I-SSH ayilaleli ngemuva kokuqalisa kabusha: ikheli le-VPN lifika sekwedlule isikhathi

Ubopha i-SSH ekhelini lethunge ngesikhathi sokusetha, iyasebenza, futhi ngemuva kokuqalisa kabusha okulandelayo akekho ongakwazi ukungena kuze kube umuntu uqalisa kabusha isevisi ngesandla. Izifakazelo akuzona inkinga. I-daemon icele i-kernel ikheli elalingakabi khona, ukubopha kwehlulekile, futhi umlayezo wadlula kungilogi yokuqalisa. Okubonakala njengenkinga yokuqinisekisa empeleni inkinga yokulandelana kokuqalisa.

Iphutha lokubopha lisho ukuthini ngempela

Isokhethi elalelayo kufanele yakhiwe ekhelini elikhona ngaleso sikhathi. Lapho i-interface ye-VPN ivela kamuva, i-daemon elungiselelwe ukubopha ekhelini lethunge kuphela ayinakho okungabambelela kukho. Ukulungiselela kuhlala kuvumelekile ngokwesakhiwo; indawo nje yayingakalungi. Isevisi eqale ngokusetshenziswa ngesandla ayikaze idlule endleleni yokuqalisa, yingakho iphutha livela kuphela ekuqaliseni kabusha okulandelayo. Qhathanisa isikhathi sokubopha okwehlulekile nesikhathi sokwabiwa kwekheli, futhi ukulandelana kuyacaca.

Ukuvumeleka kokulungiselela nokulungela ngesikhathi sokusebenza kuyizici ezihlukene. Hlola kokubili, ngoba okukodwa kuyahluleka ngaphandle kokusho lutho.

Iyiphi inqubo ephethe imbobo

I-daemon ayiyona njalo ingxenye edala isilaleli. Ukusebenza kwesokhethi kudlulisela lowo msebenzi kuyunithi, bese ukuqalisa kabusha i-daemon akushintshi lutho.

ss -ltnp 'sport = :22'
systemctl cat ssh.socket

Uhlu lwamasokhethi lubonisa ukuthi iyiphi inqubo ephethe imbobo nakukhiphi ikheli, kuyilapho i-dump yeyunithi ibonisa ukuthi iyunithi yesokhethi ikhona yini. Lapho ukusebenza kuhilekile, ikheli lingeliyunithi yesokhethi futhi ifayela le-daemon alilona igunya. Funda ingilogi yokuqalisa ukuze uthole iphutha langempela lokubopha esikhundleni sokulicabangela kusukela kuphawu. Ukungabi khona kweyunithi yesokhethi kusho nje ukuhleleka kwendabuko, lapho i-daemon ibopha khona ngqo.

Yenza ukulungela kucace, hhayi ubuthongo

Ukubambezeleka okungaguquki ukucabanga okuphatha ngendlela efanayo ihadiwe esheshayo namanethiwekhi anensa. Esikhundleni salokho veza ukuncika: linda ikheli, bese uqalisa.

ip -4 addr show dev tun0
systemctl edit ssh.service

Engeza umyalo we-ExecStartPre ophindaphindayo kuze kuvele ikheli, noma hlela iyunithi ngemuva komgomo othile wenethiwekhi onomnikazi we-interface. Zombili izindlela zirekhoda ukuncika endaweni umphathi olandelayo angayifunda. I-loop idinga isikhathi sokuphela, ngaphandle kwalokho i-VPN ehlulekile ishiya iyunithi elenga esikhundleni sokubika iphutha. Bese qinisekisa ukuthi i-daemon ibopha ikheli lethunge kuyilapho i-interface ejwayelekile ihlala ngaphansi kwemithetho yakho yokuhlunga.

Hlola ukuqalisa okuhlanzekile nokuxhuma kabusha

Ukuqalisa kabusha ngesandla ngemuva kokuba konke kuku-inthanethi akufakazeli lutho mayelana nokulandelana kokuqalisa. Qalisa kabusha umshini ngethunge elilungiselelwe ukuphakama ngokuzenzakalela futhi ubheke ukuthi isilaleli siyavela ngaphandle kokungenelela.

systemctl status ssh.service
ss -ltnp 'sport = :22'

Bese wehlisa futhi usungule kabusha ithunge, ngoba ukuxhuma kabusha kungashintsha ikheli futhi ukubopha okubhalwe ngokuqinile ngeke kukulandele. Gcina indlela yokubuyisela engaphandle kwebhendi ngesikhathi sokuhlola, ukuze ushintsho olubi lokulandelana lungakukhiyi ngaphandle komsingathi.

Umkhombandlela wempumelelo isilaleli esivela ngaphansi kokuncika kwayo okubhaliwe, hhayi leyo umuntu akhumbula ukuyiqalisa kabusha.