Ping wuu shaqeeyaa laakiin SSH wuu ku guuldareystaa VPN-ka: goormee marxaladdu jabtay?
Hal isku day faahfaahsan ayaa kala sooca helitaanka TCP, qaadista SSH, aqoonsiga martigeliyaha, gelitaanka isticmaalaha iyo ogolaanshaha fadhi, si aad u joojiso qiyaasidda tunnellada.
Jawaabaha ping iyo gelitaan SSH oo la diiday labaduba run bay noqon karaan isku mar, oo lammaanuhu ma eeddeeyaan tunnellada. Jawaabaha echo iyo xiriirka TCP ee dekedda 22 waa imtixaanno kala duwan oo leh xulashooyin kala duwan, siyaasado kala duwan iyo inta badan meelo kala duwan. Diiwaangeli hal isku day SSH oo ula kac ah, ka dibna magacaab marxaladdii ugu dambaysay ee uu gaaray. Hal caddayn oo keliya ayaa beddela toban iyo labaatan isbeddel oo qiyaas ah oo habaynta.
Diiwaangeli hal isku day, ma aha fadhi wax-ku-tuuris
Hal mar ku socodsii macmiilka iyada oo la socoto baaritaan faahfaahsan, wadaagga xiriirka la damiyay iyo waqti xiriir oo xaddidan. Daminta wadaagga waa muhiim sababtoo ah xiriirka weyn ee hore loo xaqiijiyay wuxuu haddii kale ka jawaabi lahaa isku dayga cusub oo qarin lahaa cilladda aad daba socoto.
ssh -4 -vv -o ControlPath=none -o ConnectTimeout=10 [email protected]Hayso meesha loo socdo, qoyska cinwaanka, shaabadda waqtiga iyo khaladka ugu dambeeya ee aan sir ahayn. Calanka IPv4 sidoo kale waxay ka dhigan tahay in isku daygani waxna ka odhanayn jidka IPv6 ee isla magacaas, marka ha ka guudaysan. Qor halka isku dayga laga sameeyay. Baaritaanka laga sameeyo gateway-ga VPN ma aha aragtida isku mid ah ee laptop-ka ka dambeeya, oo inta badan khilaafaadka tigidhadan waxay ka yimaadaan isku darka labada.
Marxaladda koowaad iyo labaad: TCP ka hor SSH
Xadka koowaad waa helitaanka socket-ka: cinwaan, deked iyo jid uu baakaddu dhab ahaan raaco. Haddii xiriirka TCP waligiis dhammaan waayo, waxba kama sarreeyaan weli ma jiraan, oo furayaasha martigeliyaha iyo akoonnada wax khuseeya ma leh.
nc -vz 10.90.4.20 22
ip route get 10.90.4.20
tcpdump -ni any 'host 10.90.4.20 and port 22'Isku xidh diiwaanka iyo isku dayga macmiilka. SYN oo baxa oo waxna soo noqon waayo wuxuu tilmaamaa shaandhayn, xulashooyin ama jid ku maqan dhinaca fog; jawaab leh dib-u-dejin waxay tilmaamaysaa wax si firfircoon u diida halkii ay tuuri lahayd. Xadka labaad waa isweydaarsiga borotokoolka SSH laftiisa. Xiriir TCP oo dhammaada oo haddana istaaga ayaa dhaafay helitaanka oo galay wada-hadal, jawaab server ama maaraynta baakadaha. Taasi waa baaritaan kale, oo halkaas ayaa dhibaatooyinka la xiriira cabbirka markii ugu horreysay macquul noqdaan.
Marxaladda saddexaad: yaa furayaashayda jawaabay
Marka qaadistu kacdo, macmiilku wuxuu xaqiijiyaa furaha martigeliyaha server-ka. Diidmadani halkan waa hadal ku saabsan aqoonsiga, ma aha cryptography: dhinaca kale wuxuu soo bandhigay furaha aan siyaasaddaadu aqbali karin. U qaado sidii shuruud joojin oo ka xaqiiji bannaanka, console-ka ama hawlwadeenka dib u dhisay martigeliyaha. Tirtirka diiwaanka la xusuustay si digniinta loo nadiifiyo waa dariiqa gaaban ee kaliya ee la diidi karo, sababtoo ah wuxuu burburiyaa caddaynta in wax si lama filaan ah u jawaabay.
Haddii martigeliyahii runtii dib loo dhisay, ka saar diiwaanka duugga ah oo keliya ka dib marka faraha cusub la xaqiijiyo, oo qor taariikhda iyo sababta. Injineerka xiga wuxuu la kulmi doonaa digniintaas oo wuxuu u baahan yahay macnahaas.
Marxaladda afraad iyo shanaad: akoon iyo ogolaansho
Xaqiijintu waa xadka afraad. Aqoonsiga la diiday waxay ka dhigan tahay server-ku wuu qiimeeyay isku dayga oo wuu diiday; hubi akoonka, nooca aqoonsiga ee server-ku aqbalo iyo siyaasadda server-ka laftiisa halkii password-ka VPN. Xadka shanaad waa fasaxa ka dib gelitaan guul leh. Isticmaale la xaqiijiyay wali waa laga diidi karaa qolof, amar, nidaam hoose ama gudbin, oo diidmahaas waxay u muuqdaan sida cillado qofka akhrinaya oo keliya sadarka ugu dambeeya macmiilka.
| Last stage reached | What it proves | Where to look next |
|---|---|---|
| No TCP connection | No SSH transport exists | Address, port, route, selectors, filter, listener |
| TCP up, exchange incomplete | Reachability is not the blocker | Server response, negotiation, packet handling |
| Host identity rejected | The peer is not the expected host | Independently verified host key |
| User authentication rejected | The attempt reached authentication | Account, credential and server policy |
| Authenticated, session denied | Login succeeded, the operation did not | Shell, command or forwarding permission |
Jooji ka dib dhowr isku day oo password ah oo guuldareystay. Qiyaasaha soo noqnoqda waxay abuuraan qufulo markaas u muuqda cillad labaad oo aan la xiriirin oo waqti ka badan qaata tigidhka asalka ah.
Dib u noqosho iyo diiwaanka aad haysato
Hal mar beddel hal shay, oo qor waxa aad beddeshay ka hor intaadan dib u tijaabin. Haddii isbeddelku ka sii daro isku dayga, isla markiiba dib u celi halkii aad ku kor dhigi lahayd hagaajin kale. Ku celi hawlgalkii asalka ahaa macmiilkii iyo macnihii asalka ahaa. Gelitaan guul leh oo ka yimaada mashiin kale, qoys cinwaan kale, ma aha soo-saarid oo ma caddeeyo hagaajinta.
Nadiifi waxa aad wadaagto. Soo-saarka faahfaahsan ee macmiilka wuxuu qaadi karaa magacyo gudaha, calaamado akoon, waddooyin fure iyo aqoonsiyo fure dadweyne, marka daabac gabagabada marxaladaha halkii aad daabaci lahayd raad ceyriin ah.