ya fidda hannu ko ya koma wani yanayin bayanai. Wannan rabuwa ita ce sa hannu: hanyar haɗi ta sarrafawa zuwa tashar 21 tana da lafiya, yayin da ake gina hanyar haɗin bayanai daga wani adireshi ko tasha da wani gefen ba zai iya kaiwa ba. Bayan ƙofar VPN da ita ma ke yin NAT, wanda ake zargi da yawa shi ne umarnin FTP wanda kayan sa ke ambaton adireshin rami kamar 10.8.0.6. Fassarar kawuna ba ta taɓa wannan darajar ba.
Abin da ke biyo shi ne inda wannan darajar ta fito, da wace akwati aka yarda ta canza ta.
Abin da ke karyewa shi ne kayan aiki, ba ramin ba
FTP yana sanya ƙarshen bayanai a cikin rafin sarrafawa. A yanayin aiki abokin ciniki yana aika PORT da nasa adireshi da tasharsa, sannan uwar garke tana kira zuwa ga wannan biyun. A yanayin passive uwar garke tana amsa 227 da biyu, sannan abokin ciniki yana kiran wancan maimakon.
Dukansu sifofin suna ɗauke da irin wannan magana: haɗa zuwa wannan adireshi, a wannan tasha. Na'urar da ke sake rubuta kawunan IP da TCP kawai tana barin maganar yadda take, don haka wani gefe yana ci gaba da ƙoƙarin isa wani adireshi wanda ba ya wanzu sai a wancan gefen rami. Hanyar haɗin bayanai tana tsayawa bayan an riga an ayyana hanyar haɗin sarrafawa da lafiya.
Yanayi uku, kayan aiki uku
Tebur da ke ƙasa yana nuna wane gefe ake gaya wa ya kira, da abin da NAT da ke sake rubuta kawuna kawai zai iya yi game da haka.
Karanta ginshiƙi na ƙarshe a matsayin abin da ke gazawa da farko. A yanayin aiki uwar garke ce ke kira zuwa wani adireshi na sirri; a yanayin passive abokin ciniki ne; da FTPS kayan aikin rubutu ne mai ɓoye kuma akwatin tsakiya yana da ƙarancin abin aiki da shi.
| Mode | Value in the control stream | Who dials whom | Header-only NAT leaves |
|---|---|---|---|
| Active (PORT) | client address and port | server dials the client | a server dialing an unreachable tunnel address |
| Passive (227) | server address and port | client dials the server | a client dialing an address it cannot route to |
| FTPS | the same values, inside TLS | as above | ciphertext, so no rewrite happens at all |
Sanya mataimakin a inda fassarar ke faruwa
A Linux mataimakin nf_conntrack_ftp ne ke sake rubuta kayan aiki. Yana lura da hanyar haɗin sarrafawa, yana koyon tashar da aka yi shawara a kanta, yana ƙirƙirar tsammani ga rafin bayanai, kuma a akwatin NAT yana sake rubuta adireshi da tashar da ke cikin kayan aiki. Yana taimakawa ne kawai a na'urar da ke fassara adireshin abokin ciniki. Loda shi a abokin ciniki, ko a na'urar tacewa da ke tura rafi kawai, ba ya canza komai game da zaman.
Waɗannan umarni uku suna nuna ko modul ɗin yana nan, ko an haɗa shi, da ko akwai tsammani yayin da zaman ke buɗe:
modprobe nf_conntrack_ftp
lsmod | grep nf_conntrack_ftp
conntrack -L expect | grep ftpLoda modul ɗin ba ɗaya ba ne da haɗa shi. Kwayoyin daga 4.7 zuwa gaba suna zuwa da net.netfilter.nf_conntrack_helper=0, don haka mataimakin yana jiran bayyanannen doka, misali iptables -t raw -A PREROUTING -p tcp --dport 21 -j CT --helper ftp. Idan jerin tsammani ya kasance fanko yayin da ake ƙoƙarin canja wuri, haɗin ne ya kamata a duba, ba modul ɗin ba.
Yanayin passive: gaya wa uwar garke abin da za ta sanar
Yanayin passive ya fi sauƙin tabbatarwa domin ana iya gaya wa uwar garke abin da za ta sanya a amsar 227. A vsftpd wannan shine pasv_address, tare da pasv_min_port da pasv_max_port; ProFTPD yana amfani da MasqueradeAddress da PassivePorts. Saita waɗannan da farko, domin ingantaccen adireshin da aka sanar yana kawar da buƙatar sake rubuta komai a wancan gefen.
Sannan bari daidai wannan kewayon tasha ya wuce ta ƙofar, misali -A FORWARD -i tun0 -p tcp --dport 30000:30100 -j ACCEPT, domin dokar ta dace da abin da uwar garke ke sanarwa.
Saitunan biyu dole su dace. Uwar garke da aka gaya ta sanar da 30000-30100 yayin da ƙofar ke yarda da 40000-40100 tana gazawa a mafi ƙarancin amfani: tattaunawar sarrafawa tana da lafiya kuma kowace hanyar haɗin bayanai tana mutuwa. Kwatanta lambobin kafin ka gyara wani abu.
Sa hannu biyu na gazawa, da abin da FTPS ke cirewa
Ratsewa a LIST yana nuni zuwa ga hanyar haɗin bayanai ta farko na zaman, inda duka sake rubuta adireshi da tsammani dole su yi aiki. Ratsewa a RETR bayan LIST mai aiki yana nuni zuwa ga canja wurin kanta, wato kewayon passive ko MTU na rami. Wannan sa hannu na biyu ba matsalar kayan aiki ba ce, kuma saitunan mataimakin ba za su gyara ta ba.
FTP a kan TLS yana cire kayan aikin da mataimakin ke karantawa. Akwatin tsakiya ba zai iya sake rubuta darajar PORT ko PASV da ba zai iya buɗe ba, don haka zaɓuɓɓukan da suka rage su ne wakili da ke ƙare TLS, uwar garke da ke sanar da adireshi mai isa cikin iyakataccen kewayon, ko wata yarjejeniyar canja wuri.
Gajeren tsari na bincike
Yi aiki daga alamar zuwa waje. Tabbatar LIST yana gazawa yayin da PWD ke yin nasara, kama adireshin da ke cikin kayan aikin PORT ko 227, kuma ka tambaya wace na'ura ke fassara wannan adireshin. Haɗa mataimakin a nan, kalli jerin tsammani yayin canja wuri ɗaya, sannan gyara yanayin passive a uwar garke kuma ka kwatanta kewayon a dokar ƙofar.
Ka raba gazawar hanyar bayanai da gazawar canja wuri mai yawa, domin suna tafiyar da kai zuwa saituna daban-daban.