openvpn3 session-start yana watsi da fayil ɗin shaidun shigarka

Haɗa da abokin ciniki na 2.x kuma bayanin ya yi aiki; ba da wannan fayil ɗin ga abokin ciniki na 3.x kuma yana tsayawa a tambayar kalmar sirri. Ba da --auth-user-pass creds.txt ga openvpn3 session-start kuma sakamakon ɗaya ne, domin sabon abokin ciniki ba shi da matakin da zai karanta fayil ɗin. Ƙin ɗin da gangan ne: shaidun shiga na wani zama ne, kuma sabis ne ke ƙirƙirar zama, ba tsarin da ke cikin tasharka ba. Zaɓi tsakanin tambayar mu'amala da mataimakin lodawa ta atomatik, kuma ka san abin da kowannensu ke ajiyewa.

Me ya sa fayil ɗin da aka ajiye ba shi da inda zai je

A sabon ƙira, sarrafa saitin da sarrafa zama ayyuka ne daban waɗanda suke magana ta bas ɗin tsarin. Wannan rabewar ce ke ba da damar talakawan mai amfani ya fara zama ba tare da wani daemon mai gata ya karanta masa fayil ɗin kalmar sirri mai kariya ba. Shaidun da suka dogara da fayil ba su da wuri a wannan tsari, domin babu wata farawa a gefen daemon da za ta karanta su. Ƙin ɗin sakamakon gine-gine ne, ba wata siffa da ta ɓace ba.

Ya dace a ambaci tsohon salon domin sauƙin mantawa da shi: bayani yana nuni ga fayil ɗin shaidu, kuma daemon yana karanta shi lokacin da ramin ya fara. A sabon tsari, shaidun na wani zama ne kuma ana bayar da su lokacin da wannan zama ya fara. openvpn3 session-start --config work.ovpn yana tambayar su, kuma ana ƙin --auth-user-pass creds.txt domin babu abin da zai buɗe fayil ɗin a wannan hanya. Kowace girke-girken 2.x da ka samu yana ɗaukan matakin da ba ya wanzu kuma.

Saitin da saitunan gida na rukunin yanar gizo ma a raba suke, wanda ke bayanin mamaki na biyu. Bayani na iya kamar cikakke yayin da haɗin da yake samarwa ba shi da saitin hanya da mai warwarewa. Ana amfani da waɗannan sassan a matsayin saitunan gida, dabam da fayil ɗin da aka shigo da shi.

Hanyar tambaya da zaman da take barin baya

Bayar da kalmar sirri lokacin da zama ya fara ita ce hanyar aiki da aka nufa. Abokin ciniki yana tambaya sau ɗaya, yana ba da shaidun ga bayan fage na zama, sannan ya ci gaba:

openvpn3 session-start --config work.ovpn
openvpn3 sessions-list

Ta wannan hanyar ba a rubuta komai a faifai. Zaman yana ci gaba da aiki bayan an rufe tashar, wanda ke ba wa waɗanda suke tsammanin tsarin zai mutu tare da harsashinsu mamaki. Wannan shi ne ainihin dalilin mayar da sarrafa zama zuwa sabis. Zaman yana rayuwa fiye da tashar da ta nemi shi, kuma dole ne a dakatar da shi a fili.

Ga tashar aiki da mutum a gabanta, wannan ita ce zaɓi mafi aminci kuma, domin babu wani sirri da aka ajiye da za a kare ko a manta. Ba ta dace ba kawai inda babu wanda zai buga.

Aiwatarwa ba tare da mutum a kan madannai ba

Inda inji dole ya haɗa ba tare da mutum ba, aikin yana ba da openvpn3-autoload. Yana karanta wani jaka na bayanai da kuma kwataccen bayanin kwatance ga kowane bayani, kuma bayanin yana bayar da shaidun a rubutu bayyananne. Mataimakin wani binary ne daban, yawanci a /usr/sbin/openvpn3-autoload, ba tuta a kan session-start ba. Saita shi na nufin ƙirƙirar jakar, kwafin bayanin a ƙarƙashin sunan da bayanin kwatance yake tsammani, da rubuta bayanin kwatance.

Saitin kowane mai amfani yana kama da haka, ana gudanarwa da asusun da zai mallaki zaman. Yanayin jakar yana hana sauran masu amfani na gida shiga:

mkdir -m700 -p ~/.openvpn3/autoload
cp work.ovpn ~/.openvpn3/autoload/client.conf
$EDITOR ~/.openvpn3/autoload/client.autoload

Bayanin kwatance yana ambaton shaidun kuma yana neman farawa ta atomatik. Ka riƙe darajar kalmar sirri daga sarrafa sigar:

{
  "autostart": true,
  "user-auth": {
    "autologin": true,
    "username": "svc-vpn",
    "password": "change-this-value"
  }
}

Sannan ka kira mataimakin sau ɗaya ka tabbatar zaman ya bayyana. Umarni na biyu shine binciken, ba wani matakin saiti ba:

/usr/sbin/openvpn3-autoload --directory ~/.openvpn3/autoload
openvpn3 sessions-list

Lokacin tashi, wata haɗaɗɗiyar unit mai suna openvpn3-autoload.service tana amfani da jakar dukan tsarin /etc/openvpn3/autoload, ba ta kowane mai amfani ba. Wannan wurin yana buƙatar mallakar root da tsarin da ya fi tsanani, kuma bayanin kwatance har yanzu yana riƙe kalmar sirri a rubutu bayyananne. Ciniki a bayyane yake: kalmar sirri yanzu tana kan faifai, don haka ɗauki wannan jakar a matsayin sirri, cire ta daga ajiyar da ake yi a wajen masaukin, kuma zaɓi hanyar mu'amala duk lokacin da mutum yake nan.

Kasawar bas da suke kama da kasawar kalmar sirri

Wasu kasawa da ake danganta ga shaidu ba haka suke ba kwata-kwata. Kuskuren izini da ke ambaton hanyar kunna sabis yana nufin ɗaya daga cikin biyu: bayan fage ba ya aiki, ko mai kira ba shi da izinin kunna shi. Babu wani gyaran bayani da zai canza ɗaya daga cikinsu. Ka duba yanayin sabis da manufar bas da aka kawo kafin ka taɓa saitin.

Umarnin da ke ƙasa suna raba biyun. Na farko yana bayar da rahoton ko bayan fage yana aiki; na biyu yana nuna kurakurai na bas na kwanan nan:

systemctl status openvpn3-service-client
journalctl -b -u openvpn3-service-client --no-pager | tail -20

Wata kuskuren karatu da aka saba shine zama da ya bayyana sannan ya ɓace nan take. Wannan salon yawanci yana nufin ba a taɓa amfani da saitunan gida na rukunin ba, don haka ramin ya tashi ba tare da canje-canjen hanya da mai warwarewa da ke sa shi amfani ba. Ka karanta jerin ba layin ƙarshe ba: ko an ƙirƙiri zaman, ko ya kai yanayin haɗi, da ko ya rayu abubuwa uku ne daban.

Lokacin da har yanzu ana amfani da tsohon abokin ciniki

Abokin ciniki na 2.x har yanzu yana karɓar fayil ɗin shaidu, kuma zoben maɓalli na iya amsa tambayarsa ba tare da sirrin ya taɓa isa faifai ba. Wani nade yana warware shigarwar, don haka fayil ɗin yana ambaton binciken ba kalmar sirri ba. Wannan tsari ya dogara da zoben maɓalli da ba a kulle ba, wanda kwano marar zaman shiga ko unit da ke tashi kafin kowa ya shiga ba za su iya samarwa ba. Sannan kayan aikin bincike yana ba da rahoton tarin da ba zai iya rubutu a ciki ba, don haka kuskuren yana kama da gazawar shaidu alhali gazawar zoben maɓalli ce.

Kafin ka gina kowane ɗaya daga cikin waɗannan, duba ko saitin keepalive a cikin bayanin yana kawar da buƙatar sake farawa gaba ɗaya. Zaman da ya tsaya a tsaye ba ya taɓa isa tambayar da kake ƙoƙarin aiwatarwa.