MaxSessions, MaxStartups noma ukubhaliswa kwedivayisi: yimuphi umkhawulo we-SSH okufanele ukhethwe

Izinsizakalo ze-tunnel ezithembisa idivayisi eyodwa kumhambi ngamunye azivamisile ukuthola leso sithembiso ku-MaxSessions, futhi isivivinyo sokuqala sivame ukukufakazela lokho. Umhambi uvula inqubo yesibili ye-ssh, iseshini yokuqala iyaqhubeka nokusebenza, futhi amathumbu womabili athwala ithrafikhi. Ilungiselelo ngalinye lokuhlela libala into ehlukile, futhi alikho nelilodwa elibala amadivayisi. Ukuqamba isithembiso kuqala yikho okwenza ukukhetha phakathi kwazo kucace.

Yini inketho ngayinye eyibalayo ngempela

I-MaxSessions ikhawulela inani lamaseshini avulekile athwalwa wukuxhumana kwenethiwekhi okukodwa okuqinisekisiwe. Iseshini lapha sisho i-shell, isicelo se-exec, uhlelo olungaphansi olufana ne-SFTP, noma ishaneli elifanayo elihlanganiswe ngaphakathi kwe-transport eyodwa ye-SSH. Ucingo lwesibili lwe-ssh luvula i-transport yesibili, luqinisekisa kabusha futhi luthola imvume yalo. Inani lamaseshini okuxhumana kokuqala alinamsebenzi kulo.

I-MaxStartups ikhawulela ukuxhumana kwesikhathi esisodwa okungakaqinisekiswa, okuvezwa njengomkhawulo wokuqala, izinga nomkhawulo ogcwele. Ikhona ukuze ukuqhuma kwama-handshake avuleke kancane kungakwazi ukuqeda izinsiza ze-daemon ngaphambi kokuqinisekisa. Uma iklayenti seliqinisekisile, lokho kuxhumana kuyeka ukubalwa ngokumelene ne-MaxStartups futhi kuba iseshini yothile. Akukaze kube yisabelo sakho sonke umsebenzisi, futhi ukukukhulisa akuvumeli umhambi ukuba enze okwengeziwe.

Umthetho wokubhaliswa kwedivayisi awuyona neze inketho ye-sshd. Ingena kunoma yiluphi uhlelo olukhipha izifakazelo futhi olulandelela ukuthi iyiphi idivayisi ezibamba, okusho ukuthi ludinga ukubhaliswa, uhlu kanye nokuhoxiswa esikhundleni sokubala. Ukuhlanganisa leso sidingo ekuhleleni kwe-sshd yilapho iningi lalezi zakhiwo likhona lingaqhubeki.

Lapho i-MaxSessions iyeka ukuba yisabelo

Ibhlokhi ye-Match User ishintsha ukuthi yimaphi amanani okuhlela asebenza kulowo msebenzisi, ngakho iyindawo yemvelo yokubeka i-MaxSessions eqinile kakhulu kwi-akhawunti yensizakalo. Lokho engakwazi ukukwenza ukuhlanganisa phakathi kokuxhumana, ngoba inketho ihlolwa nge-transport ngayinye. Ama-transport amabili athola umkhawulo wawo, futhi umsebenzisi ugcina enakho okuphindwe kabili kwalokho okuvunyelwe ibhlokhi.

Ukudlulisela kuyisimangaliso esihlukile. Ukudlulisela kwe-TCP akudingi ishaneli leseshini, ngakho i-MaxSessions 0 ingavimbela ama-shell nezinhlaka ezingaphansi kuyilapho isavumela amathumbu e--L ne--R. Insizakalo edlulisela kuphela futhi ethatha inani lamaseshini njengesabelo sayo somhubhe ayikho into eyikhalayo. Lokho kuziphatha kubhalwe kusithenjwa sokuhlela kweseva ye-OpenSSH, futhi kufanelekile ukusifunda ngaphambi kokuklama ngokuzungeza igama lenketho.

Khipha ukuhlela okusebenzayo esikhundleni sefayela ocabanga ukuthi lilayishiwe. Ukufakwa kanye namafolda e-drop-in kuvame ukusho ukuthi inani elisemthethweni akulona inani olilungisile.

I-MaxStartups ivikela i-daemon, hhayi umhambi

Isimo sezingxenye ezintathu se-MaxStartups sichaza ukuthi zingaki izixhumanisi ezingakaqinisekiswa ezingaba khona ngaphambi kokuthi i-daemon iqale ukulahla iphesenti lezintsha. Isimo saso esizenzakalelayo sikhona ngoba ukuxhumana kwe-SSH okungakaqinisekiswa kushibhile ukuvula futhi kuyabiza ukukugcina. Lokhu kuwukulawula kokuvikela izinsiza kwiseva, futhi kusebenza kubo bonke ngesikhathi esisodwa.

Ukukukhulisa phakathi kwesiphepho sokungena kushintshanisa ukuvikelwa kwe-daemon nokungeniswa, okuyisikhathi esithile ukushintshana okulungile futhi njalo kuyenziwa ngamabomu. Akwenzi lutho kumhambi ofuna umhubhe wesibili, ngoba umhubhe wokuqala usuqinisekisiwe. Ukudida lezi ezimbili kuholela ekushintsheni okulungisa uphawu olungalungile futhi kwephula iseva ngesikhathi esisodwa.

Uma ukungena kunqatshwa ngamaqembu, bheka kumugqa wokungena we-daemon umlayezo wangaphambi kokuqinisekisa ngaphambi kokuthinta noma iyiphi inketho. Umlayezo usho ukuthi yikuphi ukuvikela okwasebenza, futhi izivikeli azikwazi ukushintshana.

Isikhala kumsebenzisi ngamunye sidinga isimo esabiwe

Inqubomgomo yeqiniso ye-transport eyodwa esebenzayo idinga ukubhukha okugcinwa kwenye indawo ngaphandle kwe-sshd. Isinyathelo sokungeniswa kufanele sithathe isikhala se-akhawunti ngendlela ye-athomu, sikhulule lapho ukuxhumana kuvalwa, sivumele ukuphelelwa yisikhathi lapho iklayenti linyamalala ngaphandle kokuvala, futhi sinqume ukuthi umzamo omusha uyanqatshwa noma uthatha indawo yowangaphambili. Leso sinqumo sokugcina yisinqumo somkhiqizo, hhayi imininingwane yobuchwepheshe, ngoba ukushintsha umhubhe osebenzayo kunqamula othile.

Ukubhukha kufanele kwabiwe nayo yonke iseva eyamukela i-akhawunti. Amahosthi amabili anezibali zasekhaya ezizimele asebenzisa imikhawulo emibili ehlukene, futhi umhambi oxhuma kabusha ngesinye isango uthola isikhala sesibili mahhala. Noma yini egcina isimo idinga ukuziphatha kwayo kwehluleka, ngoba isitoreji esingafinyeleleki akufanele sikhiye wonke umhambi ngaphandle.

Ngesithembiso sedivayisi eyodwa, khipha izifakazelo ezihlukile zedivayisi ngayinye ebhalisiwe futhi lawula ukubhaliswa nokuhoxiswa kulelo zinga. Ukhiye wangasese okhishiwe usaqinisekisa nganoma yikuphi, ngakho ukukhipha ukhiye owodwa kumsebenzisi ngamunye akubona ubufakazi bokuthi zingaki izinsimbi eziwugcinayo.

Hlola inqubomgomo ngokuxhumana kwangempela okubili

Bhala izivivinyo zokwamukela njengezimiso ngaphambi kokubhala inqubomgomo. Izigameko ezinhlanu i-transport yesibili evulwa ngesikhathi eyokuqala isebenza, amashaneli amaningi ngaphakathi kwe-transport eyodwa, iklayenti elidlulisela kuphela amachweba, ukuxhuma kabusha ngemva kokuwa kwesixhumanisi, kanye ne-akhawunti efanayo efika kwesinye isango.

Funda imikhawulo esebenzayo kuqala, bese uvula ukuxhumana okufanele inqubomgomo ikwenqabe. Zombili izingxenye zalokho kuvivinya zibalulekile, futhi akukho okunye okuthatha indawo yokunye.

sshd -T | grep -iE "maxsessions|maxstartups|allowtcpforwarding|permitopen"
ss -tn state established '( sport = :22 )' | head
ssh -N -L 8080:127.0.0.1:80 [email protected]

Sebenzisa umyalo womhubhe kabili kumatheminali amabili futhi ubale ukuxhumana okusunguliwe echwebeni 22. Uma kokubili kuthwala ithrafikhi kuyilapho inqubomgomo yakho ithi kukhona i-transport eyodwa esebenzayo, inqubomgomo iwumbhalo hhayi ukuphoqelela. Lungisa leso sikhala ezingeni lokungeniswa, hhayi ngokwehlisa i-MaxSessions futhi uthemba ukuthi i-transport yesibili izokubona.