Sabis ɗin OpenVPN yana tsayawa a lokacin neman kalmar sirri ta maɓallin sirri: yadda ake gyara
Sabis ba shi da terminal, don haka maɓalli mai ɓoyewa yana buƙatar askpass da fayil mai iya karantawa. Rarraba kalmar sirri ta maɓallin daga shigar da asusun uwar garke sannan ka duba unit.
OpenVPN yana neman kalmar sirri ta maɓallin sirri a na’urar gida, don haka fayil ɗin shiga mai aiki ba ya amsa ta har abada. A cikin sabis babu terminal da za a rubuta a ciki, kuma farawa ko ya rataya ko ya kasa da wani rubutu a jarida wanda ke ambaton abin da aka shigar maimakon dalilin. Sirri biyu ne a cikin lamarin, kuma kowanne yana buƙatar tushensa mai iya karantawa kafin a sake kunna unit ɗin. Matakan da ke ƙasa sun raba su, sannan sun duba asalin da a zahiri ke buɗe kowane fayil.
Rarraba tambayoyin biyu
Kalmar sirri ta maɓallin tana buɗe maɓallin sirri na gida; bayanan asusun suna tabbatar da zama tare da uwar garke. Suna zuwa daga wurare daban-daban, suna kasawa a lokuta daban-daban kuma suna ba da saƙonni daban-daban. Rikice su yana tura mutane neman sake saita kalmar sirri alhali asusun bai shiga ciki ba kwata-kwata. Karanta rubutun tambayar kafin ka canza kowane zaɓi, domin kalmomin su ne kawai tabbataccen alamar wace sirri ce ta ɓace.
A cikin Community OpenVPN 2.x askpass yana nuna fayil da ke riƙe kalmar sirri ta maɓallin a layinsa na farko, kuma auth-user-pass yana nuna fayil mai sunan mai amfani a layi ɗaya da kalmar sirri a na gaba. Babu ɗaya daga cikin fayilolin da zai iya biyan ɗayan zaɓin. Aikace-aikacen tebur ko bayanin NetworkManager na iya riƙe duka biyu a cikin ajiyarsa ta sirri, wadda abokin ciniki na layin umarni ba ya karantawa har abada, don haka lura wane abokin ciniki kake saita kafin ka rubuta kowace hanya.
Nuna zaɓuɓɓukan biyu ga fayiloli masu iya karantawa
Bayanin da ke buƙatar duka shigarwar biyu yana ƙarewa da nassoshi uku na fayil: maɓallin da aka ɓoye, kalmar sirrin da ke buɗe shi, da ma’auratan shiga. Ƙara su ba tare da taɓa CA ko binciken asali ba, domin waɗannan suna yanke shawarar wanene uwar garke kuma ba sa cikin wannan matsala. Idan turawar ba ta amfani da bayanan asusu kwata-kwata, ƙara auth-user-pass yana ƙirƙirar shigarwar da babu wanda zai iya bayarwa.
key /etc/openvpn/client/office.key
askpass /etc/openvpn/client/office-key.pass
auth-user-pass /etc/openvpn/client/office-login.authZaɓuɓɓuka marasa hujja suna yin daban da zaɓuɓɓuka masu hanya, kuma bambancin yana da muhimmanci a sabis. askpass ba tare da hujja ba har yanzu yana karanta console, kuma fayil ɗin auth-user-pass mai sunan mai amfani kawai har yanzu yana barin tambayar kalmar sirri tana jira. Da zarar abokin ciniki ya zama daemon ba zai iya neman shigarwa daga terminal kwata-kwata ba, don haka sabis ɗin da aka saita haka ba ya tashi.
Hanyoyi cikakku suna kawar da tambayar babban fayil ɗin aiki amma ba sa ba da izini. Mallaka, yanayi da wucewa suna zuwa gaba, kuma duka ukun ana duba su da asusun da tsari ke gudana a ƙarƙashinsa.
Karanta saitin unit ɗin kafin bayanin
Unit ɗin ne, ba fayil ɗin da kake gyara ba, ke yanke shawarar wane saiti misalin zai loda. Karanta layin umarninsa da duk wani drop-in, sannan ka bi babban fayil ɗin aiki zuwa bayanin da a zahiri ake amfani da shi. Nassosin kalmar sirri da aka ƙara a wani fayil ɗin .ovpn ba ya canza komai ga wannan misalin.
Umarni uku na karanta-kawai suna amsa yawancin hakan. Na farko yana buga unit ɗin da duk wani drop-in, na biyu yana buga asalin da saitunan sandbox da ke ɗaure tsarin, na uku kuma yana buga abin da farawar ƙarshe ta yi korafi a kansa. Yi amfani da sunan misalin da ke kan uwar garke:
systemctl cat [email protected]
systemctl show [email protected] -p User -p Group -p WorkingDirectory -p ProtectHome
journalctl -u [email protected] -bKula da ProtectHome da zaɓuɓɓukan bayanin kansa user, group da chroot. Fayil ɗin da ke ƙarƙashin babban fayil ɗin gida na iya zama mai iya karantawa a cikin shell ɗinka kuma ba a ganinsa a cikin sabis ɗin da zarar an ɓoye manyan fayilolin gida. Asusun da systemd ke farawa da shi ba koyaushe ne asusun da a ƙarshe ke buɗe maɓallin ba.
Tabbatar cewa asalin lokacin aiki zai iya buɗe duka fayilolin biyu
Karanta yanayin bai isa ba, domin kowane babban fayil a kan hanya dole ne ya zama mai iya wucewa ta wurin asalin ɗaya. Bi hanyar sashi-sashi, sannan ka gwada buɗewa a matsayin asusun da tsarin ke amfani da shi. Fayil mai yanayi 600 mallakar root yana aiki ne kawai yayin da tsarin ke root har yanzu, wanda ba gaskiya ba ne bayan rage gata da yawancin bayanai ke yi. Umarni biyu sun rufe wucewa da buɗewa:
namei -l /etc/openvpn/client/office-key.pass
sudo -u openvpn test -r /etc/openvpn/client/office-key.pass && echo readableUmarnin farko yana buga yanayin kowane sashi kuma yana kasawa inda asusun ba zai iya wucewa ba; na biyu yana amsa tambaya ɗaya tilo mai muhimmanci, wato ko asalin lokacin aiki zai iya buɗe fayil ɗin don karantawa. Babu ɗaya daga cikinsu da ke buga abin da ke cikin fayil ɗin, kuma wannan shine ainihin abin da ake so idan fayil ɗin yana riƙe da kalmar sirri. Maimaita gwajin ga fayil ɗin shiga, domin sau da yawa ana ajiye su biyu da mallaka daban.
Idan tsarin yana amfani da chroot ko iyakataccen namespace, gudanar da gwajin ɗaya daga cikin wannan hangen nesa, in ba haka ba amsar tana bayyana tsarin fayil ɗin da ba daidai ba. Kalmar sirri da aka ajiye a ƙarƙashin ɓoyayyen babban fayil ɗin gida ita ce misalin da aka saba na gwajin da ke wucewa a wajen unit ɗin kuma ke kasawa a cikinsa.
Duba farawar farko, sannan sake haɗi
Fara misalin sau ɗaya kuma karanta kasawar farko maimakon ta ƙarshe. Rashin fayil ɗin shigarwa, kasawar buɗe maɓalli da AUTH_FAILED daga uwar garke abubuwa uku ne daban-daban da gyare-gyare uku daban-daban. Gyara gargaɗin izini ba ya tabbatar da komai game da ko an buɗe maɓallin.
Layin jarida yana gaya maka wanne daga cikin ukun kake da shi. Gyaran yana biyo daga wace shigarwa ta kasa:
| What the journal shows | Which input failed | Where to look |
|---|---|---|
| A path that cannot be opened | The file the profile names | Askpass or login path, and the unit's working directory |
| A key decryption error | The key passphrase | First line of the askpass file, and read access for the runtime identity |
AUTH_FAILED from the server | The account credentials | Login file contents, and whether the account is still valid |
Sannan ka gwada yanayin rayuwar da kake buƙata a zahiri: farawa a lokacin taya da duk wani sake haɗi da aka tallafa, ba kawai farawa da hannu daga shell ɗinka ba. Tare da auth-nocache ana watsi da shigarwar bayan amfani na farko, don haka sake haɗi na gaba yana buƙatar tushe mai iya karantawa. Maɓallin ajiya da aka buɗe a lokacin shiga tebur ba ya samuwa ga sabis ɗin da ya fara kafin kowa ya shiga, kuma wannan shine dalilin da aka saba da shi na gwajin hannu yana wucewa yayin da sake taya ke kasawa. Idan farawar farko ta yi nasara kuma sake haɗi na gaba ya kasa, karanta jaridar don abin da ya faru na sake haɗin kafin ka sake canza izini.
Ajiye kalmar sirri kusa da maɓallin yana rage abin da ɓoyewa ke ba ka, don haka takaita wannan fayil ɗin da kwafinsa. Dauki cire kalmar sirri ta maɓallin a matsayin shawara ta daban game da bayanan shiga, ba gyaran shigarwar da ta ɓace ba. Turawar da ta dogara da amincewar ɗan adam ko MFA mai mu’amala tana buƙatar wakilinta ko haɗin gudanarwarta da aka tallafa; lambar lokaci ɗaya da aka adana har abada ba ita ce makamancin maye ba.