Yadda za a janye uwar garken VPN ba tare da barin shiga a baya ba

Abokin cinikinka har yanzu yana haɗawa a ranar da tikitin janyewa ya buɗe. Wani bayanin martaba yana zaune a cikin manhajar, yana tattaunawa, kuma ramin yana tashi kamar babu abin da ya canza. Wannan shine lokacin yin aiki a kishiyar hanyar da ka gina sabis ɗin: fara daga jerin abokan ciniki, bi zuwa waje har zuwa mai sauraro, sannan zuwa bangon wuta, kuma ka ƙare da takardun shaidar da suka fi su duka rai. Kashe VM shine mataki na ƙarshe, ba na farko ba. Wannan jagorar tana ɗauka cewa kana da damar console zuwa uwar garke da ikon gyara rikodin abokan ciniki da DNS.

Fara bin jerin abokan ciniki

Buɗe duk abin da ke rarraba bayanan martabarka kuma karanta jerin kafin ka taɓa uwar garke. Kowane shigarwa na'ura ce da ta gaskata tana da shiga: wayoyi, kwamfutocin tafi-da-gidanka, na'urar router ta reshe, kwantena da ke daidaitawa kowace dare. Fitar da wannan jerin cikin tikitin, domin da zarar uwar garken ya tafi babu wg show da zai gaya maka wanene ke haɗe.

Rarraba kowace na'ura zuwa wurin ƙarshe na maye gurbin, ba a buƙata kuma, ko ba a sani ba. Kwandon da ba a sani ba shine wanda ke da mahimmanci, domin su ne bayanan martabar da wani zai samu a cikin aljihu bayan watanni kuma ya gwada. Aika sanarwar a tashar da kake amfani da ita don buƙatun shiga, kuma saka kwanan wata a ciki don lokacin da tsohon wurin ƙarshe zai daina amsawa.

Soke ainihi, ba fayil ɗin kaɗai ba

Ayyuka biyu daban-daban duka ana kiransu sokewa. A WireGuard, ana ba da izinin takwaransa ne kawai ta hanyar maɓallinsa na jama'a da ke bayyana a sashin takwarorinsa tare da shigarwar AllowedIPs, don haka share fayil ɗin saitin daga kwamfutar tafi-da-gidanka ba ya canza komai a uwar garke. Cire rukunin takwarorinsa kuma sake amfani da fayil ɗin ba tare da jefa takwarorinsa da kake riƙe ba, kamar yadda wg(8) ke bayyanawa:

wg show
wg set wg0 peer <CLIENT_PUBLIC_KEY> remove
wg syncconf wg0 <(wg-quick strip wg0)

wg syncconf shine ɓangaren da ke ceton maka taga kulawa. Yana sake gina ma'aunin daga fayil ɗin a wurin, don haka cire takwaransa ɗaya ba ya rushe ramin da kowa ke amfani da shi. Idan kana janye dukan uwar garke maimakon takwaransa ɗaya, tsari har yanzu yana da mahimmanci, domin ana iya amincewa da waɗannan maɓallan a wani wuri.

Da saitin X.509 matakin sokewa shine takardar shaida, ba fayil ɗin ba: openssl ca -revoke client.crt sannan openssl ca -gencrl -out crl.pem. Wannan yana da tasiri ne kawai inda mai tabbatarwa yake karanta shi, wanda ke nufin OpenVPN uwar garke da aka saita crl-verify kuma aka sake loda shi bayan haka. Idan wannan ƙofa ita ce kaɗai mai amfani da wannan CA, CRL zai daina da mahimmanci ranar da ya mutu; idan wannan CA ɗin yana sa hannu don ƙofa ta biyu, takardar shaidar da ba ka taɓa sokewa ba tana ci gaba da aiki a can.

Asusu sune hali na uku kuma wanda aka fi tsallakewa. Lokacin da ƙofar ta tabbatar da kanta a kan RADIUS, LDAP ko mai samar da ainihi da aka shirya, asusun yana rayuwa a wajen VPN. Kashe shi a cikin jagorar. Share stanza na mai amfani a uwar garke yana barin ingantaccen takardar shaida wanda wurin ƙarshe na maye gurbin zai karɓa a lokacin da ya nuna ga wannan jagorar.

Rufe masu sauraro da hanyoyin zuwa gare su

Dakatar da sabis ɗin ta hanyar da za ta tsira daga sake kunnawa, sannan tabbatar da lissafin soket maimakon yanayin rukunin. systemctl disable --now wg-quick@wg0 yana dakatar da ma'aunin kuma yana cire hanyoyin da dokokin da wg-quick ya ƙara; systemctl disable --now openvpn-server@server yana yin haka don misalin OpenVPN na samfuri. Bi ko wanne daga cikinsu da ss -lunp da ss -ltnp. Sakamako mara komai ga tsohuwar tashar ita ce kawai hujja da ake ƙirgawa.

Abin da wg-quick ya ƙara, wg-quick yana cirewa. Abin da ka ƙara da hannu yana wanzuwa: dokar NAT mai dorewa, izinin bangon wuta, tura tashar router, dokar shiga ta ƙungiyar tsaro ta girgije, mai sauraron ma'aunin nauyi. Waɗannan suna buƙatar cirewa a fili, haka ma rikodin DNS, wato A, AAAA da duk wani CNAME da ke nuni ga sunan. Sunan da ke warwarewa zuwa mataccen uwar garke yana kasawa daban da sunan da ba ya warwarewa, kuma wannan bambanci zai ci wani yini.

Kwafin da ka manta shine clone. Hoton ajiya ko VM da aka mayar daga ajiya har yanzu yana riƙe da maɓallan uwar garke da tsohon jerin takwarorinsa, kuma idan wani abu ya dawo da shi a wannan adireshin, abokan ciniki suna sake haɗawa da sabis ɗin da kake tsammanin an janye. Yi wa rukunin ajiyar alama a matsayin na sabis ɗin da aka soke kuma ka kiyaye shi daga hanyoyin mayarwa ta atomatik.

Bi abin da har yanzu ke nuni ga tsohon wurin ƙarshe

Bayanan martaba da aka adana sun fi DNS rai. Saitin da aka ajiye da adireshin lamba yana ci gaba da bugawa bayan rikodin ya tafi, kuma abokin ciniki na koyaushe yana sake gwadawa a kowace canjin cibiyar sadarwa. Wannan hayaniya ce ba shiga ba, domin mai sauraro a rufe yake, amma sanin wanne daga cikin biyun kake kallo yana yanke shawarar yadda za ka amsa tikitin.

Sannan share abubuwan dogaro da babu wanda ke adanawa a ƙarƙashin VPN: binciken lokacin aiki da ke taɓa tashar, ayyukan ajiya da suka ja saituna daga uwar garke, takardun shaidar atomatik da aka yi amfani da su wajen tura shigarwar takwarorinsa, asusun dawo da aka ƙirƙira don wannan wurin ƙarshe kaɗai. Kowanne hanya ce ta shiga da nasa rayuwa da nasa mai shi, don haka kowanne yana samun shawara maimakon sharewa cikin shiru.

Tabbatar, sannan rubuta shi

Janyewa tana ƙarewa lokacin da gwaji daga waje ya kasa yadda kake tsammani. Daga cibiyar sadarwar da ba ka sarrafa, haɗa zuwa tsohon adireshi da tashar. Sakamakon da aka tace ko aka ƙi shine yanayin nasara. A cikin manhajar abokin ciniki, tabbatar an cire bayanin martabar ba a kashe shi kawai ba, kuma babu bayanin martabar gudanarwa da ke sake ƙara shi cikin shiru.

Sannan rubuta abin da ka yi: wurin ƙarshe, kwanan wata, maɓallan da takardun shaidar da aka soke, asusun da aka kashe, inda ajiyar take. Duk wanda ya sami tsohon saiti na gaba yana buƙatar amsa ko an soke shi ko an share shi kawai, ba tare da hasashe ba, kuma ɗan teburi a cikin tikitin yana yin haka.

Kafin rufe tikitin:

• an cire ko an maye gurbin bayanan martabar abokan ciniki, an warware na'urorin da ba a sani ba
• an cire takwarorinsa kuma an sake amfani da saitin, ko an soke takardun shaida kuma an buga CRL
• an kashe asusun jagora, ba a share fayilolin gida kawai ba
• an kashe sabis ɗin, babu mai sauraro da ya rage a tsohuwar tashar
• an cire bangon wuta, tura tashar, ƙungiyar tsaro da rikodin DNS
• an yi wa ajiyar alama, an cire hoton ajiya daga hanyoyin mayarwa
• an janye takardun shaidar sa ido da atomatik

Tabbatar da maye gurbin daban, daga abokin ciniki da bai taɓa riƙe tsohon bayanin martaba ba. Wannan gwajin ɗaya yana gaya maka ko ka janye sabis ko ka sake sunan matsalar kawai.