Method for realizing cross-local area network edge device connection by using SSH reverse proxy

Abstract

The invention relates to a method for realizing cross-local area network edge device connection by using SSH reverse proxy, which comprises the following steps of: S1, deploying an interface service in a public network server, and modifying an ssh configuration file in the public network server; s2, deploying a daemon process in the edge device in the local area network to enable the SSH reverse proxy connection of the edge device to be successful; and S3, the edge device in the local area network receives the reverse proxy command through the public network server and then executes the reverse proxy command, so that the public service network accesses the edge device through the SSH. A server is requested through the edge device to obtain a reverse proxy command, a to-be-executed command is obtained through a heartbeat interface, and the edge device executes the command, so that the local area network device randomly uses a certain port of the cloud service, and reverse proxy is realized when remote control is needed.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method for realizing cross-local area network connection of edge devices by utilizing SSH reverse proxy. Background Art

[0002] With the continuous development of computer networks, more and more companies have begun to provide Internet services and management backgrounds. For the purpose of security management, many management backgrounds have set up IP authentication in addition to account verification. At the same time, it has become normal for companies to restrict the permissions and bandwidth of LAN access to the Internet. This has led to frequent errors and slow speeds in corporate LAN access to the management background, causing great inconvenience. The traditional method of setting up a proxy server in the intranet requires each user to change the network settings of the edge device, which is extremely inconvenient.

[0003] The reverse proxy server is located between the user and the target server, but for the user, the reverse proxy server is equivalent to the target server, that is, the user can directly access the reverse proxy server to obtain the resources of the target server. At the same time, the user does not need to know the address of the target server, nor does he need to make any settings on the user side. The reverse proxy server can usually be used as a Web acceleration, that is, the reverse proxy is used as a front-end machine of the Web server to reduce the load of the network and the server and improve access efficiency. During the reverse proxy process, the current reverse proxy server will expose the IP address and port number of the reverse proxy server to the outside world for external devices to access the proxy node. During the reverse proxy process, if multiple backend services need to be exposed to the outside world, it is necessary to configure the corresponding server port for each backend service. Although this proxy method can better support the safe operation of the backend service, it will increase the consumption of server resources and reduce server performance. At present, LAN devices need to occupy a port of the cloud server all the time. When there are too many LAN devices, the cloud server port is not enough.

[0004] Chinese patent document CN118018604A discloses a cloud-edge integrated reverse proxy method and device, wherein the method first receives an HTTP request in a web page and parses the HTTP request to determine the reverse proxy client ID being accessed; then forwards the HTTP request to the corresponding reverse proxy client according to the client ID being accessed; finally, receives the HTTP response from the client to the HTTP request, and responds to the HTTP request based on the HTTP response. In the reverse proxy method of this technical solution, the operation and maintenance personnel only need to connect to the reverse proxy server to access the reverse proxy client through the reverse proxy server. And in this technical solution, the reverse proxy client and the reverse proxy server use long connections.

[0005] Based on the above problems, it is necessary to propose a method of using SSH reverse proxy to connect edge devices across LANs, which can enable LAN devices to randomly use a port of the cloud service and implement reverse proxy when remote is needed. Summary of the invention

[0006] The purpose of the present invention is to provide a method for connecting edge devices across local area networks using SSH reverse proxy, so that local area network devices randomly use a certain port of cloud service and realize reverse proxy when remote is needed.

[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is that the method of using SSH reverse proxy to realize cross-local area network connection edge device specifically includes the following steps:

[0008] S1: Deploy the interface service in the public network server and modify the ssh configuration file in the public network server;

[0009] S2: Deploy a daemon process in the edge device in the LAN to enable the edge device SSH reverse proxy connection to succeed;

[0010] S3: The edge device in the LAN receives and executes the reverse proxy command through the public network server, so that the public service network accesses the edge device through SSH.

[0011] By adopting the above technical solution, the edge device requests the server to obtain the reverse proxy command, obtains the command to be executed through the heartbeat interface, and executes the command by the edge device, so that the LAN device randomly uses a port of the cloud service and realizes reverse proxy when remote is needed.

[0012] Preferably, in step S1, the sshd_config file in the ssh configuration file in the public network server is modified.

[0013] Preferably, in step S1, the interface service is deployed in the public network server, including deploying a reverse proxy port.

[0014] Preferably, in step S2, sshpass is first installed in the edge device, and then the ~ / .ssh / config file is modified to configure the confirmation-free login, and then a daemon process is deployed to obtain the reverse proxy command and execute the command through the interface call form. Since the public network server password needs to be manually entered to execute the command to be executed through the heartbeat interface, it is also necessary to configure the password-free login to the public network server, and then the public network server can access the edge device through ssh.

[0015] Preferably, the daemon process in step S2 initiates a heartbeat request to the public network server every 5 to 10 seconds. The heartbeat request carries the MAC address of the network card of the edge device as the ID to obtain the command that needs to be executed by the device, and then the SSH reverse proxy connection is successful after the command is executed. The reverse proxy command is obtained through the daemon process. If there is no daemon process, the reverse proxy command cannot be executed.

[0016] Preferably, the specific steps of step S3 are:

[0017] S31: The edge device in the local area network sends a request to the public network server to obtain a reverse proxy command;

[0018] S32: The local terminal connects to the public network server and sends a request to the public network server to issue a reverse proxy command;

[0019] S33: The edge device in the local area network receives and executes the reverse proxy command through the public network server, that is, the edge device is successfully connected to the local terminal.

[0020] Preferably, in step S32, the local terminal calls the public network server interface and sends a request to the public network server to issue a reverse proxy command, specifically: using postman to call the interface for issuing reverse proxy commands, and the issued reverse proxy command carries the MAC address of the edge device and the command executed by the edge device.

[0021] Preferably, after the edge device is successfully connected to the local terminal in step S33, a reverse proxy command is executed in the public network server to log in to the edge device.

[0022] Preferably, there is at least one edge device in the local area network.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] (1) The edge device requests the server to obtain the reverse command, obtains the command to be executed through the heartbeat interface, and executes the command by the edge device;

[0025] (2) Install sshpass and then modify the ~ / .ssh / config file to configure confirmation-free login, so you don’t need to enter the public server password;

[0026] (3) Edge devices can use public network server ports at will without occupying a certain port all the time. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A flow chart of a method for connecting edge devices across local area networks using an SSH reverse proxy according to the present invention;

[0028] Figure 2 This is a connection diagram when the login is successful in the method of using SSH reverse proxy to connect edge devices across local area networks of the present invention. DETAILED DESCRIPTION

[0029] The technical solution is further described below in conjunction with the accompanying drawings.

[0030] Example: Figure 1 As shown, Figure 1 The flowchart of the method for connecting edge devices across local area networks using SSH reverse proxy proposed by an embodiment of the present invention is shown. The method for connecting edge devices across local area networks using SSH reverse proxy specifically includes the following steps:

[0031] S1: Deploy the interface service in the public network server and modify the ssh configuration file in the public network server;

[0032] In step S1, modify the sshd_config file in the ssh configuration file in the public network server;

[0033] The code to modify the sshd_config file of the public network server ssh configuration file is:

[0034] #vi / etc / ssh / sshd_config

[0035] Add GatewayPorts yes

[0036] #Restart ssh service

[0037] #centos 7

[0038] systemctl reload sshd.service

[0039] #centos 7 and below

[0040] service sshd reload

[0041] In step S1, a set of interface services is deployed in the public network server, including a reverse proxy port; used to receive, store and send commands to be executed by the small box;

[0042] S2: Deploy a daemon process in the edge device in the LAN to enable the SSH reverse proxy connection of the edge device to succeed; there is at least one edge device in the LAN;

[0043] In step S2, first install sshpass in the edge device, then modify the ~ / .ssh / config file to configure confirmation-free login, and then deploy a daemon process to obtain the reverse proxy command and execute the command through the interface call form; since the public network server password needs to be manually entered to execute the command to be executed through the heartbeat interface, it is also necessary to configure password-free login to the public network server, and then the public network server can access the edge device through ssh; wherein first install the sshpass software, apt install sshpass

[0044] Configure confirmation-free login:

[0045] cat>~ / .ssh / config< <EOF

[0046] StrictHostKeyChecking no

[0047] EOF

[0048] The daemon process in step S2 initiates a heartbeat request to the public network server every 5 to 10 seconds. The heartbeat request carries the MAC address of the network card of the edge device as the ID to obtain the command that needs to be executed by the device. After the command is executed, the SSH reverse proxy connection is successful.

[0049] S3: The edge device in the local area network receives and executes the reverse proxy command through the public network server, so that the public service network accesses the edge device through SSH; the specific steps of step S3 are:

[0050] S31: The edge device in the local area network sends a request to the public network server to obtain a reverse proxy command;

[0051] S32: The local terminal connects to the public network server and sends a request to the public network server to issue a reverse proxy command;

[0052] In step S32, the local terminal calls the public network server interface and sends a request to the public network server to issue a reverse proxy command, specifically: using postman to call the interface for issuing reverse proxy commands, and the issued reverse proxy command carries the MAC address of the edge device and the command command executed by the edge device; 1. The reverse proxy command needs to be filled in here;

[0053] The reverse command is as follows:

[0054] "sudo sshpass-p'public server password'ssh-CqTfnN-R 0.0.0.0:5770:127.0.0.1:22root@public server IP'w'-o";

[0055] The account of the public network server is root. This code binds port 22 of the edge device to port 5770 of the public network server.

[0056] POST request address: "http: / / public server IP:8081 / Equipment / ExecuteCommand", pass in JSON parameters:

[0057] {

[0058] "macAddress":"3c:6d:66:00:c6:99",

[0059] "command":"sudo sshpass-p'public server password'ssh-CqTfnN-R0.0.0.0:5770:127.0.0.1:22root@public server IP'w'-o",

[0060] "args":""

[0061] }

[0062] The macAddress field is the mac address, the command field is the reverse command to be executed, and the args field can be filled with a blank string;

[0063] S33: The edge device in the local area network receives and executes the reverse proxy command through the public network server, that is, the edge device is successfully connected to the local terminal;

[0064] After the edge device is successfully connected to the local terminal in step S33, the reverse proxy command can be executed in the public network server to log in to the edge device; that is, after 5 seconds, "ssh-p 5770root@localhost" can be executed in the public network server to log in to the edge device. Figure 2 As shown in the figure, edge devices can use public network server ports at will without occupying a certain port all the time.

[0065] The software and hardware environment for implementing the above technical solution is:

[0066] 1. Several edge devices, Ubuntu system, installed at the customer site. The network is connected through multiple layers of NAT (Network Address Translation), so there is no public IP;

[0067] 2. An Alibaba Cloud server with a public IP address. The operating system of this machine is Ubuntu 20.04.6LTS.

[0068] 3. An ordinary personal computer. Specific embodiment:

[0070] A Raspberry Pi host with the official system (Raspbian) installed. The specific steps to achieve remote connection to the host in the LAN are as follows:

[0071] (1) Modify the public network server ssh configuration file sshd_config file

[0072] #vi / etc / ssh / sshd_config

[0073] Add GatewayPorts yes

[0074] #Restart ssh service

[0075] #centos 7

[0076] systemctl reload sshd.service

[0077] #centos 7 and below

[0078] service sshd reload

[0079] (2) The Raspberry Pi in the LAN connects to the reverse proxy port of the public server. This code is executed on the local Raspberry Pi. This code binds port 22 of the local machine to port 7233 of the public server:

[0080] ssh-CqTfnN-R 0.0.0.0:7233:127.0.0.1:22root@AAAA;

[0081] (3) Test whether the reverse proxy can be used to connect to the Raspberry Pi in the LAN. At this time, you can use the ssh client of a normal computer to connect to port 7233 of the public network server. Test whether the connection is successful: ssh-p 7233root@AAAA.

[0082] The present invention obtains the anti-generation command by requesting the server through the client HTTP polling, and the command is executed by the client. Since the command requires manual input of the public network server password, it is necessary to configure a password-free login to the public network server, and then the public network server can access the client through SSH. And the anti-generation client and the anti-generation server of the present invention adopt a short connection to obtain the anti-generation command and execute it, which is simple to implement, has strong compatibility, consumes less server resources, and can not only obtain the anti-generation command, but also obtain all other commands and execute them, such as reboot, etc.

[0083] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for connecting edge devices across local area networks using SSH reverse proxy, characterized in that: The specific steps include: S1: Deploy the interface service in the public network server and modify the ssh configuration file in the public network server; S2: Deploy a daemon process in the edge device in the LAN to enable the edge device SSH reverse proxy connection to succeed; S3: The edge device in the LAN receives and executes the reverse proxy command through the public network server, so that the public service network accesses the edge device through SSH.

2. The method for connecting edge devices across local area networks using SSH reverse proxy according to claim 1, characterized in that: In step S1, the sshd_config file in the ssh configuration file in the public network server is modified.

3. The method for realizing cross-LAN connection of edge devices by using SSH reverse proxy according to claim 1, characterized in that: In step S1, an interface service is deployed in a public network server, including deploying a reverse proxy port.

4. The method for connecting edge devices across local area networks using SSH reverse proxy according to claim 3, characterized in that: In step S2, sshpass is first installed in the edge device, and then the ~ / .ssh / config file is modified to configure the confirmation-free login, and then a daemon process is deployed to obtain the reverse proxy command and execute the command through the interface call form.

5. The method for realizing cross-LAN connection of edge devices by using SSH reverse proxy according to claim 4, characterized in that: The daemon process in step S2 initiates a heartbeat request to the public network server every 5 to 10 seconds. The heartbeat request carries the MAC address of the network card of the edge device as the ID to obtain the command that needs to be executed by the device. After the command is executed, the SSH reverse proxy connection is successful.

6. The method for realizing cross-LAN connection of edge devices by using SSH reverse proxy according to claim 5, characterized in that: The specific steps of step S3 are: S31: the edge device in the local area network sends a request to the public network server to obtain a reverse proxy command; S32: The local terminal connects to the public network server and sends a request to the public network server to issue a reverse proxy command; S33: The edge device in the local area network receives and executes the reverse proxy command through the public network server, so that the public service network accesses the edge device through SSH.

7. The method for realizing cross-LAN connection of edge devices by using SSH reverse proxy according to claim 6, characterized in that: In step S32, the local terminal calls the public network server interface and sends a request to the public network server to issue a reverse proxy command, specifically: using postman to call the interface for issuing reverse proxy commands, and the issued reverse proxy command carries the MAC address of the edge device and the command executed by the edge device.

8. The method for realizing cross-LAN connection of edge devices by using SSH reverse proxy according to claim 7, characterized in that: After the edge device is successfully connected to the local terminal in step S33, the reverse proxy command can be executed in the public network server to log in to the edge device.

9. The method for realizing cross-LAN connection of edge devices by using SSH reverse proxy according to claim 7, characterized in that: There is at least one edge device in the LAN.

Images