i-rsync nge-VPN: iphothi le-daemon engu-873 kuqhathaniswa nemodi ye-SSH

Iphothi 873 iwukusebenza kwangaphakathi okuthwalwa umhubhe, hhayi into eyongena esikhundleni sawo. Ihlukanise imodi ye-daemon nemodi ye-SSH, bese uvula kuphela indlela oyisebenzisayo ngempela.

Ukuvumela i-TCP 873 kuyi-interface yomhubhe akucindezeli i-rsync ukuba idlule OpenVPN, futhi akwenzi ukuthi uhlangothi olude lwamukele imodyuli. Umhubhe uthwala uxhumano lwangaphakathi okuhamba kwalo nemithetho yendawo ekuyiwa kuyo kuhlala kunjalo njengakuqala. Ngakho umbuzo wokuqala awukho mayelana nokuthi iyiphi iphothi okufanele ivulwe, kodwa ukuthi i-rsync yenza uhlobo luni loxhumano. Konke okungezansi kucabanga ukuthi umhubhe ususebenza futhi insizakalo yangaphakathi kuphela esengabazekayo.

Nquma ukuthi i-rsync yenza uxhumano luni ngempela

Impikiswano yendawo ekude emyalweni ivamise ukuphendula lowo mbuzo ngaphambi kwanoma yiluphi ushintsho lwe-firewall. Ikholethi eliphindwe kabili noma uhlelo lwe-URL kukhetha i-daemon, kanti ikholethi eyodwa ngemva kwegama le-host kukhetha i-shell yendawo ekude. Funda impikiswano oyisebenzisayo ngempela, hhayi leyo esesibonelweni sombhalo.

Isinqumo esicacile se-shell yendawo ekude singashintsha futhi impendulo, ngoba sitshela i-rsync ukuthi iyiphi uhlelo okufanele iqale ukuthutha. Funda umugqa wonke womyalo, kuhlanganise namaskripthi wokugoqa azuzwe njengefa, hhayi ingxenye ye-host kuphela.

Remote argumentWhat it opens
rsync://vault.corp.internal/archive/rsync daemon, normally TCP 873
vault.corp.internal::archive/rsync daemon, normally TCP 873
[email protected]:/srv/archive/Remote shell, normally SSH on its configured port

Imodi ye-daemon: ikheli lokubopha, imodyuli nephothi

Kusintaksi ye-daemon, ingxenye yendlela isho imodyuli ehleliwe, hhayi idayirekhthri kudiski. Iphasiwedi yemodyuli ihlolwa kuphela ngemva kokuba uxhumano lwamukelwe, futhi imodyuli ingaba ngesimo sokufunda kuphela noma ifihlwe ohlwini. Lokho kuhleleka kubalulekile lapho ufunda iphutha, ngoba uxhumano olunqatshiwe nemodyuli enqatshiwe kuwukwehluleka ezigabeni ezimbili ezahlukene. Akukho kulezi zindaba ezimbili okutshela okuthile ngomhubhe uqobo.

I-daemon ezimele ingananyathiselwa ekhelini lomhubhe kufayela layo lokulungiselela, okuyenza igcine kude ne-interface yomphakathi ngaphandle komthetho we-firewall. Inani kufanele libe khona lapho i-daemon ibopha, futhi isilaleli esivulwa nge-socket noma esilawulwa yi-inetd singayishaya indiva ngokuphelele.

address = 10.44.0.1
port = 873
[archive]
    path = /srv/archive
    read only = yes

Bese uhlola ngokumelene nekheli langasese esikhundleni segama lomphakathi. Igama le-host lomphakathi lixazululeka libe ikheli le-WAN futhi lihamba indlela ehlukile, ngisho nomshini oyedwa uphendula kokubili.

rsync --list-only rsync://10.44.0.1/archive/

Imodi ye-shell yendawo ekude: i-SSH ithwala ukudluliselwa

Ngekholethi eyodwa, i-rsync iqala uhlelo lwe-shell yendawo ekude futhi ikhuluma iphrothokholi yalo kulelo shaneli, ngakho insizakalo okuwukuphela kwayo engafinyeleleka i-SSH kunoma iyiphi iphothi iseva elalela kuyo. I-daemon ye-rsync ayikaze isebenze, iphothi 873 alinamsebenzi, futhi isinqumo sokufinyelela siphenduka isinqumo se-akhawunti ye-SSH. Indlela yendawo ekude khona-ke iyindlela yangempela yohlelo lwamafayela echazwa yi-shell ohlangothini olude. Yingakho ushintsho lwe-firewall olubhekiswe ku-873 lungenzi lutho nhlobo kule modi.

Lowo mklamo udinga i-akhawunti egunyaziwe nokuqinisekiswa kokhiye we-host, futhi uzuzwa njengefa inqubomgomo yokuqinisekisa ye-SSH uqobo. Kuvame ukuba isinqumo esingcono lapho ukudluliselwa kufanele kweqe inethiwekhi engathembekile, ngoba ukufihla kungokwephrothokholi eyakhelwe lokho. I-daemon ebuzayo iphasiwedi ayiyona into efanayo.

Vula kuphela indlela oyikhethile

Lapho imodi isinqunyiwe, vumela insizakalo eyodwa yangaphakathi kuyi-interface eyodwa ethwala umhubhe. Nciphisa umthetho nge-interface, ichibi lomthombo nekheli lendawo ekuyiwa kuyo ukuze ushintsho lwengemuva lokwenqaba oluzayo lungakwazi ukuwukhulisa buthule. Bese ubuyekeza ukuhleleka kwemithetho, ngoba umthetho ovumelayo ngaphambili kukhange lokho kwenza umthetho omncane ube umhlobiso nje.

Uma i-daemon isebenza kumshini ongemuva kwesango le-VPN hhayi kwisango uqobo, isango lidinga futhi indlela yokudlulisela futhi okuhlosiwe kudinga imvume yako nendlela yokubuya. Ukuvula iphothi esangweni kuphela kukhiqiza uxhumano olwamukelwayo bese lungayi ndawo.

Qinisekisa kusukela kuklayenti ngemodi efanayo nendawo ekuyiwa kuyo ohlosela ukuyisebenzisa ekukhiqizeni. Uhlu oluyimpumelelo lubonisa isilaleli, indlela kanye nomthetho ndawonye; ukuphela kwesikhathi kukhomba indlela, futhi ukwenqaba kukhomba isilaleli.

ufw allow in on tun0 from 10.44.0.0/24 to 10.44.0.1 port 873 proto tcp
ss -ltnp | grep 873

Izihloko ezihlobene