Ithrafikhi yohlelo lokusebenza iyiphi ngempela ethwalwa ukudluliswa kwe-SSH?

I-shell, ukudluliswa kwasendaweni, i-SOCKS kanye nemodi yedivayisi yomhubhe kukhombisa izixhumanisi ezihlukene. Shayela igama isixhumanisi uhlelo lwakho olungalusebenzisa ngaphambi kokuluqhathanisa ne-VPN enomzila.

Ithemineli iyaxhuma, uphawu lokufaka luvela, futhi wonke umuntu uyavuma ukuthi ukufinyelela kwe-SSH kuyasebenza. Bese kuthi iklayenti ledathabhethi kukhompyutha ephathekayo lingakwazi ukufinyelela umsingathi oyimfihlo, futhi kusolwa isikhathi sokusebenza. Okwakhiwe kwakuyi-shell, futhi lokho kungenye yezixhumanisi ezine ezihluke kakhulu i-SSH engazinikeza. Qala ngokushayela igama isixhumanisi, bese uhlola ukuthi uhlelo luyisebenzisa ngempela. Ukulandelana kubalulekile, ngoba isixhumanisi ngasinye sihluleka ngendlela yaso.

Shayela igama isixhumanisi ngaphambi kokuqhathanisa noma yini

incwadi yesandla yeklayenti le-OpenSSH ihlukanisa izindlela ezine okulula ukuzidida. I-shell noma umyalo okude kusetshenziswa kumsingathi we-SSH. Ukudluliswa kwasendaweni kuvula isokhethi elalelayo kuklayenti futhi kwenza ukuxhumana okulandelayo kusuka ohlangothini olukude. Ukudluliswa okude kwenza okuphambene, kulalele ohlangothini lweseva. Ukudluliswa okuguqukayo kubonisa iphuzu lokugcina le-SOCKS ezinhlelweni ezazi ukulisebenzisa.

  • I-shell: uhlelo lusebenza emshinini okude, akukho okulalelayo endaweni.
  • Ukudluliswa kwasendaweni: ikhompyutha yakho ephathekayo inembobo, umsingathi okude wenza ukuxhumana okuphumayo.
  • Ukudluliswa okude: uhlangothi olukude lunembobo, ithrafikhi ibuya kuwe.
  • Okuguqukayo: i-proxy ye-SOCKS kuklayenti, isetshenziswa kuphela izinhlelo eziqonda i-proxy.

Akukho kulokhu okufaka umzila. Uhlelo oluziba izilungiselelo ze-proxy, noma olukhuluma i-UDP, noma oluxazulula amagama ngokwalo, aluthinteki isikhathi sokusebenza se-SSH esisebenzayo. Lokhu akusona iphutha ku-SSH; lona umkhawulo wesixhumanisi osikhethile.

Ukudluliswa kwasendaweni, okude nokuguqukayo kuyahluka ngokuthi ubani olalelayo

Umehluko onquma izimo eziningi ukuthi ubani ungumnikazi wesokhethi elalelayo. Ekudlulisweni kwasendaweni iklayenti liyalalela futhi umkhawulo okude ushayela indawo ekuyiwa kuyo, yingakho ikheli lendawo ekuyiwa kuyo lixazululwa ngombono weseva. Ekudlulisweni okude iseva iyalalela futhi ukuxhumana kubuyiselwa ohlangothini lwakho, futhi yileyo ndlela obonisa ngayo isevisi yasendaweni ngaphandle kokuyishicilela ngqo.

ssh -N -L 5432:db.internal.example:5432 [email protected]
ssh -N -D 1080 [email protected]
ss -ltnp | grep -E '5432|1080'

Umyalo wokuqala ubopha imbobo 5432 kukhompyutha ephathekayo futhi uyidlulisela kudathabhethi njengoba ibonakala kusuka kubhastioni. Owesibili wenza i-proxy ye-SOCKS embotsheni 1080. Umyalo wesithathu uqinisekisa ukuthi yiziphi izinqubo ezilalelayo ngempela, futhi lokho kuwubufakazi obulodwa bokuthi ukudluliswa kukhona kunokuba kuhluleke buthule ngenxa yokungqubuzana kwembobo.

Ukudluliswa okuguqukayo kufanele isixwayiso sako: kuhlanganisa kuphela izinhlelo ezihlonipha i-SOCKS. Isiphequluli singabhekiswa kuso, ithuluzi lomugqa womyalo lingatshelwa ukuba lisebenzise, kodwa umshayeli wedathabhethi onesitaki sakhe sokuxhumana ngokuvamile akakwazi. Ukucabanga ukuthi yonke inhlelo kumshini manje isebenzisa umhubhe yiphutha elivame kakhulu kuyo yonke le nkambu.

Imodi yedivayisi yomhubhe iwukuphela kokuhlukile kwangempela kwenethiwekhi

I-OpenSSH futhi isekela ukudluliswa kwedivayisi yomhubhe -w, okudlulisa isixhumanisi samaphuzu amabili esikhundleni somlaleli we-TCP. Lowo umhubhe wangempela wenethiwekhi, futhi uhlelwa ngamabomu, akusona umphumela oseceleni wokuvula i-shell.

sudo ssh -w 0:0 [email protected]
ip addr show tun0

Idinga izinombolo zesixhumanisi ezifanele ezitholakalayo kuzo zombili izinhlangothi, ukulungiselelwa okufanele kuseva kanye negunya elanele kuklayenti ukuze kwakhiwe idivayisi. Idinga futhi uhlelo lwamakheli nolomzila, ngoba isixhumanisi esingenalutho asithwali nqubo yokuthi iziphi izindawo okufanele zisebenzise.

Ngisho nalapho, umhubhe uphela kumsingathi okude. Noma yikuphi ukuvikelwa okunikezwe ukuthutha kwe-SSH kuphela lapho, futhi ukuxhumana okulandelayo ukugxuma okuhlukile. Isango le-VPN linesimo esifanayo somngcele, yingakho ukuqhathaniswa kufanele kube mayelana nobubanzi nokuphela hhayi mayelana nokuthi iyiphi ithuluzi elinamandla kakhulu. Ukusho lowo mngcele ngokuzwakalayo futhi kuqeda ingxabano yokuthi umhubhe «ubethela konke», ngoba kusobala ukuthi awukwenzi.

Hlola ukuthi uhlelo lwakho lusebenzisa isixhumanisi osakhile

Ukuqinisekisa kungenzelwa uhlelo ngalunye, hhayi isikhathi sokusebenza. Ukudluliswa okusebenzayo kufakazela ukuthi imbobo iboshiwe futhi uhlangothi olukude lungashayela; akufakazeli ukuthi uhlelo olubalulekile kuwe luxhumene ngalo.

curl -sS --socks5-hostname 127.0.0.1:1080 -o /dev/null -w '%{http_code}\n' https://app.internal.example/health
psql "host=127.0.0.1 port=5432 dbname=app sslmode=require" -c 'select 1'

Umyalo wokuqala uthumela isicelo ngokusebenzisa iphuzu lokugcina le-SOCKS ngenkathi igama lomsingathi lixazululwa kude, futhi owesibili uhlola imbobo yedathabhethi edlulisiwe ngenkathi i-TLS isadingeka. Gijimisa lezo zivivinyo uma ukudluliswa kumisiwe ukuze uqinisekise ukuthi ziyahluleka, ngoba isivivinyo esiphumelela zombili izindlela asikaze sisebenzise umhubhe.

Bese uqhathanisa ne-VPN enomzila kuphela ezintweni ezibalulekile: yiziphi izindawo ezihlanganisiwe, yimiphi imithetho yokuxhumana esebenzayo, ukuvikelwa kuphela kuphi futhi ubani okufanele agunyaze ukufinyelela. Ukudluliswa kwesevisi eyodwa kungaba yimpendulo encane futhi engcono, kuyilapho i-VPN iyisimo esifanele lapho izinhlelo eziningi zidinga indlela efanayo yenethiwekhi. Akukho kokubili okunikeza konke okufinyelelekayo kusuka ekugcineni kwako okude.

Izihloko ezihlobene