Gcina i-SSH yasendaweni lapho umsingathi usebenzisa i-VPN ephumayo

Iseva encane ye-Linux isebenzisa i-VPN ephumayo yohlelo eluyisingatha, futhi umphathi usafuna ukuyifinyelela nge-SSH esuka etafuleni eliseduze. Lesi yisidingo esinengqondo, futhi ngokuvamile asidingi ukudluliswa kwembobo, ikheli lomhlinzeki noma imbobo ethunelini. Esikudingayo umzila wokuphatha owakhiwe ngamabomu esikhundleni sokuthola ifa kulokho iklayenti le-VPN elikwenzile kuthebula lomzila.

Izinyathelo ezingezansi zicabanga ukuthi umphathi ukulolo LAN.Ukuphatha kude kuyinkinga ehlukile enempendulo ehlukile.

Bopha i-SSH ekhelini elisetshenziswa abaphathi

Qala kusilaleli.ss -ltnp | grep :22 ikhombisa ukuthi i-sshd iboshelwe ini, futhi isilaleli esiku-0.0.0.0 samukela ukuxhumana okuvela kuyo yonke i-interface, kuhlanganise nethuneli. Ukubopha ekhelini le-LAN kuncane futhi kwenza inhloso ibonakale:ListenAddress 192.168.10.20 ku sshd_config, bese kuba ukuhlolwa kokumiswa nokulayishwa kabusha. Iphutha lokubhala kulelo kheli libonakala kakhulu kune-wildcard, ngoba i-sshd iyala ukuqala lapho ikheli lingekho.

Gcina ukuhlolwa kokhiye komsingathi nokuqinisekisa komsebenzisi ngamunye kunjengoba kunjalo. „Kuyinethiwekhi yasendaweni kuphela“ akulona indlela yokuqinisekisa, futhi isiteshi sokuphatha esidlula ukuhlolwa kokhiye ngoba umzila mfushane siyisiteshi esilindele ukusetshenziswa kabi. Ukubekelwa i-DHCP noma ikheli eliqinile kwenza umgomo ubikezeleke ngaphandle kokuwenza ube yisimo somphakathi seseva.

Gcina umzila we-LAN ngaphandle kwethuneli

Umsingathi onekheli ku-192.168.10.0/24 unomzila oxhunyiwe waleso siqalo, futhi umzila othile kakhulu unqoba owokuqala we-VPN kulelo thebula. Yingakho i-SSH yasendaweni ivamise ukuqhubeka isebenza ngokwayo lapho ithuneli likhuphuka. Qinisekisa lokho esikhundleni sokucabanga:ip route get 192.168.10.50 isho i-interface nekheli lomthombo okuzosebenzisa i-kernel, futhi impendulo kufanele kube idivayisi ye-LAN, hhayi ithuneli. Phinda ukuhlolwa kusuka emshinini womphathi futhi, ngoba ithebula lakhe uqobo linquma ukuthi amaphakethe afika yini. Abasingathi ababili ocingweni olulodwa bangase bangavumelani ngokuthi yiluphi uhlangothi olufinyelelekayo.

Ukucabanga kuyaphuka ezindaweni ezimbili. Umthetho womzila osuselwe kunqubomgomo ungathumela ithrafikhi kwithebula okokuqala kwalo kukhombisa ethunelini ngaphambi kokuba ithebula eliyinhloko libhekwe. Iklayenti le-VPN elinesici sokukhiya noma i-kill switch lingavimba futhi ithrafikhi engangeni ethunelini, kungakhathaliseki ukuthi ithi ini ithebula lomzila.

Ama-VLAN okuphatha anomzila yiwo elinye icala. Uma umphathi ehlezi ku-192.168.50.0/24 ngemva komzila wasendaweni, iseva idinga umzila ocacile waleso siqalo ngokusebenzisa u-192.168.10.1, futhi lowo mzila kufanele umele ukuxhumana kabusha. Gcina okuhlukile kukhochwepheshe wokuphatha; okuhlukile okubanzi kwezikhala eziyimfihlo kuyawuchitha umgomo wethuneli.

Yenza okuhlukile kwensimbi yomlilo kube mncane njengomthetho

Uma umsingathi usebenzisa insimbi yomlilo, vumela i-SSH kusuka kumthombo wokuphatha kuphela, futhi ku-interface ye-LAN kuphela. Umthetho ovumela imbobo 22 kusuka yonke indawo ubanzi kunesidingo futhi kunzima ukuwuvikela ekubuyekezweni. Kusicingo se-nftables umthetho usemgqeni wokufaka lapho i-interface nomthombo kufana; kusicingo se-iptables okulingana nakho iyingqayizivele yokufana ku -i kanye -s. Phawula umthetho ngeqembu labaphathi eliwukhonzayo, ukuze ukuhlolwa okulandelayo kungadingi ukuqagela ukuthi kungani imbobo 22 ivuliwe.

Hlola futhi isihlungi seklayenti le-VPN uqobo. Amanye amaklayenti afaka imithetho elahla ithrafikhi yasendaweni ngokwakhiwa, futhi umthetho wensimbi yomlilo olungile phezu kokulahlwa kwezinga leklayenti awushintshi lutho. Funda ukumiswa kweklayenti ngaphambi kokuhlela insimbi yomlilo yomsingathi, ngoba izihlungi ezimbili zilandelana zikhiqiza ukwehluleka okungafani nanoma yisiphi sazo.

Hlola zombili izimo

Gijimisa ukuhlolwa kabili: kanye nethuneli lixhunyiwe kanye nelivaliwe. Esimweni ngasinye, qinisekisa isilaleli, umzila kanye nokungena kwe-SSH kwangempela kusuka emshinini womphathi. Umzila osebenza kuphela ngesikhathi ithuneli liphezulu awuwona umzila wokuphatha wasendaweni; kuyisigameko nje.

Bese uqala kabusha ithuneli ngesikhathi isikhathi se-SSH sivuliwe. Isikhathi esisindayo sibonisa ukuthi umzila uzinzile; isikhathi esiwayo sikutshela ukuthi iklayenti libhala kabusha imizila noma izihlungi lapho lixhuma kabusha, okuyinto okufanele uyazi ngaphambi kwesigameko hhayi phakathi kwaso.

Rekhoda ikheli lomthombo owahlola kulo, ngoba umthetho obhalelwe u-192.168.10.50 uyahluleka buthule lapho ikhompyutha ephathekayo yomphathi isuka iye kwenye i-subnet.

Bhala umzila wokululama ku-runbook

Nquma manje ukuthi kuzokwenzekani uma i-VPN ephumayo iphula umzila wasendaweni. Ukufinyelela ngekhonsoli, ikheli lesibili lokuphatha noma inqubo ebhaliwe yokumisa iklayenti konke kuyizimpendulo ezisemthethweni, futhi noma iyiphi yazo ingcono kunokuthola inkinga ngesikhathi okudingeka khona ukungena. Uma iseva ikude, umzila wasendaweni awukho, futhi umklamo olungile umzila wokufinyelela kude ogunyaziwe ohlukile noma i-bastion esikhundleni sembobo yomphakathi evulekile.

Gcina izindima ezimbili zihlukene emibhalweni: i-SSH yasendaweni yomphathi oseduze, kanye nethuneli eliphumayo lethrafikhi yohlelo. Uma lezo zindima zibhaliwe, ushintsho lwesikhathi esizayo kunoma iyiphi yazo lunendawo ecacile okufanele ihlolwe, futhi umuntu olandelayo akadingi ukuphinda athole ukuthi kungani iseva ene-VPN isaphendula ekhelini layo le-LAN.