Nika i-Pi ekude i-SOCKS proxy ngokusebenzisa iklayenti lakho le-SSH

Ucabanga ukuthi i-SOCKS proxy kufanele isebenze lapho ukufinyelela kunethiwekhi sekukhona khona. I-OpenSSH ingabeka isilaleli kwenye indawo ngokuphelele. Ukudlulisela okunamandla okukude kuvula imbobo ye-SOCKS kumphathi okude futhi kuqala konke ukuxhumana kusuka kuklayenti lakho le-SSH lendawo, elithwala indlela ye-VPN egunyaziwe yekhompyutha yakho ephathwayo. I-Pi ithola i-proxy enomkhawulo; ayizuzi umhubhe wakho noma amalungelo akho njengefa.

Isilaleli kanye nohlangothi okuqalwa kulo ukuxhumana kungahluka

I-ssh -D 1080 evamile isebenzisa isilaleli emshinini wakho futhi ithumela ukuxhumana kusuka lapho. Ukudlulisela okunamandla okukude kukuhlanekezela lokho: isilaleli sivela kumphathi okude, futhi konke ukuxhumana elikwamukelayo kuvulwa kusuka ohlangothini lwendawo. incwadi yesandla yeklayenti le-OpenSSH ibhala i--R ngaphandle komgomo ogxilile njengalolu hlelo lwe-SOCKS4/5.

Umyalo osekelwe ovela ekhompyutheni ephathwayo ubukeka kanje, kuthathwa i-akhawunti, abaphetheli kanye nembobo njengezindawo zokubamba:

ssh -NT -S none -o ExitOnForwardFailure=yes \
  -o PermitRemoteOpen=app.corp.example:443 \
  -R 1080 [email protected]

Imininingwane emithathu yenza umsebenzi owusizo lapho. I--S none igcina isikhathi sokuphila kude nomphathi wokulawula owabiwe, i-ExitOnForwardFailure ihluleka ngokushesha esikhundleni sokukushiya nesikhathi esivulekile ngesigamu, futhi i-PermitRemoteOpen ikhawulela lapho isilaleli esikude singafinyelela khona. Sebenzisa i-akhawunti ye-Pi egunyaziwe futhi uqinisekise ukhiye womphathi ngaphambi kokwengeza noma yini yalokhu.

Yini isilaleli esikude esiyidalulayo ngempela

Hlola inqubomgomo yokudlulisela yesevitha ngaphambi kokwethemba isilaleli. Nge-GatewayPorts no ukudlulisela okukude kuhlala kuboshelwe ku-loopback, futhi yilokho ukudalulwa okukufunayo. Isevitha elilungiselelwe ukuphoqa ukudlulisela kwe-wildcard ishicilela imbobo efanayo kuyo yonke i-interface, okushintsha i-proxy yomuntu siqu ibe yinto inethiwekhi yendawo engayifinyelela.

I-loopback nayo ayisona umkhawulo kumsebenzisi ngamunye. Enye inqubo ku-Pi ingaxhuma ku-127.0.0.1:1080 uma yazi imbobo, ngakho ama-akhawunti endawo e-Pi nakho konke okusebenza kuyo kuyingxenye yedizayini yakho yokufinyelela. Lesi yisizathu sokugcina uhlu lwezindawo luncane, hhayi isizathu sokweqa ukuhlolwa kwenqubomgomo.

Gcina indawo evunyelwe icacile kunoma yiluphi uhlelo lokusebenza ozama ukulufinyelela. Ukushintsha lokho ngokudlulisela okungenamkhawulo ukuze uhlelo olungahlobene lusebenze kwandisa indlela idlule kude inkinga oqale ngayo. Uhlu lwezindawo lubhala futhi ukuthi isikhathi sasenzelwe ini, okusiza noma ubani ozokuhlola kamuva. Kubhale eduze kwe-akhawunti oyisebenzisile.

Dlulisa uhlelo lokusebenza olulodwa nge-proxy

Iklayenti ku-Pi eliqonda i-proxy lingase lenze isicelo. Isiqalo se-socks5h sinikeza igama lendawo ku-proxy, ngakho ukusesha nokuxhumana kokubili kwenzeka ohlangothini lwekhompyutha ephathwayo, futhi kuhambisana nendawo eshiwo ku-PermitRemoteOpen:

curl --proxy socks5h://127.0.0.1:1080 \
  --noproxy '' https://app.corp.example/

Gcina ukuqinisekiswa kwesitifiketi okuvamile kanye nokuqinisekiswa kohlelo lokusebenza ngokwalo. I-proxy ishintsha lapho ukuxhumana kwe-TCP kwakhiwa khona; ayikwenzi isevisi engenakuqinisekiswa iphephe, futhi ayiguquli indawo yokugcina esayinwe ngokwayo ibe ngeyethembekile.

Ikhompyutha ephathwayo isadinga indlela yayo kanye nokufinyelela kwesisombululi kokubili kusevitha ye-SSH nakuhlelo lokusebenza. Ithrafikhi yeklayenti layo le-SSH kufanele ikhethwe inqubomgomo ye-VPN egunyaziwe, futhi ukukhishwa kwe-split-tunnel kungathumela leyo thrafikhi ngendlela ehlukile kunaleyo oyihlolile.

Fakazela indlela bese uyivala

Qinisekisa ukuthi isilaleli sikhona lapho usilindele khona nokuthi yindawo ehlosiwe kuphela ephendulayo:

$ ss -ltnp | grep 1080
LISTEN 0 128 127.0.0.1:1080 0.0.0.0:*
$ curl -sS -o /dev/null -w '%{http_code}\n' \
    --proxy socks5h://127.0.0.1:1080 https://app.corp.example/

ExitOnForwardFailure ingafakazela ukuthi ukudlulisela kwasungulwa, futhi ayikwazi ukuqinisekisa ukuthi ukungena kuhlelo lokusebenza kuyaphumelela ezansi. Hlola uhlelo lokusebenza, hhayi imbobo kuphela. Isilaleli esamukelayo bese sihluleka zonke izicelo ngokuvamile sisho ukuthi igama lendawo noma indlela yekhompyutha ephathwayo ayilungile, hhayi ukuthi umhubhe wehlulekile.

Lolu hlelo luthwala i-TCP kuphela. I-UDP, i-ICMP kanye nezinhlelo ezingazinaki izilungiselelo ze-proxy zihlala ngaphandle kwalo, futhi ukudlulisela kuphela ngesikhathi isikhathi se-SSH siphela. Misa leso sikhathi uma usuqedile bese ususa isilungiselelo se-proxy osengeze kuhlelo lokusebenza.

Ukuze uthole ukufinyelela unomphela, sebenzisa ukubhaliswa okusekelwe umnikazi wenethiwekhi noma isango elilawulwayo esikhundleni salokho. I-proxy ephambene iyithuluzi elingalungile lokugwema imikhawulo yedivayisi noma yezinsiza ye-VPN; uma isetshenziswa ngaphakathi kwayo, imane iyindlela eyodwa egunyaziwe yohlelo lokusebenza enemikhawulo ecacile.