Kungani uhlu lwe-FTP lubambe ngemva kwesango le-VPN elenza i-NAT
Ukungena ne-PWD kuyaphumelela kuyilapho i-LIST ne-RETR zima uma i-NAT ibhala kabusha izihloko kuphela. Bheka lapho umsizi we-FTP kufanele abe khona nendlela yokulungisa imodi engasebenzi.
Ukungena kuyasebenza, i-PWD iyasebenza, bese i-LIST ilenga ize iklayenti linikele noma lishintshele kwenye imodi yedatha. Lokho kwehlukana yikho isiginesha: uxhumano lokulawula oluya kuphothi 21 luphelele, kuyilapho uxhumano lwedatha lwakhiwa kusuka ekhelini noma kuphothi okungenakufinyelelwa yilolo hlangothi. Ngemva kwesango le-VPN elenza ne-NAT, imbangela evamile umyalo we-FTP okuthwe umthwalo wawo ubiza ikheli lomhubhe njengo-10.8.0.6. Ukuhunyushwa kwezihloko akukaze kuthinte lelo nani.
Okulandelayo ukuthi lelo nani livela kuphi, nokuthi iyiphi ibhokisi evunyelwe ukulishintsha.
Okwephukayo umthwalo, hhayi umhubhe
I-FTP ibeka iphoyinti lokugcina ledatha ngaphakathi komfula wokulawula. Kumodi esebenzayo iklayenti lithumela i-PORT nekheli naphothi lalo, futhi iseva ishayela emuva kulolo mbhangqwana. Kumodi engasebenzi iseva iphendula ngo-227 ngenhlanganisela, futhi iklayenti lishayela kuleyo esikhundleni.
Zombili izimo zithwala uhlobo olufanayo lwesitatimende: xhuma kuleli kheli, kuleli phothi. Idivayisi ebhala kabusha izihloko ze-IP ne-TCP kuphela iyawushiya umyalelo, ngakho uhlangothi olulodwa luqhubeka luzama ukufinyelela ikheli elikhona kuphela kolunye uhlangothi lomhubhe. Uxhumano lwedatha luyama ngemva kokuba uxhumano lokulawula selumenyezelwe luphelele.
Izinhlobo ezintathu, imithwalo emithathu
Ithebula elingezansi likhombisa ukuthi yiluphi uhlangothi oluyalelwa ukushaya, nokuthi i-NAT ebhala kabusha izihloko kuphela ingenzani ngalokho.
Funda ikholomu yokugcina njengento ehluleka kuqala. Kumodi esebenzayo iseva iyona eshayela ikheli eliyimfihlo, kumodi engasebenzi yiklayenti, kuthi ku-FTPS umthwalo uwumbhalo obethelwe futhi ibhokisi eliphakathi linezinto ezimbalwa neze okufanele lisebenze ngazo.
| Mode | Value in the control stream | Who dials whom | Header-only NAT leaves |
|---|---|---|---|
| Active (PORT) | client address and port | server dials the client | a server dialing an unreachable tunnel address |
| Passive (227) | server address and port | client dials the server | a client dialing an address it cannot route to |
| FTPS | the same values, inside TLS | as above | ciphertext, so no rewrite happens at all |
Beka umsizi lapho kwenzeka khona ukuhumusha
Ku-Linux ukubhala kabusha komthwalo kwenziwa umsizi i-nf_conntrack_ftp. Iqapha uxhumano lokulawula, ifunde iphothi okwavunyelwana ngalo, yakhe ukulindela komfula wedatha, futhi kwebhokisi le-NAT ibhala kabusha ikheli nephothi ngaphakathi komthwalo. Isiza kuphela kudivayisi ehumusha ikheli leklayenti. Ukulayisha kuklayenti, noma kusithungo esidlulisela umfula kuphela, akushintshi lutho kuseshini.
Le miyalo emithathu ikhombisa ukuthi imodyuli ikhona yini, ixhunyiwe yini, nokuthi kukhona ukulindela ngesikhathi iseshini ivuliwe:
modprobe nf_conntrack_ftp
lsmod | grep nf_conntrack_ftp
conntrack -L expect | grep ftpUkulayisha imodyuli akufani nokuyixhuma. Amakherneli kusukela ku-4.7 kuya phambili afika ne-net.netfilter.nf_conntrack_helper=0, ngakho umsizi ulindela umthetho ocacile, isibonelo i-iptables -t raw -A PREROUTING -p tcp --dport 21 -j CT --helper ftp. Uma uhlu lokulindela luhlala lungenalutho ngesikhathi kuzanywa ukudlulisa, okufanele kuhlolwe ukuxhumeka, hhayi imodyuli.
Imodi engasebenzi: tshela iseva ukuthi kufanele kumemezele ini
Imodi engasebenzi kulula ukuyenza ibe nqunyelwe ngoba iseva ingatshelwa ukuthi kufakwe ini empendulweni engu-227. Ku-vsftpd lokho yi-pasv_address, kanye ne-pasv_min_port ne-pasv_max_port; i-ProFTPD isebenzisa i-MasqueradeAddress ne-PassivePorts. Setha lezo kuqala, ngoba ikheli elimenyezelwe ngendlela efanele lisusa isidingo sokubhala kabusha noma yini ngalolo hlangothi.
Bese uvumela lelo banga lamaphothi ukuba lidlule esangweni, isibonelo i-A FORWARD -i tun0 -p tcp --dport 30000:30100 -j ACCEPT, ukuze umthetho uhambisane nalokho okumenyezelwa yiseva.
Izilungiselelo zombili kufanele zivumelane. Iseva etshelwa ukumemezela u-30000-30100 kuyilapho isango livumela u-40000-40100 ihluleka ngendlela engasizi neze: ingxoxo yokulawula ibonakala iphelele futhi zonke izixhumanisi zedatha ziyafa. Qhathanisa izinombolo ngaphambi kokulungisa enye into.
Izimpawu ezimbili zokuhluleka, nokuthi i-FTPS isusa ini
Ukulenga ku-LIST kukhombisa uxhumano lwedatha lokuqala lweshini, lapho kokubili ukubhala kabusha kwekheli nokulindela kufanele kusebenze. Ukulenga ku-RETR ngemva kwe-LIST esebenzayo kukhombisa ukudlulisa uqobo, okungukuthi ibanga elingasebenzi noma i-MTU yomhubhe. Leyo siginesha yesibili akuyona inkinga yomthwalo, futhi izilungiselelo zomsizi ngeke zikulungise.
I-FTP phezu kwe-TLS isusa umthwalo ofundwa umsizi. Ibhokisi eliphakathi alikwazi ukubhala kabusha inani le-PORT noma le-PASV elingakwazi ukulihumusha, ngakho okusele i-proksi eqeda i-TLS, iseva ekhangisa ikheli elifinyelelekayo phakathi kwebanga elilinganiselwe, noma enye iphrothokholi yokudlulisa.
Ukulandelana okufushane kokuhlola
Sebenza usuka kuphawu uye ngaphandle. Qinisekisa ukuthi i-LIST iyahluleka kuyilapho i-PWD iphumelela, bamba ikheli ngaphakathi komthwalo we-PORT noma we-227, bese ubuza ukuthi iyiphi idivayisi ehumusha lelo kheli. Xhuma umsizi lapho, bheka uhlu lokulindela phakathi nokudlulisa okukodwa, bese ulungisa imodi engasebenzi kuseva futhi ubonise ibanga emthethweni wesango.
Hlukanisa ukuhluleka komzila wedatha nokuhluleka kokudlulisa okukhulu, ngoba kukuholela ezilungiselelweni ezihlukene.