Imithetho yokungena ye-SSH ne-VPN: yini uhlu lwezimvume olulawula ngempela

Landela uxhumano olulodwa kusuka kuklayenti kuya kumsingathi: yiluphi uhlaka oludlulayo, kungani ukulenga nokwenqatshwa kusho imithetho ehlukile nokuthi kungani ukwenqaba akulona inqubomgomo.

Xhuma kanye ngaphambi kokushintsha umthetho futhi ubhale phansi ukuthi iklayenti liyalenga noma lenqatshwa ngokushesha. Lowo mehluko owodwa ukutshela ukuthi isiphi isinqumo esilahle iphakethe futhi konga ihora lokufunda amafayela wenqubomgomo. Uhambo olusele lufushane: iphakethe lidlula uhlaka olulodwa, lihambisana nomthetho futhi lifinyelela isilaleli noma cha. Uhlu lwezimvume luwukubalwa nje ezungeze lawo maqiniso amathathu.

Landela umzamo owodwa we-SSH kuze kufike ohlakeni lokungena

Iklayenti lithumela i-SYN ekhelini lomsingathi kumbhebhedu 22, futhi i-kernel inquma ukuthi lelo phakethe lingelesevisi yasendaweni yini. Uma kunjalo, indlela yokungena iyasebenza futhi isethi yemithetho iyalemukela noma iyilahla. Ukuthula kusho ukuthi i-SYN yafa ngaphambi kokuba isilaleli siyibone, kuyilapho ukwenqatshwa okusheshayo kusho ukuthi okuthile kuphendule ngokusetha kabusha. Lezi yizinqumo ezihlukile ezivela emithethweni ehlukile, futhi zombili ziyimiphumela esemthethweni.

Bese uqinisekisa isilaleli, ngoba awukho umthetho ongasindisa isevisi engekho. Gijimisa ss -ltnp bese uhlola ukuthi kukhona okuboshiwe embhebhedeni nasemndenini wekheli olindele, bese ufunda i-ssh -v kuklayenti ukuze ubone lapho ima khona.

Ukudlulisela kungesinye isinqumo

Kuseva ye-VPN uhlaka oluthakazelisa kakhulu i-forward, ngoba ithrafikhi yeklayenti ihamba ngomshini esikhundleni sokulethwa kuwo. Umsingathi osebenza kuphela iklayenti yakhe ye-VPN udinga isethi yemithetho emincane kakhulu kunalowo odlulisela amaphakethe abanye abantu. Ukuhlanganisa zombili izakhiwo kumshini owodwa kukhiqiza imithetho ebukeka ilungile futhi engadlulisi lutho.

Bhala inqubomgomo yangaphakathi njengombuzo wayo: yimaphi amakheli eklayenti angafinyelela ziphi izindawo ngomhubhe. Gcina indlela yokuphatha, njenge-SSH, endleleni yokungena ngomkhawulo wayo womthombo. Umthetho we-forward ovumelayo ongewiswa ngesikhathi sokuhlola yilona sici sakudala esiphila isikhathi eside kunokuhlola, ngakho ngemuva koshintsho buyekeza isethi yonke yemithetho hhayi umugqa owuhleliwe. Ukuvula isilaleli somhubhe akusona isigunyazo sokuthi wonke iklayenti elixhunyiwe liphathe umsingathi.

Ukulahla nokwenqaba kuyizenzo, hhayi izinqubomgomo

Inqubomgomo yeketanga eyisisekelo iyemukela noma iyalahla futhi yilolo uhlu oluphelele lwezinketho, njengoba kusho incwadi yesandiso ye-nftables. Ukwenqaba kukhona njengesenzo somthetho esinempendulo ekhethiwe, yingakho ukukubhala njengenqubomgomo kwehluleka ku-nftables naku-iptables. Empeleni i-drop ayiniki iklayenti lwazi, kuyilapho i-reject ilinika iphutha elingasebenza ngalo.

table inet admin {
    chain input {
        type filter hook input priority filter; policy drop;
        ct state established,related accept
        ip saddr 203.0.113.0/28 tcp dport 22 accept
        udp dport 51820 accept
        icmp type { destination-unreachable, time-exceeded } accept
    }
}

Funda leso sithombe njengesimo sesinqumo hhayi njengefayela lokunamathisela, ngoba izikhawu zamakheli ziyizibonelo. I-reject esobala embhebhedeni we-SSH yenza iklayenti elingagunyaziwe lihluleke ngomzuzwana esikhundleni sokulinda isikhathi sokuphela, okunciphisa ukulungisa kwakho amaphutha. Ukuthula kuvimbela ukuskena okungahleliwe futhi akutsheli lutho umsebenzisi ogunyaziwe. Khetha ngesevisi ngayinye futhi bhala ukuthi kungani, ngaphandle kwalokho umuntu olandelayo uzokubuyisela.

Gcina ithrafikhi yokulawula oyidingayo ngempela

Ukuvimba yonke i-ICMP kuyisimo esiyisisekelo esidumile esephula ukutholwa kwe-MTU yendlela, futhi uphawu uxhumano olusungulwayo bese lukhahlelwa kumaphakethe amakhulu. Ukutholwa komakhelwane ku-IPv6 kuncike ezinhlotsheni zayo ze-ICMPv6, futhi ukuzilahla kwephula isixhumanisi ngaphambi kokuba noma yimuphi umthetho we-TCP ubuzwe. Kokubili kungena ohlwini lwezimvume njengezincikile eziqanjiwe hhayi njengezimvume ezibanzi. Inqubomgomo ephula ukutholwa buthule imbi kunaleyo evumela ithrafikhi encane yokuxilonga.

Vumela izimo ze-established ne-related ezixhumanisweni ozisungulele wena, futhi uyeke injini eqapha isimo ibhekane nezimpendulo. Bese uqinisekisa ukuthi indlela yempendulo ayivalwanga kude, ngoba umkhawulo wethrafikhi ephumayo kuphela phezulu udala isikhathi sokuphuza esifanayo obuzokubeka icala kumsingathi.

Khombisa ukululama ngaphambi kokushiya indlela endala

Gcina isikhathi sekhonsoli sivuliwe, sebenzisa ushintsho bese uvula uxhumano lokuphatha olusha ngokuphelele kusuka kwenye itheminali. Isikhathi esikhona asikhombisi lutho, ngoba singasinda emthethweni ovimba konke ukungena okusha, okusenza sibe yinto engamanga eqinisekisa kakhulu emsebenzini wezingcingo zomlilo. Uma uhlelo lokubheka luhlola umsingathi, engeza ikheli lomthombo ngaphambi koshintsho hhayi ngemuva sesexwayiso sokuqala. Bese uhlola iphakethe elilodwa elikhulu nelilodwa elincane ukukhombisa ukuthi ukutholwa kusasebenza.

Kusevisi ye-VPN, phinda kusuka kuklayenti elingakaze lixhume, ngoba isikhathi esiqhubekayo singasebenzisa kabusha isimo okufanele isikhathi esisha sixoxisane ngaso. Bhala phansi isethi yemithetho enembile eyadlulayo, ne-checksum noma ikhophi, ukuze ukuhlela kwakamuva kuqhathaniswe hhayi kuqagelwe. Xhumanisa nalowo ophethe ukulandelana kwemithetho, ngoba umthetho wangaphambili unqoba buthule lowo owengezile.

Izihloko ezihlobene