Openresty Python LUA

Openresty Python LUA 学习资料 QQ群:397745473

0%

295_利用cloudflare免服务器打洞

发表于 更新于 分类于

QQ群：397745473

295_利用cloudflare免服务器打洞

场景描述

利用cloudflare安装一个服务到服务器上, 就能达到穿透内网任意服务的目的，确实十分方便。比FRP感觉更舒服。

小缺点: 需要绑卡才能用, 开始测试的时候总是连不上, 以为是配置不当，折腾很久发现原来是没有绑卡开通这个Zero Trust服务

现在来记录一下使用Zero Trust 连接服务器中的一个Docker环境的ssh

准备工作

  1. 一个 cloudflare 账号 免费的, 没有就到下面网站注册一个
1
https://dash.cloudflare.com/
  1. 装上docker
1
curl -sSL https://get.daocloud.io/docker | sh;curl -L https://get.daocloud.io/docker/compose/releases/download/v2.3.2/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose;chmod +x /usr/local/bin/docker-compose

安装桌面系统

只需要把22端口映射到本地再用bitvise https://www.bitvise.com/ssh-client-download 穿透后连接rdp或者VNC

只需要连上了ssh就可以利用ssh转发任意端口到本地连接了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
docker run -itd 127.0.0.1:9922:22 --shm-size=2000m --restart always --name=vnc -e VNC_PASSWORD=yb67Yq6K5kBG387TDaz6 --device /dev/snd -e ALSADEV=hw:2,0 -v /dev/shm:/dev/shm dorowu/ubuntu-desktop-lxde-vnc


# 装ssh和xrdp
docker exec -it vnc bash
passwd root
apt-get update;apt-get upgrade -y; 
apt-get install openssh-server xrdp -y;
systemctl enable ssh.service;/etc/init.d/ssh restart;
systemctl enable xrdp.service;/etc/init.d/xrdp restart

#  注意检查一下ssh的配置
#允许root认证登录
sed -i 's/PermitRootLogin no/PermitRootLogin yes/g'  /etc/ssh/sshd_config 
sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/g'  /etc/ssh/sshd_config
#允许密码认证
sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g'  /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication.*/PasswordAuthentication yes/g'  /etc/ssh/sshd_config

火狐浏览器

这个直接用vnc连接就会跳出一个浏览器来的docker镜像

ssh 连接纯折腾, 可以忽略

1
2
3
4
5
6
7
8
9
10
- 火狐浏览器
https://hub.docker.com/r/jlesage/firefox
mkdir -p /docker/appdata/firefox

docker run -d --name=firefox --shm-size=2000m --restart always -p 127.0.0.1:9969:5800 -e VNC_PASSWORD=yb67Yq6K5kBG387TDaz6 -v /docker/appdata/firefox:/config:rw jlesage/firefox


# 带声音
docker run -d --name=firefox --shm-size=2000m --restart always --device /dev/snd -p 127.0.0.1:9969:5800 -e VNC_PASSWORD=yb67Yq6K5kBG387TDaz6 -v /docker/appdata/firefox:/config:rw jlesage/firefox

折腾ssh连接

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
- 火狐浏览器
https://hub.docker.com/r/jlesage/firefox
docker run -d --name=firefox --shm-size=2000m --restart always -p 127.0.0.1:8822:22 -e VNC_PASSWORD=yb67Yq6K5kBG387TDaz6 -v /docker/appdata/firefox:/config:rw jlesage/firefox

docker exec -it firefox sh
apk --no-cache update;apk --no-cache upgrade
apk add --no-cache openssh openrc
adduser -D -H -s /sbin/nologin sshd
useradd admin && echo 'admin:newpassword' | chpasswd
# 如果要需要提升为root，直接修改/etc/passwd把用户组和用户ID改为0


vi /etc/ssh/sshd_config
sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/g'  /etc/ssh/sshd_config
Port 22 #SSH服务器监听的端口号
PermitRootLogin yes #是否允许root用户通过SSH登录
PasswordAuthentication yes #是否允许使用密码进行身份验证
UsePAM yes #启用PAM身份验证
UsePrivilegeSeparation yes
mkdir -p /run/openrc/;touch /run/openrc/softlevel
ssh-keygen -A
rc-status
rc-service sshd restart
rc-update add sshd default

kasmweb 桌面系统

用户名: kasm_user

密码: admin

Docker Kali

1
docker run -d --name=desktop --restart always --shm-size=512m -p 127.0.0.1:8822:22 --user root -e VNC_PW=admin kasmweb/core-kali-rolling:1.12.0

Ubuntu

测试成功

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
# 来自 https://blog.yslifes.com/archives/3132
# catyku/ubuntu-xrdp   22.04     1a7f35267eaf   3 weeks ago   1.59GB
docker run -d --name containerName -p 3389:3389 catyku/ubuntu-xrdp:22.04 createUser password rootYesNo
docker run -d --name containerName -p 3389:3389 catyku/rockylinuxrdp createUser password rootYesNo

# 示例
docker run -d --name=desktop --restart always --shm-size=512m -p 127.0.0.1:8822:22 --user root catyku/ubuntu-xrdp:22.04 ubuntu ubuntu123 yes

docker run -d --name=desktop --restart always --shm-size=512m -p 127.0.0.1:8822:22 --user root catyku/rockylinuxrdp createUser password rootYesNo

# 开SSH
docker exec -it desktop bash
echo 'root:newpassword' | chpasswd
apt-get update;apt-get upgrade -y; 
apt-get install openssh-server -y
#  注意检查一下ssh的配置
#允许root认证登录
sed -i 's/PermitRootLogin no/PermitRootLogin yes/g'  /etc/ssh/sshd_config 
sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/g'  /etc/ssh/sshd_config
#允许密码认证
sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g'  /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication.*/PasswordAuthentication yes/g'  /etc/ssh/sshd_config

/etc/init.d/ssh restart

Ubuntu Jammy

用户名: kasm_user

密码: password

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
# Ubuntu 22.04 Jammy Jellyfish（幸运水母）
# Ubuntu 20.04 LTS Focal Fossa（瞩目狸猫）
# Ubuntu 18.04 LTS Bionic Beaver（仿生河狸）
# kasmweb/ubuntu-jammy-desktop   1.12.0    404ccd2d1c94   3 months ago   7.21GB

docker run -d --name=desktop --restart always --shm-size=512m -p 127.0.0.1:8822:22 --user root -e VNC_PW=password kasmweb/ubuntu-jammy-desktop:1.12.0
docker exec -it desktop bash

# echo 'root:newpassword' | chpasswd
# echo 'kasm_user:newpassword' | chpasswd
passwd root
apt-get update;apt-get upgrade -y; 
apt-get install openssh-server xrdp -y;
systemctl enable ssh.service;/etc/init.d/ssh restart;
systemctl enable xrdp.service;/etc/init.d/xrdp restart

#  注意检查一下ssh的配置
#允许root认证登录
sed -i 's/PermitRootLogin no/PermitRootLogin yes/g'  /etc/ssh/sshd_config 
sed -i 's/#PermitRootLogin.*/PermitRootLogin yes/g'  /etc/ssh/sshd_config
#允许密码认证
sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g'  /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication.*/PasswordAuthentication yes/g'  /etc/ssh/sshd_config

/etc/init.d/ssh restart

6901 novnc端口
1
2
# kasmweb/core-ubuntu-jammy   1.12.0-rolling   127c814d8750   About an hour ago   1.72GB
docker run -d --name=desktop --restart always --shm-size=512m -p 127.0.0.1:8822:22 --user root -e VNC_PW=password kasmweb/core-ubuntu-jammy:1.12.0-rolling

微桌面

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# https://github.com/soffchen/tiny-remote-desktop
# soff/tiny-remote-desktop   latest    ff6ac60ddd41   2 years ago   724MB

docker run -d --name=desktop --restart always --shm-size=512m -p 127.0.0.1:9922:22 -p 127.0.0.1:9969:6901 -p 127.0.0.1:9933:3389 --user root -e VNC_PW=password soff/tiny-remote-desktop

# 声音
docker run -d --name=desktop --restart always --shm-size=512m --device /dev/snd -p 127.0.0.1:9922:22 -p 127.0.0.1:9969:6901 -p 127.0.0.1:9933:3389 -e RESOLUTION=1600x1200 -e VNC_PW=password soff/tiny-remote-desktop

apt update && apt install alsa-base pulseaudio


# 问题1  有时候重启docker xrdp无法启动。 把这个文件删除再启动就可以了 /var/run/xrdp.pid
/ # xrdp
logging configuration:
        LogFile:       /var/log/xrdp.log
        LogLevel:      4
        EnableSyslog:  1
        SyslogLevel:   4
It looks like xrdp is already running.
If not, delete /var/run/xrdp.pid and try again.

Centos

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
# xrdp 测试失败
docker run -d --name=desktop --restart always --shm-size=512m -p 127.0.0.1:8822:22 --user root -e VNC_PW=password kasmweb/centos-7-desktop:1.12.0

docker exec -it desktop bash
# 安装ssh 参考: https://developer.aliyun.com/article/553468
[root@b5926410fe60 /]# yum install passwd openssl openssh-server -y
[root@b5926410fe60 /]# ssh-keygen -q -t rsa -b 2048 -f /etc/ssh/ssh_host_rsa_key -N ''    
[root@b5926410fe60 /]#  ssh-keygen -q -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N ''
[root@b5926410fe60 /]# ssh-keygen -t dsa -f /etc/ssh/ssh_host_ed25519_key  -N '' 
[root@b5926410fe60 /]# sed -i "s/#UsePrivilegeSeparation.*/UsePrivilegeSeparation no/g" /etc/ssh/sshd_config
[root@b5926410fe60 /]# sed -i "s/UsePAM.*/UsePAM no/g" /etc/ssh/sshd_config
[root@b5926410fe60 /]# passwd root
[root@b5926410fe60 /]# /usr/sbin/sshd -D

yum update -y;yum upgrade -y; 
yum install openssh-server -y;
yum install xrdp -y;
systemctl enable ssh.service;/etc/init.d/ssh restart;
systemctl enable xrdp.service;/etc/init.d/xrdp restart

其他桌面

1
2
3
4
5
6
7
8
9
https://morioh.com/p/9240212eef7e
Docker Ubuntu: Ubuntu with XRDP and MATE
https://github.com/RattyDAVE/docker-ubuntu-xrdp-mate-custom


# Xfce桌面安装
https://www.modb.pro/db/410039


另一个完整案例

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
参考: https://twitter.com/wesbos/status/1634310926219333642
Nice free ngrok alternative. 

# -- Use Cloudflare tunnels to proxy your localhost application to the outside world with https. 
1. brew install cloudflared
2. cloudflared tunnel --url http://localhost:6969

# -- Also, setup a re-usable named tunnels on your own domain name so you have a consistent URL:
1. cloudflared tunnel login
2. cloudflared tunnel create local 
3. cloudflared tunnel route dns local http://local.yourdomain.com
4. cloudflared tunnel run --url http://localhost:9999 local

# 另外推荐2个打洞工具: 
https://tunnelto.dev
https://localtunnel.me --> https://theboroer.github.io/localtunnel-www/
https://github.com/antoniomika/sish


# https://github.com/leejoneshane/docker-ezgo-vdi
## 启动容器
# 中英文正常 容器有点大 10.6G 支持RDP和声音  用户名密码都是 ezgo
docker run -p 888:80 -d leejoneshane/ezgo-vdi
docker run -p 3389:3389 -d leejoneshane/ezgo-vdi


# 用公共的cloudflare做映射
curl -Lo /usr/bin/cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 && chmod +x /usr/bin/cloudflared
下面这条命令参考: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide/local/local-management/ingress/
cloudflared tunnel --url tcp://localhost:3389
cloudflared tunnel --url rdp://127.0.0.1:3389

# 在windows本地执行
exe 下载地址: https://github.com/cloudflare/cloudflared/releases
# 会显示一个框里面的网址就是ws地址 https://chapel-kidney-finishing-integration.trycloudflare.com
.\cloudflared-windows-amd64.exe access rdp --hostname https://chapel-kidney-finishing-integration.trycloudflare.com --url rdp://localhost:13389 --loglevel debug

安装Tunnels

1
2
3
4
5
6
7
8
curl -Lo /usr/bin/cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 && chmod +x /usr/bin/cloudflared
cloudflared login

** 登陆成功后就可以在网页上随意控制映身端口了

登陆：https://one.dash.cloudflare.com/
选择: Access/Tunnels --> Create a tunnel
新建一个隧道后会有命令提示直接复制后执行就行了

Windows客户端本地执行

1
2
3
4
5
6
7
8
参考官方文档: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/use_cases/


下载: https://github.com/cloudflare/cloudflared/releases

参考:
.\cloudflared-windows-amd64.exe access rdp --hostname rdp.2bkf.com --url rdp://localhost:13389 --loglevel debug
.\cloudflared-windows-amd64.exe access ssh --hostname ssh.2bkf.com --url tcp://localhost:9922 --loglevel debug

参考资料

1
2
【超简易Cloudflare Tunnel搭配Docker使用指南】 https://www.bilibili.com/video/BV1XY411T7sT/?share_source=copy_web&vd_source=cce1b28f8472adea56ea0325aa0ea453

分享 免费能建docker的平台

1
2
https://gitpod.io/workspaces
https://shell.cloud.google.com/

QQ群：397745473

相关文章

欢迎关注我的其它发布渠道