Transmission ku-Linux: phoqa ukuphuma ngokomnikazi wenqubo

Ukuvimba iphothi lokungena le-Transmission akusona isinqumo se-VPN. Iklayenti le-torrent livula izixhumanisi zokuphuma ziya kontanga nasezilandelini, lixazulula amagama futhi lingase liveze isilaleli sokulawula kude, futhi ngakunye kwalokhu kungaphuma ngendlela ongayihlosanga. Dabuluza izinhlolo ezinhlanu ngokulandelana futhi uthathise umthetho we-firewall, hhayi izilungiselelo zeklayenti, njengomngcele. Izinhlolo ezimbili zokugcina yizo abantu abazishiyayo, futhi zizo ezinqumayo ukuthi isiqinisekiso siyahlala yini lapho ithumbu liwa.

Shono inqubo engumnikazi wokudluliswa

Uhlelo lwedeskithophu kanye ne-daemon yesistimu kusebenza ngaphansi kwama-akhawunti ahlukene, futhi umthetho osuselwe kumnikazi ulandela i-akhawunti kunegama lohlelo. Thola ukuthi yikuphi kokubili okusebenzayo ngaphambi kokubhala noma yimuphi umthetho. I-akhawunti yesevisi ezinikezelwe inika inqubomgomo isihloko esiqondile, kuyilapho umsebenzisi wedeskithophu abelana ubunikazi bakhe neziphequluli, abahleli nakho konke okunye esikhathini. Qinisekisa i-UID esikhundleni sokucabanga ukuthi igama le-akhawunti eliphuma kuphakethe yilona elisetshenziswayo.

systemctl status transmission-daemon
ps -o user=,pid=,cmd= -C transmission-daemon

Uma i-akhawunti ingakabi khona, yidale ngale njongo futhi ungayiniki okunye okuyosetshenzwa. Bhala i-akhawunti ne-UID kumbhalo womthetho, ngoba umthetho ongenasihloko umthetho okungekho muntu ongawuhlela ngokuphepha.

Hlukanisa izinkambu zesilaleli nomzila

I-Transmission 4.x ibhala amakheli okulalela ontanga ngokwehlukile ku-rpc-bind-address, futhi umehluko ubalulekile. Isilungiselelo se-RPC silawula kuphela isilaleli sokulawula kude, ngakho ukusishintsha akukhethi umzila wethrafikhi yontanga. Ukufunda izilungiselelo ezimbili njengesisodwa yisizathu esivame kakhulu sokuthi ukucushwa okubonakala kunakekela kusavuza. Umbhalo ofanayo uchaza indlela yokubuyela emuva lapho ikheli lokulalela ontanga lingavumelekile, ngakho ikheli elingatholakali liyicala lokubuyela emuva elibhaliwe, hhayi ukwenqaba okuqinisekisiwe.

grep -E '"(peer-port|rpc-bind-address|bind-address-ipv4)"' /var/lib/transmission-daemon/.config/transmission-daemon/settings.json

Sebenzisa izilawuli zeklayenti ngokwalokho eziyikho, futhi faka isiqinisekiso ku-firewall. Isilungiselelo sesilaleli singase sisawusizo, kodwa asiqiniseki ukuthi ukuxhumana nezilandelayo, ukutholwa kwasendaweni noma ukuseshwa okudlulisiwe konke kuphuma ngethumbu. Lapho kokubili kungavumelani, i-firewall iyona enqumayo.

Bhala ukufaniswa komnikazi kuketanga elifanele

Incwadi ye-Netfilter mayelana nokufaniswa komnikazi ichaza ukuthi amaphakethe akhiqizwe endaweni asabelwa kanjani kumsebenzisi noma iqembu elingumnikazi wefayela le-socket. Lokho kwabelwa akudluleli kuthrafikhi edluliselwe phambili, futhi ukufaniswa kwamaqembu engeziwe kudinga inketho ecacile. Funda incwadi yesandiso osisebenzisayo ngempela hhayi isibonelo sokuqala ositholayo.

iptables -A OUTPUT -m owner --uid-owner transmission -o tun0 -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner transmission -j REJECT
ip6tables -A OUTPUT -m owner --uid-owner transmission -o tun0 -j ACCEPT
ip6tables -A OUTPUT -m owner --uid-owner transmission -j REJECT

Ukulandelana kubalulekile njengokufaniswa. Ukwamukelwa okubanzi ekuqaleni kuketanga kubhubhisa ukwenqaba okuqondile kamuva, ngakho hlola iketanga lonke esikhundleni sokungeza umthetho futhi uthembe. Faka zombili izigaba zamakheli uma umphathi esebenzisa i-IPv6, ngoba inqubomgomo ye-v4 kuphela ishiya umzila ovulekile ongageiniwe muntu. Gcina imithetho ifakiwe phakathi kokuqalwa kabusha kweklayenti nethumbu.

Nquma ukuthi kwenzeka ini lapho u-tun0 unyamalala

Inqubomgomo yokwehluleka iwukhoqo lomsebenzi. Uma ithumbu linyamalala futhi i-hook efanayo isusa imithetho, iklayenti likhululekile ukusebenzisa isixhumi somzimba kuze kube yilapho okunye kukuyeka. Idizayini ephephile igcina imithetho futhi iyivumela ukwenqaba, futhi yikho okwenza umngcele ungavuki ekuxhomekekeni empilweni yethumbu. I-hook yokubhidliza ephinde isuse imithetho iyokuphambana nenqubomgomo yokwehluleka.

ip link show tun0
iptables -S OUTPUT

Yihlole ngamabomu: misa ithumbu, qala ukudluliswa okuphephile ukukushiya futhi ubheke ukuthi kukhona yini okuphumayo. Bese ubuyisela ithumbu futhi uqinisekise ukuthi umzila owawuhlosiwe uyasebenza futhi.

Hlanganisa imizila umthetho ongayiboni

Ukuxazululwa kwamagama kungase kusetshenzwe inqubo yokuxazulula ehlukile, futhi i-namespace noma isango elizinikezelwe kungase kunikeze omunye umngcele uma imizila yayo yokwabelana nokuqalisa iklanyelwe lokho. Nquma ukuthi iyiphi ingxenye engumnikazi we-DNS nokuthi iyawulandela yini umthetho wokuphuma ofanayo. Bese ubheka i-RPC: uma i-rpc-whitelist isetshenziswa, inethiwekhi yokuphatha evunyelwe iyingxenye yesivumelwano, futhi ububanzi be-RFC1918 obukhulu abusiyo.

ss -tunp | grep -i transmission

Izibali zesixhumi zingasekela umbono, kodwa azikwazi ukufakazela ukuthi iyiphi inqubo ekhiqize amabhayithi. Yenza ukudluliswa ovunyelwe ukukushiya: kuqala emzileni osebenzayo, bese kungena ngaphandle kwethumbu ekuqaleni, bese kudlula ekuphazamisekeni, ekuxhumaneni kabusha nasesixhumini esisanda kwenziwa. Hlola kokubili umzamo omutsha nokuxhumana obekuvele kuvulekile, ngoba umthetho kungenzeka ungasetshenziswanga ku-socket endala. Bhala usuku, i-akhawunti nomphumela kanye nokuhlolwa.

Ukunamathisela isibonelo esikhanyisa iketanga lonke kushintsha umgodi owodwa ngochungechunge, ngakho engeza imithetho esikhundleni sokuyisusa. Lapho izinhlolo ezinhlanu zidlula, isiqinisekiso sicacile: ithrafikhi yeklayenti iphuma ngethumbu noma ayiphumi nhlobo, futhi umthetho oyiphoqayo weqa ukwehluleka kwethumbu ngokwalo.