[{"data":1,"prerenderedAt":454},["ShallowReactive",2],{"docs:/docs/remote/security":3},{"id":4,"title":5,"body":6,"description":446,"extension":447,"meta":448,"navigation":449,"path":450,"seo":451,"stem":452,"__hash__":453},"docs/docs/remote/security.md","安全与凭证",{"type":7,"value":8,"toc":435},"minimark",[9,12,25,29,40,87,98,102,157,160,163,223,230,233,277,280,358,375,378,408,411],[10,11,5],"h1",{"id":5},[13,14,15,16,20,21,24],"p",{},"远程桌面把「一台内网机器的桌面」交给一个网页，所以发放规则比文件分享更敏感。本页说明这条链路",[17,18,19],"strong",{},"默认给你挡住了什么","、",[17,22,23],{},"没挡住什么","，以及出事之后怎么收。",[26,27,28],"h2",{"id":28},"访问地址本身就是凭证",[30,31,37],"pre",{"className":32,"code":34,"language":35,"meta":36},[33],"language-text","https://p2pee.cn/r/\u003C凭证>/\n                 └────────┘ 路径这一段编码这台网关的凭证信息\n","text","",[38,39,34],"code",{"__ignoreMap":36},[41,42,43,50,65],"ul",{},[44,45,46,49],"li",{},[17,47,48],{},"凭证写在地址里，而不是写在服务端 session 里","。这是有意的设计取舍：不把内网地址与机器名推给持有凭证的浏览器，就没法知道该连哪台机器。",[44,51,52,53,56,57,64],{},"结论：",[17,54,55],{},"拿到完整地址的人 = 能连进这台网关清单里的机器","。RDP 还要目标机的账号口令；",[17,58,59,60,63],{},"VNC 如果预置了 ",[38,61,62],{},"pass=","，那就什么都不用再输","。",[44,66,67,68,71,72,75,76,79,80,83,84,64],{},"地址",[17,69,70],{},"不会","被搜索引擎收录（",[38,73,74],{},"/r/"," 在 ",[38,77,78],{},"robots.txt"," 里 Disallow，入口页带 ",[38,81,82],{},"X-Robots-Tag: noindex","），但这只是防索引，",[17,85,86],{},"不是保密手段",[88,89,92],"callout",{"title":90,"type":91},"这些都不该做","danger",[13,93,94,95,97],{},"把地址发到群聊 / 公开仓库 / 工单系统；给 VNC 预置 ",[38,96,62],{}," 之后把地址发给不熟悉的人；把地址存成书签共享给同事一起用（每份会话都占并发额度，且无从追责）。",[26,99,101],{"id":100},"目标机器改不了也当不了跳板","目标机器改不了，也当不了跳板",[103,104,105,118],"table",{},[106,107,108],"thead",{},[109,110,111,115],"tr",{},[112,113,114],"th",{},"防线",[112,116,117],{},"实现",[119,120,121,130,149],"tbody",{},[109,122,123,127],{},[124,125,126],"td",{},"地址只来自启动参数",[124,128,129],{},"网页上没有地址输入框，机器卡片上的地址只作展示",[109,131,132,135],{},[124,133,134],{},"选择只认清单 ID",[124,136,137,138,141,142,145,146],{},"页面回传的是 ",[38,139,140],{},"rdp-1"," / ",[38,143,144],{},"vnc-2"," 这样的编号，",[17,147,148],{},"ID 不在清单里一律被拒绝",[109,150,151,154],{},[124,152,153],{},"启动时就拒绝公网目标",[124,155,156],{},"回环 / 私有网段 / 链路本地 / CGNAT / 内网语义域名 / 裸主机名之外一律不让启动，判定不看订阅、也没有绕过开关",[13,158,159],{},"所以就算有人拿到完整凭证，也无法让网关去连它指定的一台内网机器 —— 能连的只有你启动时写下的那几台。",[26,161,162],{"id":162},"口令的去向",[103,164,165,178],{},[106,166,167],{},[109,168,169,172,175],{},[112,170,171],{},"凭据",[112,173,174],{},"出现位置",[112,176,177],{},"不会出现在",[119,179,180,191,205],{},[109,181,182,185,188],{},[124,183,184],{},"RDP 用户名 / 域",[124,186,187],{},"可写在启动参数里预置，页面仍可修改",[124,189,190],{},"—",[109,192,193,196,202],{},[124,194,195],{},"RDP 口令",[124,197,198,201],{},[17,199,200],{},"只在页面输入","，仅存内存，随会话结束消失",[124,203,204],{},"启动参数、机器清单、日志、地址",[109,206,207,210,220],{},[124,208,209],{},"VNC 口令",[124,211,212,213,215,216,219],{},"可写在启动参数 ",[38,214,62],{}," 里；",[17,217,218],{},"不进清单","，只在会话就绪时经已加密的 P2P 通道下发一次",[124,221,222],{},"页面 DOM、机器清单、日志",[13,224,225,226,229],{},"RDP 不给预置是因为 NLA / CredSSP 需要账号与口令",[17,227,228],{},"成对","出现，塞进命令行就等于让启动参数变成凭据载体。",[26,231,232],{"id":232},"日志与数据面",[41,234,235,253,263],{},[44,236,237,240,241,244,245,248,249,252],{},[17,238,239],{},"日志脱敏","：访问地址只写成 ",[38,242,243],{},"https://…/r/Abc123***"," 这种",[17,246,247],{},"认得出、用不上","的形式；换凭证的 ",[38,250,251],{},"key="," 请求串、broker 地址与 topic 的账号段都会被遮掉。完整地址只出现在网关启动的那一次横幅里 —— 要长期托管它，请当作密码管理。",[44,254,255,258,259,262],{},[17,256,257],{},"画面不经服务器","：桌面字节始终走浏览器与网关之间的 ",[17,260,261],{},"DTLS 加密 P2P DataChannel","，服务器只牵线、牵完即退出链路；网关不开放任何入站端口，也不需要端口映射。",[44,264,265,268,269,272,273,276],{},[17,266,267],{},"走中继也不解密","：打洞失败经 TURN 中继转发时，改变的是",[17,270,271],{},"路径","（多一跳、带宽受限）而不是",[17,274,275],{},"机密性","，中继拿到的只是密文。",[26,278,279],{"id":279},"地址外泄之后怎么作废",[103,281,282,295],{},[106,283,284],{},[109,285,286,289,292],{},[112,287,288],{},"手段",[112,290,291],{},"效果",[112,293,294],{},"说明",[119,296,297,310,323,342],{},[109,298,299,304,307],{},[124,300,301],{},[17,302,303],{},"停止网关进程",[124,305,306],{},"立即失效（连不上）",[124,308,309],{},"最可靠的一层，但重启后若 markID 不变，同一地址又活了",[109,311,312,317,320],{},[124,313,314],{},[17,315,316],{},"重启网关（非会员）",[124,318,319],{},"换新地址",[124,321,322],{},"markID 每次随机 1000-9999，重启即作废旧地址",[109,324,325,334,336],{},[124,326,327],{},[17,328,329,330,333],{},"改 ",[38,331,332],{},"-mark"," 后重启（会员）",[124,335,319],{},[124,337,338,339,341],{},"会员用 ",[38,340,332],{}," 固定地址，作废就得改成新值",[109,343,344,349,355],{},[124,345,346],{},[17,347,348],{},"控制台重置账户 Key",[124,350,351,352],{},"❌ ",[17,353,354],{},"作不了废",[124,356,357],{},"已发出的地址里编码的是「用户 + 派生口令 + markID」，与 Key 无关，重置 Key 后旧地址照样打得开",[88,359,361],{"title":360,"type":91},"重置 Key ≠ 换访问地址",[13,362,363,364,367,368,370,371,374],{},"这是最容易误判的一条。Key 泄露要重置 Key；",[17,365,366],{},"访问地址泄露要靠让网关重新分配 markID","（重启或改 ",[38,369,332],{},"），或者先把网关停掉。顺手把 ",[38,372,373],{},"-connect"," 里的 VNC 预置口令一并撤掉，避免新地址又带着免入口令。",[26,376,377],{"id":377},"一份发放前自检",[379,380,381,389,392,395,398],"ol",{},[44,382,383,385,386,388],{},[38,384,373],{}," 里有没有不该预置的 ",[38,387,62],{},"？发给别人就撤掉。",[44,390,391],{},"目标机上是否只开了需要的账号？别为了让空口令账户连上而去关掉口令要求。",[44,393,394],{},"地址只发给需要的人，并告诉他「这是凭证，不要转发」。",[44,396,397],{},"用完让网关下线：停进程、让被控机休眠，或在控制台确认这条被控端已不在列表里。",[44,399,400,401,404,405,64],{},"长期常驻的机器（NAS / 软路由）上，把带 ",[38,402,403],{},"-key"," 的服务文件权限收到 ",[38,406,407],{},"600",[26,409,410],{"id":410},"相关",[41,412,413,421,428],{},[44,414,415,420],{},[416,417,419],"a",{"href":418},"/docs/remote/targets","目标串与被控机要求","：地址准入的完整范围与 NLA 设置",[44,422,423,427],{},[416,424,426],{"href":425},"/docs/remote/console","控制台查看与管理","：确认哪台网关在线、有哪些浏览器连着",[44,429,430,434],{},[416,431,433],{"href":432},"/docs/remote/troubleshooting","常见问题排查","：地址无效 / 网关离线怎么判",{"title":36,"searchDepth":436,"depth":436,"links":437},3,[438,440,441,442,443,444,445],{"id":28,"depth":439,"text":28},2,{"id":100,"depth":439,"text":101},{"id":162,"depth":439,"text":162},{"id":232,"depth":439,"text":232},{"id":279,"depth":439,"text":279},{"id":377,"depth":439,"text":377},{"id":410,"depth":439,"text":410},"p2pee 远程桌面的安全模型：访问地址本身就是凭证、目标机器无法被页面改写、口令的去向与日志脱敏，以及地址外泄后怎么作废。","md",{},true,"/docs/remote/security",{"title":5,"description":446},"docs/remote/security","BNAkjDGBlJ0jChlYL4MPhDOQp3ZI-i_xQfS3zTQx_BI",1792518096321]