Ukudluliswa kwe-SSH okuguqukayo njenge-proxy ye-SOCKS phezu kwe-VPN yakho
Uhlelo lokusebenza olukhuluma i-SOCKS kuphela alunayo iphoyinti lokugcina le-proxy ku-VPN evamile. Ukugxuma okubili, isilaleli esisodwa se-loopback kanye nokusesha igama okumele kwenziwe iseva ye-SSH ngokwayo.
Uhlelo lokusebenza olukhuluma i-SOCKS kuphela alunakho okokukhuluma nako ku-VPN evamile, ngoba umhubhe uthwala amaphakethe futhi uhlelo lufuna iphoyinti lokugcina le-proxy. I-OpenSSH inganikeza leyo phoyinti uma umnikazi wokufinyelela evuma, ngoba ukudluliswa okuguqukayo kuguqula isikhathi esisodwa se-SSH sibe yi-proxy yasendaweni. Ngemuva kwalokho kunezikhathi ezimbili zokugxuma okumele zigcinwe zehlukene: umhubhe ofinyelela kumsingathi we-SSH, kanye nokuxhumana okusungulwa yilowo msingathi ngemuva kwalokho. Ukuzihlukanisa kuchaza kokubili ukuthi kungani leli lungiselelo lisebenza kanye nalokho elingasoze likwenze.
Isilaleli se-SSH siba yini futhi singabi yini
Ukudluliswa okuguqukayo kuphoqa iklayenti le-SSH ukuthi lilalele endaweni futhi likhulume i-SOCKS4 noma i-SOCKS5 nakho konke okuxhumayo. Isicelo ngasinye sisho indawo ekuyiwa kuyo futhi iseva ye-SSH ivula ukuxhumana okulandelayo, yingakho ukusesha indawo ekuyiwa kuyo kungenzeka ngaphesheya. Lokhu ukudluliswa kwe-TCP ezingeni lohlelo lokusebenza, hhayi i-VPN yedivayisi yonke. Akuthwali ukuhlangana kwe-UDP, akukho i-ICMP, futhi akukho lutho ezinhlelweni eziziba ngokuphelele izilungiselelo ze-proxy. Ukugxuma kusuka kuseva ye-SSH kuya kuhlelweni nakho akukho ngaphakathi komhubhe wakho, lokhu kubalulekile lapho indawo ekuyiwa kuyo yamukela ukuhamba kuphela okuvela kumanethiwekhi aziwayo.
Izimfuneko zangempela zikhona: umzila oya kumsingathi we-SSH, i-akhawunti egunyaziwe, ukhiye womsingathi weseva oqinisekisiwe kanye nemvume yokudlulisa. Akukho ngisho okukodwa kwazo okwenziwa yi-proxy, futhi eyokugcina ivamise ukuba yeyokuqala ukushoda. Qinisekisa kazo zonke ezine ngaphambi kokuxazulula enye into, ngoba kusuka kuklayenti ukuhluleka kubonakala kufana, noma iyiphi eshonayo.
Yiqale ku-loopback ngephothi elicacile
Khetha iphothi lasendaweni elingasetshenziswanga futhi ulibophe ngokusobala ku-loopback esikhundleni sokushiya ikheli lingenalutho. Izinketho ezintathu ezingezansi zikhona umunye ngasinye ngesizathu esisodwa.
ssh -D 127.0.0.1:1080 -NT -o ControlPath=none -o ExitOnForwardFailure=yes \
[email protected]-N yeqa umyalo okude futhi -T yeqa i-pseudoterminal, ngakho isikhathi sikhona kuphela ukudlulisa. ExitOnForwardFailure yenza iklayenti liphume lapho isilaleli singakwazi ukwenziwa, esikhundleni sokusebenza ngaphandle kokudluliswa okukucelile. ControlPath=none igcina isikhathi ngaphandle kokuxhumana okukhona okuninginingi okungase kunezele ukudluliswa kwayo. I-loopback igcina isilaleli ngaphandle kwe-LAN, kodwa kumshini owabiwe lokhu akusona umngcele wokugunyazwa, ngoba nezinye izinqubo zasendaweni zingafinyelela kuso. Incwadi yesikhombisi yeklayenti le-OpenSSH ibhala zonke lezi zimpawu, futhi isexwayiso se-loopback sivela kulokho okuyikho isokhethi elalelayo.
Thumela amagama ngaphakathi kwe-proxy, hhayi ngaphesheya kwayo
Iklayenti le-SOCKS5 lingazixazulula ngokwalo indawo ekuyiwa kuyo noma licele i-proxy ukuthi yenze lokho, futhi lokho kukhetha kunquma ukuthi iyiphi isixazululi ephendulayo. Nge-socks5h i-curl ithumela igama lomsingathi ngaphakathi kwe-proxy, ngakho ukusesha kwenzeka kuseva ye-SSH. Nge-socks5 evamile ikhompyutha ephathwayo ixazulula kuqala futhi ukuxhumana kuphela okuhambayo, lokhu kubhubhisa buthule inhloso lapho igama lingelangaphakathi. Isicelo esingezansi siphinde sikhulise uhlu olungenayo i-proxy, ngakho inani le-NO_PROXY elizuzwe njengefa alikwazi ukuyihola ngaphesheya kwe-proxy.
curl -sS --noproxy '' --proxy socks5h://127.0.0.1:1080 https://app.corp.example/healthUkuqinisekiswa kwesitifiketi nokungena kohlelo lokusebenza ngokwako kusasebenza, ngoba i-proxy ayithathi indawo yakho kokubili. Kusele ukusesha okubili: ikhompyutha ephathwayo kumele ifinyelele umsingathi we-SSH ngomzila we-VPN ne-DNS ovunyelwe, futhi iseva ye-SSH kumele ixazulule igama lohlelo ngokwayo. Okwesibili kungahlolwa ngokwahlukene ngaphambi kokuthi noma yikuphi ukuhamba kudlule nge-proxy.
ssh [email protected] getent hosts app.corp.exampleFakazela indawo eyodwa evunyelwe, bese uvala isikhathi
Hlola indawo evunyelwa inqubomgomo kanye naleyo okufanele iyinqabe, ngoba ukudluliswa okusebenzayo kufakazela kuphela ukuthi isilaleli siyasebenza futhi akukho okunye. Uhlelo lubona ikheli lomthombo elikhethwa yiseva ye-SSH, futhi lokho akulona ikheli lomhubhe wekhompyutha yakho ephathwayo. Lapho uhlangothi olukude lubhala ukuxhumana ngokomthombo, lowo mehluko uyinto yokuqala okumele ibhekwe lapho isicelo sinqatshwa.
Misa isikhathi ngokusebenzisa inqubo engumnikazi waso esikhundleni sokubulala igobolondo elingahlobene. Bese uqinisekisa ukuthi isilaleli asisekho, ngoba iphothi elisaphendulayo yisikhathi ongakavalanga ngempela. Susa kuphela isilungiselelo se-proxy esilethwe yilo msebenzi wokuzilolonga, futhi ushiye ezinye izilungiselelo zohlelo njengoba zinjalo. Ithemini elingenakuqashelwa eliphethe umthetho wokudlulisa akulona isevisi, futhi i-proxy unomphela idinga umjikelezo wokuphila ogunyaziwe, hhayi iwindi elikhohliwe.
ss -ltn | grep 1080Ukuhluleka okungeke kukulungise lokhu kulungiselelwa
Ezinye izimpawu zikhomba ngqo emingceleni engenhla, futhi ukuzibona kusenesikhathi konga intambama yokuxazulula i-proxy. Ithebula lixhumanisa lokho okubonayo nalokho elivame ukukusho. Noma yini kukholamu yokugcina iwumbuzo womklamo, hhayi iphutha lesilungiselelo.
| What you see | What it usually means | Where to look |
|---|---|---|
| The app connects and nothing follows | It ignores proxy settings entirely | Its own network settings, not the SSH session |
| A name resolution error for the destination | The SSH server cannot resolve it | Server resolver and search domains |
| A UDP-only application fails | Dynamic forwarding carries TCP only | This arrangement cannot serve it |
| curl works, the browser does not | The browser is not using the socks5h endpoint | Browser proxy configuration |
| The listener answers after the session ended | Another process owns port 1080 | The ss output, then the owning process |
Imigqa emithathu yokuqala yilokho abantu abakuxilonga ngokungalungile, ngoba ngamunye ukhiqiza umzamo wokuxhumana esikhundleni sephutha mayelana ne-proxy ngokwayo. Igama elixazululwa kukhompyutha ephathwayo alisho lutho mayelana nesixazululi seseva, futhi ukuhluleka kufundwa njengenkinga yesitifiketi noma yesikhathi. Izinhlelo ezisebenzisa i-UDP kuphela zimi ngaphandle komklamo, hhayi ziphukile ngaphakathi kuwo, futhi akukho inketho ye-ssh eyengeziwe ekushintshayo lokho. Umugqa wesiphequluli uyisikhumbuzo esivamile sokuthi izilungiselelo ze-proxy zezohlelo ngalunye. Umugqa wokugcina uyisizathu sokuthi ukuhlolwa kokuvala kukhona: iphothi elisalalelayo lisho ukuthi manje okunye okunye okungumnikazi waso.