I-VM ye-Azure ayifinyeleli i-IMDS noma i-WireServer ngemuva kokuthi i-VPN iqale

I-VM iyasebenza, iklayenti le-VPN lithi lixhunyiwe, futhi ngemva kwemizuzu embalwa i-ejenti ye-Azure iqala ukubika isimo esingesihle. Kwesinye isikhathi i-SSH iyasinda kodwa i-Run Command esuka kuphothali ayisindi, okwenza abantu babheke i-ejenti esikhundleni sethebula lemizila. Izinqumo zokudlulisa zesivakashi zishintshile ngesikhathi kukhuphuka umhubhe, futhi ngokuvamile amakheli amabili eplathifomu aba yizisulu zokuqala. Ngikuthatha njengophawu lomzila ngaphambi kokukuthatha njengokwehluleka kwe-ejenti.

Uphawu lubukeka njenge-ejenti ephukile

Womabili amakheli ngezansi ahlongozwa njengesixazululo, futhi awona isidingo esisodwa. Ukukopisha i-/32 kwelinye ngoba kusebenzile kwelinye iyona ndlela yokuthi isixazululo sesikhashana sibe ukulungiselela okuqhubekayo okungekho muntu onesibindi sokususa.

Ukulandelana okusebenzayo ukuthi kuqinisekiswe ukuthi yiliphi ikheli ocingo oluhlulekile luqondise kulo ngempela, bese ufunda ukuthi isivakashi silixazulula kanjani. Konke okunye ukuqagula okunezinyathelo ezengeziwe kanye newindi lokushintsha elide.

I-168.63.129.16 ayiyona indawo yomphakathi

I-168.63.129.16 iyikheli leplathifomu lebhuloho elikhethekile le-Azure, futhi enye yezindima zayo i-WireServer, esetshenziswa i-ejenti ye-VM ukukhuluma ne-fabric. I-Microsoft ibhala ukuthi ukuhamba kwe-ejenti kuya emachwebeni e-TCP 80 no-32526 kufanele kuhlale kutholakala. Akulona isibungu se-internet esijwayelekile, futhi akusikho into okufanele i-VPN yomhubhe ogcwele ikuyise endaweni yokuphuma ekude. Yingakho umhubhe obukeka uphilile usengakwazi ukulambisa i-ejenti.

Imibhalo yekheli leplathifomu nayo ithi leli kheli alilawulwa imizila echazwe umsebenzisi, okuyisici se-Azure fabric hhayi isithembiso mayelana nesivakashi sakho. Umthetho we-firewall wasekhaya noma inqubomgomo yomzila yeklayenti le-VPN uqobo kusengawaphula indlela, futhi akukho kulokhu okuhlala kuthebula lemizila le-VNet.

Uma kuyi-ejenti ebika inkinga, hlola isimo sesevisi kanye nendlela eya kulelo kheli ngaphambi kokufaka kabusha noma yini.

I-169.254.169.254 inemithetho yayo

I-169.254.169.254 iyikheli le-link-local le-Azure Instance Metadata Service. Izicelo eziya kuyo zinezidingo zazo: i-NIC eyinhloko ne-IP eyinhloko, ukulungiselelwa kwe-DHCP okusekela ikheli, nokudlula kunoma yimuphi i-proxy ye-HTTP. Ukuzithumela ngokuphuma kwe-VPN ekude noma ngesango le-internet elingenangqondo akusona isibonelo sokufinyelela esichazwa yi-Microsoft.

Leso sigatshana se-proxy sibamba abantu abalungise umzila kodwa basabona ukwehluleka. I-proxy ye-HTTP esivakashini ingaphula i-IMDS kuyilapho i-ip route get ibuyisela kahle leyo interface oyilindele, ngakho hlola okukhethiwe kwe-proxy kanye nemizila.

Unganamatheli izimpendulo ze-metadata ethikithini lokusekela ngesikhathi ulungisa lokhu. Zingase zithwale izifakaziso nemininingwane ye-instance ehlala isikhathi eside kunesigameko.

Funda i-policy routing yesivakashi, hhayi ithebula eliyinhloko kuphela

Kusivakashi se-Linux, imiyalo emithathu yokufunda kuphela ihlukanisa izendlalelo: i-ip -4 rule show yemithetho yenqubomgomo, bese i-ip -4 route get 168.63.129.16 ne-ip -4 route get 169.254.169.254 yezinqumo i-kernel ezenza ngempela. Yisebenzise ngaphambi nangemva kokuxhumana kwe-VPN. Umehluko phakathi kwalokho kuphuma kubili iqoqo lakho lezinguquko, futhi uwusizo ukwedlula noma yikuphi ukuqagula mayelana nokwenziwa yiklayenti.

Iklayenti le-VPN elifaka imithetho yenqubomgomo lingashiya ithebula eliyinhloko lingathintekile futhi lisakwazi ukuqondisa leyo zinto ezifunwayo. Yingakho isixazululo sethebula eliyinhloko kuphela sibonakala sisebenza kusibungu esisodwa futhi singenzi lutho kwesilandelayo. Izivakashi ezinama-NIC amaningi zengeza le nkinga ngakolunye uhlangothi, ngoba impendulo incike ekutheni iyiphi i-NIC nekheli lomthombo elikhethwa umthetho.

Phikisana neresiphi eyengeza yomibili imizila ye-/32 ngokusebenzisa isango elidala. Indlela yeplathifomu ye-link-local nokugxuma okulandelayo kwe-WAN ejwayelekile kuyizinto ezihlukene, futhi ukukhishwa okubanzi kufihla ukungqubuzana kwenqubomgomo kwangempela.

Hlukanisa ukuphatha nokubuyisela

Impendulo yakho ye-SSH noma ye-RDP nayo ingabanjwa i-default yomhubhe ogcwele, kodwa iqondisa ikheli elibonwe umlawuli hhayi iphuzu leplathifomu. Yihlole kusukela kupheya yayo yesicelo nempendulo, futhi gcina indlela yokubuyisela ezimele njengekhonsoli yochungechunge ngaphambi kokushintsha inqubomgomo ye-VPN. Uma ukusetshenziswa kuqala kabusha i-VM futhi i-ejenti ibika isimo esingesihle, hlola isenzo esirekhodiwe kanye nesevisi enomthwalo wemfanelo esikhundleni sokucabanga ukuthi ukushintsha komzila kubangele ukuqala kabusha.

Bese uqinisekisa imifudlana emithathu ngokwehlukana: insiza yangasese obuyifuna ngempela, ukuxhumana kwe-ejenti neplathifomu okusekelwayo, kanye nendlela yokuphatha. Ukubuyisela okukodwa akubona ubufakazi bokuthi ezinye ezimbili zasinda.

Bhala okukhishwe okugunyaziwe ngaphansi komnikazi wenethiwekhi yesivakashi nokulungiselelwa kwe-VPN, kufaka phakathi okwenzeka ekuxhumaneni kabusha nasekuqaliseni kabusha. Ama-UDR e-Azure awona ithebula lemizila lesivakashi, futhi ukuwuhlela ngeke kulungise umthetho wenqubomgomo wasekhaya.