SSH ProxyCommand da tabbatarwa ta tushen mai masauki: wane mai masauki ne ke sa hannu?

Maƙasudi na iya ganin haɗin TCP da ke fitowa daga bastion yayin da SSH client ɗin da ke yin tabbatarwar yana gudana a kan workstation.

Host behind-bastion
    ProxyCommand ssh -W %h:%p bastion

A nan mataimaki yana shiga bastion kuma yana neman SSH server ɗinsa haɗin da aka tura zuwa maƙasudi. Babban SSH client na workstation yana musayar ka'idar SSH ta maƙasudin ta wannan rafi. Bastion ɗin yana samar da jigilar; bai fara SSH client ɗin da ke fuskantar maƙasudin ba.

Wannan bambanci yana da muhimmanci ga tabbatarwa ta tushen mai masauki. Mataimakin ssh-keysign na OpenSSH yana samun maɓallan mai masauki na gida don ƙirƙirar sa hannun da ake buƙata. Adireshin tushen cibiyar sadarwa na bastion ba ya sa workstation ta sa hannu da maɓallin mai masaukin bastion.

Kwatanta wannan da:

ssh -t bastion ssh target

Wannan yana fara wani shirin SSH a kan bastion. Tsarin sa na gida da maɓallan mai masauki da ke akwai na wannan na'urar ne, don haka yana iya shiga cikin tsarin amincewa na tushen mai masauki da aka riga aka tsara tsakanin bastion da maƙasudi. Har yanzu yana buƙatar izini mai dacewa da binciken suna na maƙasudin.

Siffar ta biyu kuma tana canza yadda zaman ke aiki: tana gudanar da umarni na nesa kuma tana amfani da tashar tasha. Ba shine maye gurbin bayyananne ga kowace jigilar fayil ɗin SSH ko jigilar sarrafa kai ba. Zaɓi tsarin bisa ga wace na'ura ce ya kamata ta tabbatar wa maƙasudin, maimakon raunana binciken amincewar uwar garken don adireshin tushen ya yi kama da isa.