Ukudlulisa kwe-SSH yasendaweni noma i-VPN ephelele yesikrini esisodwa se-Mac?

Udinga ukubona isikrini se-Mac eyodwa kusuka kumshini wakho, i-Mac ingemuva komsingathi osekwazi ukuxhuma kuyo nge-SSH, futhi umbuzo uwukuthi lokho kufanele i-VPN yini. Ngokuvamile cha. Ukudlulisa okukodwa kwasendaweni kuthwala iphothi elilodwa le-TCP ngesikhathi seseshini ye-SSH osevele unayo, futhi esikrinini esisodwa kumsingathi oyedwa lokhu kuwuhlelo oluncane futhi oluhlolakalayo kakhulu kunokuhambisa yonke inethiwekhi.

Izimo ezintathu zinquma, futhi noma isiphi sazo singakusunduzela ku-VPN ephethwe.

Izimo ezintathu zinquma

Okokuqala ubukhulu: isevisi eyodwa kumsingathi oyedwa, noma izingingi eziningi namaphothi amaningi. Okwesibili ukuthi ngabe zonke izigaba phakathi kwe-bastion nomgomo sezithenjiwe kakade, ngoba i-SSH ivikela ingxenye eyiphetha kuphela. Okwesithathu ukuthi ubani okufanele asekele loluhlelo ngemuva kokuba ulwakhe, ngoba ithuneli elenziwe ngesandla livame ukuphila isikhathi eside kunomuntu owayiluqonda. Shono igama lalowo muntu ngaphambi kokuba uqale, futhi ubhale umyalo endaweni angawuthola kuyo. Ukudlulisa okungabhalwanga wumbhalo wenzakalo yesikhathi esizayo enosuku lokuqala oluhlehlisiwe.

Uma izimpendulo zingu-«kunye», «yebo» kanye no-«mina, okwamanje», ukudlulisa iyithuluzi elifanele. Uma noma isiphi isimpendulo sishintsha, umklamo wokufinyelela kude osekelwayo ushada kancane ngonyaka kunokubuyekezwa kwenzakalo okulandela ithuneli elingabhalwanga.

Dlulisa iphothi elilodwa, hhayi inethiwekhi

Ukudlulisa kwasendaweni kuvula isilaleli emshinini wakho futhi kudlulisela ukuxhumana ngakunye ngesiphakeli se-SSH siye endaweni isiphakeli esingayifinyelela. Kwi-Mac osevisi yayo yokwabelana ngesikrini ilalela ku-TCP 5900, kanye ne-bastion ekwazi ukuxazulula mac.corp.example, umyalo mfishane futhi uwumngcingo ngamabomu. Yonke inketho kuyo ikhona ukuze uhlelo luhlale luluncane: akukho shell, akukho silaleli kuzo zonke izixhumanisi, akukho daemon. Kufunde njengesitatimende sobukhulu, hhayi njengeresiphi.

ssh -N -o ExitOnForwardFailure=yes -L 127.0.0.1:15900:mac.corp.example:5900 [email protected]

Ukubopha isilaleli ku-127.0.0.1 kusigcina kude nazo zonke ezinye izixhumanisi. Lokhu akukona ukwenziwa ngokomthetho: ukudlulisa okuboshwe kuzo zonke izixhumanisi kwenza ikhompyutha yakho yasemathangeni ibe yisidluliseli esivulekile esingena kunethiwekhi yebhizinisi kunoma ubani okuleso Wi-Fi sekhefi. Uma iphothi isivele isetshenziswa, khetha elinye iphothi eliphakeme futhi uvuselele isibuki; ungayeki isevisi engahlobene ukuze isibonelo silingane.

I-akhawunti ku-bastion nayo idinga imvume yokudlulisela kuleyo ndawo. Ezinye izilungiselelo ze-SSH eziqinisiwe zivala ngokuphelele ukudlulisa kwamaphothi, kanti ezinye zikukhawulela ngomyalo we-permit-listen noma we-permit-open. Funda inqubomgomo yesiphakeli ngaphambi kokucabanga ukuthi isiteshi esenqatshiwe sisho ukuthi igama lokugqithisa lalilungile.

I-SSH ibethela ini, futhi iyeka kuphi

Iseshini ye-SSH ivikela uhambo olusuka ku-Mac wakho luye ku-bastion, futhi ukudlulisa kuthwala iphrothokholi ye-VNC ngaphakathi kwaleso sikhathi ngaphandle kokuyiqonda. Uma ukuxhumana sekushiya i-bastion kukhangele emgomweni, akusekho ngaphakathi kweseshini yakho ye-SSH. Noma yikuphi ukuvikelwa okukhona kwalelo gxathu lokugcina kungokwephrothokholi yomgomo nokwalokho okulawula inethiwekhi yangasese uqobo.

Yilokho okwenza kungafanele ukudluliswa kwe-VNC kokugcina okulula kuchazwe njengokubethelwe kuqala kokuphela nje ngoba igxathu lokuqala lasebenzisa i-SSH. Chaza izigaba ngobuqotho: kuqinile kusukela kuklayenti kuya ku-bastion, bese kuba yilokho umgomo okusekelayo. Uma imfuneko iwukuthi yonke indlela ibethelwe ngendlela eyodwa, ukudlulisa akukufezi.

Ukuqinisekisa kumgomo kuyindaba ehlukile futhi. I-akhawunti ye-SSH ayinikezi ukungena ku-macOS, futhi isevisi yokwabelana ngesikrini isacela ubufakazi bayo uqobo futhi isasebenzisa uhlu lwayo lokufinyelela. Isilaleli sasendaweni esamukela ukuxhumana asifakazeli lutho mayelana nokuthi isevisi ekude izosamukela yini iseshini.

I-VPN ephelele iyisinqumo esifanele nini

Khetha i-VPN uma umsebenzi udinga amaphothi angaphezu kwelilodwa: imisebenzi yokuphatha nokubika ye-Apple Remote Desktop isebenzisa uhambo olwengeziwe lwe-TCP ne-UDP ukudlulisa kwe-TCP okukodwa elingakwazi ukuluthwala. Ukudlulisa akusikho ukuqaliswa okuyingxenye yomkhiqizo wonke; kuyithuluzi elihlukile, elincane.

Khetha kona uma abaphathi abaningi bexhuma besuka ezindaweni ezishintshayo, ngoba iphrofayili ephethwe isabalalisa imizila, ubufakazi nenqubomgomo ngaphandle kokuthi wonke umuntu aqambe umugqa womyalo. Khetha kona uma umkhondo wokucwaninga kufanele ukhombise ukuthi ubani waxhuma kunani, ngoba iseshini ye-SSH yomsebenzisi ngamunye nokudlulisa kwasendaweni okwabiwe kushiya amarekhodi ahluke kakhulu.

Ekugcineni, khetha kona uma inethiwekhi yomgomo ingafanele ifinyeleleke nakancane kusuka kukhompyutha ngaphandle kwesango lenhlangano uqobo. Ukudlulisa komuntu siqu kweqa leso sango ngokomklamo, futhi yikho kanye okwenza kube ngokomqulu woshintsho hhayi umlando we-shell.

Vumela ukudlulisa kwehluleke ngomsindo

Sebenzisa i-ExitOnForwardFailure=yes ukuze ukubopha okwehlulekile kumise iseshini esikhundleni sokushiya i-shell ebonakala ixhunyiwe futhi engadlulisi lutho. Gcina ukuqinisekiswa kokhiye womsingathi kuvuliwe, futhi ukhethe ukhiye noma i-ejenti kuneqiniso lokugqithisa. Bese uhlola i-URL ngqo ezosetshenziswa isibuki, ngoba iseshini ye-SSH esebenzayo nokuxhumana kwesikrini okusebenzayo kuyimiphumela emibili ehlukene.

Kuklayenti yomdabu ku-macOS, isibuki sifinyeleleka nge-URL yasendaweni: open "vnc://127.0.0.1:15900". Uma iwindi livuleka futhi umsingathi okude wenqaba ukuqinisekisa, ithuneli lilungile futhi inkinga isemgomweni. Uma iwindi lingavuli nhlobo, inkinga isesilalelini noma ephothini.

Misa iseshini uma usuqedile, futhi bhala iphothi, i-bastion, umgomo nenqubomgomo ye-akhawunti. Ukudlulisa okungabhalwanga muntu akukwazi ukuhlukaniswa nomnyango wangemuva ngemuva kwezinyanga eziyisithupha, futhi leso yisizathu esinamandla sokukugcina kukuncane, kunegama futhi kungokwesikhashana.