Kungani i-Samba inqaba amaklayenti e-VPN afinyelela iseva

Iklayenti le-VPN li-pinga iseva yamafayela, lixazulula igama layo futhi alikwazi ukuvula ukwabelana. Inqubomgomo yabasingathi ye-Samba ingenye yezigaba ezine ezingala ukwamukela lolo xhumano, futhi iyona abantu abayihlela ekugcineni. Uhlu lwabavunyelwe luhlolwa ngokumelene nekheli lomthombo i-smbd elilithola ngempela, futhi kungenzeka ukuthi akulona ikheli iklayenti elicabanga ukuthi linalo. Ukuthola lowo mthombo ngendlela efanele kuguqula inkinga yemvume engacacile ibe ushintsho lokucushwa komugqa owodwa.

Izigaba ezine ezihluleka ngomlayezo ofanayo

Ukunqatshwa kungavela emzileni, ku-firewall yomsingathi, kunqubomgomo yabasingathi ye-Samba noma kubunikazi be-SMB. Isigaba ngasinye sikhipha umlayezo kuklayenti osho cishe into efanayo, yingakho ukuqagela kudla ingxenye yosuku. Ukuhlela izivivinyo kusuka kunethiwekhi kungena ngaphakathi kususa iningi lokuqagela.

Qala ngokuthutha. Uma imbobo 445 ingafinyeleli iseva, akukho kulungiselelwa kwe-Samba okubalulekile, futhi ukuthwebula kusixhumi se-seva kuyixazulula ngemizuzwana. Kulandela i-firewall yomsingathi kuyo iseva uqobo, engase ilahle umthombo ovunyelwe ngaphambi kokuba i-smbd iwubone. Kukhona kuphela ngemva kokuba lezi zimbili zidlulile lapho uhlu lwabavunyelwe luba umgadli. Ukuqinisekisa ubunikazi kuza ekugcineni, ngoba ukwehluleka kokungena nokunqatshwa umsingathi kubonakala ngendlela ehlukile kuloji ye-seva, ngisho nalapho iklayenti libika kokubili njengokufinyelela okunqatshiwe. Ukulandelana kubaluleke kakhulu kunezisetshenziswa, ngoba isigaba ngasinye sinomyalo osiphendulayo.

Thola ikheli lomthombo i-smbd elibona ngempela

Ekufinyeleleni okuhamba ngomzila iseva ngokuvamile ibona ikheli leklayenti elivela echibini le-VPN. Uma kukhona ukuhumusha komthombo esangweni ibona ikheli le-LAN lesango esikhundleni salokho, futhi iklayenti ngalinye ngemuva kwalelo sango alisahlukaniseki.

Lo mehluko unquma ukuthi umbhalo ohlwini lwabavunyelwe uyinqubomgomo noma umgodi. Ukuvumela ikheli lesango elihunyushiwe kwamukela wonke umuntu ongemuva kwalo, okuyinto umthetho weklayenti ngalinye owawuvame ukungayisho. Funda umthombo kuseva hhayi emcabangweni weklayenti ngokwakhe ikheli. Ukuthwebula kusixhumi se-seva yindlela eshibhile yokukubona, futhi lokho kuthwebula kufakazela nokuthi iphakethe lafika ngempela. Khawulela ukuthwebula ngenani lamaphakethe futhi ungeze isihlungi somsunguli uma usazi ukuthi yiliphi iklayenti olilandayo. Ithebula lezikhathi le-Samba liyingxenye yesibili yempendulo: ku-smbstatus -b ikholamu yeklayenti kumugqa ngamunye wesikhathi iwukuhambisana i-smbd ekubhalile, futhi lokho kuwukuqinisekisa okusheshayo kwekheli elafinyelela khona kusevisi.

sudo tcpdump -ni any -c 20 'tcp port 445'
sudo smbstatus -b
ss -tnp | grep ':445'

Funda uhlu lwabavunyelwe njengoba i-Samba ilufunda

Ukulungiselelwa kwe-hosts allow kuthatha uhlu lwamakheli, amanethiwekhi noma amagama, futhi kungaba ngokuphelele noma ngaphakathi kokwabelana. Imibhalo emibili ebukeka ilingana kuwe ingase ingalingani kumhlaziyi, ngakho ukucushwa okusebenzayo yikho okufanele kuhlolwe. Lokho kusho umbono ohlanganisiwe hhayi ifayela oyihlele ngengozi.

Ipheya yezandiso eyisibonelo ibukeka njengomugqa ongezansi, futhi lesi isibonelo hhayi ukufaka esikhundleni semibhalo esivele ikhona. Gcina amaklayenti okuphatha kanye nezinhlelo axhumana ngokusemthethweni namuhla, futhi ufunde noma yiluphi uhlu lokuvinjelwa esigabeni esifanayo. Ukuthi umsingathi uzokwamukelwa kuncike kunqubomgomo yonke, ngakho hlola iklayenti eliqondile esikhundleni sokuphikisana ngokubaluleka. Imvume yomsingathi ayisho lutho nangemvume yokwabelana noma izindlela zohlelo lwamafayela, okuyizango ezihlukile. Impumelelo yamathuluzi okuhlola isho ukuthi inqubomgomo yabasingathi yamukela lowo mthombo, hhayi okunye.

hosts allow = 192.168.50.0/24 10.90.0.0/24
testparm -s
testparm -s /etc/samba/smb.conf client.example 10.90.0.14

Shintsha ifayela elihlala ngemva kokuqalisa kabusha

Kumsingathi ojwayelekile we-Linux indlela yokucushwa iqinile futhi isevisi iyifunda futhi lapho iqalisa kabusha. Kumuthala noma kudivayisi i-smb.conf esebenzayo ivame ukukhiqizwa ngesikhathi sokuqalisa, futhi ukuhlela ngesandla kuyanyamalala ekuqaliseni okulandelayo. Sebenzisa indlela yokwenza ngokwezifiso esekelwe yidivayisi, evamise ukuba yifayela layo lokucushwa.

Isilingo kulesi sigaba ukushisa i-firmware ehlukile ngoba intambo ethile ibike ukuthi iyasebenza. Lokho ushintsho olukhulu enkingeni encane yenqubomgomo, futhi kukhipha idivayisi esimweni sayo esisekelwe. Qala ngokukhomba ukulawula okusekelwe, ngoba iningi lamadivayisi likhombisa uhlu lwabavunyelwe ngesixhumi salo. Uma ngempela bengekho, lowo mkhawulo uyimpikiswano yehardware ehlukile hhayi yokwakhiwa okungasekelwe.

Bhala ukuthi yiliphi ifayela olilungisile nokuthi yini elikhiqiza futhi, ukuze umuntu olandelayo angaphindi ukuxilonga.

Hlola iklayenti elilodwa elivunyelwe nelilodwa elingafakiwe

Hlola imiphumela yomibili, hhayi kuphela leyo obuyifuna. Iklayenti elivunyelwe elixhumayo lifakazela ukuthi ushintsho luyasebenza; iklayenti elingafakiwe elisaqhubeka linqatshwa lifakazela ukuthi umthetho awuzange uvule konke nje.

smbclient -L //fileserver -U alice
sudo testparm -s /etc/samba/smb.conf alice-laptop 10.90.0.14
sudo tail -n 40 /var/log/samba/log.smbd

Uma uxhumano lungafinyeleli neze ku-smbd, impendulo isemzileni noma ku-firewall yeseva. Uma umsingathi uvunyelwe futhi ukungena kwehluleka, inkinga ubunikazi futhi ukwandisa uhlu lwabavunyelwe ngeke kusize. Gcina okukhiphayo kokuxilonga kuyimfihlo, ngoba ilogi ye-Samba enemininingwane ingase iveze izindlela zokwabelana namagama ama-akhawunti. Shintsha isigaba esisodwa ngomzamo ngamunye, kungenjalo umphumela olandelayo ngeke ukutshele lutho.