Kungani ukuskena kwembobo kushintsha uma kusetshenziswa i-sudo

I-Nmap ayihlali ithumela iphakethe ocabanga ukuthi ulicele. Uma ama-socket aluhlaza engatholakali, ishintsha ukuskena kwe-SYN okuzenzakalelayo ngokuskena kwe-TCP connect, ngakho ukusebenza njengomsebenzisi ojwayelekile nokusebenza ngaphansi kwe-sudo kungaphendula imibuzo ehlukene mayelana nembobo efanayo. Imiphumela ibukeka njengenkinga yemvume, futhi ngokuvamile inguquko yendlela. Ukwenza indlela icace yikho kuphela indlela yokuqhathanisa lokho kusebenza okubili.

Ama-probe amabili, imbobo eyodwa, izindlela zekhodi ezihlukene

Ukuskena kwe-SYN kwakha ngokwako isihloko se-TCP, kuyithumele kusuka ku-socket eluhlaza futhi kufunde impendulo isuka kunethiwekhi ngaphambi kokuba isitaki se-TCP se-kernel sibhale ukuxhumana okuqediwe. Ukuskena kwe-connect kucela uhlelo lokusebenza ukuba luvule i-socket ejwayelekile futhi kubike lokho connect() ekubuyiselayo. Kokubili kungabiza imbobo njengevuliwe, kodwa kukodwa kuphela okushiya umzamo ovulekile ngasohlangothini, futhi kukodwa kuphela okungaphansi kwenqubomgomo yezinga le-socket ehlobene nenqubo ethumelayo.

Indlela eluhlaza idinga CAP_NET_RAW, yingakho ukuskena okuzenzakalelayo kuncipha ngokuthula uma lelo khono lingekho. Incwadi yezindlela zokuskena ye-Nmap uqobo iyabhala lokhu kushintshwa: ukuskena kwe-connect kuyisiphele ngoba akudingi mvume ekhethekile. Ukushintshwa kwenzeka ngaphandle kwesexwayiso ezinhlotsheni eziningi zokusebenza, futhi yikho okukwenza kube lula ukukufunda ngokungalungile. Uma usukwazi ukuthi isiphele sikhona, “kuvuliwe njenge-root, kuvaliwe njengomsebenzisi” akusazwakali njengephutha lemvume futhi kuqala ukuzwakala njengezilinganiso ezimbili ezihlukene.

I-sudo ishintsha ngempela ini ekuskeneni

Ukuphakamisa imvume kubuyisela indlela ye-socket eluhlaza, futhi lokho kushintsha okungaphezu kwesinqumo. Ukukhethwa kwembobo yomthombo, isikhathi samaphakethe, ukuziphatha kokuthumela kabusha kanye nendlela impendulo ehlungiwe ehlukaniswa ngayo konke kuvela kukhodi ehlukene. Ithuluzi eliphakathi elikhawulela izinga le-SYN liphatha lokho kusebenza okubili ngokungalingani ngisho nalapho umsingathi womgomo ufanayo.

Ukubhalwa kwamalogi ohlangothini lomgomo nakho kuyahluka. Ukuxhawulana okuqediwe kubonakala kusevisi nakunoma yikuphi ukubalwa kwe-socket, kuyilapho i-probe evulekile ngasohlangothini esethiwe kabusha ivamise ukungabonakali. Uma uqhathanisa lokho kusebenza nomsingathi okufunda nawo amalogi ayo, ingxenye yomehluko owubonayo iwukubuka uqobo.

Gcina indlela ijwayelekile kukho kokubili ukusebenza

Phoga indlela efanayo kuzo zombili izingcingo futhi ukuqhathanisa kuqala ukuba nencazelo. Ifulegi -sT licela ukuskena kwe-connect ngokucacile, -Pn lisusa ukutholwa kwemisingathi, -n lisusa ukuxazululwa kwamagama, futhi i--p eyodwa isusa umehluko wohlu lwezimbobo.

nmap -sT -Pn -n -p 8443 198.51.100.77
sudo nmap -sT -Pn -n -p 8443 198.51.100.77

Shintsha ikheli nembobo ngomsingathi ovunyelwe ukuba uwuhlole; ibanga lemininingwane elingenhla liyisibonelo, hhayi umgomo. Uma lokho kusebenza okubili manje kuvumelana, umehluko wokuqala wawuvela endleleni yokuskena. Uma kungakavumelani, enye into ihlukanisa ithrafikhi, futhi isigaba esilandelayo yindawo okufanele ibhekwe.

Umongo we-akhawunti awuwona nje ifulegi lemvume

Ukusetshenziswa kwe-VPN kungahlukanisa amaphakethe nge-UID, nge-cgroup, noma ngomthetho ohlobene nenqubo evule i-socket. Khona-ke ithrafikhi ye-root neyomsebenzisi iphuma ngamathebula omzila ahlukene noma ihlangabezana namaqoqo emithetho ahlukene, futhi akukho kuqondiswa kwendlela yokuskena okungabavumelanisa.

Hlola inqubomgomo, hhayi imvume. Ku-Linux, i-nftables iveza lokhu nge-meta skuid futhi i-iptables ngokufana komnikazi, futhi noma iyiphi ingathumela i-UID eyodwa kuthaneli ngenkathi enye iqhubeka isebenzisa umzila wangempela ozenzakalelayo.

sudo nft list ruleset | grep -n skuid
sudo iptables-save | grep -n uid-owner
ip rule show
ip route get 198.51.100.77

Qinisekisa i-probe ngaphambi kokuqhathanisa imiphumela

Ngaphambi kokuphetha, fakazela ukuthi iyiphi i-probe eyasebenza. I-Nmap ibiza ubuchwepheshe ngokwayo kokuphuma kwayo, futhi i---reason ingeza ubufakazi ngemuva kwesimo ngasinye, futhi yingxenye leyo ekutshela ukuthi ukuxhawulana kuqede ngempela yini.

nmap --reason -sT -Pn -n -p 8443 198.51.100.77
sudo nmap --reason -sS -Pn -n -p 8443 198.51.100.77
getcap "$(command -v nmap)"
capsh --print | grep -i net_raw

Lokho kusebenza okubili okubika isimo esifanayo ngezizathu ezihlukene akukuphikisani, futhi lokho kusebenza okubili okubika izimo ezihlukene ngesizathu esifanayo kukhomba ekuhlelweni kwemizila noma kunqubomgomo, hhayi ekuskeneni. Gcina umgomo, imbobo, isikhala samagama nesikhathi kufana, bese ushintsha ukuguquguquka okukodwa ngesikhathi. Ukusebenza kwesevisi njenge-root akusona isixazululo sokungavumelani kwenqubomgomo; isixazululo ukuveza inqubomgomo ehlosiwe ngumnikazi wesevisi.