Ƙarewar kuki na ConnMan OpenConnect, ba matsalar takardar shaidar ba

ConnMan yana aiki da rana sannan ya ƙi, kuma layin log yana ambaton tabbatar da takardar shaida. Wannan layin yana tura mutane zuwa tarin CA waɗanda ba su taɓa lalacewa ba. Rashin nasara biyu daban-daban suna haifar da kusan irin wannan siffar gazawa: kukin zaman ya ƙare, ko kuma takardar shaidar uwar garken ta canza da gaske. Ana iya raba su cikin kusan minti ɗaya, kuma ɗaya kawai daga cikinsu ya shafi hoton yatsa kwata-kwata.

Rashin nasara biyu, layin log ɗaya mai ruɗani

Suna rabuwa a kan abubuwan lura biyu, kuma babu ɗayansu da ke buƙatar karatu na biyu. Na farko shi ne lokacin da gazawar ta fara: kukin da ya ƙare yana zuwa bayan sa'o'i ko kwanaki na aiki, kuma takardar shaidar da aka maye gurbinta tana zuwa nan da nan bayan canjin ƙofa.

Gwajin minti ɗaya shi ne gudanarwar authenticate da ke ƙasa. Kwatanta FINGERPRINT ɗinsa da OpenConnect.ServerCert a cikin fayil ɗin. Hoton yatsa ɗaya tare da COOKIE daban yana nufin maye gurbin kukin kawai. Hoton yatsa daban yana nufin takardar shaidar uwar garken ta canza da gaske, don haka sake liƙa ta da gangan kuma rubuta wanda ya amince da hakan.

Ƙirƙiri kayan maimakon buga su

ConnMan ba shi da matakin shigo da bayanai don martanin OpenConnect, sabanin NetworkManager. Yana karanta fayil ɗin tanadi wanda dole ne a ƙirƙiri ƙimominsa tun da farko, kuma hanyar da aka tallafa don ƙirƙirar su ita ce yanayin authenticate na OpenConnect.

sudo openconnect --csd-wrapper=/home/user/.cisco/csd-wrapper.sh \
  --authenticate --user myuser vpn.example.com

Fitowar tana buga ƙimomi huɗu: POST, COOKIE, HOST da FINGERPRINT. Hoton yatsa, wanda ke da prefix sha256:, shi ne liƙawar uwar garken. Kuki kuma kayan aikin zaman ne wanda ƙofar ke ƙayyade tsawon rayuwarsa. Mai da su nau'o'in asiri daban-daban: suna ƙarewa bisa jadawali daban-daban, kuma ɗaya kawai ake sa ran zai canza.

Fayil ɗin yana ɗauke da duka biyu, kuma suna tsufa daban

Fayil ɗin tanadi yana ƙarƙashin /var/lib/connman-vpn/ kuma daemon ɗin VPN yana karanta shi ga kowace haɗi, ba applet ɗin tray ba. Riƙe sunan haɗin a sashen duniya da bayanan ka'idar a sashen mai bayarwa.

[global]
Name = Company VPN

[provider_openconnect]
Type = OpenConnect
Name = Company Cisco VPN
Host = vpn.example.com
Domain = corp.example
OpenConnect.ServerCert = sha256:...
OpenConnect.Cookie = ...

Yi amfani da sunan host ɗin da portal ɗin ke hidima da gaske. Adireshin IP tsirara na iya wuce gwajin takardar shaida kuma har yanzu ya gaza, domin na'urar tana bin hanyar host ɗin kama-da-wane kuma tana buƙatar sunan.

systemctl status connman-vpn --no-pager   # is the daemon even installed and running
sudo systemctl restart connman-vpn       # after the file edit
journalctl -u connman-vpn --since '1 hour ago'  # after the connection attempt

Abin da log ɗin ke nunawa da gaske

Tushen bayanai na tray ba zai faɗa muku wace gazawa kuke da ita ba. Log ɗin zai faɗa, idan kun karanta jerin maimakon layin farko mai tsoratarwa. Tsohon kuki yawanci yana nuna cewa tattaunawar TLS ta kammala sannan layin HTTP ya ƙi, shi ya sa kalmomin game da takardun shaida suke kusa da gazawar izini.

Kwatanta sabon gudanarwar authenticate da ƙimomin da ke cikin fayil ɗin. Idan hoton yatsa ya yi daidai kuma kuki ne kawai ya bambanta, kun sami amsarku ba tare da taɓa saitunan amana ba.

Sabunta filin da ya ƙare

Maimaita umarnin authenticate, maye gurbin OpenConnect.Cookie, sannan sake kunna daemon. Bar hoton yatsa shi kaɗai sai dai idan sabuwar fitowar ta nuna wata ƙima daban; a wannan yanayin an maye gurbin takardar shaidar uwar garken da gaske kuma sake liƙawa shawara ce da ya kamata wani ya rubuta, ba liƙawa daga saƙon kuskure ba.

Sarrafa sabuntawa cikin tsari abu ne mai ma'ana: ƙaramin rubutu yana karanta kalmar sirri daga shigarwar daidaitacciyar, yana gudanar da yanayin authenticate kuma yana sake rubuta layin kuki kawai. Riƙe shaidar shiga daga cikin rubutun kuma a karanta ta kawai ga asusun da ke gudanar da shi, kuma mai da sake rubutawa atomatik don gudanarwar da ta gaza ba ta bar fayil rabin rubutacce ba.

Idan ana buƙatar sabuntawa kowane ƴan sa'o'i, rubuta tazarar. Siffa ce ta manufar zaman ƙofa, kuma tana yanke shawara ko za a sarrafa sabuntawa ko a nemi zaman da ya fi tsayi.