Yadda ake haɗa bayanan martabar abokin ciniki na OpenVPN daga fayilolin da aka bayar

Ma'aikacin ku yana ba da tarar CA, takardar shaidar abokin ciniki da maɓallinta, kuma abokin cinikin ba zai tashi ba har sai an haɗa su cikin bayani ɗaya. Bayanin saiti ne: yana nuni ga waɗannan fayiloli, bai ƙunshi su ba, kuma gyara shi ba zai iya mai da shi takardar shaida ba. Jagorar tana farawa daga kwamfutar tafi-da-gida da aka riga aka amince da ita kuma tana ƙarewa da bayanin da za ku iya farawa daga babban fayil da aka sani. Ba ya ƙirƙirar CA, ba ya yin rijistar sabuwar takardar shaida kuma ba ya taɓa uwar garken.

Manufar a nan ita ce abokin cinikin layin umarni na OpenVPN 2.6 don Linux, wanda aka yi masa hanyar TUN a kan UDP, tare da tabbatarwar takardar shaida.

Tattara fayilolin ɓangaren abokin ciniki kawai

Yi aiki a cikin babban fayil mai kariya kuma tattara kayan amincewar CA da aka amince da su, takardar shaidar abokin cinikin da aka ba ku da maɓallin sirri wanda ya dace da ita. A wannan misalin sunayen sune ca.crt, laptop-a.crt da laptop-a.key. Sunayen fayiloli alamomi ne kawai; ba su ce komai game da abin da kowane fayil ya ƙunsa ba.

Idan kun ƙirƙiri maɓallin a lokacin rijista, bai taɓa barin na'urar ba; daga mai bayarwa sai takardar shaidar da aka sa hannu da sarkar jama'a kawai za su dawo. Tabbatar takardar shaidar tana ɗauke da matsayin abokin ciniki da sabis ɗin ke tsammani. Haka kuma tabbatar maɓallin na wannan takardar shaidar ne ba wata tsohuwa daga wani yunƙuri na baya ba. Haɗin da bai dace ba yana haifar da gazawar TLS da yawa daga baya, wanda ke kama da matsalar uwar garke.

Ka bar maɓallin sa hannu na sirri na CA, maɓallin sirri na uwar garke da sigogin DH a wajen wannan kunshin.

Haɗa fayilolin cikin ƙaramin bayani

Bayanin da ke ƙasa gajere ne da gangan. Kowane layi ko dai yana zaɓar ƙarshen hanya, ko yana iyakance asalin da abokin ciniki zai karɓa, ko yana nuni ga ɗaya daga cikin fayilolin uku.

client
dev tun
proto udp
remote vpn.example.net 1194
nobind

remote-cert-tls server
verify-x509-name vpn-gateway name
ca ca.crt
cert laptop-a.crt
key laptop-a.key

Layin remote yana zaɓar ƙarshen hanyar cibiyar sadarwa. remote-cert-tls server yana nuna cewa dole abokin hulɗa ya gabatar da takardar shaida mai matsayin uwar garke. verify-x509-name yana ƙulla sunan da ake tsammani, a nan vpn-gateway a matsayin Common Name na takardar shaidar uwar garke tare da filin suna na OpenVPN. Ba a samo wannan ƙimar daga sunan mai masaukin DNS ba, don haka yi amfani da tsarin asalin da ma'aikaci ya bayar.

Kada ku watsar da waɗannan binciken kawai saboda wata ƙarshen gwaji tana nuna wata takardar shaida dabam.

Wannan bayanin tushe yana ɗauka cewa babu wata ƙalubalen asusu daban kuma babu maɓallin tashar sarrafawa. Idan sabis ɗin yana buƙatar auth-user-pass, tls-auth ko tls-crypt, ka riƙe saitin da kayan da aka ba ka, domin sirrin tashar sarrafawa da ka ƙirƙira da kanka ba zai dace da wanda uwar garken ke riƙe ba. Haka kuma ka riƙe manufar sirrin sabis ɗin maimakon shigo da layukan matsewa ko sirri daga wani tsohon misali.

Bayyana babban fayil ɗin aiki a fili

Hanyoyin dangi suna bin babban fayil ɗin aikin tsari, ba wurin da fayil ɗin .ovpn yake ba.

Wannan yana ba mutanen da suka matsar da bayanin zuwa sabon babban fayil mamaki, suna tsammanin maɓallin zai bi shi. Don babban fayil ɗin da mai gudanarwa ya zaɓa, umarnin da ke ƙasa yana zuwa hanyar cikakkiya kafin karanta bayanin da nassoshinsa.

sudo openvpn --cd /etc/openvpn/client/laptop-a --config laptop-a.ovpn

Mayen shigar da kaya na tebur ko sabis ɗin tsarin na iya tattara abubuwan dogaro a madadinku kuma ya yi amfani da nasa dokoki. Zai iya amfani da wani babban fayil ɗin aiki dabam da wanda kuka gwada a ciki. Tabbatar yadda hanyar ƙaddamarwarku ke warware hanyoyin maɓalli, takardar shaida da CA. Matsar da fayil ɗin .ovpn kawai ba ya matsar da maɓallin sirri na dabam.

Ka riƙe maɓallin abin karantawa ga mai amfani ko asalin sabis ɗin da aka nufa kawai.

Tabbatar da miƙa, ba sunayen fayiloli ba

Kafin haɗin farko da aka ba da izini, duba ƙarshen hanya, asalin takardar shaida, mai bayarwa da lokacin inganci. Sannan tabbatar nassosin fayilolin suna warwarewa daga babban fayil ɗin aikin da za ku yi amfani da shi da gaske. Bayan haɗi, gwada halin aikace-aikacen da DNS da manufar hanya ya kamata ta samar. Fayiloli uku masu karantawa ba su tabbatar da komai ba game da izinin uwar garke ko hanyar albarkatu mai amfani.

Idan tambayar jimlar izini ta bayyana, ta maɓallin sirri ce, ba asusun VPN ba.

A ƙarshe, yi lissafin kunshin a matsayin kayan shaidar izini. Ba da wannan takardar shaida da maɓalli ga kwamfutar tafi-da-gida ta biyu yana kwafin asali, kuma sake sunan fayil ɗin ba ya ba ku rijista ta biyu. Wannan shi ne bambanci tsakanin haɗa bayani da bayar da shi.