OpenVPN ba ya samun ca.crt duk da cewa bayanin yana lodawa

Sabis ɗin yana farawa, yana karanta bayanin ba tare da wata korafi ba, sannan ya mutu a kan layin da ba ya da alaƙa: ba zai iya buɗe ca.crt ba. Babu abin da ya canza a cikin takardar shaidar, kuma hanyar bayanin a cikin fayil ɗin unit cikakkiya ce. Wannan haɗin shi ne alamar. Hanyar da ka bayar tana gano fayil ɗaya, kuma sunayen da ke cikin wannan fayil ana warware su a wani wuri daban gaba ɗaya, don haka ƙaddamarwar da ta yi kama da cikakkiyar cancanta tana iya karanta maɓallanta daga wata babbar fayil da babu wanda ya yi nufi.

Kasawar tana da ƴan dalilai, kuma ya dace a raba su bisa tsari: babbar fayil ɗin da tsarin ke da shi a zahiri, yanayin ƙaddamar da sabis ɗin, da izini ko sandbox da ke kewaye da fayil ɗin da zarar hanyar ta yi daidai. Kowanne yana barin wata alama daban — a cikin unit, a cikin tsari da kuma a kan tsarin fayil.

Hanyar bayanin ba babbar fayil ba ce

Ka yi tunanin wani tsari da ke farawa a /tmp kuma aka ba shi /etc/vpn/prod/tenant-a.ovpn. A cikin wannan bayanin, layin ca ca.crt yana ambaton hanya mai alaƙa. Babu abin da ke cikin hujjar da ta gano bayanin da ke sake rubuta wannan sunan, don haka tsarin yana neman /tmp/ca.crt kuma yana ba da rahoton fayil da ya ɓace.

Abin da ke damun kai shi ne tsarin kurakurai. OpenVPN yana fara nazarin tsarin daidaitawa kuma yana buɗe fayilolin da aka ambata yayin da ya isa gare su, don haka kuskuren rubutu a cikin bayanin ana ba da rahoto kafin a taɓa kowane maɓalli, yayin da takardar shaidar da ta ɓace tana bayyana ne kawai lokacin da nazarin ya kai haka. Don haka bayanin da ke lodawa hujja ce cewa tsarin rubutu yana da kyau, ba cewa an sami fayilolin da yake ambata ba.

Abin da littafin jagora ya raba: --config da --cd

Littafin jagorar OpenVPN 2.6 yana bayanin zaɓuɓɓuka biyu daban. Ɗaya yana loda fayil ɗin daidaitawa. Ɗayan yana canza babbar fayil ɗin tsari kafin a karanta tsarin daidaitawa, maɓalli, script da sauran fayiloli, kuma yana buƙatar babbar fayil cikakkiya ba tare da wata magana kan ta yanzu ba.

openvpn --cd /etc/vpn/prod --config tenant-a.ovpn

Wannan kira siffa ce, ba umarni ba ne don ƙaddamar da bayanin wani. Abin da yake ba ka shi ne tabbaci: tushen kowace suna mai alaƙa a cikin sarkar an faɗe ta a cikin umarnin maimakon a gado daga kowace harsashi ko manaja da ya fara tsarin. Madadin ɗin daidai yake da inganci kuma sau da yawa ya fi kyau ga sabis: bar babbar fayil ɗin aiki a yadda yake kuma ka mai da kowane fayil da aka ambata cikakke a cikin bayanin.

Ko me ka zaɓa, duba dukan sarkar maimakon kasawa ta farko. Bayani na iya jawo wani fayil ɗin daidaitawa, kuma ana warware sunayen mai alaƙa na fayil ɗin da aka haɗa bisa wannan babbar fayil ɗin tsari, ba bisa babbar fayil ɗin fayil ɗin da ya haɗa su ba. Hanyoyin log, fayilolin tabbatarwa da script ɗin taimako suna bin wannan ka'ida.

Sabis ɗin yana farawa a wani wuri

Harsashin mu'amala a cikin babbar fayil ɗin bayanin ba ya tabbatar da kome game da unit ɗin da aka tattara. Manajoji suna saita nasu babbar fayil ɗin aiki, kuma script ɗin nannade na iya sake canza ta kafin binary ɗin ya gudu. Unit ɗin da ke kasawa shi ne kawai ƙaddamarwar da ta dace a yi tunani a kanta.

systemctl show -p WorkingDirectory -p ExecStart --value openvpn@tenant-a
ls -l /proc/$(pgrep -n openvpn)/cwd

Umarni na biyu yana nuna babbar fayil ɗin da tsarin rai ke riƙe da shi a zahiri, kuma wannan ya fi fayil ɗin unit aminci idan an haɗa nannade. Idan biyun ba su daidaita, nannade shi ne amsarka kuma unit ɗin alama ce mai ɓata.

Bayan bincike: izini, chroot da sandbox

Daidaitaccen babbar fayil na iya ba da wannan saƙon, domin warwarewa da shiga matakai ne daban. Tsarin yana buƙatar izinin aiwatarwa a kowace babbar fayil ta iyaye da izinin karantawa a fayil ɗin, kuma unit ɗin sabis da ke ɓoye wani ɓangare na tsarin fayil yana canza abin da tsarin zai iya gani kwata-kwata.

Bambance-bambance uku na yau da kullum suna haifar da kuskure ɗaya. Fayil ɗin root ne kaɗai zai iya karantawa yayin da sabis ɗin ke barin gata kafin ya buɗe shi. Unit ɗin yana saita wata kariyar kallon tsarin fayil wadda ba ta haɗa da babbar fayil ɗin bayanin ba. Daemon ɗin yana gudana da chroot, don haka hanyar da ke akwai a kan mai masauki babu ita a cikin wannan kallon.

Yi bincike da mallakar fayil ɗin da asalin tsarin, ba ta sassauta izini ba. Mai da maɓalli mai sirri abin karantawa ga kowa don shiru wannan kuskure yana musanya kasawa mai ƙarfi da wata marar ƙarfi, kuma maɓallin shi ne ɓangaren babbar fayil ɗin da ka fi ƙin fallasa.

Tabbatar da gyaran da ƙaddamarwar ku

Sake farawa da ainihin unit daga wata babbar fayil da ba ta da alaƙa da bayanin kuma ka lura da layin farawa ɗaya. Sannan ka tabbatar tsarin yana riƙe da babbar fayil ɗin da aka yi niyya yayin da yake gudana, kuma takardar shaidar da ya loda ita ce da kake tsammani.

systemctl restart openvpn@tenant-a
systemctl status openvpn@tenant-a --no-pager
journalctl -u openvpn@tenant-a -n 20 --no-pager

Lokacin da lodin hanyoyi ya yi nasara, tabbatarwa da tafarkin kai matakai ne daban da nasu kasawa, kuma haɗin da ya tashi amma ba ya wuce wani zirga-zirga wani bincike ne daban. Gyaran a nan ya shafi daga wace babbar fayil ɗin fayilolin suka zo ne kawai, kuma ya kamata ya kasance a bayyane a cikin kiran maimakon wanda ya gudanar da shi da hannu a ƙarshe ya tuna da shi.

Idan ana tura bayanin ta hanyar manajan daidaitawa, saka babbar fayil ɗin ko cikakkun sunayen fayiloli a can ma. Gyaran hannu a kan mai masauki ɗaya shi ne sigar wannan matsalar da ke dawowa bayan sake ginawa na gaba.