Za a bar chroot ko a kwafi iproute2 cikin kurkuku?
Kurkuku marar cikawa tana gazawa bayan farawa, ba a lokacin boot ba. Zaɓi tsakanin sassauta ƙarfafawa da kwafin binaries tare da ɗakunan karatu zuwa sabon tushe.
Sabis ɗin yana farawa, abokin ciniki yana haɗawa, kuma babu hanyar da ta taɓa bayyana a gefen uwar garke. Ko daemon ya ƙi farawa ya ambaci umarnin da bai iya aiwatarwa ba. Dukansu sakamakon biyu suna bin layi uku ɗaya, waɗanda yawanci ana kwafa su tare daga jagorar ƙarfafawa: sauya zuwa asusun da ba shi da izini, barin rukuni, da canza tushen tsarin fayil. Ɗaya ne kawai cikin uku ke ɓoye fayiloli, kuma ɗaya ne kawai daga cikinsu ke cire ikon canza teburin turawa. Raba su shine hanyar da za ka koyi wane layi kake so da gaske.
Abin da kurkuku ke cirewa da daemon ke buƙata har yanzu
Canjin tushe yana faruwa bayan farawa, don haka daemon yana riƙe da duk abin da ya riga ya buɗe kuma ya rasa duk abin da zai buɗe daga baya. Duk wani mataimaki da haɗin zai gudanar bayan wannan lokacin dole ya kasance cikin sabon tushe, tare da ɗakunan karatu na gama gari da yake ɗauka. Kurkukun da aka gina daga fayil ɗin tsari da takardar shaida ba shi da ko ɗaya.
Sauya zuwa asusun da ba shi da izini wani ƙuntatawa ne daban. Tsarin da ya bar root na iya kasa canza hanyoyi ko ɗaga interface ko da binary ɗin yana nan, don haka dole a bincika gazawar biyu daban.
Sharudda uku ne ke ƙayyade wane gyara kake buƙata
Sharadi na farko shine yadda gininka ke girka hanyoyi. Sabbin OpenVPN fitattun suna saita interface da teburin turawa cikin tsari, yayin da tsofaffin fakiti da saitunan kai suka dogara da kayan aiki na waje ko scripts na up da down. Idan log ɗin ya ambaci umarni, akwai kayan aiki na waje da ke da hannu kuma kurkuku yana ɓoye shi. Idan log ɗin ya nuna kuskuren izini maimakon haka, asusun ne matsalar.
Na biyu shine kulawa. Kurkukun da ke da binaries da aka kwafa dole a sabunta shi duk lokacin da fakitin da ke samar da su ya inganta, in ba haka ba haɓakawa ta farko za ta bar rami da ya karye a baya. Na uku shine ko wani iko na musamman yana buƙatar chroot da gaske; idan buƙatar ta shafi rabuwar izini ne, canza asusun kaɗai zai iya isa.
| Signal in the log | Other side of the boundary | Repair direction |
|---|---|---|
| Command not found after startup | Binary and its libraries absent inside the new root | Populate the jail, or drop the chroot line |
| Operation not permitted | Account lost the privilege to edit routes | Keep the account privileged, or pre-create routes elsewhere |
| No such device | Jail lacks the tun device node | Create the node inside, or open it before the root change |
Abin da kurkuku mai aiki dole ya ƙunshi
Kurkukun da ke gudanar da umarni yana buƙatar binary ɗin, kowace ɗakin karatu da yake haɗi da ita, da kowace node ɗin na'ura da daemon ke buɗewa a makare. Kwafi sassan ka gwada su ba tare da VPN a cikin hoto ba:
ldd /usr/sbin/ip
chroot /etc/openvpn/jail /sbin/ip route show
chroot /etc/openvpn/jail /sbin/ip link set tun0 upUmarni na farko yana lissafa abubuwan dogaro, kuma shine abin da mutane ke tsallakewa. Binary ɗin da aka kwafa wanda bai sami ɗakin karatu ba yana gazawa da saƙo daban da binary ɗin da ya ɓace, kuma dukansu suna kama da lalacewar OpenVPN idan an karanta su daga gefen abokin ciniki. Gudanar da umarnin da hannu cikin kurkuku yana sake haifar da gazawar ba tare da sake kunna sabis ɗin ba.
Kwafi kuma tsarin, takaddun shaida da kowane CRL cikin kurkuku, domin fayil ɗin da daemon ke tsammanin sake karantawa bayan farawa ba za a same shi ba da zarar tushen ya canza. Rubuta abin da ka kwafa, domin haɓakawa na gaba na fakitin cibiyar sadarwa zai maye gurbin na asali kuma ya bar kurkuku a kan tsohon kwafin.
A maimakon haka rage ƙarfafawa
Idan kurkuku yana wanzuwa ne kawai saboda jagora ya faɗi haka, cire wannan layi ɗaya yayin da ake riƙe ƙuntatawar asusu sakamako ne mai iya karewa. Daemon yana riƙe da ra'ayinsa na tsarin fayil kuma ya rasa matsalar, kuma ragewar izini har yanzu tana cire root daga tsari mai dogon rai.
Rubuta abin da ya rage, da kuma dalilin. Tsarin da ya yi asarar iko a hankali ba tare da rubutu ba shine yadda ƙarfafawa ke karkata, kuma bincike na gaba zai tambayi dalilin da layin ya ɓace.
Raba layi ukun kafin ka zaɓa
Kwafi tsarin, kashe duk umarni ukun kuma tabbatar cewa abokin ciniki yana haɗawa kuma hanyoyin da ake tsammani suna bayyana. Sannan sake kunna layin asusun kawai, sannan chroot shi kaɗai. Matakin da ramin ya karye yana nuna iyakar, kuma kana guje wa sake gina kurkukun da bai taɓa zama sanadi ba.
Lokacin da ya sake tura, gudanar da zaman abokin ciniki ɗaya da ƙarin bayani kuma karanta layin da ke ambaton umarnin ko izinin da ya kasa. Wannan layin ya fi daraja fiye da lokacin da abokin ciniki a ƙarshe ya bayar.