Ngubani ngempela obona iphasiwedi yakho ye-SSH ku-VPN engathenjwa?

Dlulisa isikhathi se-SSH nge-VPN ongayiphathi wena, futhi iphasiwedi iseyeyesiphakeli se-SSH, hhayi inethiwekhi ephakathi. Uma ukuhanjiswa okuya kumsingathi oqinisekisiwe kuvikelwe kahle, umbukeli ongenzi lutho kuleyo ndlela akayitholi iphasiwedi ngendlela efundekayo. Kodwa shintsha isimo esisodwa, futhi impendulo iyashintsha: umsingathi ongaqinisekisiwe, uhlu lwezinhlamvu ezenziwe buthaka, noma isiteshi sokusebenza esihlaselwe konke kunikeza imiphumela ehlukene. Yenza izivivinyo ezingezansi ngokulandelana, futhi thatha ngayinye njengesimo sokuma.

Shono igama lomamukeli ngaphambi kokuthayipha noma yini

Inkambu yephasiwedi ihamba ngaphakathi komlayezo wokuqinisekisa, futhi lowo mlayezo uhamba ngaphakathi kokuhanjiswa okubethelwe. Ukufihlakala kuyisici sokuhanjiswa, okusho ukuthi kuncike ekutheni ukuvikelwa kuxoxiwe ngakho nokuthi kuxoxwe nomusingathi obuwuhlosile. Yilo yonke ingxenye yesibili abantu abayidlulayo. Ukuxhumana okubethelwe kumkhohlisi kuyimfihlo futhi akunamsizo ngasikhathi sinye. Ukungena ku-VPN akufakazi lutho mayelana nomsingathi we-SSH, futhi isithunzi somhlinzeki asithathi indawo yokuhlolwa kokhiye.

Gcina izinhlangothi ezimbili zihlukene engqondweni yakho. Ukhiye womsingathi uphendula ukuthi ufinyelele kuphi isiphakeli. Ukuqinisekiswa ngephasiwedi noma ngokhiye kuphendula ukuthi isiphakeli samukela muphi umsebenzisi. Ukuthuthukisa okwesibili akukulungisi neze okokuqala.

Hlola ubunikazi bomsingathi, irekhodi kanye nezingxoxo

Qala kuklayenti ngerekhodi osunalo kakade. Umshicileli weminwe oshicilelwe waqhathaniswa nomthombo othembekile, kanye nokufakwa ku-known_hosts okusafanayo, kukunikeza ubufakazi obubodwa obalulekile ngaphambi kokuqala kokuqinisekisa.

ssh-keygen -F ssh.internal.example.net -f ~/.ssh/known_hosts
ssh -o StrictHostKeyChecking=yes ssh.internal.example.net

Ngakwesokudla kwesiphakeli, printa izimpawu zeminwe ozimisele ukuzishicilela esikhundleni sokuzikopisha engqondweni. Ukuzisabalalisa ngaphandle kwesiteshi yikho konke okuyisihluthulelo; umshicileli weminwe onanyathiselwe kusuka esiteshini sokuxoxa esifanayo negama lomsingathi ufakaza kuphela ukuthi kokubili kwavela endaweni eyodwa.

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
sudo sshd -T | grep -E 'hostkey|kexalgorithms|cipher'

Ama-algorithms okuxoxwe ngawo avela ekuhlanganyeleni kwezinhlangothi zombili. Uma ukucushwa kuklayenti kubophela ukushintshana kokhiye okuphelelwe yisikhathi ukufinyelela idivayisi endala, lokho kukhetha kusebenza kumsingathi ngamunye ekukhulumayo, ngakho kukhawulele kulowo msingathi hhayi umhlaba wonke.

Funda izindlela isiphakeli esizamukela ngempela

Ukwazi ukuthi yiziphi izindlela zokuqinisekisa isiphakeli esizivumelayo kukutshela ukuthi iphasiwedi ingeyani ngempela. Umsingathi owamukela kuphela okhiye basesidlangalaleni akanakho ukushintshana kwephasiwedi okufanele kuvikelwe, futhi umsingathi osamukela amaphasiwedi usafanele isinqumo esenziwe ngamabomu hhayi okuzenzakalelayo okuzuzwe njengefa.

sudo sshd -T | grep -E 'passwordauthentication|pubkeyauthentication|permitrootlogin'

Ukuhambisa umsebenzisi ekuqinisekisweni ngokhiye kususa iphasiwedi yalowo msebenzisi kulokho kushintshana. Lokho akwenzi isiteshi sokusebenza esihlaselwe sibe siphephile, futhi akwenzi isikhathi esikude esingathenjwa singabi yingozi. Lezi izingozi ezihlukene ezinokulawulwa okuhlukene. Nquma futhi mayelana nokudluliswa kwe-ejenti. Ukudlulisa i-ejenti kumsingathi ongathenjwa kunika lowo msingathi amandla okusebenzisa okhiye bakho ngesikhathi sesikhathi, futhi lokho kuwukuchayeka okukhulu kunombuzo wephasiwedi okuqale ngawo konke.

Phatha isexwayiso sokhiye womsingathi njengesinyathelo somcimbi

Uma iklayenti lixwayisa ukuthi ukuhlonza komsingathi kushintshile, ma ukuze uqinisekise ngomhubhe ongadluli kuyo leyo ndlela yenethiwekhi. Qhathanisa umshicileli weminwe nekhonsoli yesiphakeli noma nomsebenzi oyakhe kabusha. Ukususa okufakiwe okudala ukuze kuthuliswe isexwayiso yisona senzo esisodwa okufanele usenqabe. Kuyalahla ubufakazi futhi kuguqule ukubanjwa okungenzeka kube ukungena okuvamile.

Uma umsingathi wakhiwe kabusha ngokusemthethweni, susa okufakiwe okuphelelwe yisikhathi kuphela ngemva kokuqinisekiswa komshicileli weminwe omusha, bese uxhuma futhi uhlole izingxoxo futhi. Rekhoda ushintsho nosuku nesizathu, ngoba umuntu olandelayo uzobona isexwayiso esifanayo futhi udinga ukwazi ukuthi sixazululiwe.

Lokho le ncwadi ayikuhlanganisi

Umsebenzi we-VPN obuka ithrafikhi akufani nesofthiwe enamalungelo endawo kumshini wakho. Ukuhlaselwa kwendawo yokugcina, isandiso sesiphequluli esinobutha noma isirekhodi sekhibhodi kukhona ngaphansi kwakho konke i-SSH engakuxoxa, futhi akukho mhubhe okushintshayo lokho. Uma isiteshi sokusebenza sisolwa, landela inqubo yomcimbi esikhundleni sokuhlola imfihlo ngokuxhuma kabusha ngomunye umgudu wokuphuma. Ukuxhuma kabusha kufakaza ukuthi indlela yenethiwekhi ishintshile futhi akukho lutho mayelana nendawo yokugcina.

Qeda ngecala elivamile: umsingathi oqinisekisiwe, ukuhanjiswa okuvikelwe, indlela yokuqinisekisa oyikhethe ngamabomu, futhi akukho kudluliswa obekungadingeki. Leyo nhlanganisela iyimpendulo yombuzo osesihlokweni, futhi izinqumo ezine hhayi esisodwa.