I-Git iyagxuma ngaphandle kwe-VPN? I-OpenSSH imaka amaphakethe nge-IPQoS

Ikhloni evela ehhovisi iyasebenza, ikhloni efanayo nge-hotspot yocingo iyasebenza, futhi ikhloni efanayo evela kunethiweki yehhotela iyalenga ize kuvulwe i-VPN. Ukuxhawula kwe-SSH kuyaqeda futhi iseshini ithule lapho kudluliswa kwangempela kokuqala. Umugqa owodwa owengezwe ekulungiselelweni kweklayenti welapha i-git ne-ssh ndawonye. Lapho isilungiselelo seklayenti esisodwa silungisa amathuluzi amaningi ngesikhathi esisodwa, iphutha likulokho okuthunyelwa yiklayenti, hhayi kulolo xhumano elithumela ngayo.

Funda uphawu njengomehluko wendlela

I-tunnel elapha inkinga ayivamisile ukuba ukulungisa. Ishintsha indlela, umhlinzeki namadivayisi aphakathi, kuyilapho ilaptop iqhubeka ikhiqiza amaphakethe afanayo ncamashi. Uma indlela eyodwa iphatha kabi isihloko kanti enye iyidlulisa ingashintshiwe, umehluko usemgomeni wedivayisi ephakathi, hhayi kuklayenti. Lapha i-tunnel ingufakazi, hhayi isisombululo.

Iphuzu lapho iseshini ifa khona liyinciphisa nakakhulu. Akukho okwehlulekayo ekufuneni igama noma ekushintshisaneni kokhiye okubukeka kanjena. Iseshini eqinisekisayo, eprenta ibhana bese iyajiya ekubhaleni okukhulu kokuqala isivele yabonisa ukuthi ukuhlela indlela, amagama nokufakazela kusebenza konke.

Iklayenti igcizelela ibhayithi ye-QoS kusokhethi ngayinye ye-SSH

Yonke ixhumano le-OpenSSH kusukela ku-7.8 iya phambili ithwala inani esihlokweni se-IP okungasetshenziswa ngamarutha ukubeka phambili ithrafikhi. Amaseshini wetheminali athola inani elilodwa kanti amakhophi amakhulu athola elinye, ngokombono wokuthi umuntu othayiphayo ufanele ukuphathwa kangcono kunokudluliswa kwefayela. Iningi lamanehthiweki lishaya indiva ngokuphelele lo mkhondo, yingakho edlula ngokungabonakali iminyaka. Idlanzana lezishayamthetho ze-Wi-Fi, abahlinzeki bezocingo nezikhungo ze-VPN zisebenza ngawo, futhi ezinye zazo zisebenza kabi.

Lapho lelo nani libhalwa kabusha noma lilahliwe phakathi nokugeleza, uxhumano alunhluleki, luvele luyeke ukuqhubeka. Ukuthunyelwa kabusha kuyakhula, iwindi liyawa, futhi uhlelo alubiki lutho ngoba akukho okubuyise iphutha. Lokho kuthula yikona okwenza abantu bachaze uphawu njengokulenga hhayi njengokwehluleka.

Qinisekisa kuqala inguqulo yeklayenti nge-ssh -V. Noma yikuphi ku-7.8 noma ngaphezulu kuthwala lokhu kuziphatha ngokuzenzakalela.

Imiyalo emithathu ehlukanisa lokhu ne-MTU ne-DNS

Izimbangela ezimbili ezifanayo kufanele zikhishwe ngaphambi kokuhlela noma yiliphi ifayela lokulungiselela. Iphutha le-MTU lidlulisa ukushintshisana okuncane bese lijiya kusaphakethe sokuqala esikhulu, kuyilapho iphutha lamagama lingakhi iseshini nhlobo.

ssh -o IPQoS=none -v [email protected]
ssh -G [email protected] | grep -i ipqos
sudo tcpdump -ni any -vv "tcp port 22"

Umyalo wokuqala uphinda umsebenzi ohlulekayo ngomkhondo ucishiwe, futhi ukuwusebenzisa ngempumelelo kuwubufakazi obubodwa obunamandla kunakho konke okutholakalayo. Owesibili uprenta ukulungiselela iklayenti elizokukusebenzisa ngempela kuleyo ndawo, okubamba okufakiwe okuphelelwe yisikhathi efayeleni oyikhohliwe. Owesithathu ubonisa ibhayithi ye-TOS kuzo zombili izinhlangothi ngenkathi ukudluliswa kugxumile, futhi iphethini ethakazelisayo inani endleleni ephukile futhi alikho kuleyo esebenzayo.

Thwebula kwi-laptop hhayi kuseva, ngoba umthumeli ubeka inani futhi zombili izinhlangothi zingalishintsha. Qhathanisa indlela esebenzayo nendlela ehlulekayo ngokuthwebula okufanayo, futhi umehluko uyavela ngaphandle kokuqagela.

Beka okuhlukile efayeleni elilodwa, isibambi esisodwa ngesikhathi

Okuhlukile kufanele kube seduze kwesibambi okusebenza kuso, nokuphawula okusho ukuthi kungani kukhona.

Host gitlab.example.internal
    IPQoS none
    # direct route rewrites the marking; the tunnel route passes it

Ububanzi bubaluleke kakhulu kunenani ngokwalo. Okufakiwe kwe-wildcard kucisha ukuziphatha kuyo yonke indawo, kulahla umkhondo owusizo kumanethiweki aziphethe kahle, futhi akushiyi muntu okwazi ukusho ukuthi kwavela nini. Okufakiwe kwesibambi ngasinye kuyafundeka, kuyabuyiseka futhi kulula ukuksusa uma inethiweki isilungisiwe. Sebenzisa ifayela lomsebenzisi ukuzikhipha komuntu siqu kanye nefayela elilawulwayo lapho iqembu lonke lidinga okuhlukile okufanayo.

Shono ngokucacile lokho okuhlukile okungakumbo. Kusebenza ku-SSH, ngakho i-HTTPS ekude, isibuko samaphakethe nesiphequluli konke kuhlala ngaphandle kwayo, futhi ukwehluleka kwanoma yikuphi kukho kudinga ubufakazi bakho. Ochungechungeni oludlula ku-bastion, wonke amagxathu asebenzisa ukulungiselela kweklayenti, futhi igxathu eligxumayo yilona elifanele ukukhawulwa.

Vala umjikelezo nomnikazi wenethiweki

Dlulisela okutholakele njengamaqiniso amane: inguqulo yeklayenti, indlela ehloliwe, iklayenti le-VPN elisetshenziswayo, nokuthi yiluphi uhlangothi oluthwale umkhondo. La mane anele kumnikazi wenethiweki ukukhiqiza kabusha ukuphathwa nokunquma ukuthi kwenzelwe yini.

Uma okuhlukile kungalelaphi ukugxuma, kususe. Isisombululo esiphila ngemva kokuhlolwa okwehlulekile siba inganekwane, futhi umuntu olandelayo uchitha ihora ebonisa ukuthi akenzi lutho. Uma silapha ukugxuma, indlela isengalungile kuyo yonke eminye imithuluzi edlula kuyo, futhi ukulungiswa kungokwalowo osebenzisa idivayisi ephakathi.

Ushintsho kuklayenti yisixazululo sesikhashana esinosuku lokuphelelwa. Bhala lolo suku kumbhalo wophawula.