I-bastion ye-SSH noma ukufinyelela kwe-VPN okuqondile: iyiphi inqubomgomo esebenzayo?

Ukuthi abasebenzisi be-VPN bangafinyelela kumaseva ngaphandle kokweqa isibungu sokugxuma kuwumbuzo wenqubomgomo ogqoke izingubo zenethiwekhi. Uma i-bastion yenza ukulawula okudingekayo, ukujoyina i-VPN kufanele kuholele kuyo hhayi ukuyizungeza. Uma isibungu sokugxuma sasihlanganisa nje ingxenye eyayingafinyeleleki ngaphambili, umzila oqondile omncane ungaba ukushintsha okuqotho. Yenza izivivinyo ezingezansi ngokulandelana futhi ume kokokuqala okuhlulekayo, ngoba leyo mpendulo inquma okunye.

Hlola ukuthi i-bastion ilawula ini ngempela

Qala ngobufakazi besikhathi samanje, hhayi ngomdwebo ovela kudokhumenti yokuklama. Bheka ukulungiselelwa kwe-SSH kanye nesihlungi samaphakethe somgomo: uma imbobo engu-22 engenayo yamukelwa kuphela kusukela ekhelini le-bastion, isibungu sokugxuma siwukulawula okuphoqelelwe. Uma leyo mbobo yamukela ukuxhumana okuvela kuwo wonke amachibi e-VPN, i-bastion yayiwukusiza futhi ukuphoqelela kuhlala kwenye indawo ngokuphelele. Umlando wamathikithi uvame ukuqinisekisa ukuthi ikuphi kwalokhu okubili okwaba khona kuqala.

Sho okutholiwe ngomusho owodwa osho ukulawula okunikezwa yi-bastion: umkhawulo wendawo okuyiwa kuyo, isinyathelo sesibili sokuqinisekisa, ukurekhoda kwesesheni, noma ukubonakala kokusebenza ngesikhathi sezehlo. Lowo musho yiwona inqubomgomo yokushintsha okufanele iwugcine.

Hlola ukuthi umgomo ungowahlukanisa yini imizila

Imithetho yekheli lomthombo isebenza kuphela uma imizila emibili ifika namakheli omthombo ahlukene. Isango le-VPN elifihla ithrafikhi eya kunethiwekhi engaphansi yamaseva lisusa lowo mehluko, bese kuthi ukuxhumana konke okuya embotsheni engu-22 kubonakale sengathi kuvela esangweni. Isivivinyo sisekhaya kumgomo futhi sithatha isikhashana: bhala izesheni ze-SSH ezisunguliwe futhi ufunde ikheli lozakwenu ngesinye ngasinye.

Uma imizila yomibili iwela ekhelini elilodwa, umehluko kufanele wenziwe ngaphambili, ngokusebenzisa izindawo okuyiwa kuzo eziyizwa yi-VPN kanye nangezihlungi zesango ngokwazo. Ukwengeza umthetho kumgomo kuleso simo kwakha umbono womngcele ngaphandle kokushintsha okufikayo.

Hlola ukuthi irekhodi ngalinye ligcina ini ngempela

Amalogi amathathu ahlukene achaza izehlakalo ezintathu ezihlukene, futhi awekho owodwa othatha indawo yomunye. Irekhodi lokuxhumana le-VPN likhombisa ukuthi ubunikazi bangena endaweni yenethiwekhi. Irekhodi lokudlulisa le-bastion likhombisa umzila we-TCP oyishiya uya endaweni okuyiwa kuyo nembotsheni. Ilogi yokuqinisekisa yomgomo ikhombisa ukuthi i-akhawunti ingene nge-SSH. Ukuzifunda ndawonye yikho okwakha uchungechunge lwesikhathi; ukufunda okukodwa kuphela kwakha ukuqagela.

Awekho kula marekhodi aqukethe okwenzeka ngaphakathi kwesesheni ebethelwe phakathi kwekhasimende nomgomo. Uma ukubuyekezwa kwezinga lomyalo kuyimfuneko, kudinga indlela yokurekhoda ebekwe ngamabomu enemithetho yayo yokuphatha idatha. Ukulindela lokho kumalogi esibungu sokugxuma yiyo indlela igebe lokucwaninga elihlala lifihlekile ngayo kuze kube yilapho libalulekile.

Hlola ukuthi inqubomgomo isetshenziswa kuphi ngempela

Isilungiselelo sekhasimende esifana ne-ProxyJump isicelo, hhayi umkhawulo. I-OpenSSH izovula ngokuzimisela ukuxhumana okuqondile uma indawo okuyiwa kuyo ifinyeleleka, ngakho amafayela okulungiselela kumakhompyutha aphathekayo achaza inhloso kuyilapho izicishamlilo zinquma umphumela. Ukuphoqelela kungokwezindawo ezivunyelwe zesango le-VPN nangemithetho yokufinyelela yomgomo ngokwawo, futhi umsebenzisi akakwazi ukuhlela kokubili. Hlola ngasikhathi sinye eminye imizila: isixhumi sesibili, isilaleli somphakathi, ungqimba lwe-mesh noma umhubhe wakudala phakathi kweziza — ngayinye ingabuyisela indlela emfushane osanda kuyivala.

Noma kunjalo lungiselela i-ProxyJump, ngoba yenza umzila ogunyaziwe ube ngowolula futhi ivimbele umsebenzi wansuku zonke ukuthi ungenzi okuhlukile. Qinisekisa ukuthi ikhasimende lixazulula ini ngempela ngaphambi kokulithemba.

ssh -G app01.lab.internal | grep -iE '^(hostname|port|proxyjump|proxycommand)'

Qinisekisa ngomzamo oqondile wamabomu

Inqubomgomo engakaze ihlolwe iyithemba nje. Kusukela kukhasimende elixhunywe ku-VPN, zama umzila okufanele manje wenqatshwe, bese uzama owogunyaziwe, futhi gcina yomibili imiphumela. Umzamo owenqatshiwe uwubufakazi bokuthi ushintsho lwaqala ukusebenza.

nc -vz -w 3 10.20.30.41 22
ssh -J bastion.lab.internal app01.lab.internal true

Umphumela ohlanzekile ubonakala njengokuxhumana okuqondile okwenqatshiwe noma okuphelelwe yisikhathi okuya ekhelini lomgomo, kulandele ukungena okuphumelelayo esibungwini sokugxuma kanye nokufakwa kokuqinisekisa ohlangothini lomgomo okusho umthombo osekelwe. Noma yini enye isho ukuthi umngcele usanomgodi, kusho noma idokhumenti ithini. Bhala usuku, umthetho oshintshiwe kanye nemiphumela yomibili, bese nikeza umzila wokubuyisela umnikazi kanye nosuku lokuphelelwa yisikhathi ukuze ukufinyelela okuphuthumayo kungabi umzila wansuku zonke ngokuthula.