Matakan script-security na OpenVPN daga 0 zuwa 3, da abin da kowanne yake buɗewa
Kowane matakin script-security yana faɗaɗa abin da bayanin martaba zai iya aiwatarwa: da farko mataimakan gudanarwa, sannan rubutun mai amfani, sannan kalmomin sirri a cikin muhalli. Karanta umarnin.
Shigo da bayanin martaba a cikin abokin ciniki na tebur kuma gazawar farko sau da yawa layi ne da abokin ciniki ya ki girmama: ƙugiyar rubutu da ba zai gudanar ba, ko ƙimar script-security da yake ganin ta fi izini. Ɗaga lambar yana sa tattaunawar ta ɓace. Hakanan yana faɗaɗa abin da wannan bayanin martaba ke da izinin aiwatarwa a na'urarka, wanda abu ne mai ban mamaki a bayar kawai don rufe gargaɗi. Bi shigarwar har zuwa umarnin kuma shawarar ta zama tabbatacce.
Daga tattaunawar shigarwa zuwa umarni
Bayanin martaba fayil ne na rubutu mai ɗauke da umarni, kuma abokin ciniki yana karanta su kafin a sami kowane rami. Umarni kamar up, down ko tls-verify yana ambaton shirin waje wanda OpenVPN ya kamata ya gudanar a wani lokaci da aka ƙayyade. Ko OpenVPN a shirye yake ya gudanar da shi saitin daban ne da ake kira script-security, kuma bayanin martaba yawanci yana saita shi ma.
Don haka gargaɗin ba ya magana kan ɓoyewa ko takaddun shaida. Yana magana kan fayil ɗin tsari da ke neman abokin ciniki ya aiwatar da wani abu a kan mai masauki, da kuma abokin ciniki yana duba ko matakin izininsa na yanzu ya yarda da wannan buƙatar.
A wannan mataki gazawa biyu daban-daban suna kama da juna. Bayanin martaba da ke neman matakin da abokin ciniki ba zai bayar yana haifar da ƙi. Bayanin martaba da ke neman matakin da abokin ciniki ya bayar amma rubutun ba ya nan yana haifar da gazawa a lokacin gudanarwa maimakon haka, kuma ana rikita su biyu a cikin zaren tallafi. Ɗaya tambaya ce ta izini ɗayan kuma tambaya ce ta fakiti.
Abin da kowane mataki yake buɗewa da gaske
Mataki 0 yana haramta kiran shirye-shiryen waje gaba ɗaya, wanda ya dace da abokin ciniki da ke tsara nasa fuskar da kansa ba tare da taimako ba kuma bai dace da wanda ke kiran tsarin aiki ba. Mataki 1, na asali, yana ba da izinin fayilolin aiwatarwa na ciki da tsarin fuska da hanya ke buƙata. Babu ɗayan matakan da ke gudanar da wani abu da mai amfani ya bayar.
| Level | What OpenVPN may execute | What it exposes |
|---|---|---|
| 0 | No external programs at all | Interface and route setup must not depend on helpers |
| 1 (default) | Built-in helpers such as ip, ifconfig, route or netsh | Privileged commands the platform already ships |
| 2 | Built-in helpers plus user-defined scripts | Whatever the named script does with the client's privileges |
| 3 | Everything above, plus passwords in environment variables | Credentials visible to child processes and their logs |
Mataki 2 shine iyakar mai ban sha'awa, domin yana yarda da rubutun da mai amfani ya ayyana. Daga wannan lokacin gatan abokin ciniki suna aiki akan lambar da wataƙila ba ka taɓa karantawa ba, ana kiranta a lokutan da ba ka zaɓa ba, tare da muhalli da ya ƙunshi bayanan haɗi. Mataki 3 ya wuce gaba kuma yana ba da izinin wuce kalmomin sirri ta hanyar masu canjin muhalli, shi ya sa littafin jagora ya kwatanta shi a matsayin mai yiwuwa mara lafiya.
Babu ɗaya daga cikin waɗannan lambobin da ya zama saitin ƙarfi. Bayanin martaba a mataki 3 ba shi da ingantaccen ɓoye fiye da wanda ke mataki 1; kawai yana da faffadan aiwatarwa, kuma ramin daidai yake.
Yanke shawara abin da bayanin martaba ya cancanta
Tambayi abin da rubutun yake don yi kafin ka tambayi wane mataki yake buƙata. Ƙugiya da ke tura saitunan DNS ko gyara hanya bayan haɗi dalili ne mai inganci na gudanar da wani abu. Ƙugiya da ke kiran binary da ba a sani ba a cikin babban fayil na wucin gadi dalili ne na tsayawa.
Hanyar rubutun tana da muhimmanci kamar rubutun. Ana warware hanyar dangi bisa ga kowane babban fayil da abokin ciniki ke amfani da shi, kuma babban fayil da za a iya rubutu a ciki yana mai da shigarwar lokaci ɗaya wurin aiwatarwa na dindindin. Hanyoyi cikakke a cikin babban fayil da mai amfani ba zai iya canzawa sune siffar da ya kamata a fifita.
Rubutun kuma suna gado muhallin abokin ciniki, inda takardun shaidar shiga da bayanan haɗi suke. Wannan gadon shine ainihin abin da ke sa mataki 3 ya zama mai haɗari tare da rubutun da ke yin rikodin muhallinsa, kuma shine dalilin da ya sa zubar bincike daga abokin ciniki mai kunna rubutu ya cancanci dubawa na biyu kafin a liƙa shi a tikiti. Cire muhallin kafin raba shi.
grep -nE 'script-security|^up |^down |tls-verify' client.ovpnCanza abu ɗaya, sannan ka lura da rushewa kuma
Idan bayanin martaba yana buƙatar rubutu da gaske, canza matakin kawai kuma kawai don wannan bayanin martaba. Gudanar da abokin ciniki a gaba tare da cikakken bayani domin kurakuran rubutun su kasance a bayyane maimakon mai kula da sabis ya haɗiye su.
openvpn --config client.ovpn --script-security 2 --verb 3
ip route show defaultGwada dukan zagayowar rayuwa, ba kawai haɗi ba. Ƙugiyar kashewa da ta gaza tana barin hanyoyi suna nuni ga mataccen rami, wanda ke haifar da na'ura da ta yi kama da an haɗa amma ba ta isa ko'ina. Sake haɗi sau ɗaya kuma ka cire haɗi sau ɗaya kafin ka ce canjin ya ƙare, kuma duba teburin turawa bayan kowane.
Ajiye kwafin ainihin bayanin martaba. Idan abokin ciniki na dandamali bai aiwatar da tsarin rubutu ɗaya ba, share umarnin har shigarwar ta yi nasara na iya cire haɗin DNS ko hanya da ramin yake buƙata, kuma haɗin da ya haifar zai tabbatar da inganci sosai yayin da ba ya warware komai.
Shawarar da za a rubuta ƙunci ce: wane rubutu, a wace hanya, an bayar a wane mataki, don wane bayanin martaba. Duk sauran abubuwa a cikin bayanin martaba ba su canzawa, kuma wannan jumla ce da mai bita zai iya tantancewa.