I-ping iyasebenza kodwa i-SSH yehluleka ku-VPN: yisiphi isigaba esaphuka?
Umzamo owodwa onemininingwane uhlukanisa ukufinyeleleka kwe-TCP, ukuthuthwa kwe-SSH, ubunikazi bomsingathi, ukungena komsebenzisi kanye nemvume yesikhathi, ukuze uyeke ukuqagela ngetheku.
Izimpendulo ze-ping nokungena kwe-SSH okunqatshiwe kungaba yiqiniso ngasikhathi sinye, futhi laba ababili abasoli itheku. Izimpendulo ze-echo nokuxhumana kwe-TCP embobeni 22 yizivivinyo ezihlukene ezinabakhethi abahlukene, izinqubomgomo ezihlukene futhi ngokuvamile izindawo ezihlukene. Rekhoda umzamo owodwa we-SSH owenziwe ngamabomu, bese usho isigaba sokugcina esafinyelela kuso. Leyo nto eyodwa yobufakazi ithatha indawo yezinguquko eziyishumi nambili zokucabanga zokulungiselela.
Rekhoda umzamo owodwa, hhayi isikhathi sokugwaza kaningi
Gijimisa iklayenti kanye ngokuxilonga okunemininingwane, ukwabelana ngokuxhumana kuvaliwe kanye nesikhathi sokuxhumana esilinganiselwe. Ukuvala ukwabelana kubalulekile ngoba ukuxhumana okuyinhloko okuqinisekisiwe ngaphambili kuzophendula esikhundleni somzamo omusha futhi kufihle iphutha olixoshayo.
ssh -4 -vv -o ControlPath=none -o ConnectTimeout=10 [email protected]Gcina indawo oya kuyo, umndeni wamakheli, uphawu lwesikhathi kanye nephutha lokugcina elingeyona imfihlo. Ifulegi le-IPv4 lisho futhi ukuthi lo mzamo awusho lutho ngomzila we-IPv6 oya egameni elifanayo, ngakho ungajikisi kukho. Bhala ukuthi umzamo wenziwe kusuka kuphi. Ukuhlola esangweni le-VPN akusona isibonelo esifanayo sokubuka njengekhompyutha ephathekayo engemuva kwaso, futhi ukungqubuzana okuningi kulawo amathikithi kuvela ekuhlanganiseni kokubili.
Isigaba sokuqala nesibili: i-TCP ngaphambi kwe-SSH
Umngcele wokuqala ukufinyeleleka kwesokhethi: ikheli, umbobo kanye nomzila iphakethe eliwulandela ngempela. Uma ukuxhumana kwe-TCP kungapheleli, akukho lutho olungaphezulu kwalo okwamanje, futhi okhiye bomsingathi namakhawunti akubalulekile.
nc -vz 10.90.4.20 22
ip route get 10.90.4.20
tcpdump -ni any 'host 10.90.4.20 and port 22'Hlanganisa irekhodi nomzamo weklayenti. I-SYN ephumayo futhi kungabuyi lutho ikhomba ekuhlungweni, kubakhethi noma emzileni ongakho ohlangothini olukude; impendulo enokuhlehliswa ikhomba entweni enqaba ngokuqhubekayo esikhundleni sokulahla. Umngcele wesibili ukushintshana kweprotocol ye-SSH uqobo. Ukuxhumana kwe-TCP okuphelayo bese kuma kudlule ukufinyeleleka kwangena ezingxoxweni, empendulweni yeseva noma ekuphatheni amaphakethe. Lokho kuwuphenyo oluhlukile, futhi yilapho izinkinga ezihlobene nosayizi ziqala ukuba nokwenzeka khona.
Isigaba sesithathu: ukhiye kabani ophendulile
Uma ukuthutha sekuphezulu, iklayenti liqinisekisa ukhiye womsingathi weseva. Ukwenqaba lapha kuyisitatimende ngobunikazi, hhayi nge-cryptography: umlingani wethula ukhiye umgomo wakho ongawamukeli. Kuthatha njengombandela wokuma futhi uqinisekise ngaphandle kwebhendi, kukhonsoli noma kumsebenzisi owakha kabusha umsingathi. Ukususa okufakiwe okukhunjulwayo ukuze kususwe isexwayiso iyona ndlela emfushane okufanele uyinqabe, ngoba ibhubhisa ubufakazi bokuthi kukhona okuphendule ngokungalindelekile.
Uma umsingathi wakhiwe kabusha ngempela, susa irekhodi elidala kuphela ngemva kokuqinisekiswa kwesigxivizo somunwe esisha, futhi bhala usuku nesizathu. Unjiniyela olandelayo uzohlangabezana nese xwayiso futhi udinga lowo mongo.
Isigaba sesine nesihlanu: i-akhawunti nezimvume
Ukuqinisekisa ubunikazi ngumngcele wesine. Imininingwane yokungena enqatshiwe isho ukuthi iseva yahlola umzamo futhi yawunqaba; hlola i-akhawunti, uhlobo lwemininingwane yokungena iseva eyamukelayo kanye nomgomo weseva uqobo esikhundleni sephasiwedi ye-VPN. Umngcele wesihlanu ukugunyazwa ngemva kokungena okuphumelelayo. Umsebenzisi oqinisekisiwe usengavinjelwa i-shell, umyalo, uhlelo olungaphansi noma ukudlulisela, futhi lokho kunqatshwa kubonakala njengeziphutha kumuntu ofunda umugqa wokugcina weklayenti kuphela.
| Last stage reached | What it proves | Where to look next |
|---|---|---|
| No TCP connection | No SSH transport exists | Address, port, route, selectors, filter, listener |
| TCP up, exchange incomplete | Reachability is not the blocker | Server response, negotiation, packet handling |
| Host identity rejected | The peer is not the expected host | Independently verified host key |
| User authentication rejected | The attempt reached authentication | Account, credential and server policy |
| Authenticated, session denied | Login succeeded, the operation did not | Shell, command or forwarding permission |
Yeka ngemva kwemizamo embalwa yephasiwedi ehlulekile. Ukuqagela okuphindaphindiwe kudala ukuvalwa okubese kubonakala njengephutha lesibili elingahlobene futhi kudla isikhathi esiningi kunethikithi lokuqala.
Ukuhlehlisa kanye nerekhodi olugcinayo
Shintsha into eyodwa ngesikhathi, futhi bhala ukuthi washintshani ngaphambi kokuhlola futhi. Uma ushintsho luba kubi umzamo, buyisela emuva ngokushesha esikhundleni sokunqwabelanisa okunye ukulungiswa phezu kwakho. Phinda umsebenzi wokuqala kusuka kuklayenti nakuwo umongo wokuqala. Ukungena okuphumelelayo kusuka kumshini omunye, kumndeni wamakheli omunye, akusikho ukuphindwa futhi akubonisi ukulungiswa.
Hlanza lokho okwabelanayo. Ukuphuma kweklayenti okunemininingwane kungathwala amagama angaphakathi, amalebula e-akhawunti, izindlela zokhiye kanye nezihlonzi zokhiye womphakathi, ngakho shicilela isiphetho sesigaba ngasinye esikhundleni somkhondo oluhlaza.