Kungani imiphumela yokuhlolwa kwezimbobo ishintsha ngemva kokuphuma kwe-VPN?
Shintsha indlela yokuphuma futhi umgodi ungaphendula ngendlela ehlukile ngaphandle kokuthi isevisi inyakaze. Hlukanisa ukubheka komzila kuhlu lokho okudinga ngempela.
Gijimisa ukuhlolwa komgodi okufanayo kusuka ocingweni lwehhovisi nokusuka endleleni yokuphuma ye-VPN, futhi izimpendulo ezimbili zingase zingavumelani ngekheli akekho ayilushintshile. Lelo gebe livela emzileni nasesihambini esaphendula, hhayi ekutheni isevisi iyasebenza noma cha. Imibuzo emithathu ihlukanisa lezo zincazelo: ukuhlolwa kwabuza ini ngempela, isiphi isihambi esaphendula, nokuthi iseva yakho yona ngokwayo yabhala ini. Zilandele ngokulandelana kanye futhi ubhale impendulo ngayinye ngaphambi kokudlulela kwelandelayo.
Lungisa ukuhlolwa ngaphambi kokuqhathanisa ukugijima okubili
Igama lesimo lingaqhathaniswa nelinye igama lesimo kuphela lapho kokubili kuphuma esivivinyweni esisodwa. Izinkambu ezinhlanu zikugxilisa lokho: ikheli lomthombo uhlangothi olukude olubonile, indawo okuyiwe kuyo esixazululiwe, umgodi, uhlobo lokuhlola kanye nesikhathi. Shintsha noma yikuphi kuzo futhi usuwenzile isivivinyo sesibili esikhundleni sokukala esokuqala kabili.
Hlola umthombo ngaphambi kwanoma yini enye, ngoba iklayenti le-VPN lingase lisebenze kuyilapho ukuhamba kusaphuma ngesixhumi esibonakalayo. Buza uhlangothi olukude ukuthi lubona ini, bese ubuza i-kernel ukuthi ikhethe isiphi isixhumi:
curl -s https://ifconfig.me
ip route get 203.0.113.20Amakheli amabili kumanethiwekhi ahlukene asho ukuthi incazelo isivele isesandleni, futhi ezinye izivivinyo zizovele zikuqinisekise. Lapho zivumelana, thatha ukuhlolwa kuvulwe ifulegi lesizathu, ukuze isimo sibuya sixhunywe encazelweni esikhundleni sokuma sodwa njengegama elinqunu. Uhlobo lokuhlola nakho kungolwalugcino, ngoba luchaza okwabuzwa, hhayi okwabuya. Isimo esingenamthombo, esingenandlela nangesingenasigxivizo sesikhathi asikwazi ukuqhathaniswa nanoma yini:
nmap -sT -p 443,8443 --reason 203.0.113.20Gcina lokho okuphumile eduze kombhalo wokugcina, hhayi kubhafa yokuskrola umuntu olandelayo angeke ayibone. Ukuhlola okubili okuqotho okungavumelani kuyimpikiswano kuphela lapho kungekho obhale imibandela. Uma imibandela isigxiliwe, kungenzeka imiphumela ivumelane futhi umbuzo uvaleka, noma yehluke futhi umehluko uyinto yeqiniso ngomzila.
Thola ukuthi isiphi isihambi esaqeda ukuxhawulana
Ukuxhawulana okuqediwe kufakazela ukuthi isihambi esithile sakugcina, futhi leso sihambi akudingeki sibe yinqubo oyicabangayo. Isilinganisi somthwalo, i-proxy ehlanekezelwe noma i-SYN proxy kungaphendula ngaphambi kokuthi iseva yangempela ihlanganyele, okuwukuklanywa okuvamile hhayi uphawu. Isitifiketi esivumelekile segama elilindelekile naso asikunciphisi lokhu, ngoba isitifiketi sichaza ubuhlobo besevisi futhi asisho lutho mayelana nokuthi imuphi umshini waqeda ukuxhumana.
Inkomba yezimo zomgodi ye-Nmap ikuthatha lokhu njengesisekelo: isimo sibhala lokho ukuhlolwa okwakwazi ukukubona kusuka lapho kuthunyelwe khona, hhayi isici somgodi. Funda igama lesimo ngale ndlela futhi ukugijima okubili okwakungavumelani kuqala ukubonakala kuvumelana esikhundleni sokuphikisana, kuyilapho umbuzo usuka ekutheni umgodi uvulekile yini uya ekutheni ngubani owayemi phambi kwawo.
Phendula umbuzo wesibili ku-backend hhayi ngaphandle. I-frontend eyamukela ukuxhumana bese yehluleka ukufinyelela ku-upstream wayo ikhiqiza isithombe sangaphandle esiqondile sesevisi enempilo enohlelo oluhamba kancane. Umbhalo we-upstream uqobo kuphela ohlukanisa izimo ezimbili:
tail -n 5 /var/log/nginx/access.log
ss -ltnp 'sport = :443'Umugqa we-log ubonisa ikheli leklayenti uhlelo olwabona ngempela, futhi umyalo wesibili ubonisa ukuthi inqubo ephethe umgodi 443 uhlelo lwakho yini noma into engaphambi kwalo. Uma kokubili kungavumelani ngokuthi yikuphi ikheli elixhumekile, ubheka imilenze emibili yesicelo esisodwa futhi ithikithi kufanele lisho lokho.
Hlola imithetho yakho ngaphambi kokusola umhubhe
Inqubomgomo eyenziwe ngamabomu iyisizathu esivame kakhulu sokuthi umgodi uphendule kunethiwekhi eyodwa hhayi kwenye, futhi iyincazelo engathandeki kakhulu etholakalayo. Imithetho yokufinyelela ikhona ukuze ivumele umthombo owodwa futhi ilahle ezinye, ngakho ukushintsha kokuphuma kuyisigameko siqu sabethelwe kona. Ngakho isimo esihlukile nge-VPN asibonisi ukuthi umhlinzeki uhlola ukuhamba. Sibonisa ukuthi ikheli lomthombo wakho manje lihlukile, okuyisimangalo esincane kakhulu.
Le mithetho ingafundwa kuseva, ngakho yifunde esikhundleni sokuqagela ngaphakathi kwenethiwekhi. Bhala imithetho yokuhlunga ekhuluma nganoma yiliphi lamabanga amabili amakheli, bese uhlola ukuthi ukuxhumana kwafinyelela ku-daemon yini:
nft list ruleset | grep -n -e 203.0.113 -e 198.51.100
journalctl -u sshd -n 50 | grep 203.0.113Umphumela wesibili ongenalutho unolwazi, ngoba akukho okwafinyelela ku-daemon futhi umbuzo ungowokuhlunga, iqembu lokuphepha noma umzila uqobo. Ukushaya kusho ukuthi isevisi yabona umthombo wakho futhi yakhetha impendulo yayo, futhi leso sinqumo sivame ukubhalwa emthethweni ongawufunda. Akukho mphumela oseka indaba ngomhlinzeki, futhi kokubili kushibhile ukuqinisekisa kunokubamba amaphakethe.
Funda ukuthutha, isitifiketi nempendulo ngokwahlukana
Izingqimba ezintathu zikhiqiza ukubheka okuthathu, futhi ukuhlolwa okuhlola okukodwa kuzo akukwazi ukubika ngezinye ezimbili. Zibeke njengemigqa ehlukene embhalweni esikhundleni sokuzigoqa zibe yisinqumo esisodwa, ngoba umugqa ngamunye wehluleka ngendlela yawo futhi indlela yokwehluleka ikutshela lapho okufanele ubheke khona ngokulandelayo.
| Observation | What it settles | What it leaves open |
|---|---|---|
| Connection completed | A host on the path accepted the handshake | Which host, and whether its upstream is reachable |
| Certificate valid for the name | The endpoint holds a credential for that name | Whether the process behind it is the one you meant |
| Expected response body | The application handled the request | Anything about other ports or other paths |
| Connection refused | A host replied and nothing was listening | Whether a filter sits ahead of the refused port |
| Timeout | No reply arrived before the deadline | Drop, blackhole route or an overloaded host |
Umyalo owodwa ukhiqiza imigqa emithathu yokuqala uma uqhathaniswa nesevisi oyilawulayo. Beka okukhishwe yiwo embhalweni eduze nokuhlolwa hhayi kumlayezo wengxoxo:
curl -v --resolve office.example:443:203.0.113.20 https://office.example/Funda okukhishiwe ngokulandelana: ukuxhawulana kuphendula umbuzo wokuthutha, isihloko sesitifiketi siphendula umbuzo wegama, futhi umzimba wempendulo uphendula umbuzo wohlelo. Lapho umugqa wokuxhawulana uphumelela kanti umugqa wempendulo ungeke, une-frontend ene-upstream ephukile hhayi umgodi ovaliwe. Lelo yithikithi elihlukile kunalelo owalivulayo, futhi kufanelekile ukusho lokho ngokusobala.
Qeda ngokubhala amaqiniso amane ethikithi: ikheli lomthombo, uhlobo lokuhlola, isihambi esaphendula kanye nesikhathi. Konke okuqhathaniswa kwakamuva okukudingayo kuphila kulawo mane, futhi lowo ozothatha icala ngokulandelayo ngeke abe nomlando wetheminali yakho. Uma ungeke ugcwalise womane, ukugijima akukakapheli.