Magana

Mako guda da ya gabata na rubuta makala kan batun da aka yi nuni a cikin taken kuma na fuskanci gaskiyar cewa, a ce, babu bayanan ilimi da yawa a Intanet. Galibi busassun bayanai da umarnin saitin. Saboda haka, na yanke shawarar in ɗan gyara rubutun kuma in buga shi azaman labarin.

Menene FTP

FTP (Protocol Canja wurin fayil) yarjejeniya ce don canja wurin fayiloli akan hanyar sadarwa. Yana ɗaya daga cikin ƙa'idodin Ethernet na asali. Ya bayyana a cikin 1971 kuma ya fara aiki a cikin cibiyoyin sadarwar DARPA. A halin yanzu, kamar HTTP, canja wurin fayil yana dogara ne akan samfurin da ya ƙunshi saitin ƙa'idodin TCP/IP (Transmission Control Protocol/Internet Protocol). An bayyana shi a cikin RFC 959.

Ƙa'idar ta bayyana waɗannan abubuwa:

Ta yaya za a gudanar da binciken kuskure?
Hanyar tattara bayanai (idan an yi amfani da marufi)
Ta yaya na'urar aika ke nuna cewa ta gama sako?
Ta yaya na'urar karba ke nuna cewa ta karɓi saƙo?

Sadarwa tsakanin abokin ciniki da uwar garken

Bari mu dubi tsarin da ke faruwa yayin aiki na FTP. An fara haɗin haɗin ta hanyar fassarar yarjejeniya ta mai amfani. Ana sarrafa musayar ta hanyar tashar sarrafawa a cikin ma'aunin TELNET. Fassarar yarjejeniya ta mai amfani ce ta samar da umarnin FTP kuma ana aika zuwa uwar garken. Hakanan ana aika martanin uwar garken ga mai amfani ta tashar sarrafawa. Gabaɗaya, mai amfani yana da ikon kafa lamba tare da fassarar ƙa'idar ka'idar uwar garken kuma ta hanyar wanin fassarar mai amfani.

Babban fasalin FTP shine cewa yana amfani da haɗin kai biyu. Ana amfani da ɗayansu don aika umarni zuwa uwar garken kuma yana faruwa ta tsohuwa ta tashar tashar TCP 21, wanda za'a iya canzawa. Haɗin sarrafawa yana kasancewa muddin abokin ciniki yana sadarwa tare da uwar garken. Dole ne tashar sarrafawa ta kasance a buɗe lokacin canja wurin bayanai tsakanin injuna. Idan an rufe, watsa bayanai yana tsayawa. Ta na biyu, kai tsaye canja wurin bayanai faruwa. Yana buɗewa duk lokacin da canja wurin fayil ya faru tsakanin abokin ciniki da uwar garken. Idan an canja wurin fayiloli da yawa a lokaci guda, kowannensu yana buɗe tashar watsa nasa.

FTP na iya aiki a cikin yanayin aiki ko m, zaɓin wanda ke ƙayyade yadda haɗin haɗin gwiwa. A cikin yanayin aiki, abokin ciniki ya ƙirƙiri haɗin haɗin TCP tare da uwar garken kuma aika adireshin IP ɗin sa da lambar tashar tashar abokin ciniki ta sabani zuwa uwar garken, sannan yana jira uwar garken don fara haɗin TCP tare da wannan adireshin da lambar tashar jiragen ruwa. Idan abokin ciniki yana bayan bangon wuta kuma ba zai iya karɓar haɗin TCP mai shigowa ba, ana iya amfani da yanayin m. A cikin wannan yanayin, abokin ciniki yana amfani da hanyar sarrafawa don aika umarnin PASV zuwa uwar garken, sannan ya karɓi daga uwar garken adireshin IP ɗinsa da lambar tashar tashar jiragen ruwa, wanda abokin ciniki ke amfani da shi don buɗe bayanan da ke gudana daga tashar jiragen ruwa ta sabani.

Yana yiwuwa a iya canja wurin bayanai zuwa na'ura ta uku. A wannan yanayin, mai amfani yana tsara tashar sarrafawa tare da sabobin biyu kuma ya tsara tashar bayanan kai tsaye tsakanin su. Dokokin sarrafawa suna tafiya ta hanyar mai amfani, kuma bayanai suna tafiya kai tsaye tsakanin sabobin.

Lokacin watsa bayanai akan hanyar sadarwa, ana iya amfani da wakilcin bayanai guda huɗu:

ASCII - ana amfani dashi don rubutu. Bayanan, idan ya cancanta, an canza su daga wakilcin hali akan mai aikawa zuwa "ASCII-bit ASCII" kafin watsawa, kuma (sake, idan ya cancanta) zuwa wakilcin hali akan mai karɓa. Musamman, ana canza haruffan sabbin layi. Sakamakon haka, wannan yanayin bai dace da fayilolin da ke ɗauke da rubutu ba kawai.
Yanayin binary - na'urar aikawa tana aika kowane fayil byte byte, kuma mai karɓa yana adana rafi na bytes bayan an karɓa. An ba da shawarar goyan bayan wannan yanayin don duk aiwatar da FTP.
EBCDIC - ana amfani da shi don canja wurin rubutu a sarari tsakanin runduna a cikin rufaffen EBCDIC. In ba haka ba, wannan yanayin yayi kama da yanayin ASCII.
Yanayin gida - yana ba da damar kwamfutoci biyu masu saiti iri ɗaya don aika bayanai cikin tsarin nasu ba tare da canzawa zuwa ASCII ba.

Ana iya aiwatar da canja wurin bayanai ta kowane nau'i uku:

Yanayin rafi - ana aika bayanai azaman rafi mai ci gaba, yana 'yantar da FTP daga aiwatar da kowane aiki. Madadin haka, duk aiki ana yin ta TCP. Ba a buƙatar alamar ƙarshen-fayil sai don raba bayanai cikin bayanai.
Yanayin toshe - FTP yana karya bayanai zuwa tubalan da yawa (toshewar kai, adadin bytes, filin bayanai) sannan kuma aika su zuwa TCP.
Yanayin matsawa - ana matsa bayanai ta amfani da algorithm guda ɗaya (yawanci ta hanyar ɓoye tsayin gudu).

FTP uwar garken sabar ce da ke ba da damar yin amfani da ka'idar Canja wurin Fayil. Yana da wasu fasaloli waɗanda ke bambanta shi da sabar gidan yanar gizo na al'ada:

Ana buƙatar amincin mai amfani
Ana yin duk ayyuka a cikin zaman na yanzu
Ikon yin ayyuka daban-daban tare da tsarin fayil
Ana amfani da tashoshi daban don kowace haɗi

Abokin ciniki na FTP shiri ne wanda ke ba ku damar haɗawa zuwa uwar garken nesa ta hanyar FTP sannan kuma aiwatar da ayyukan da suka dace akansa tare da abubuwan tsarin fayil. Abokin ciniki na iya zama mai bincike, a cikin adireshin adireshin wanda ya kamata ka shigar da adireshin, wanda shine hanyar zuwa takamaiman jagora ko fayil akan sabar nesa, daidai da babban tsarin toshe URL:

ftp://user:pass@address:port/directory/file

Koyaya, yin amfani da burauzar gidan yanar gizo a cikin wannan mahallin zai ba ku damar dubawa ko zazzage fayilolin sha'awa kawai. Domin samun cikakken amfani da duk fa'idodin FTP, yakamata kuyi amfani da software na musamman azaman abokin ciniki.

Tabbacin FTP yana amfani da tsarin sunan mai amfani / kalmar wucewa don ba da dama. Ana aika sunan mai amfani zuwa uwar garken tare da umarnin USER, kuma ana aika kalmar sirri tare da umarnin PASS. Idan bayanin da abokin ciniki ya bayar ya karɓi sabar, sa'an nan uwar garken zai aika gayyata ga abokin ciniki kuma zaman ya fara. Masu amfani za su iya, idan uwar garken tana goyan bayan wannan fasalin, shiga ba tare da samar da takaddun shaida ba, amma uwar garken na iya ba da iyakanceccen dama ga irin waɗannan zaman.

Mai watsa shiri da ke ba da sabis na FTP zai iya ba da damar shiga FTP wanda ba a san shi ba. Masu amfani yawanci suna shiga tare da "marasa sani" (maiyuwa ya zama mai kula da wasu sabar FTP) azaman sunan mai amfani. Ko da yake galibi ana tambayar masu amfani da su ba da adireshin imel ɗinsu maimakon kalmar sirri, ba a zahiri tabbatarwa ba. Yawancin rundunan FTP waɗanda ke ba da sabuntawar software suna goyan bayan shiga maras sani.

Tsarin tsari

Ana iya ganin hulɗar abokin ciniki da uwar garken yayin haɗin FTP kamar haka:

Amintaccen FTP

Tun asali FTP ba a yi niyya ta kasance mai tsaro ba, kamar yadda aka yi niyya don sadarwa tsakanin cibiyoyin soja da yawa. Amma tare da haɓakawa da yaduwar Intanet, haɗarin shiga ba tare da izini ba ya karu sau da yawa. Akwai bukatar kare sabobin daga hare-hare iri-iri. A cikin Mayu 1999, marubutan RFC 2577 sun taƙaita raunin cikin jerin batutuwa masu zuwa:

Hare-hare na ɓoye ( hare-haren bounce)
Spoof harin
Hare-haren da karfi da yaji
Kama fakiti, shaka
Satar tashar jiragen ruwa

FTP na yau da kullun ba shi da ikon canja wurin bayanai ta hanyar rufaffiyar, sakamakon wanda sunayen masu amfani, kalmomin shiga, umarni da sauran bayanai za su iya shiga cikin sauƙi da sauƙi ta hanyar maharan. Magani na yau da kullun ga wannan matsalar shine a yi amfani da “amintaccen”, nau'ikan kariyar TLS na ƙa'idodin ƙa'idar rauni (FTPS) ko wata, mafi amintaccen yarjejeniya, kamar SFTP/SCP, wanda aka tanadar tare da mafi yawan aiwatar da yarjejeniyar Shell mai aminci.

FTPS

FTPS (FTP + SSL) tsawo ne na daidaitaccen ƙa'idar canja wurin fayil wanda ke ƙara zuwa ainihin aikinsa ƙirƙirar zaman rufaffiyar ta amfani da yarjejeniyar SSL (Secure Sockets Layer). A yau, ana ba da kariya ta ƙarin ingantattun analogue TLS (Transport Layer Security).

SSL

Netscape Communications ne ya gabatar da ƙa'idar SSL a cikin 1996 don tabbatar da tsaro da sirrin haɗin Intanet. Yarjejeniyar tana goyan bayan amincin abokin ciniki da uwar garken, aikace-aikacen mai zaman kansa ne, kuma yana bayyane ga ka'idojin HTTP, FTP, da Telnet.

Yarjejeniyar Handshake SSL ta ƙunshi matakai biyu: amincin uwar garken da ingantaccen abokin ciniki na zaɓi. A mataki na farko, uwar garken yana amsa buƙatar abokin ciniki ta hanyar aika takaddun shaida da sigogin ɓoyewa. Sa'an nan abokin ciniki ya samar da babban maɓalli, ya ɓoye shi tare da maɓallin jama'a na uwar garken, kuma ya aika zuwa uwar garken. Sabar tana ɓoye maɓalli mai mahimmanci tare da maɓalli na sirri kuma ta tabbatar da kanta ga abokin ciniki ta hanyar mayar da saƙon da ya inganta ta babban maɓallin abokin ciniki.

Ana rufaffen bayanan da ke gaba kuma an inganta su tare da maɓallan da aka samo daga wannan babban maɓallin. A mataki na biyu, wanda shine na zaɓi, uwar garken yana aika buƙatu ga abokin ciniki, kuma abokin ciniki ya tabbatar da kansa ga uwar garken ta hanyar mayar da buƙatun tare da sa hannu na dijital da takaddun maɓalli na jama'a.

SSL tana goyan bayan algorithms iri-iri na cryptographic. A lokacin kafa sadarwa, ana amfani da tsarin maɓalli na jama'a na RSA. Bayan musayar maɓalli, ana amfani da maɓalli daban-daban: RC2, RC4, IDEA, DES da TripleDES. Hakanan ana amfani da MD5 - algorithm don ƙirƙirar narkar da saƙo. An siffanta ma'auni na takaddun maɓalli na jama'a a cikin X.509.

Ɗaya daga cikin mahimman fa'idodin SSL shine cikakken 'yancin kai na dandamali na software. An haɓaka ƙa'idar akan ka'idodin ɗaukar hoto, kuma akidar gininta ba ta dogara da aikace-aikacen da ake amfani da ita ba. Bugu da ƙari, yana da mahimmanci cewa wasu ƙa'idodi za a iya lulluɓe su a sarari a saman ka'idar SSL; ko dai don ƙara haɓaka ƙimar kariyar bayanan da ake buƙata, ko don daidaita iyawar bayanan sirri na SSL don wani ingantaccen aiki.

haɗin SSL

Amintaccen tashar da SSL ke bayarwa yana da manyan kaddarorin guda uku:

Tashar ta sirri ce. Ana amfani da ɓoyayyen ɓoye don duk saƙonni bayan tattaunawa mai sauƙi wanda ke aiki don tantance maɓallin sirri.
Tashar ta tabbata. Bangaren uwar garken tattaunawar koyaushe ana inganta shi, yayin da bangaren abokin ciniki ke da zaɓin ingantacce.
Tashar ta dogara. Jirgin saƙo ya haɗa da bincika amincin (ta amfani da MAC).

Fasalolin FTPS

Akwai aiwatarwa guda biyu na FTPS, ta amfani da hanyoyi daban-daban na samar da tsaro:

Hanyar fakewa ta ƙunshi yin amfani da daidaitattun ka'idar SSL don kafa zaman kafin aika bayanai, wanda, bi da bi, yana karya daidaituwa tare da abokan ciniki na FTP na yau da kullun da sabar. Don dacewa da baya tare da abokan ciniki waɗanda basa goyan bayan FTPS, ana amfani da tashar tashar TCP 990 don haɗin sarrafawa kuma ana amfani da 989 don canja wurin bayanai. Wannan yana riƙe daidaitaccen tashar tashar jiragen ruwa 21 don yarjejeniyar FTP. Ana ɗaukar wannan hanya mara amfani.
Bayyananne ya fi dacewa, tunda yana amfani da daidaitattun umarnin FTP, amma yana ɓoye bayanan lokacin amsawa, wanda ke ba ku damar amfani da haɗin sarrafawa iri ɗaya don duka FTP da FTPS. Dole ne abokin ciniki a sarari ya nemi amintaccen canja wurin bayanai daga uwar garken, sannan ya amince da hanyar ɓoyewa. Idan abokin ciniki bai nemi amintaccen canja wuri ba, uwar garken FTPS yana da haƙƙin ko dai ya kiyaye ko rufe haɗin da ba shi da tsaro. An ƙara ingantaccen tsarin shawarwarin tsaro da bayanai ƙarƙashin RFC 2228 wanda ya haɗa da sabon umarnin FTP AUTH. Kodayake wannan ma'auni baya fayyace hanyoyin tsaro a sarari, ya fayyace cewa dole ne abokin ciniki ya ƙaddamar da amintaccen haɗi ta amfani da algorithm da aka kwatanta a sama. Idan uwar garken ba ta goyan bayan amintattun haɗin kai ta uwar garken, ya kamata a dawo da lambar kuskure na 504. Abokan ciniki na FTPS na iya samun bayanai game da ka'idojin tsaro da uwar garken ke goyan bayan ta amfani da umarnin FEAT, duk da haka, ba a buƙatar uwar garken don bayyana matakan tsaro. goyon baya. Mafi yawan umarnin FTPS sune AUTH TLS da AUTH SSL, waɗanda ke ba da tsaro na TLS da SSL, bi da bi.

SFTP

SFTP (Tabbataccen Yarjejeniyar Canja wurin Fayil) ƙa'idar canja wurin fayil Layer Layer ce wacce ke gudana a saman tashoshi mai tsaro. Kada ku ruɗe da (Simple File Transfer Protocol), wanda ke da gajarta iri ɗaya. Idan FTPS kawai tsawo ne na FTP, to, SFTP wata ka'ida ce ta daban kuma wacce ba ta da alaƙa wacce ke amfani da SSH (Secure Shell) azaman tushen sa.

Shell mai aminci

Daya daga cikin kungiyoyin IETF mai suna Secsh ne ya kirkiro wannan yarjejeniya. Takaddun aiki don sabuwar yarjejeniya ta SFTP ba ta zama ma'auni na hukuma ba, amma an fara amfani da shi sosai don haɓaka aikace-aikacen. Daga baya, an fitar da nau'ikan yarjejeniya guda shida. Duk da haka, sannu a hankali haɓaka aiki a cikinta ya haifar da gaskiyar cewa a ranar 14 ga Agusta, 2006, an yanke shawarar dakatar da aikin haɓaka ƙa'idar saboda kammala babban aikin (ci gaban SSH) da kuma rashin aikin. na isasshen matakin ƙwararru don matsawa zuwa haɓaka ƙa'idar tsarin tsarin fayil mai nisa cikakke.

SSH yarjejeniya ce ta hanyar sadarwa wacce ke ba da damar sarrafa nesa na tsarin aiki da tunnel na haɗin TCP (misali, don canja wurin fayil). Kama da aiki ga Telnet da rlogin ladabi, amma, ba kamar su ba, yana ɓoye duk zirga-zirga, gami da kalmomin shiga da aka watsa. SSH yana ba da damar zaɓar algorithms ɓoye daban-daban. Abokan ciniki na SSH da sabar SSH suna samuwa don yawancin tsarin aiki na cibiyar sadarwa.

SSH yana ba ku damar canja wurin kusan duk wata yarjejeniya ta hanyar sadarwa a cikin amintaccen muhalli. Don haka, ba za ku iya aiki daga nesa kawai a kan kwamfutarka ta hanyar harsashi ba, amma har ma da watsa rafi mai jiwuwa ko bidiyo (misali, daga kyamarar gidan yanar gizo) ta hanyar rufaffen tashoshi. SSH kuma na iya amfani da matsawa bayanan da aka watsa don ɓoyewa na gaba, wanda ya dace, misali, don ƙaddamar da abokan ciniki na X WindowSystem na nesa.

Sigar farko ta yarjejeniya, SSH-1, an haɓaka ta a cikin 1995 ta mai bincike Tatu Ulönen daga Jami’ar Fasaha ta Helsinki (Finland). An rubuta SSH-1 don samar da babban sirri fiye da ka'idojin rlogin, telnet, da rsh. A cikin 1996, an samar da mafi amintaccen sigar yarjejeniya, SSH-2, wacce ba ta dace da SSH-1 ba. Yarjejeniyar ta sami karbuwa sosai, kuma a shekara ta 2000 tana da kusan masu amfani da miliyan biyu. A halin yanzu, kalmar "SSH" yawanci tana nufin SSH-2, saboda Sigar farko ta ƙa'idar yanzu ba a yi amfani da ita a zahiri saboda gazawar ta. A cikin 2006, ƙungiyar aiki ta IETF ta amince da yarjejeniya a matsayin ma'aunin Intanet.

Akwai aiwatarwa guda biyu na SSH: kasuwanci mai zaman kansa da buɗe tushen kyauta. Ana kiran aiwatarwa kyauta OpenSSH. A shekara ta 2006, kashi 80% na kwamfutoci akan Intanet sun yi amfani da OpenSSH. SSH Communications Security ne ya haɓaka aiwatar da aikin, wani reshen Kamfanin Tectia gabaɗaya, kuma kyauta ne don amfanin da ba na kasuwanci ba. Waɗannan aiwatarwa sun ƙunshi kusan saitin umarni iri ɗaya.

Ƙa'idar SSH-2, ba kamar ka'idar telnet ba, tana da juriya ga hare-haren satar bayanan jama'a ("sniffing"), amma ba ta da juriya ga hare-haren mutum-a-tsakiyar. Ka'idar SSH-2 kuma tana da juriya ga hare-haren satar lokaci, tunda ba shi yiwuwa a shiga ko sace wani zaman da aka riga aka kafa.

Don hana harin mutum-in-tsakiyar lokacin haɗawa da mai watsa shiri wanda har yanzu ba a san maɓalli ga abokin ciniki ba, software na abokin ciniki yana nuna wa mai amfani da “hantson yatsa”. Ana ba da shawarar a bincika a hankali “hoton maɓalli” wanda software ɗin abokin ciniki ya nuna tare da hoton maɓallin uwar garken, wanda zai fi dacewa da samun ta hanyar amintattun hanyoyin sadarwa ko a cikin mutum.

Ana samun tallafin SSH akan duk tsarin UNIX-kamar, kuma galibi suna da abokin ciniki ssh da uwar garken azaman daidaitattun kayan aiki. Akwai yawancin aiwatarwa na abokan ciniki na SSH don waɗanda ba UNIX OSes ba. Yarjejeniyar ta sami karbuwa sosai bayan ci gaban masana'antar binciken zirga-zirgar zirga-zirgar zirga-zirgar zirga-zirgar zirga-zirgar zirga-zirgar zirga-zirgar zirga-zirgar zirga-zirgar ababen hawa da hanyoyin dakile ayyukan cibiyoyin sadarwa na gida, a matsayin madadin mafita ga ƙa'idar Telnet mara tsaro don sarrafa mahimman nodes.

Sadarwa ta amfani da SSH

Don yin aiki ta hanyar SSH, kuna buƙatar uwar garken SSH da abokin ciniki na SSH. Sabar tana sauraron haɗin kai daga injunan abokin ciniki kuma, lokacin da aka kafa haɗin gwiwa, yana aiwatar da tantancewa, bayan haka ta fara yiwa abokin ciniki hidima. Ana amfani da abokin ciniki don shiga cikin injin nesa da aiwatar da umarni.

Kwatanta da FTPS

Babban abin da ke bambanta SFTP daga daidaitattun FTP da FTPS shine cewa SFTP tana ɓoye dukkan umarni, sunayen masu amfani, kalmomin shiga da sauran bayanan sirri.

Dukansu ka'idojin FTPS da SFTP suna amfani da haɗin haɗin algorithms asymmetric (RSA, DSA), algorithms masu daidaitawa (DES/3DES, AES, Twhofish, da sauransu), da kuma maɓallin musayar algorithms. Don tabbatarwa, FTPS (ko don zama madaidaici, SSL/TLS akan FTP) yana amfani da takaddun shaida X.509, yayin da SFTP (SSH protocol) yana amfani da maɓallan SSH.

Takaddun shaida na X.509 sun haɗa da maɓallin jama'a da wasu bayanai game da takardar shaidar mai shi. Wannan bayanin yana ba da damar, a gefe guda, don tabbatar da amincin takardar shaidar kanta, sahihanci da mai shi. Takaddun shaida X.509 suna da maɓallin keɓaɓɓen madaidaicin maɓalli, wanda galibi ana adana shi daban da takardar shaidar saboda dalilai na tsaro.

Maɓallin SSH ya ƙunshi maɓallin jama'a kawai (ana adana maɓalli na sirri daban daban). Ba ya ƙunshi kowane bayani game da mai maɓalli. Wasu aiwatarwa na SSH suna amfani da takaddun shaida na X.509 don tantancewa, amma ba su tabbatar da duk sarkar takardar shedar ba-kawai maɓallin jama'a ake amfani da shi (wanda ke sa irin wannan tabbacin bai cika ba).

ƙarshe

Ka'idar FTP babu shakka har yanzu tana taka muhimmiyar rawa wajen adanawa da rarraba bayanai akan hanyar sadarwa duk da shekarunta masu daraja. Yana da dacewa, multifunctional da daidaitaccen yarjejeniya. An gina ɗakunan ajiyar fayiloli da yawa bisa tushen sa, wanda ba tare da wanda aikin fasaha ba zai yi tasiri sosai ba. Bugu da ƙari, yana da sauƙi don saitawa, kuma uwar garken da shirye-shiryen abokin ciniki sun wanzu don kusan dukkanin dandamali na yanzu kuma ba haka ba.

Hakanan, nau'ikan sa masu kariya suna magance matsalar sirrin bayanan da aka adana da kuma watsawa a duniyar zamani. Duk sabbin ka'idoji guda biyu suna da ribobi da fursunoni kuma suna yin ayyuka daban-daban. A waɗancan wuraren da ake buƙatar ma'ajiyar fayil, yana da kyau a yi amfani da FTPS, musamman idan an riga an yi amfani da FTP na gargajiya a can baya. SFTP ba ta da yawa saboda rashin dacewa da tsohuwar yarjejeniya, amma yana da aminci kuma yana da ƙarin ayyuka, tun da yana cikin tsarin gudanarwa mai nisa.

Jerin kafofin

source: www.habr.com

SFTP da FTPS ladabi