I-SSH ngokusebenzisa i-relay yokugeleza ye-NGINX ngaphandle kokuyiphula

I-SSH yomphakathi ngokusebenzisa i-relay iyahluleka emikhawulweni emibili engahlobene, futhi ukulungisa eyodwa ngokuvamile kwembula enye. Kuphakathi noma unqenqema lubuyisela impendulo ye-HTTP esikhundleni sokuthwala ukugeleza, noma i-relay ifaka ikhanda ngaphambili ebesingakuvunyelwanga yi-backend ukulifunda. Izimo ezintathu zinquma ukuthi ubheka yikuphi: irekhodi lomphakathi likhomba kuphi ngempela, ingxenye yokugeleza ithumela ini phezulu, nokuthi iyiphi igama eqinisekiswa yiklayenti le-SSH. Zisebenze ngalolo hlelo.

Imikhawulo emibili, izimpawu ezimbili

Ukuhluleka konqenqema kubonakala njengekhasi lesimo se-HTTP elifika lapho kufanele kube khona ibhanela le-SSH. Ukuxhumana kuphela ezingeni le-TCP futhi amabhayithi okuqala awumbhalo wesiphakamiso sewebhu. Lokho kuwukungafani kwephrothokholi, hhayi iphakethe elilahlekile. Kubuye kutshele ukuthi unqenqema lukhonza ngenhloso okunye ngalelo gama.

Ukuhluleka engxenyeni ephezulu kubonakala ngendlela ehlukile. Ukuxhumana kufinyelela ku-sshd, i-sshd ifunda amabhayithi okungewona ukushintshana kobunikazi elikulindele, futhi iseshini iyafa noma ilengela ngaphandle kokunikeza ukhiye.

Lokhu kuwukubili kulula ukukudida ngoba kokubili kuveza iklayenti elixhumayo bese lihluleka. Impendulo yephrothokholi yokuqala oyitholayo iyona ehlukanisa, yingakho kufanele ibe sekhathini.

Ikhanda le-PROXY liwumlayezo, akusona isishintshi

Ku-modyuli yokugeleza, i-proxy_protocol on iyala i-NGINX ukuthi ibhale ikhanda lephrothokholi ye-PROXY ngasezindongeni eziphezulu ngaphambi komthwalo. Lokhu akunikezi amandla i-proxy ye-TCP, futhi akuhlangene nokubethelwa kwe-SSH. Kungumbhalo oqondiswe kumamukeli. Uma umamukeli engakwazi ukuwufunda, uba udoti ekuqaleni kokugeleza.

Insizakalo eyamukelayo kumele isebenzise lelo khanda ngenhloso. I-sshd evamile ilindele ukushintshana kobunikazi be-SSH njengamabhayithi okuqala kuxhumano, ngakho isethulo esingalindelekile siphula ukuxhawulana ngendlela ebukeka njengesiphakamiso esonakele.

stream {
    server {
        listen 2222;
        proxy_pass 10.77.0.20:22;
    }
}

Leyo ngxenye iyi-relay ephelele esebenzayo ye-backend efinyeleleka nge-VPN. Akukho myalelo we-PROXY ovelayo ngoba umamukeli akakhulumi leyo phrothokholi, futhi lokho kungabikho kuyisinqumo, hhayi ukushiywa.

Hlukanisa futhi izinhlangothi zombili. Ukusetha i-proxy_protocol emugqeni we-listen kusho ukuthi i-NGINX ilindele ukuthi iklayenti layo uqobo lithumele ikhanda kuqala; ukuyinika amandla eklayentini elivamile le-SSH kuveza okuphambene ncamashi nenkinga abantu abavame ukuzama ukuyixazulula.

Igama lomsingathi womphakathi lifinyelela kuphi ngempela

Ikhasi le-HTTP 400 eseseshini ye-SSH liwubufakazi ngonqenqema. Kukhona okukhuluma i-HTTP endleleni, futhi akukho msebenzi wokhiye noma we-akhawunti ku-backend ozokushintsha lokho. Yeka ukushintsha i-backend kuze kube unqenqema lucacisiwe.

Irekhodi elivamile elenziwe nge-proxy le-Cloudflare lithwala ithrafikhi ye-HTTP ne-HTTPS esekelwayo kumachweba abekiwe. Ukuvula i-proxy egameni lomsingathi akudali i-relay evamile ye-TCP, futhi ukuhambisa i-SSH echwebeni 443 akukwenzi kube yi-HTTPS.

Kunezindlela ezimbili ezisebenzayo. Irekhodi le-DNS kuphela lingakhomba ku-relay yakho ye-TCP, okushiya isinqumo sokuchayeka ezandleni zakho. Kungenjalo, sebenzisa umkhiqizo obhala ngokucacile ukuthwalwa kwe-SSH, nokuhlelwa kwawo komthombo, iklayenti nokufinyelela.

Noma yikuphi okukhethayo, i-relay isadinga indlela ye-VPN eya ku-backend, ukuxhumana okuvunyelwe kanye nendlela yokubuya. Indlela ayiyona into ozikhethela yona ngoba uhlangothi lomphakathi luyasebenza.

Gcina ubunikazi be-SSH buzinzile ngesibongo esikhashana

Abasebenzisi bavame ukufuna ukuqhubeka betayipha igama lomsingathi abanalo. Isibongo esikhashana ekuhlelweni kwe-SSH singakwenza lokho ngaphandle kokushintsha lutho ku-relay, futhi sigcina ushintsho ohlangothini lweklayenti lapho kufanele khona.

Host git.example.com
    HostName ssh-entry.example.net
    Port 2222
    User git
    HostKeyAlias git.example.com

Ngaphandle kwe-HostKeyAlias, i-OpenSSH ibheka ukhiye womsingathi ngaphansi kwegama elixhumanayo, ngakho okufakiwe kuyasuka futhi wonke umsebenzisi ubona isixwayiso sokhiye oshintshile ekusetshenzisweni kokuqala. Ukusetha isibongo esikhashana kugcina okufakiwe kwe-known-hosts kuzinzile ngenkathi ukuxhumana kusaya ku-relay.

Lesi sibongo esikhashana sisebenza kuphela ezindaweni eziqongelelwe ezikude ezisekelwe ku-SSH. I-URL ye-Git ye-HTTPS ayibuzi ngayo, futhi i-URL evamile yendawo ekude kumele ihambisane nokuthwalwa okuyilungiselele ngempela.

Into okungafanele uyenze ukuvala ukuqinisekiswa kokhiye womsingathi ukuze isixwayiso sinyamalale. Lokho kususa isivikelo okwakungazange kucelwe ukuthi kusithintwe ukulungiswa kokudlulisela, futhi kuphendula ukungakhululeki kokubukeka kube ukuchayeka kwangempela.

Qinisekisa ukugxuma ngakunye ngokwehlukana

Hlola isilaleli somphakathi sisodwa, bese kuba ukuxhumana kwe-relay-kuya-kubackend kusuka kumsingathi we-relay, futhi ngemva kwalokho kuphela iklayenti kusukela ekupheleni kuya ekupheleni. Ngakunye kwalokho kuhlolwa okuthathu kususa ungqimba oluhlukile. Ukweqa okukodwa kusho ukuthi imiphumela emibili esele ayikwazi ukuhunyushwa. Ukubona okuthathu, izindawo ezintathu lapho ukuhluleka kungahlala khona.

Gcina ikheli lendawo okuyiwa kuyo, ichweba kanye namabhayithi okuqala ephrothokholi kanye nomphumela ngamunye. Lokho kuthathu kwahlukanisa iphutha lonqenqema kunenkinga yomzila we-VPN kanye nokuhluleka kokuqinisekisa kwe-SSH, futhi lowo umehluko phakathi kokulungisa nokuqagela.

Ekugcineni, bhala phantsi ukuchayeka obekuhlosiwe. I-relay ye-TCP ethwala i-SSH iya ku-backend eyimfihlo ingukuvuleka ngamabomu emngceleni womphakathi, futhi ifanele ukubuyekezwa okufanayo nanoma iyiphi enye insizakalo engenayo.