SSH-ka fog ee VPN-ka dhexdiisa: waxa tunnel-ku aanu qabanin
VPN wuxuu server-ka SSH gaarsiin karaa oo wax kale ma qabto. Saddex shuruudood ayaa go'aamiya haddii uu ku habboon yahay, marxaladda guul-darrada ayaa tilmaamaysa lakabka qaladka leh.
VPN wuxuu server-ka SSH siinayaa waddo gaar ah wuxuuna meesha ka saarayaa baahida loo qabo dhageyste dadweyne oo ku taal dekedda 22. Ma xaqiijiyo host-ka, ma ogolaansho user-ka, mana go'aamiyo account-yada geli kara. Taasi wali waa shaqada SSH. Haddii VPN uu yahay habka saxda ah ee server-ka loo gaaro waxay ku xiran tahay saddex shuruudood, tunnel-kuna waa mid ka mid ah jawaabaha suurtagalka ah.
Waxa tunnel-ku beddelo iyo waxa SSH weli go'aamiyo
Tunnel-ku wuxuu beddelaa gaaritaanka: address-yada la gaari karo iyo meesha laga soo galo. Ma beddelo waxa dhaca ka dib marka xiriirka TCP dhaco, halkaas oo server-ku soo bandhigo fure host-ka oo weydiiyo aqoonsiga user-ka.
Labada lakab kala sooc maskaxdaada iyo dukumeentigaaga. Gelitaanka VPN wuxuu caddeeyaa cidda network-ka isticmaali karta. Wax ma sheegto account-yada ku jira bartilmaameedka, mana aha ogolaansho lagu galo machine kasta oo la gaari karo.
Hababka guul-darraduna sidoo kale way kala duwan yihiin, taasina waa waxa kala-soocidda faa'iido u leh inta lagu jiro dhacdo.
Saddex shuruudood oo go'aamiya qaabka gelitaanka
Marka hore, server-ku ma u baahan yahay in dadka ka baxsan network-kaaga ay gaaraan? Haddii kale, waddo gaar ah oo lagu daray bastion ama mesh waa naqshadda yar. Marka labaad, dadka client-ka ah ma si dhab ah u kaxayn karaan client-ka VPN, oo ay ku jiraan kuwa ku jira aaladaha la maareeyo oo xaddidan?
Marka saddexaad, ma u baahan tahay kontorol adeeg kasta ama kontorol user kasta? VPN wuxuu bixiyaa gaaritaanka network-ka; SSH wuxuu bixiyaa gelitaanka account-ka. Haddii shuruuddu tahay in qandaraasle gaaro hal host oo aan wax kale gaarin, taasi waa shuruud ogolaansho oo tunnel-ku keligiis ma sheegi karo.
Ka jawaab saddexdaas oo qaabku iskiisuu is doortaa. Haddii aad ka boodo, waxaad ku dhammaanaysaa inaad SSH si dadweyne u soo bandhigto si aad uga fogaato fidinta client-ka.
Xaqiiji wadada gaarka ah ka hor inta aadan SSH eedayn
Ku xidh VPN-ka la ansixiyay oo isticmaal magaca ama address-ka gaarka ah ee bartilmaameedka ee dukumeentiga ku qoran. Kadib hubi waddada la doortay, ogolaanshaha gateway-ga iyo waddada dib ugu noqota client-ka. Magac si sax ah u xallin ma aha caddayn in address-ku qaato tunnel-ka loogu talagalay, sababtoo ah prefix-yada maxalliga ah iyo kuwa fog ee isku dhaca waxay codsiga u diri karaan meel kale gebi ahaan. Farqigaas waa in lagu qoraa runbook-ga.
Haddii xiriirku waligiis dhicin, xaqiiji in server-ku dhageysanayo interface-ka aad filayso iyo in firewall-ka host-ka uu ogolaado isha uu dhab ahaan arko. NAT gateway-ga ayaa dib u qori kara ishaas, marka liiska ogolaanshaha ee loo qoray address-ka tunnel-ka client-ka weligiis ma qaban karo.
Isku-dhaqaaq la'aantaas waa cilladda SSH ee ugu caansan ee iska timid ee VPN-ka.
Akhri marxaladda guul-darrada, ma aha khaladka isku dhafan
Saddex marxaladood ayaa soo saara saddex fariin oo kala duwan, midkoodna kaliya ayaa ku saabsan aqoonsiga gelitaanka.
| Stage | What you see | What it points at |
|---|---|---|
| Before the connection | Timeout, no route | Tunnel, route or gateway permission |
| Connection refused | Immediate reset | Nothing listening, or a host firewall rejecting |
| Authentication | Permission denied after a prompt | User, key or server policy |
Isticmaal khaladka saxda ah iyo log-ga server-ka laftiisa halkii aad isku mar dib u dhigto aqoonsiga VPN iyo SSH. Labadaba dib u dhigistooda waa sida baaritaan shan daqiiqo ah uu u noqdo dhacdo aqoonsi oo laba maalmood ah.
Soosaarka faahfaahsan wuxuu muujinayaa marxaladda aad gaartay:
ssh -vv [email protected]Ilaali furayaasha host-ka iyo ogolaanshaha
Xaqiiji fure host-ka iyada oo loo marayo habka kalsoonida loogu talagalay, gaar ahaan ka dib beddelaad server. Digniinta fure isbeddelay oo lama filaan ah waa fariinta aadan sinaba u tirtiri karin sababtoo ah VPN-ku xirmay oo keliya, maxaa yeelay tunnel gaar ah ma ka dhigayo bartilmaameedka machine-ka aad u malaynayso inuu yahay. Hubi fingerprint-ka isha aad ka kalsoon tahay xiriirka.
Dhinaca server-ka, xaqiiji in account-ku ogolaansho leeyahay iyo in habka xaqiijinta aad habaystay uu yahay kan la soo bandhigayo. Fure jira laakiin la iska indhatiray badanaa waa dhibaato ogolaansho ama habayn, ma aha mid network.
Ku xaddid gelitaanka adeegga aqoonsiyada loo baahan yahay oo hayso waddo soo kabsasho oo la ogolaaday isbeddelada network-ka.