Rubuta script ɗin abokin ciniki na VPN: zaɓi Layer kafin kalmar sirri

Script ɗin suna fara abokan ciniki na VPN a Layer ɗin da marubucin ya zaɓa, kuma wannan Layer ɗin ba kasancewar shi ne abin da aikin yake buƙata ba. Layin umarni na mai bayarwa, mai buga waya na tsarin aiki da manufar app ɗin wayar hannu duk suna dawowa a lokuta daban-daban na rayuwar haɗin. Suna kuma kula da sirrin daban, kuma wannan bambancin yana ƙayyade ko kalmar sirri tana bayyane ga kowane mai amfani a na'urar. Zaɓi Layer ɗin kafin ka rubuta layin farko na script ɗin.

Layer 1: layin umarni na mai bayarwa

Yawancin abokan ciniki na desktop suna bayar da layin umarni wanda ke karɓar sunan bayanan martaba kuma, sau da yawa, kalmar sirri. Tsohon abokin ciniki na Cisco ya karɓi kalmar aiki connect tare da hujjojin mai amfani da kalmar sirri; macOS yana fallasa sabis ɗin da aka gina ta networksetup; NetworkManager yana amsa nmcli. Waɗannan kira suna dawowa lokacin da umarnin ya ƙare, wanda ba lokacin da tunnel ɗin ya zama mai amfani ba. Karanta takardun mai bayarwa don sigar da kake turawa, saboda waɗannan mu'amaloli suna canzawa kuma wasu ana cire su gaba ɗaya.

nmcli connection up "Work VPN"
networksetup -connectpppoeservice "Work VPN"

Amfani shi ne cewa mai bayarwa ya san ajiyar bayanan martabarsa, don haka kiran yana amfani da tsarin da GUI zai yi amfani da shi. Rashin amfani shi ne kowane mai bayarwa yana ƙirƙira kalmominsa na aiki, kuma script ɗin da aka rubuta don abokin ciniki ɗaya baya miƙa zuwa wani. Iyaka wannan Layer ɗin a matsayin hanya mafi guntu lokacin da abokin ciniki ya tabbata kuma sigar an lika.

Layer 2: sabis ɗin tsarin aiki da kansa

A Windows mai buga waya ɓangare ne na tsarin aiki, kuma yana aiki da shigarwar littafin waya maimakon ajiyar bayanan martaba na mai bayarwa. Wannan yana sa ya fi sauƙin ɗauka tsakanin abokan ciniki kuma ya fi sauƙin rubuta script daga asusun sabis. Yana kuma nufin haɗin zai iya kasancewa a wuri ɗaya ba a wani ba, wanda ke rikitar da mutanen da suke kallon jerin da ba daidai ba.

rasdial "Work VPN" user pass
Get-VpnConnection -Name "Work VPN" | Select-Object ConnectionStatus

Yi amfani da fuskar PowerShell lokacin da kake buƙatar ƙirƙira ko cire shigarwar maimakon buga ta. Layer ɗin WMI da cmdlet suna fallasa abubuwa ɗaya da sunaye daban-daban, kuma cirewa aiki ne dabam da cire haɗin. Script ɗin da kawai yake bugawa zai bar tsofaffin shigarwa bayan ƙaura. Duba ajiyar da sarrafa naka yake rubutawa kafin ka yi alkawarin tsaftacewar za ta faru.

Remove-VpnConnection -Name "Old VPN" -Force
Get-VpnConnection

A macOS kwatankwacinsa shine jerin sabis ɗin cibiyar sadarwa, inda sabis ɗin da ke akwai ake haɗa da suna maimakon ƙirƙira shi nan take.

Shaidu suna zubewa a kowane Layer, don haka zaɓi tashar

Duk abin da ka wuce a layin umarni yana bayyana a teburin tsari ga kowane mai amfani na gida, kuma yawanci yana rayuwa a tarihin shell ma. Madadin da OpenVPN ke goyan baya shine karanta sirrin daga fayil da --askpass, kuma fayil ɗin kansa yana buƙatar izini waɗanda suka dace da amincewar da ka sa a ciki. Bututu mai suna yana guje wa rubuta sirrin a faifai amma yana barin kowane tsari da zai iya buɗe shi ya rubuta a wurin. A Windows, ajiye sirrin a mai kula da shaidu, ko a fayil ɗin da asusun sabis kaɗai zai iya karantawa, kuma kada ka taɓa ajiye shi a matsayin rubutu kai tsaye a fayil ɗin batch.

openvpn --config /etc/openvpn/work.conf --askpass /etc/openvpn/work.secret --auth-nocache --daemon
ls -l /etc/openvpn/work.secret

Wannan dokar ta shafi token da lambobin amfani ɗaya: idan sarrafa yana buƙatar su, sarrafa yana buƙatar tashar da ba hujja ce ta layin umarni ba. Juya sirrin lokacin da ka canza tsarin, saboda tsohuwar ƙimar ta kwanta a wani log a wani wuri. Script ɗin da ke aiki kuma yake zubewa ba script ɗin da ke aiki ba ne.

Jira yanayi, sannan ka kula da mai shi ɗaya

Kowane ɗayan waɗannan kira yana dawowa kafin tunnel ɗin ya shirya, don haka bincika yanayin da abokin ciniki yake fallasa ko gwada manufa a ciki da iyakacin lokaci. Kwafin fayiloli ko buɗe haɗin bayanan bayanai nan da nan bayan kiran haɗin tsere ne, kuma yana gazawa lokaci-lokaci ta hanyar da take kama da matsala ta cibiyar sadarwa.

ip link show tun0
nmcli -t -f GENERAL.STATE connection show "Work VPN"
curl -sS --max-time 5 https://app.internal.example/health -o /dev/null

Cire haɗin yana da matsala ɗaya a akasin hanya: tsari zai iya fita kafin hanyoyin su tafi. Yi amfani da ƙugiya na abokin ciniki inda suke, kamar OpenVPN scripts ɗin up da down ko ExecStartPost na rukunin systemd, saboda suna gudana a wurin da kake da muhimmanci da gaske. Ƙugiyoyi suna gudana da ikon duk abin da ya kira su, don haka ƙugiya da ke sake kunna hanyar sadarwa tana buƙatar doka bayyananne maimakon zato. Riƙe ainihin mai shi ɗaya a tsawon rayuwar haɗin.

Lokacin da masu sa ido biyu suka fara kuma suka dakatar da bayanan martaba ɗaya, sakamakon shine madauki na sake haɗawa wanda ake karantawa kamar gazawar mai bayarwa. Runbook ɗin yana ƙare lokacin da Layer ɗin ya rubuta, sirrin yana da tashar da ba argv ba, yanayin jira shine duba yanayi da iyakacin lokaci, kuma tsari ɗaya ya mallaki zagayowar rayuwa.