Jump server'lar: nima, nima uchun va qanday
Jump server nima ekanligini va uni SSH access uchun qanday sozlashni o'rganing.
Muallif: Kamran Ahmed
Quyida ikki xil qismdan — application server va database server'dan iborat veb-ilova uchun namunaviy production environment ko'rsatilgan.
Application server'da ham public, ham private IP address bor. Unga internetdan kirish mumkin. Database server'da esa faqat private IP address bor va unga faqat application server'dan kirish mumkin.
Xavfsizlik nuqtai nazaridan bunday sozlash keng tarqalgan amaliyot hisoblanadi. Bu database server'ga ruxsatsiz kirishning oldini olish uchun qilinadi.
Jump server nima?
Jump server — boshqa serverlarga kirish uchun ishlatiladigan server. U bastion host deb ham ataladi. Bu internetdan kirish mumkin bo'lgan va internetdan kirib bo'lmaydigan boshqa serverlarga kirish uchun ishlatiladigan server.
Yuqoridagi misolda application server jump server deb ataladi.
Masalan, sizda bu infratuzilma AWS'da bo'lishi mumkin: unda ikkita subnet'ga ega custom VPC bor.
- Public Subnet: tashqi dunyo kira oladi
- Private Subnet: faqat VPC ichidan kirish mumkin
Aytaylik, application server public subnet'da, database server esa private subnet'da joylashgan.
Agar AWS VPC haqida ko'proq bilmoqchi bo'lsangiz, AWS VPC, subnet'lar va AWS VPC haqida bilishingiz kerak bo'lgan boshqa barcha narsalar bo'yicha ushbu AWS VPC haqidagi batafsil qo'llanmani ko'rib chiqing. Shuningdek, EC2 instance'lar haqidagi barcha muhim tushunchalar va ularni qanday ishga tushirishni qamrab olgan AWS EC2 instance'lari haqidagi ushbu qo'llanmaga ham nazar tashlang.
Biz internetdan application server'ga osongina SSH orqali ulanishimiz mumkin, ya'ni:
ssh -i ~/.ssh/mykey.pem ec2-user@3.112.5.67
Lekin database server'da public IP address yo'q. Shuning uchun internetdan unga SSH orqali ulana olmaymiz. Masalan, quyidagi buyruq ishlamaydi:
# Won't work because the IP address is private
ssh -i ~/.ssh/mykey.pem ec2-user@192.168.1.0
Endi database server'ga SSH orqali ulanishimiz kerak bo'lsa, avval application server'ga SSH orqali ulanib, so'ng u yerdan database server'ga SSH orqali ulanishimiz kerak. Chunki application server xuddi shu VPC'da joylashgani uchun database server'ga kira oladi.
Keling, sinab ko'ramiz
Avval application server'ga SSH orqali ulanamiz:
ssh -i ~/.ssh/mykey.pem ec2-user@3.112.5.67
Application server ichiga kirganimizdan so'ng, database server'ga SSH orqali ulanishga harakat qilamiz:
ssh -i ~/.ssh/mykey.pem ec2-user@192.168.1.0
Bizda xato chiqdi:
Warning: Identity file /home/ubuntu/.ssh/mykey.pem not accessible: No such file or directory.
ubuntu@192.168.1.0: Permission denied (publickey).
Nima bo'ldi? Buning sababi — application server'da private key, ya'ni ~/.ssh/mykey.pem mavjud emas. Bu muammoni hal qilishning ikki yo'li bor.
1-yechim - Private key'ni serverga nusxalash
Private key'ni lokal kompyuterimizdan application server'ga nusxalab, database server'ga kirish uchun undan o'sha yerda foydalanishimiz mumkin. Buni lokal kompyuteringizda quyidagi buyruqni ishga tushirib bajarishingiz mumkin:
scp -i path/to/key.pem examplefile yourusername@yourserver:/home/yourusername/
Ya'ni bizning holatimizda bu quyidagicha bo'ladi:
scp -i ~/.ssh/mykey.pem ~/.ssh/mykey.pem ec2-user@3.112.5.67:/home/ubuntu/
# --------^---------- -------^-------- ----^--- ----^----- ----^--------
# key file path file to copy user host path to copy
Endi application server'ga SSH orqali ulanib, database server'ga kirish uchun /home/ubuntu/mykey.pem manziliga nusxalangan private key'dan foydalanishimiz mumkin.
Bu yechimning muammosi shundaki, agar application server'imiz buzib kirilsa, hujumchi private key'imizga ega bo'ladi va database server'ga kira oladi.
2-yechim - SSH agent forwarding'dan foydalanish
Ikkinchi yechim — SSH agent forwarding'dan foydalanish. SSH agent forwarding — internetdan kirib bo'lmaydigan serverga kirish imkonini beradigan usul. SSH agent forwarding'ni sozlash uchun quyidagi qadamlarni bajaring:
Application server'ga ulanish uchun foydalanadigan private key'ni (.pem faylni) lokal SSH agent'imizga qo'shamiz:
ssh-add ~/.ssh/mykey.pem
Endi ssh-add -l buyrug'ini ishga tushirsangiz, agent'ga qo'shilgan key'ni ko'rasiz:
2048 SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx path/to/key.pem (RSA)
Endi quyidagi buyruq yordamida application server'ga SSH orqali ulanamiz:
ssh -A -i ~/.ssh/mykey.pem ec2-user@3.112.5.67
# ^^^ -A flag is used to enable agent forwarding
Application server'ga SSH orqali ulanganingizdan so'ng, shunchaki quyidagi buyruq bilan database server'ga SSH orqali ulanishingiz mumkin:
ssh ec2-user@192.168.1.0
Mana bo'ldi! Siz application server'dan database server'ga SSH orqali muvaffaqiyatli ulandingiz.
Qadamlar qisqacha
# Add the private key to the local SSH agent
ssh-add ~/.ssh/mykey.pem
# SSH into the application server using the private key
ssh -A -i ~/.ssh/mykey.pem ec2-user@3.112.5.67
# you don't need to specify the private key here because it is already added to the SSH agent, so you can simply use the following command
ssh -A ec2-user@3.112.5.67
# SSH into the database server from the application server
ssh ec2-user@192.168.1.0
Endi hatto avval application server'ga SSH orqali ulanmasdan turib, database server'ga bitta buyruq bilan SSH orqali ulanishimiz ham mumkin. Buni jump server'ni ko'rsatish uchun ishlatiladigan -J flag'i yordamida qilishimiz mumkin.
ssh -A -J ec2-user@3.112.5.67 ec2-user@192.168.1.0
# -------^----------- --------^-----------
# jump server destination
SSH buyrug'ini soddalashtirish
Bu host yozuvlarini ~/.ssh/config faylimizga qo'shib, buni yanada soddalashtirishimiz mumkin. Faylni o'zingiz yoqtirgan matn muharririda oching va quyidagi satrlarni qo'shing:
Host app
HostName 3.112.5.67
User ec2-user
Port 22
IdentityFile /Users/yourusername/.ssh/mykey.pem
ForwardAgent yes
Host db
HostName 192.168.1.0
User ec2-user
Port 22
ProxyJump app
Endi lokal kompyuteringizda quyidagi buyruqlarni ishga tushirish orqali application yoki database server'ga oddiygina SSH orqali ulanishimiz mumkin:
# SSH into the application server
ssh app
# SSH into the database server
ssh db
Xulosa
Ushbu maqolada biz jump server haqida va internetdan kirib bo'lmaydigan serverga kirish uchun SSH agent forwarding'dan qanday foydalanishni o'rgandik. Shuningdek, ~/.ssh/config fayliga host yozuvlarini qo'shish orqali SSH buyrug'ini qanday soddalashtirishni ham bilib oldik.