An ƙi PSK na L2TP/IPsec: bi maganar, sannan fayilolin

Kuna liƙa maɓallin da aka raba tun da farko daga saƙon mai gudanarwa a cikin maganar NetworkManager, ku yi alama a akwatin don nuna shi, kuma ya yi daidai harafi da harafi. Haɗin yana ƙarewa da gazawar tabbatarwa kafin ramin ya tashi. Lokacin da na ga haka a karon farko, na ɗauka maɓallin ba daidai ba ne; ba haka ba ne. Wasu abubuwa biyu ne ke ƙayyade abin da daemon ɗin ke karantawa da gaske: fayil ɗin sirrin da plugin ɗin ke rubutawa don wannan haɗin, da ko ƙimar ta tsallake maganar ba tare da canji ba.

Tafiyar da ke ƙasa tana bin maɓallin daga filin zuwa fayil ɗin, kuma wannan tsari ne ke gaya muku inda ya ɓace. Yi shi a kan injin da ke gazawa, ba a kan wanda ke aiki ba, domin bambancin waɗannan injuna biyu yawanci tsarin fayiloli ne ba maɓallin ba.

Fara daga maganar, amma kada ku amince da filin

Buɗe shafin IPsec na haɗin kuma sake rubuta maɓallin maimakon liƙa shi. Maɓallin da aka kwafa daga saƙon hira, PDF ko mai sarrafa kalmar sirri na iya zuwa da tsagawar layi a ƙarshe wadda filin ba ya nunawa, kuma haruffan da ake gani suna kama da daidai.

Danna maɓallin nuna kalmar sirri ka dubi ƙarshen zaren, ba tsakiyarsa ba. Idan mai nuni ya bar layi mara komai a ƙasan rubutun, share shi ka sake rubuta harafin ƙarshe. Wannan gyara ɗaya yana warware kaso mai ban mamaki na waɗannan rahotanni, kuma ya fi arha fiye da karanta kowane log.

Idan maɓallin ya fito daga tsarin tikiti da ke naɗe dogayen layuka, nemi shi ta hanyar da ba ta naɗewa. Kwatanta tsawon da mai gudanarwa maimakon kallon zaren biyu gefe da gefe; harafin da ya ɓace a wurin naɗewa ba a ganinsa a cikin rubutun daidaitacce.

Bi maɓallin cikin /etc/ipsec.d

Plugin ɗin ba ya taɓa ba da PSK ga daemon ɗin IPsec a matsayin hujja a kan layin umarni. A maimakon haka yana ajiye ƙimar a cikin fayil ɗin sirri kuma yana shirya daemon ɗin ya ɗauki wannan fayil, ta hanyar ƙara layin include a /etc/ipsec.secrets idan babu ɗaya. Abin da maganar ke riƙe shi ne shigarwa ga wannan fayil ɗin da aka ƙirƙira, ba ƙimar da ake amfani da ita ba.

Jera abin da ke akwai kafin ka canza wani abu:

ipsec --version
sudo ls -l /etc/ipsec.d/*.secrets /etc/ipsec.d/ipsec.nm-l2tp.secrets 2>/dev/null
sudo grep -n "include" /etc/ipsec.secrets

Tsofaffin fitattun plugin ɗin suna rubuta fayil ɗaya ga kowane haɗi, mai suna bayan UUID na haɗin, misali /etc/ipsec.d/nm-l2tp-ipsec-<uuid>.secrets. Share bayanin martaba a cikin applet ba ya share wannan fayil ɗin amintacce. Idan tsohon fayil daga sabar da ta gabata yana nan a faifai kuma har yanzu ana haɗa shi, daemon ɗin na iya zaɓar sirrin da ya shafi bayanin martabar da ba ku ƙara amfani da shi, kuma haɗin ya gaza alhali filin da ake gani daidai ne.

Fahimci abin da canjin 1.2.12 ya yi ga ɗaukaka

Sigar plugin 1.2.12 ta maye gurbin fayilolin sirri na kowane haɗi da fayil ɗaya da aka raba, /etc/ipsec.d/ipsec.nm-l2tp.secrets. Ɗaukaka ba ta tsaftace tsofaffin fayilolin bisa UUID ba, kuma layin include /etc/ipsec.d/*.secrets da ke akwai har yanzu yana ɗaukar su. Sigar 1.2.16 ta canza yadda ake sarrafa shawarwarin tsoho, ba tsarin sirrin ba.

Wannan tarihin yana bayyana dalilin da ya sa injuna biyu masu kama da bayanin martaba ɗaya suke ɗaukar hali daban. Maɓallin ɗaya ne; tarin fayilolin da daemon ɗin ke ɗauka ba ɗaya ba ne. Lokacin da kuke cire fayil maraya, matsar da shi gefe maimakon share shi, tabbatar da haɗin, sannan share shi bayan an rubuta yanayin aiki. Sake suna yana kiyaye tsohuwar ƙimar da za a iya dawo da ita idan gazawar ta kasance a wani wuri.

Raba haruffan da tsarin adana ba zai iya riƙe su ba

Takardun strongSwan game da zaren sirrin da aka raba sun bayyana cewa ƙimar ba za ta iya ƙunsar sabon layi ko harafin zance biyu ba. Maɓallin da aka liƙa daga takarda na iya ɗaukar ɗaya daga cikinsu ba tare da wani bambancin gani a cikin magana ta yau da kullum ba.

Tun daga 1.2.12 ƙimar da aka adana ba rubutu kawai ba ce. Plugin ɗin yana lissafta PSK da base64 kafin ya isa fayil ɗin, kuma bayanan fitarwa suna gabatar da wannan lissafin a matsayin dalilin da ya sa zance biyu ya zama abin karɓa a cikin maɓalli yanzu. Don haka zancen da aka rubuta a filin ana iya wakilta shi; haka ba gaskiya ba ne ga kowane harafin sarrafawa.

Tsawon wata ƙuntata ce daban. Babu wani ƙaramin ma'auni na duniya a cikin software na L2TP/IPsec: wasu abokan ciniki suna karɓar maɓallai gajarta fiye da haruffa ashirin wasu kuma ƙofofin suna tilasta ƙaramin ma'auni. Idan an ƙi ɗan gajeren maɓalli, ƙa'idar ta kasance ta manufar sabar ko tabbatarwar wancan abokin ciniki, kuma ɗaga wani abu a gida ba zai canza shi ba.

Karanta wane matakin tabbatarwa ya gaza

Fara da ipsec --version, domin strongSwan da Libreswan suna amfani da sunayen fayiloli da tsari daban, kuma shawara ga ɗaya na iya cutar da ɗayan. Sannan karanta matakin gazawar daga saƙon abokin ciniki ko log ɗin daemon: korafi game da maɓallin da aka raba tun da farko wata al'amari ce daban da ƙin sunan mai amfani da kalmar sirri.

PSK yana tabbatar da ƙarshen ramin. Sunan mai amfani da kalmar sirri suna tabbatar da mutumin da ke cikin L2TP, kuma PPP yana kula da su bayan haɗin IPsec ya tashi. Daidaitaccen PSK tare da asusu mara kyau har yanzu yana gaza, kuma canza asusu ba zai gyara maɓallin da daemon bai taɓa karanta daidai ba.

Lokacin da kuke rufe tikitin, rubuta duka huɗun: sigar plugin, fayil ɗin sirrin da ake amfani da shi, ko an sake rubuta maɓallin ko an liƙa shi, da matakin da aka ambata cikin kuskure. Sannan duk wanda ya sake wannan tafiya daga baya zai iya tsalle kai tsaye zuwa bambancin da ke tsakanin injin da ke aiki da wanda ke gazawa.