ServerAliveInterval ye-SSH ku-VPN: yiluphi uhlangothi oluthumela uphenyo?

Iningi lezeluleko zokugcina iseshini ye-SSH iphila ziyagcina ekutheni «engeza i-ServerAliveInterval 30» futhi zishiye izingxenye eziwusizo ngaphandle. Igama elingukhiye isibali sikhathi esisehlangothini lwekhlayenti esisebenza kuphela lapho isiteshi sithule, sibala uphenyo olungaphendulwanga esikhundleni samasekhondi, futhi sihlala efayeleni lapho inani lokuqala elihambisanayo linqoba khona. Uma wenza iphutha kulezi zici ezintathu, iseshini ye-VPN enempilo isazoqhuma, kuyilapho eyofile iyolenga.

Izinhlangothi ezimbili zingezika-daemon abehlukene

I-ServerAliveInterval ifundwa yikhlayenti lakho le-ssh. I-ClientAliveInterval ifundwa yi-sshd ohlangothini olukude futhi iphenya ngakolunye uhlangothi, isuka kuseva iye kukhlayenti. Azizona iziteketiso futhi azisebenzisani, ngakho ukusetha okukodwa akunamthelela ekuziphatheni kolunye uhlangothi. Ukuzixuba yisizathu esivamile sokuthi ukulungisa kubonakale kusebenza kumsingathi oyedwa kodwa kungasebenzi kolandelayo.

Kokubili kwamukela uziro. Kuziro ikhlayenti alithumeli lutho nhlobo, futhi ohlangothini lweseva i-ClientAliveCountMax enguziro icisha ukunqanyulwa obekuzolandela ngemva kokuhlolwa okungaphendulwanga.

Uphenyo lufakazelani, futhi lungenzi ntoni

Ngemva kokuba isikhathi esimisiwe sidlule ngaphandle kokuthi idatha ifike isuka kuseva, ikhlayenti lithumela isicelo esincane ngomsele oguquliwe okhona futhi lilinde impendulo. I-ServerAliveCountMax inquma ukuthi zingaki zazo ezingahlala zingaphendulwanga ngaphambi kokuba iseshini inqanyulwe. Ngesikhathi esingu-60 kanye nenani elingu-3 ikhlayenti liyancama ngemva cishe kwamaminithi amathathu okuthula, futhi lelo nani liyisici sokucushwa kwakho, hhayi izinga lenethiwekhi. Uma ushiya isikhathi kunani lalo lokumisiwe elingu-0 akukho phenyo oluzothunyelwa nhlobo, yikho lokho okwenza ikhlayenti elijwayelekile likwazi ukuhlala kusixhumanisi esifile ngokungapheli.

Njengoba ukushintshana kwenzeka ngaphakathi kokuthuthwa kwe-SSH, impendulo ifakazela ukuthi inqubo ye-SSH yohlangothi olunye isafunda futhi isabhala. Ayisho lutho ngohlelo olwalususa kuleyo seshini: ikhlayenti lesizindalwazi, imbobo edlulisiwe noma iskripthi esisebenza isikhathi eside kungase kumile ngesikhathi ukuthuthwa kuphendula uphenyo ngokujabulayo.

I-TCPKeepAlive iyindlela ehlukile esezingeni elilodwa ngezansi. Ibanjwa yi-kernel, ayiguquliwe, futhi uhlangothi olune-daemon ye-SSH emile lungayifeza namanje. Yikho lokho okwenza uphenyo lwezinga le-SSH lube uphawu olunengqondo kakhulu uma ukhathazekile ngeseshini hhayi ngesokhethi.

Ukulandelana kunquma ukuthi yiliphi inani eliyosinda

I-OpenSSH isebenzisa inani lokuqala elilitholayo kumpharamitha ngamunye, ngakho ibhulokhi ye-Host ethile kufanele ivela ngaphambi kwanoma iyiphi ibhulokhi ebanzi ezovumelana nayo futhi. Beka amanani okumisiwe anezimpawu zokungafani phansi efayeleni, hhayi phezulu, futhi khumbula ukuthi ibhulokhi ye-Match engezansi ayikwazi ukuchitha inani eselivele limisiwe. Incwadi yokucushwa kwekhlayenti ye-OpenSSH isho ngqo umthetho wenani lokuqala, futhi kufanelekile ukuyifunda kanye ngaphambi kokuhlela kabusha ukucushwa okwabiwe.

Izinketho zomugqa womyalo zinqoba ifayela, okwenza ukuhlola kwesikhashana kungabizi:

ssh -o ServerAliveInterval=15 -o ServerAliveCountMax=4 office-shell

Ukuze ubone lokho ikhlayenti elikuxazulule ngempela hhayi lokho ocabanga ukuthi ukubhalile, cela likhiphe ukucushwa okusebenzayo. Imiphumela iqukethe amanani ahlanganisiwe alelo gama lomsingathi futhi iyona ndlela esheshayo yokubamba ibhulokhi yangaphambili elahlekile:

ssh -G office-shell | grep -i alive

I-keepalive yenzani ngokuthungela umhubhe

Ithrafikhi yezikhathi ezithile ivimbela ukuthi imephu ye-NAT noma yodonga lomlilo enesimo iphelelwe yisikhathi, okuyinzuzo yangempela ku-VPN ogwava lwayo lulahla imifudlana engasebenzi ngemva kwemizuzu embalwa. Uphenyo olufika njalo ngemizuzwana engu-60 lushintsha leyo mephu ngaphandle kokuthwala idatha yohlelo.

Azikwazi ukwakha kabusha indlela esehambile. Lapho isixhumi esibonakalayo somhubhe sinyamalala uphenyo luyahluleka njengakho konke okunye, futhi iseshini iyaphela lapho inani liphela. Ukuthola ukuphila kanye nokubuyisela indlela kuyizinkinga ezihlukene, futhi okokuqala kuphela okungacushwa ku-ssh_config. Lokho isikhathi nenani elikunikeza khona ngempela ukuthi ikhlayenti libona ngokushesha kangakanani, futhi yilokho umsebenzisi akuzwa njengokumiswa.

Izixhumanisi ezihlanganisiwe zenezela ukugoqa. Uma i-ControlMaster isebenza uphenyo lungolokuxhumana okuyinhloko, futhi iseshini entsha phezu kwenhloko ekhona izuza lokho okwaxoxwa yinhloko leyo. Uma inhloko ye-mux imile, ukuvula elinye iwindi ngeke kuhlole indlela futhi.

Ukuqinisekisa ukucushwa kusukela ekuqaleni kuze kube sekugcineni

Kuseva, khipha ukucushwa kwe-daemon okusebenzayo esikhundleni sokufunda ifayela nokuqagela ukuthi iyiphi i-include enqobile:

sshd -T | grep -i clientalive

Bese ubuka iseshini yangempela ngemiphumela yokulungisa evuliwe. Ikhlayenti liphrinta umugqa wesikhathi sokuphela lapho inani liphela, futhi izigxivizo zesikhathi ezizungezile zibonisa ukuthi ukuthula kwakuqhubeka noma uphenyo aluzange luthunyelwe nhlobo. Iseshini efa ngaphandle kothrafikhi lokuhlola ivamise ukugcina igama elingukhiye ebhulokhini elingazange livumelane.

Kufanelekile ukwengeza izinto ezimbili zokuhlola kunoma yimuphi umsingathi oyifinyelela kuphela ngomhubhe: qinisekisa ukuthi isikhathi esixazululiwe yisona obekuhlosiwe, futhi qinisekisa ukuthi leso sikhathi siphindwe ngenani sincane kunesikhathi sokungenzi lutho esigwaveni se-VPN. Uma inombolo yesibili inkulu, ugwava lulahla umfudlana buthule kuqala futhi uphenyo lwe-SSH alutholi ithuba lokubika lutho.