I-SSH iyakhala ku-SSH2_MSG_KEX_ECDH_REPLY: akusona njalo i-MTU

Ithuneli liyasebenza, ibhanela liyafika, futhi iklayenti liphrinta umyalezo wokulinda impendulo yokushintshana kokhiye. Imiphumela yosesho ikhomba ngqo ku-MTU, futhi kwesinye isikhathi lokho kulungile. Kaningi akusikho: impendulo kungenzeka ayizange ithunyelwe, ngoba iklayenti alikwazanga ukufunda ifayela lokhiye noma izinhlangothi azizange zivumelane nge-algorithm. Umugqa uchaza ukuthi iklayenti lilindeni, hhayi ukuthi ukulinda kwaqala ngani. Kuthatha njengophawu futhi uhlukanise izimbangela ezintathu ngaphambi kokushintsha noma yisiphi isayizi.

Funda umkhondo ukubona ukuthi impendulo yayilindelekile yini

Umphumela onemininingwane ukhombisa isinyathelo sokugcina esiphumelelayo ngaphambi kokuthula. Uma ibhanela lephrothokholi leseva lifikile, i-TCP iyasebenza futhi uhlangothi olukude luyaphila; umbuzo ovulekile ukuthi kwenzekani ngephakethe elithile. Umzuzu wokuthula ngemva kwebhanela ubonakala njengenkinga yomzila. Umyalezo wokuthi awekho indlela yokushintshana kokhiye ehambisanayo uyingkinga yenqubo. Ukulinda isikhathi eside okuphetha ngokuthi iseva ivale isikhathi kusho ukuthi iseva yadela, futhi ilogi yayo ichaza ukuthi kungani.

Esimweni sokugcina, funda ilogi yokuqinisekisa yesiva ngaphambi kokuthinta iklayenti. Iklayenti alikwazi ukubona isinqumo iseva engazange isithumele.

Kungani impendulo encane ingaba nkulu kakhulu

Izimpendulo zokushintshana kokhiye zivame ukuba zincane kakhulu, ngakho ukusola usayizi kuzwakala kungafanele. Ngamasertifikethi omsingathi impendulo ayincane, ngoba ithwala uchungechunge lwamasertifikethi eseva. Lokho kuyenza ibe iphakethe lokuqala esikhathini esingadlula umthwalo osebenzisekayo wethuneli. Uma impendulo yokutholakala kwe-MTU yomzila ilahleka kwenye indawo emzileni, umthumeli uqhubeka ethumela iphakethe elingangeni, futhi iklayenti lilinda ingunaphakade emugqeni ofanayo.

Thola usayizi esikhundleni sokucabanga. Funda i-MTU yethuneli nge-ip link show tun0, bese uthumela izivivinyo okungafanele zihlukaniswe: ping -4 -M do -s 1352 host, ziphindwe ngemithwalo emincane. Ukushintsha kusuka ekwehlulekeni kuya empumelelweni kusayizi othile ubufakazi; ukwehluleka okufanayo kusikisela ukuthi i-ICMP iyahlungwa futhi akukutsheli lutho.

Ukwehlisa kwesikhashana kuqinisekisa ithiyori ngokushesha, futhi inguqulo ehlala njalo ingeyephrofayela noma i-MSS clamp kumrutha odlulisa ithuneli:

sudo ip link set dev tun0 mtu 1200
sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Izimbangela ezimbili ezilingisa inkinga yosayizi

Ifayela lokhiye iklayenti elingakwazi ukulifunda likhiqiza ukulinda okufanayo, ngaphandle kwesixwayiso ngisho kumphumela onemininingwane. Iphethini elilodwa le-known_hosts yenza lokhu kube lula: umfakelo we-@cert-authority okhomba kukhiye womphakathi we-CA okwaziwa ukufundwa yiakhavu eyodwa kuphela. I-akhawunti engumnikazi wefayela iyaxhuma, futhi yonke enye i-akhawunti iyakhala. Uma ukwehluleka kulandela umsebenzisi hhayi umsingathi, hlola izimo zefayela ngaphambi kosayizi wamaphakethe.

Ukuvuselelwa kungase futhi kususe i-algorithm obekade yabiwa yizinhlangothi zombili. Phina indlela eyodwa iseva esayinikeza njengokuxilonga: ssh -oKexAlgorithms=ecdh-sha2-nistp521 user@host. Ukuxhumana okuphumelela ngokushesha kufakazela ukuthi umzila ulungile nokuthi ukulungiswa kuseqoqweni lwenqubo yokuxoxisana ezinhlangothini zombili.

Amaqiniso amathathu okufanele abhalwe phansi

Bhala i-MTU yethuneli ngaphambi nangemva kwanoma yiluphi ushintsho, ukuthi ukukopisha ifayela elikhulu kuyahluleka kusayizi ophindwayo, nokuthi umsingathi ongenasertifikethi kulelo thuneli nawo uyakhala ngendlela efanayo. Lokho kubona okuthathu kuhlukanisa usayizi emvumweni nasekuxoxisaneni ngokushesha kuneqoqo lemikhombandlela.

Futhi zivimbela umuntu olandelayo ukwehlisa i-MTU ngenxa yephutha elalingakaze libe mayelana nosayizi.

Uma isithombe singakacaci, hlola kusuka kuklayenti lesibili kulelo thuneli. Iklayenti elixhumayo lihambisa iphutha lisuka emzileni liye ekucushweni komshini wokuqala.