rsync iyada oo loo marayo VPN: dekedda daemon-ka 873 iyo habka SSH

Oggolaanshaha TCP 873 ee interface-ka tunnel-ka ma riixo rsync OpenVPN, mana ka dhigto in dhinaca kale uu aqbalo module-ka. Tunnel-ku wuxuu qaadaa xiriir gudaha ah oo xeerarkiisa protocol-ka iyo goobta ay si sax ah u sii ahaanayaan sidii ay ahaayeen. Sidaas darteed su'aasha koowaad ma aha dekeddee la furo, laakiin waa nooca xiriirka ee rsync sameeyo. Wax kasta oo hoose waxay u malaynayaan in tunnel-ku horey u shaqeynayo oo kaliya adeegga gudaha ayaa wali shaki ku jira.

Go'aanso xiriirka rsync runtii sameeyo

Doodda fog ee amarka ayaa badanaa ka jawaabta su'aashaas ka hor wax kasta oo isbeddel firewall ah. Laba dhibcood oo labanlaab ah ama qaab URL ayaa dooranaya daemon-ka, halka hal dhibic oo ka dambeeya magaca host ay dooranayso shell fog. Akhri doodda aad runtii fulinayso, ma aha tan ku jirta tusaalaha dukumentiga.

Ikhtiyaar shell fog oo cad ayaa mar kale beddeli kara jawaabta, sababtoo ah wuxuu u sheegaa rsync barnaamijka la bilaabo gaadiidka. Akhri dhammaan khadka amarka, oo ay ku jiraan scripts-ka duubista ee la dhaxlay, ma aha oo kaliya qaybta host-ka.

Habka daemon-ka: cinwaanka xidhitaanka, module-ka iyo dekedda

Qaabka daemon-ka, qaybta waddada waxay magacawdaa module la habeeyey, ma aha galka disk-ga. Furaha module-ka waxaa la hubiyaa kaliya ka dib marka xiriirka la aqbalo, module-kuna wuxuu sidoo kale noqon karaa mid-akhris-kaliya ama ka qarsoon liiska. Habkaas ayaa muhiim ah marka aad akhrinayso qalad, sababtoo ah xiriir la diiday iyo module la diiday waa guul-darrooyin laba marxaladood oo kala duwan. Midkoodna fariimaha wax kama sheego tunnel-ka laftiisa.

Daemon madax-bannaan ayaa lagu dhejin karaa cinwaanka tunnel-ka faylka habayntiisa, taas oo ka fogaanaysa interface-ka dadweynaha iyada oo aan lahayn xeer firewall ah. Qiimaha waa inuu jiraa marka daemon-ku xidho, dhageystaha socket-ku kiciyey ama inetd-ku maamulo ayaa laga yaabaa inuu gebi ahaanba iska indho tiro.

address = 10.44.0.1
port = 873
[archive]
    path = /srv/archive
    read only = yes

Kadib tijaabi cinwaanka gaarka ah halkii magaca dadweynaha. Magaca host dadweyne waxaa loo xalliyaa cinwaan WAN oo wuxuu maraa waddo kale, xitaa marka hal mashiin ka jawaabo labadaba.

rsync --list-only rsync://10.44.0.1/archive/

Habka shell fog: SSH ayaa qaada wareejinta

Hal dhibic, rsync wuxuu bilaabaa barnaamij shell fog oo khadkaas ku hadla protocol-kiisa, sidaas darteed adeegga kaliya ee la gaari karo waa SSH deked kasta oo server-ku dhageysto. Daemon-ka rsync weligiis ma shaqeeyo, dekedda 873 khuseysa ma leh, go'aanka gelitaankuna wuxuu noqdaa go'aan akoon SSH. Waddada fog markaas waa waddo dhab ah oo nidaamka faylasha ah oo ay tarjunto shell-ka dhinaca kale. Taas ayaa sabab u ah in isbeddel firewall oo loo jeediyey 873 uusan waxba u qaban habkan.

Naqshaddaas waxay u baahan tahay akoon la oggolaaday iyo xaqiijinta furaha host-ka, waxayna dhaxashaa siyaasadda xaqiijinta SSH lafteeda. Badanaa waa doorashada wanaagsan marka wareejinta ay tahay inay ka gudubto shabakad aan la aaminin, sababtoo ah sirta waxay ka tirsan tahay protocol loo dhisay taas. Daemon weydiinta furaha ah ma aha isla wax.

Fur oo keliya waddada aad dooratay

Marka habka la go'aamiyo, oggolow adeegga kaliya ee gudaha ee interface-ka kaliya ee qaada tunnel-ka. Xaddid xeerka interface-ka, barkada isha iyo cinwaanka goobta si isbeddelka diidmada caadiga ah ee dambe uusan si aamusan u ballaarin karin. Kadib dib u eeg nidaamka xeerraha, sababtoo ah xeerka oggolaanshaha ee hore ee silsiladda wuxuu xeerka cidhiidhiga ah ka dhigaa mid qurxin kaliya.

Haddii daemon-ku ku shaqeeyo mashiin ka dambeeya gateway-ga VPN halkii uu ku shaqeyn lahaa gateway-ga laftiisa, gateway-ga waxa uu sidoo kale u baahan yahay waddo gudbin, bartilmaameedkuna wuxuu u baahan yahay ogolaansho u gaar ah iyo waddo soo noqod. Furista dekedda kaliya gateway-ga waxay soo saartaa xiriir la aqbalo oo markaas meelna uusan tagin.

Ka xaqiiji macmiilka isla habka iyo goobta aad dooneeyso inaad ku isticmaasho wax soo saarka. Liis guuleystay ayaa caddeeya dhageystaha, waddada iyo xeerka wadajir; waqti-ka-dhammaadka wuxuu tilmaamayaa waddada, diidmada waxay tilmaamaysaa dhageystaha.

ufw allow in on tun0 from 10.44.0.0/24 to 10.44.0.1 port 873 proto tcp
ss -ltnp | grep 873