Gudbinta gudaha SSH ee proxy HTTP hore u jirta: laba cinwaan loopback

Proxy-gaaga la ansixiyay wuxuu ku shaqeeyaa martigeliyaha boodboodka halkaas oo uu kaliya ku dhageysto loopback, sidaas darteed wax ka baxsan mashiinkaas ma gaari karo. Uma baahnid VPN ama proxy cusub; waxaad u baahan tahay hal deked oo mashiinkaas ah oo la geeyo hal deked oo adiga ah. Gudbinta gudaha ayaa sidaas sameysa, waxayna u baahan tahay hal amar iyo hal dejinta codsiga. Jahwareerku wuxuu inta badan ka yimaadaa isku qasidda cinwaanka loopback ee mashiin kasta.

Go'aanso in proxy go'an uu horey u jiray

Farsamadan waxay gudbisaa adeeg horey u shaqeynayay. Haddii martigeliyaha fog uu leeyahay kaliya daemon SSH oo aan lahayn proxy, wax xaddiga gudbin ah ma abuurayo mid, xiriirka waxaa laga diidi doonaa dhinaca fog. Xaqiiji in proxy-ga la xidhay, dekeddiisu waa maxay, iyo in uu ku dhageysto 127.0.0.1 ama cinwaan interface gaar ah, maxaa yeelay cinwaankaas waa bartilmaameedka gudbintu tahay.

Xaqiijintan marka hore waxay kaa badbaadinaysaa cilad-baadhista tunnel aan waligii wax ku xirmin.

Dhis gudbinta oo akhri amarka

Qaabka aad rabto wuxuu ku xidhaa hal deked loopback laptop-kaaga oo ka xidha dhinaca server-ka cinwaanka proxy-ga sida server-ku u arko.

ssh -NT -o ControlPath=none -o ExitOnForwardFailure=yes \
  -L 127.0.0.1:13128:127.0.0.1:3128 [email protected]

-N wuxuu cabburiyaa amarka fog, -T wuxuuna cabburiyaa qoondaynta termios, maxaa yeelay waxaad rabtaa tunnel oo aan ahayn qolof. Cinwaanka loopback ee ugu horreeya waa halka laptop-ku ku dhageysto; kan labaad waxaa xalliya server-ka SSH, sidaas darteed 127.0.0.1 halkaas waa proxy-ga mashiinkaas. ExitOnForwardFailure wuxuu amarka si cod dheer u fashilmaa haddii dekedda gudaha horey loo qabsaday, halkii uu bilaabi lahaa fadhi aan wax gudbin. Qor cinwaanka bartilmaameedka sida server-ku u xalliyo, maxaa yeelay magac kaliya laptop-kaaga xalli kara wuu ku fashilmi doonaa dhinaca kale.

Siyaasadda server-ka laftiisu waxay khusaysaa ka hor inta wax ka mid ah shaqeeyo. AllowTcpForwarding waa in uu oggolaadaa, PermitOpen waxa uu xaddidi karaa meelaha iyo dekedaha fadhi gaari karo, sidaas darteed gudbin macmiilku aqbalo ayaa server-ku weli diidi karaa. Diidmada waxay u muuqataa sida khalad gudbin ama kanaal macmiilka, akhrinta fariintaasna way ka dhaqso badan tahay wax ka beddelka amarka.

U jeedi hal codsi gudbinta

Deji codsiga in uu isticmaalo proxy HTTP ku yaal http://127.0.0.1:13128, oo wata aqoonsi haddii proxy-ga fog uu u baahan yahay. Hayso xaqiijinta shahaadada codsiga laftiisa ee loogu talagalay bartilmaameedyada HTTPS, maxaa yeelay tunnel-ka proxy-ga ma beddelo. Kani waa gudbin go'an oo hal adeeg ah, sidaas darteed codsiga waa in loo sheegaa proxy, ee aan loo dayn inuu isagu mid ogaado.

Hubin degdeg ah ka hor wax dejis ah oo joogto ah: curl -x http://127.0.0.1:13128 -I https://example.com, kaas oo tababara habka HTTP CONNECT ee proxy-ga ay tahay inuu taageero.

Hayso awoodda meeshii ay ku jirtay

Proxy-ga fog wuxuu weli go'aamiyaa bartilmaameedyada iyo hababka uu oggolaado, gelitaanka SSH-na waa in aanu si aamusan u siin xisaab kasta gudbineed web guud. Ku xidhidda 127.0.0.1 laptop-ka waxay ka fogaataa in dekedda lagu daabaco shabakaddaada gudaha, mana ka dhigto dekedda mid gaar ah oo ka reeban hababka kale ee isla mashiinka. Ku beddelidda xidhitaankaas cinwaan wildcard si proxy-ga loo wadaago waa sida gudbineed furan oo aan la maamulin u abuurmo.

Gaadiidka SSH wuxuu ilaaliyaa boodboodka ilaa server-ka. Wixii ka dambeeya bartaas proxy-ga wuxuu furaa xiriirkiisa, sidaas darteed codsi HTTP caadi ah oo bartilmaameed ah wuxuu caadi ahaan u sii socdaa xitaa ka dambeeya server-ka, inkastoo qaybta koowaad la sirteeyay.

Xaqiiji labada daraf, ka dib nadiifi

Dejinta tunnel-ka gudaha iyo guusha adeegga fog waa natiijooyin kala duwan, heerka bixitaanka amarkuna wuxuu kaliya ka warramayaa tan koowaad. Hubi in dhageyste uu jiro ss -ltn, ka dib samee codsi la oggolaaday oo codsiga ah iyo codsi ay proxy-ga tahay inuu diido. Haddii labaduba u dhaqmaan sida la filayay, waddadu waa dhab; haddii tunnel-ku shaqeynayo oo codsi kastaa fashilmo, proxy-ga ayaa diidaya ama ma gaari karo bartilmaameedka.

Markaad dhammeysato, jooji habka SSH ee iska leh, ka saar dejinta proxy-ga codsiga, oo xaqiiji in dekedda gudaha ay tagtay halkii aad ka tagi lahayd dhageyste ka sii noolaada hawsha.