Fitar da abokin ciniki ɗaya na OpenVPN: kashe, hana ko soke takardar shaida?

Kana da common name da adireshi a cikin bayananka, da umarni uku waɗanda duk suna kama da suna cire abokin ciniki. Ɗaya ne kawai yake yin abin da kake so, kuma zaɓin ya dogara da ko kana buƙatar ka ƙare zaman da ke gudana yanzu, ka ƙi amincewa da shiga na gaba, ko ka cire 'yancin haɗawa gaba ɗaya. Karanta asalin da kake da shi a zahiri kafin ka taɓa wani abu, domin tafkin OpenVPN yana ba da adireshin tunnel ɗaya ga wani zama daga baya.

Wace asali kake da ita a zahiri

Fayil ɗin matsayi na siga 3 shine farkon da aka saba. Sashen CLIENT_LIST yana ɗauke da common name, adireshin gaske, ƙididdigar byte da lokacin haɗawa; sashen ROUTING TABLE yana danganta adireshin kama-da-wane da common name tare da tambarin lokacin ambato na ƙarshe. Common name shine asalin da ba ya canzawa. Adireshin kama-da-wane rabo ne, kuma adireshin gaske a bayan NAT na iya canzawa tsakanin zama ba tare da wani abu a uwar garken ya canza ba.

Ƙofar gudanarwa tana nuna irin wannan ra'ayi ta hanyar umarninta na status kuma tana ƙara ID na abokin ciniki ga kowane zama. Wannan ID ne client-kill yake tsammani, kuma ba adireshin tunnel ba ne. Idan kana buƙatar sanin wane common name ya karɓi wane adireshi a lokacin haɗawa, mahallin rubutun client-connect yana da duka biyu, tare da amintaccen adireshin waje, amma wannan rubutun yana gudana a matsayin mai amfani da OpenVPN kuma yana buƙatar hanyar log ɗin da za a iya rubutu.

Kashe yanzu, hana lokacin shiga, soke har abada

Dukkan umarnin cirewa biyu a cikin ƙofar gudanarwa ayyukan zama ne. kill yana ɗaukar common name ko adireshin gaske da tashar jiragen ruwa; client-kill yana ɗaukar ID ɗin abokin ciniki kuma yana ƙare wannan misali nan take. Babu ɗayansu toshe: abokin ciniki da aka kora mai ingantaccen takardar shaida da kalmar sirri yana sake haɗawa cikin daƙiƙa, wanda yake da kyau lokacin da kake sake amfani da peer na gwaji kuma ba shi da amfani lokacin da aka sace kwamfutar tafi-da-gidanka.

client-deny wani nau'in shawara ne daban. Yawancin lokaci ana bayar da shi daga ƙugiya ta tabbatarwa ko client-connect kuma yana ƙin zama da dalili, don haka ya dace da manufar da ke ƙin shiga maimakon wadda ke katse haɗi. Takardun kuma suna gargadin cewa ƙin da aka bayar yayin sake tattaunawar TLS yana lalata maɓallin da aka sake tattauna yayin da zaman da ke akwai zai iya gudana har sai taga canjin ya rufe. Idan abin da ake buƙata shi ne abokin ciniki ya tafi yanzu, amsar da aka rubuta ita ce client-kill.

Cirewa mai dorewa yana ƙarƙashin duk wannan. Soke takardar shaidar kuma tabbatar crl-verify yana nufin jerin da uwar garken yake sake lodawa a zahiri, kashe fayil ɗin daidaitawa na musamman na abokin ciniki a cikin babban fayil ɗin ccd, ko kashe asusun a kowace cibiyar da ƙugiyar tabbatarwa ke tambaya. Sokewa ma ba nan take ba ce: da tsoffin saitunan reneg-sec zama da aka kafa zai iya ci gaba har sai ya sake tattaunawa, don haka aikin zama da aikin takardar shaidar suna cika juna, ba madadi ba.

Shin socket ɗin gudanarwa yana da kyauta?

Ƙofar gudanarwa tana hidimar abokin ciniki ɗaya a lokaci ɗaya. Idan GUI ko daemon na sa ido suna riƙe da haɗin, rubutunka ba zai iya haɗawa kusa da shi ba, kuma dangane da abokin ciniki za ka iya fitar da wanda ke akwai maimakon gazawa a tsaftace. Kalmar sirrinsa tana tafiya a bayyane a kan wannan socket, don haka ya dace da adireshin gida ko socket ɗin unix, ba a kan ƙofar jama'a ba.

Lokacin da ba za ka iya ɗaukar socket ɗin ba, har yanzu kana da zaɓuɓɓuka, kuma duk sun fi jinkiri. Fara sakin zaman GUI idan kana da iko da shi, ko ka amince da hanyar takardar shaida kuma ka jira sake tattaunawa na gaba. Abin da bai kamata ka yi ba shi ne sake kunna sabis ɗin don kawar da abokin ciniki ɗaya, domin hakan yana ƙare duk sauran zama kuma yana lalata shaidar fayil ɗin matsayi na wannan.

Tsarin da nake gudanarwa a kan uwar garke mai rai

Haɗa, karanta matsayin yanzu, yi aiki da ID ɗin da ka karanta yanzu, sannan sake karanta shi. Ƙididdiga da aka kwafa daga takarda ita ce hanya mafi yawa ta kashe mutumin da bai dace ba.

status                     # note the client ID and common name
client-kill 3              # end that session now
kill Test-Client           # alternative: by common name
status                     # confirm the session is gone

Sunan da lambar da ke sama mazauni ne, kuma ana sake amfani da ID bayan sauran abokan ciniki sun cire haɗi. Tabbatar layin ba ya nan kafin ka rubuta wani abu a matsayin an gama, kuma duba cewa adadin abokan ciniki da ke haɗe ya motsa da ɗaya maimakon da yawa.

Tabbatar ya kasance a waje

Rubuta common name, adireshin tunnel, adireshin waje da minti na cirewa. Idan wannan common name ya sake bayyana bayan minti ɗaya, aikin zama ya yi aiki kuma rukunin takardar shaida bai yi ba, wanda shine gyara daban da na umarnin da bai taɓa yin tasiri ba.

Sannan gwada daga bangaren abokin ciniki. Takardar shaidar da aka soke yakamata ta kasa handshake na gaba; idan har yanzu tana haɗawa, ba a karanta CRL kwata-kwata, kuma wannan shine binciken da ya cancanci rahoto. Zaɓi aikin bisa ga abin da kake buƙatar ƙarewa, tabbatar da status na biyu, kuma gyara rukunin takardar shaida lokacin da amsar za ta daɗe fiye da zaman.