Gaaritaanka bogga HTTPS ee kaliya VPN-ka lagu heli karo iyada oo loo marayo gudbin SSH

Hal mishiin ayaa horey u lahaa gelitaan VPN la ansixiyay, mishiin labaad wuxuu u baahan yahay si sax ah hal adeeg HTTPS oo gaar ah, gudbin SSH maxalli ahna wuxuu buuxin karaa farqigaas isagoo aan mishiinka labaad siinin tunnel. Gudbintu waxay qaaddaa hal meel TCP halkii ay qaadan lahayd shabakadda oo dhan, xaddidaaddaasna waa qodobka muhiimka ah. Raac shanta tallaabo ee hoose si kala horreysan, sababtoo ah mid kastaa wuxuu ku guuldareystaa sabab ka duwan midda kale, tallaabada dambeesana ma badbaadin karto farqiga hore. Haddii shardi horudhac ah uu maqan yahay, nashqaddan ma xallinayso, wax hagaajin ah oo amarrayna ma caawin doonto.

Tallaabada koowaad: xaqiiji saddexda shardi

Saddex waxyaabood waa inay horey u run ahaadaan ka hor inta aan amar kasta macne yeelan. Waxaad u baahan tahay fasax si aad mishiinka koowaad u isticmaasho martigeliyaha gudbinta, gelitaan SSH oo shaqeeya oo ku socda, iyo siyaasad server oo oggolaanaysa meesha loo jeedo. Akoon SSH oo loo sameeyay wareejinta faylalka ayaa laga yaabaa in gudbintu ku dansan tahay, server oggolaanaya gudbintana weli wuxuu xaddidi karaa meelaha laga gaari karo isaga oo maraya. Weydii ka hor inta aanad tijaabin, sababtoo ah isticmaalka shaqada saaxiibka oo aan heshiis lahayn sida barta boodhka waa dhibaato siyaasad, xitaa marka amarku si nadiif ah u shaqeeyo.

Laba amar ayaa xalliya qeybta farsamada ee liiskaas. Midda koowaad waxay caddeynaysaa in akoonka iyo furaha ay shaqeeyaan iyagoon u baahnayn codsi isdhexgal ah, midda labaadna waxay daabacdaa siyaasadda dhabta ah ee serverka halkii ay daabaci lahayd tusaalaha lagu faallooyay faylka habaynta.

ssh -o BatchMode=yes [email protected] 'echo ok'
sudo sshd -T | grep -E 'allowtcpforwarding|permitopen'

Tallaabada labaad: xir port loopback oo hay fadhiga nool

Mishiinka socodsiinaya barnaamijka macmiilka, fur gudbin maxalli ah oo u socda adeegga gaarka ah. Si cad ugu xir loopback si aan loogu faafin shabakadda maxalliga ah, oo dooro port sare oo aanay horey u haysan adeeg maxalli ah. Hay fadhiga socodsiinta inta aad shaqeynayso, sababtoo ah xiritaanku wuxuu xiraa dhageystaha. ExitOnForwardFailure wuxuu xirnaansho la diiday ama port la qabsaday u beddelaa bixin degdeg ah halkii uu ka ahaan lahaa fadhi aan gudbin lahayn, waana habka guuldarrada ee waqtiga ugu badan lumiya.

Xiriirka gaarka ah waxaa laga sameeyaa martigeliyaha boodhka, sidaas darteed DNS, waddooyinka, siyaasadda VPN iyo gelitaanka adeegga martigeliyahaas waa inay dhammaantood shaqeeyaan. Fadhiga SSH ma abuuro gaaritaan uusan martigeliyaha boodhku lahayn, mana hagaajin karo waddo uusan VPN-ku waligiis riixin. Xaqiiji dhageystaha halka uu dhab ahaan joogo halkii aad ku kalsoonaan lahayd aamusnaanta amarka.

ssh -N -o ExitOnForwardFailure=yes -L 127.0.0.1:9443:portal.lab.example:443 [email protected]
ss -ltn '( sport = :9443 )'

Tallaabada saddexaad: hay magaca HTTPS marka socket-ku maxalli yahay

https://127.0.0.1:9443/ baaritaanku wuxuu beddelaa magaca serverka TLS iyo awoodda barnaamijka. Shahaado loo soo saaray portal.lab.example laguma ansixin doono cinwaan loopback, khaladka ka dhashaana wuxuu u eg yahay shahaado jaban halkii uu ahaan lahaa marin gaaban oo gudbin ah. Tijaabada khadka amarka, hay URL-ka dhabta ah oo beddel kaliya meesha socket-ka. --connect-to taas ayuu sameeyaa, oo buugga curl wuxuu diiwaangeliyaa qaabka afar goobood ee hoos lagu isticmaalay.

curl --noproxy portal.lab.example --connect-to portal.lab.example:443:127.0.0.1:9443 https://portal.lab.example/

Magacu wuxuu ku sii jiraa URL-ka, gacan-qaadista TLS iyo madaxa Host, halka xiriirka TCP uu u socdo dhageystaha maxalliga ah. Ikhtiyaarka proxy-la'aanta ah wuxuu tijaabada ku hayaa gudbintan halkii uu u oggolaan lahaa proxy HTTP la habeeyay inuu dhex galo, oo xaqiijinta shahaadada furan haynta ayaa ka dhigta natiijada mid macne leh.

Tallaabada afraad: ogow waxa hal gudbin aanay dabooli karin

Hal gudbin TCP waxay dabooltaa hal port oo loo jeedo. Bog u wareejiya magac martigeliye labaad, ka soo raraya agabka martigeliye ku dhex jira shabakadda gaarka ah ama u dira port kale wuxuu u baahan yahay gudbin u gaar ah, mid kastaana wuxuu u baahan yahay isla hubinta siyaasadda sida midda koowaad. Socodka shaqada browser-ku wuxuu ku daraa shuruudihiisa, sababtoo ah browser-ka waa in loo sheegaa inuu magaca dhabta ah u diro port maxalli ah isagoo maraya habaynta proxy ama khariidad maxalli ah. Sidaas darteed tijaabadu khadka amarka oo guulaysata ma caddeyso in browser-kuna guuleysan doono, in kastoo ay caddeyneyso waddada.

UDP, ogaanshaha SMB iyo gelitaanka domain-ka gabi ahaan ma maraan gudbin TCP. Haddii baahida dhabta ah ay tahay gelitaan shabakadeed guud, nashqaddan waa qalab khaldan oo iridda gelitaanka fog ee la taageeray ayaa sax ah.

Tallaabada shanaad: nadiifi oo qor

Jooji fadhiga marka tijaabadu dhammaato oo xaqiiji in dhageystuhu tagey. Haddii port-ka la doortay horey loo qabsaday, dooro port loopback kale oo aan la isticmaalin oo cusboonaysii URL-ka, amarka tijaabada iyo qoraalka wada, halkii aad joojin lahayd adeeg maxalli ah oo aan khuseyn si aad lambarka u sii daysid. Gudbin furan ku reebista laptop-ka waxay baaritaan u beddeshaa adeeg aan la maamulin.

Qor martigeliyaha boodhka, meesha la gudbiyay, port-ka maxalliga ah iyo cidda ansixisay heshiiska. Gudbin ku jirta kaliya taariikhda shell-ka qof waxay hal dib-u-bixin u jirtaa baaritaan soo noqnoqda, qofka xigana ma ogaan doono shardiga saddexda ah ee horey loo hubiyay.