An yi watsi da client-config-dir bayan OpenVPN ya zama sabis

Raminka yana tashi kuma abokin ciniki yana haɗawa, amma adreshin da aka tsayar da hanyoyin da ka ayyana wa wannan mai amfani ɗaya sun ɓace. Log ɗin bai ce “file not found” ba, kuma wannan ne ke tura mutane su sake ƙirƙirar takaddun shaida. A yawancin waɗannan lokuta daemon yana gudana daga wani kundi dabam da harsashin da ka yi gwaji a ciki, kuma client-config-dir ba a taɓa warware shi yadda ka zata ba. Gyaran shine gyaran hanya, ba sake saita bayanan shiga ba.

Karanta unit ɗin kafin ka taɓa saitin

Fara da aikin da ke gudana da gaske, ba fayil ɗin da ka gyara ba. Tambayi systemd layin aiwatarwa, kundin aiki da asusun da yake sauka zuwa gare shi. Waɗannan amsoshi uku suna bayyana yawancin gazawar wannan rukuni:

systemctl show openvpn-server@server -p ExecStart -p WorkingDirectory -p User -p RootDirectory

WorkingDirectory mara komai yana nufin unit ɗin yana farawa a /, don haka ana neman client-config-dir ccd na dangi a /ccd. Wannan kundin kusan ba ya wanzuwa, kuma daemon ba ya ɗaukar rashinsa a matsayin mai mutuwa.

Kwatanta wannan da ƙaddamarwar hulɗa da ka yi amfani da ita lokacin gwaji, inda kundin yanzu na harsashinka wataƙila shine kundin saitin. Fayil ɗaya, kalmomi ɗaya, sakamako biyu dabam.

Da me ake warware hanyar dangi

Ana warware kalmar maɓalli da kundin aikin aikin a lokacin da ake amfani da zaɓi. Ba yana nufin “gefen fayil ɗin saitin da na wuce da --config” ba. OpenVPN zai karanta saitin daga cikakkiyar hanya cikin jin daɗi kuma har yanzu zai warware ƙimar dangi a wani wuri, kuma wannan shine tarkon a nan. Littafin OpenVPN 2.6 ya bayyana ƙa'idar ƙarƙashin --client-config-dir kuma kuma ƙarƙashin --cd.

Kalmar maɓalli cd tana canza wannan mahallin kafin a karanta wasu fayiloli, don haka unit da ya saita cd /etc/openvpn/server sannan client-config-dir ccd yana warware zuwa /etc/openvpn/server/ccd. Idan ka ƙara cd, duba tsarin umarnin kuma ka tuna yana shafar kowace wata magana ta dangi a cikin fayil ɗin.

Bi hanyar a matsayin asusun daemon

Hanya na iya zama daidai kuma har yanzu ba a iya karantawa. Bayan saukar da gata daemon ba ya zama root kuma, don haka kowane kundin iyaye yana buƙatar izinin bincike ga wannan asusun, kuma fayil ɗin abokin ciniki yana buƙatar izinin karatu. Ɗaya daga cikin bit ɗin aiwatarwa da ya ɓace a kan iyaye ya isa ya ɓoye fayil ɗin, kuma kuskuren yana bayyana ne kawai a matsayin abokin ciniki da ke samun tafkin da aka saba a shiru.

namei yana buga izinin kowane sashi a jere, wanda ya fi saurin duba kundin ɗaya bayan ɗaya:

namei -l /etc/openvpn/server/ccd/client1

Sannan gwada karatun a matsayin asusun sabis maimakon kai:

runuser -u openvpn -- test -r /etc/openvpn/server/ccd/client1 && echo readable

Idan unit ɗin yana amfani da chroot, kundin dole ya kasance cikin kurkuku, kuma ana fassara hanyar da ke cikin saitin bayan an yi chroot. Fayil da ke kan mai masaukin a waje da kurkukun ba a ganinsa daga ciki.

Tabbatar da binciken maimakon yin hasashe

Ɗaga matakin log don sake farawa ɗaya sannan karanta abin da uwar garken ke faɗa game da zaɓuɓɓukan abokin ciniki. A verb 4 daemon yana ba da rahoton saitin kowane abokin ciniki da ya shigo da shi, don haka layin da ya ɓace tabbataccen hujja ce cewa ba a karanta wani fayil don wannan haɗin ba.

openvpn --config /etc/openvpn/server.conf --verb 4 --client-config-dir /etc/openvpn/server/ccd

Gudanar da wannan a gaba a wata tashar jiragen ruwa ta ajiya kuma haɗa abokin ciniki ɗaya. Wannan yana cire systemd gaba ɗaya daga hoton: idan sakewa sun bayyana a nan ba a ƙarƙashin sabis ɗin ba, bambancin shine mahallin unit ɗin, ba fayil ɗin ba.

Yanke shawara abin da ya kamata ya faru idan babu fayil da ya dace. Ba tare da ccd-exclusive ba ana karɓar abokin ciniki da saitunan tafkin duniya kawai, kuma wannan shine gazawar shiru da aka bayyana a sama. Da ita, fayil ɗin da ya ɓace yana zama haɗin da aka ƙi, kuma wannan ƙin yana da sauƙin lura amma yana da wuyar gyara a ƙarƙashin nauyi.

Gyara, sake farawa, tabbatar

Sanya kundin ya zama cikakke a cikin saitin kuma ka bar shi haka. Hanyoyin dangi suna da aminci ne kawai lokacin da unit ɗin ya kafa kundin aiki, kuma kafa shi wani ɓangare ne mai motsi wanda wani zai cire daga baya.

client-config-dir /etc/openvpn/server/ccd
ccd-exclusive

Sake farawa instance ɗin, sake haɗa wani sanannen abokin ciniki sannan karanta adreshin da ya samu tare da hanyoyin da aka tura masa. Idan adreshin ya dace da layin ifconfig-push a cikin fayil ɗin wannan abokin ciniki, binciken ya yi aiki. Idan abokin cinikin har yanzu ya faɗi cikin tafkin gama gari, koma ga lissafin layukan log: shigo da sifili yana nufin hanya ko ainihi ba daidai ba, shigo da ɗaya da abun ciki mara kyau yana nufin kana gyara wani fayil dabam da wanda daemon ke karantawa.

Koma baya ta hanyar dawo da tsohon unit da saitin tare, sannan sake farawa. Ba a buƙatar sake fitar da takaddun shaida don kowane ɗayan waɗannan, kuma ɗaukar matsalar kundi a matsayin matsalar bayanan shiga shine yadda gyaran minti biyar ke zama taga kulawa.