Ukufinyelela isayithi le-HTTPS elitholakala kuphela nge-VPN ngokudluliswa kwe-SSH

Umshini owodwa usunokufinyelela kwe-VPN okuvunyiwe, umshini wesibili udinga ngqo isevisi eyodwa eyimfihlo ye-HTTPS, futhi ukudluliswa kwe-SSH kwasekhaya kungavala lelo gebe ngaphandle kokunikeza umshini wesibili umhubhe. Ukudluliswa kuthwala indawo eyodwa ye-TCP esikhundleni sayo yonke inethiwekhi, futhi lowo mkhawulo uyona ndaba. Landela izinyathelo ezinhlanu ezingezansi ngokulandelana, ngoba ngayinye ihluleka ngesizathu esihlukile futhi isinyathelo sakamuva asikwazi ukusindisa igebe langaphambili. Uma noma yisiphi isimo esidingekayo singekho, lo mklamo awukuxazululi futhi akukho kulungiswa kwemiyalo okuzosiza.

Isinyathelo sokuqala: qinisekisa izimo ezintathu ezedingekayo

Izinto ezintathu kufanele zibe yiqiniso kakade ngaphambi kokuba noma yimuphi umyalo ube nencazelo. Udinga imvume yokusebenzisa umshini wokuqala njengomsingathi wokudluliswa, ukufinyelela kwe-SSH okusebenzayo kuwo, kanye nenqubomgomo yesiphakeli evumela indawo okuhloswe ngayo. I-akhawunti ye-SSH eyenzelwe ukudlulisa amafayela ingase ibe nokudluliswa okuvaliwe, futhi isiphakeli esivumela ukudluliswa sisengakhawulela ukuthi yiziphi izindawo ezingafinyelelwa ngaso. Buza ngaphambi kokuhlola, ngoba ukusebenzisa isiteshi somsebenzi sikazakwenu njengendawo yokugxuma ngaphandle kwesivumelwano kuyinkinga yenqubomgomo, ngisho nalapho umyalo usebenza ngokuphelele.

Imiyalo emibili ixazulula ingxenye yezobuchwepheshe yalolo hlu. Eyokuqala ikhombisa ukuthi i-akhawunti nokhiye basebenza ngaphandle kwesicelo sokuxhumana, eyesibili yona ishicilela inqubomgomo yesiphakeli yangempela esikhundleni sesibonelo esichazwe kufayela lokumisa.

ssh -o BatchMode=yes [email protected] 'echo ok'
sudo sshd -T | grep -E 'allowtcpforwarding|permitopen'

Isinyathelo sesibili: bopha imbobo ye-loopback futhi ugcine iseshini iphilile

Kumsihini osebenzisa uhlelo lokusebenza lwekhasimende, vula ukudluliswa kwasekhaya okuya kwisevisi eyimfihlo. Kubophe ngokusobala ku-loopback ukuze kungamenyezelwa kunethiwekhi yasekhaya, futhi ukhethe imbobo ephezulu okungekho sevisi yasekhaya esivele iyibambile. Gcina iseshini isebenza ngesikhathi usebenza, ngoba ukuyivala kuvala nomlaleli. ExitOnForwardFailure kuguqula ukubopha okwaliwe noma imbobo esetshenzisiwe kube ukuphuma ngokushesha esikhundleni seseshini ehlala ingekho ukudluliswa, futhi yiyo leyo ndlela yokwehluleka echitha isikhathi esiningi.

Ukuxhumana okuyimfihlo kwenziwa kusuka kumsingathi wokugxuma, ngakho i-DNS, imizila, inqubomgomo ye-VPN nokufinyelela kwisevisi yalowo msingathi konke kufanele kusebenze. Iseshini ye-SSH ayidali ukufinyeleleka umsingathi wokugxuma angenakho, futhi ayikwazi ukulungisa umzila i-VPN engakaze iwusunduze. Qinisekisa umlaleli lapho ukhona ngempela esikhundleni sokuthemba ukuthula komyalo.

ssh -N -o ExitOnForwardFailure=yes -L 127.0.0.1:9443:portal.lab.example:443 [email protected]
ss -ltn '( sport = :9443 )'

Isinyathelo sesithathu: gcina igama le-HTTPS lapho isokhethi isekhaya

Ukuphequlula ku-https://127.0.0.1:9443/ kushintsha igama lesiphakeli se-TLS negunya lohlelo lokusebenza. Isitifiketi esikhishwe se-portal.lab.example ngeke siqinisekiswe ngokumelene nekheli le-loopback, futhi iphutha elivelayo libonakala njengesitifiketi esiphukile esikhundleni sendlela emfushane yokudluliswa. Ukuze uhlole ngomugqa womyalo, gcina i-URL yangempela futhi ushintshe indawo yesokhethi kuphela. Yilokho okwenziwa i---connect-to, futhi incwadi ye-curl ibhala ngohlobo lwezinkambu ezine olusetshenziswe ngezansi.

curl --noproxy portal.lab.example --connect-to portal.lab.example:443:127.0.0.1:9443 https://portal.lab.example/

Igama lihlala ku-URL, ekuxhumaneni kwe-TLS nakusihloko se-Host, kuyilapho ukuxhumana kwe-TCP kuya kumlaleli wasekhaya. Inketho engenayo i-proxy igcina uhlolo kulokhu kudluliswa esikhundleni sokuvumela i-proxy ye-HTTP emisiwe ukuba iyivimbe, futhi ukugcina ukuqinisekiswa kwesitifiketi kuvuliwe yikho okwenza umphumela ube nencazelo.

Isinyathelo sesine: wazi ukuthi ukudluliswa okukodwa akukwazi ukumboza ini

Ukudluliswa okukodwa kwe-TCP kumboza imbobo eyodwa yendawo. Ikhasi eliqondisa kabusha kwelinye igama lomsingathi, elilayisha izinsiza kusuka kumsingathi ongaphakathi kwenethiwekhi eyimfihlo noma elithumela kwenye imbobo lidinga ukudluliswa kwalo, futhi ngakunye kwazo kudinga ukuhlolwa kwenqubomgomo okufanayo nalokho kokuqala. Imisebenzi yesiphequluli yengeza izidingo zayo, ngoba isiphequluli kufanele sitshelwe ukuthi sithumele igama langempela embotsheni yasekhaya ngokumisa i-proxy noma ngokuhlela kwasekhaya. Ngakho-ke uhlolo lomugqa womyalo oluphumelelayo alufakazeli ukuthi isiphequluli sizophumelela, nakuba sifakazela indlela.

I-UDP, ukutholwa kwe-SMB nokungena esizindeni akudluli nakancane ngokudluliswa kwe-TCP. Uma isidingo sangempela siwukufinyelela okujwayelekile kwenethiwekhi, lo mklamo uyithuluzi elingalungile futhi isango lokufinyelela kude elisekelwe yilo elilungile.

Isinyathelo sesihlanu: hlanza futhi ubhale phansi

Misa iseshini lapho uhlolo luphela futhi uqinisekise ukuthi umlaleli akasekho. Uma imbobo ekhethiwe ibivele isetshenzisiwe, khetha enye imbobo ye-loopback engasetshenzisiwe futhi ubuyekeze ndawonye i-URL, umyalo wokuhlola kanye nenothi, esikhundleni sokumisa isevisi yasekhaya engahlobene ukuze ukhulule inombolo. Ukushiya ukudluliswa kuvulekile kukhompyutha ephathekayo kuguqula ukuxilongwa kube isevisi engaphethwe.

Bhala umsingathi wokugxuma, indawo edlulisiwe, imbobo yasekhaya kanye nalowo ovumile ukuhlelwa. Ukudluliswa okukhona kuphela emlandweni we-shell yothile kusemva kokuqalwa kabusha okukodwa kokuphenywa okuphindwayo, futhi umuntu olandelayo ngeke azi ukuthi yisiphi sezimo ezintathu esidingekayo esivele sihloliwe.