I-SSH ehlehlayo yedivayisi eyodwa: isilaleli se-loopback noma i-VPN enomzila?

Idivayisi yakho ingemuva kwe-NAT yomhlinzeki, ingavula ukuxhumana okuphumayo, futhi isebenzisa iseva ye-SSH okungekho muntu ongayifinyelela. Isicelo esifikayo ngokuvamile sisho ukuthi "yinike i-VPN", okuyimpendulo eyodwa kweziningi. Ngaphambi kokuyamukela, nquma ukuthi udinga iphothi elilodwa le-TCP lokuphatha noma indlela enomzila eya kuyo yonke i-subnet, ngoba leyo imisebenzi ehlukene enokuchayeka okuhlukene.

Umhubhe ohlehlayo uphendula kahle enguqulweni emincane. Idivayisi ishaya ku-hub yakho, icela i-hub ukuthi ilalele kuphothi le-loopback, bese idlulisela leyo phothi emuva kuphakathi kwayo i-SSH. Ngemva kwalokho abaphathi bafinyelela isilaleli nge-hub, hhayi nge-inthanethi yomphakathi.

Izimo ezintathu ezinqumayo ukukhetha

Zibhale phansi ngaphambi kwanoma yikuphi ukumiswa. Ziyingqamuzana phakathi kokungena kokuphatha okulinganiselwe nokwandiswa kwenethiwekhi, futhi ukuzihlanganisa yikho okwenza umhubhe wemigqa emihlanu ube inethiwekhi eliyisicaba elingenamnini.

Umugqa wesithathu yiwo abantu abaphikisana ngawo. Umhubhe oya kuphothi le-SSH ledivayisi awubeki omakhelwane bayo kunethiwekhi yakho, futhi akufanele kubonakale sengathi kwenza kanjalo ngohlu lwezinye izidluliselo. Uma isidingo siyi-LAN ngempela, shono lokho bese udizayina yona esikhundleni.

Uhlangothi lwe-hub: i-akhawunti ye-relay elinganiselwe

Nika idivayisi ngayinye i-akhawunti yayo ye-relay enokuqinisekiswa ngokhiye womphakathi futhi ngaphandle kweseshini yokuxhumana. Match ibhlokhi elinganiselwe kuleyo akhawunti ligcina imvume incane, futhi ukhiye oyimfihlo uhlala kudivayisi lapho kufanele khona.

Match User relay-dev-7
    AuthenticationMethods publickey
    PubkeyAuthentication yes
    AllowTcpForwarding remote
    PermitListen 127.0.0.1:21022
    GatewayPorts no
    MaxSessions 0
    PermitTTY no
    X11Forwarding no
    AllowAgentForwarding no

MaxSessions 0 uwumugqa othakazelisayo. Unqaba amaseshini e-shell kanye ne-subsystem kuyilapho uvumela ukudlulisela okudingwa yidivayisi, ngakho ukhiye owebile awukwazi ukuguqulwa ube ukungena okuxhumanayo. PermitListen ibopha ikheli nephothi lesilaleli ohlangothini lwe-hub, futhi GatewayPorts no iligcina ku-loopback esikhundleni sokulivulela inethiwekhi i-hub ekuyo.

Hlola ukumiswa okusebenzayo ngaphambi kokulayisha kabusha, futhi ugcine iseshini yesibili ivuliwe ngesikhathi wenza lokho. Match ibhlokhi elisebenza kubo bonke ngengozi, noma iphutha lokubhala egameni lenketho, iyindlela yakudala yokuzivalela ngaphandle kwebhokisi olikhomesayo. Khipha ukumiswa okusebenzayo bese ufunda izinketho futhi esikhundleni sokuthemba ifayela osanda kulibhala. Qaphela ukuthi ukusekelwa kwezinketho kuyahluka phakathi kokwakhiwa, ngakho umugqa owamukelwa kuseva entsha ungase udelelwe nje yindala.

Uhlangothi lwedivayisi: ukudlulisela okuhluleka ngomsindo

Idivayisi ivula ukuxhumana futhi icela isilaleli. Amakheli amabili ku-agumenti -R asho izinto ezihlukene, futhi ukuwafunda kusukela kwesokunxele kuye kwesokudla iyona ndlela esheshayo yokukhumbula ukuthi yikuphi.

ssh -NT \
    -o ExitOnForwardFailure=yes \
    -o ServerAliveInterval=30 \
    -o ServerAliveCountMax=3 \
    -R 127.0.0.1:21022:127.0.0.1:22 \
    [email protected]

Ipheya lesokunxele yindawo lapho i-hub kufanele ilalele khona. Ipheya lesokudla yilokho idivayisi exhuma kukho uma isicelo sifika, kuxazululwe ohlangothini lwedivayisi uqobo. Ukuzishintsha kudala umhubhe okhuphuka kahle bese udlulisela endaweni engalungile, okubi kunokuhluleka.

ExitOnForwardFailure=yes iphoqa umyalo ukuthi uphume uma isilaleli esiceliwe singakwazi ukusungulwa, ngakho umjikelezo wokuqalisa kabusha ukutshela iqiniso esikhundleni sokushiya iseshini esebenza kancane. Akusho lutho mayelana nokuthi isevisi ye-SSH yasendaweni inempilo kamuva, ngakho yihlanganise nomphathi wezinqubo kanye nokuhlolwa kwangempela kokuxhumana ngezikhathi ezithile.

Ungalokothi ushintshe ikheli lokulalela le-loopback nge-wildcard ukuze ugweme ukweqa okwengeziwe. Lolo shintsho olulodwa lumehluko phakathi kwendlela yokuphatha nephothi efinyeleleka ngumphakathi, futhi ngokuvamile lwenzeka ngesikhathi sokulungisa amaphutha bese luhlala. Uma uzakwenu engakwazi ukufinyelela iphothi nge-hub, lungisa ukumiswa kokweqa esikhundleni sokwandisa isibopho. I-loopback iyiyo yonke impikiswano yezokuphepha yalo mklamo.

Ukufinyelela komphathi nge-hub

Umphathi one-akhawunti evamile ku-hub angakwazi ukweqa ngayo eya kuphothi elidlulisiwe. I-akhawunti ye-relay ayisetshenziselwa lokhu, futhi yikho kanye okushiwo ukuzigcina zehlukene.

ssh -J [email protected] -o HostKeyAlias=device-7 \
    -p 21022 [email protected]

Qinisekisa ukhiye womsingathi wedivayisi ngaphansi kwesibizo osikhethile, ngoba lowo khiye ukhomba idivayisi ekupheleni kochunge lwemisebenzi futhi umhubhe uwukuthutha kuphela. Ukungena kusukela ekupheleni kuye ekupheleni kusaqinisekisa izinhlangothi zombili; umhubhe ophela ku-hub eyabiwe awukwenzi kube indlela ethembekile ngokwayo.

Thatha ubunikazi bomjikelezo wempilo

Gijima umyalo wedivayisi ngaphansi komphathi wezinqubo nesimo esisodwa esisebenzayo nqobo kanye nenqubomgomo yokuqalisa kabusha oyikhethe ngamabomu. Izinketho ze-keepalive zibona umlingani ofile; azivusi inqubo ephumile.

Bese ubhala inqubo yokuhoxiswa. Idivayisi ngayinye ithola isilaleli sayo nokhiye wayo, ngakho ukuhoxiswa kusho ukuhoxisa leyo akhawunti nokususa lowo khiye, hhayi ukuzungezisa imfihlo eyabiwa yiqembu lonke.

Ekugcineni, khumbula ukuthi i-loopback ikunika ini. Inciphisa ukuchayeka kwenethiwekhi futhi ayenzi lutho mayelana nabanye abasebenzisi basendaweni ku-hub eyabiwe, ngakho inqubomgomo yokufinyelela ye-hub uqobo kufanele isalunga. Isithenjwa se-sshd_config ibhala phansi yonke inketho esetshenziswe ngenhla, futhi kufanelekile ukufunda izingxenye zokudlulisela ngokugcwele ngaphambi kokwandisa noma iyiphi yazo.