Abin da fitarwar Mac VPN ke ɗauka, da abin da ta bar baya
Fitarwar Mac VPN tana ɗaukar saituna da wani lokacin maɓallin sirri, amma ba kalmar wucewar keychain ko rijistar na'urar ba. Fara duba kowanne ɓangare.
Danna Export a cikin abokin ciniki na Mac VPN sai ka sami fayil da ke bayyana haɗi ba tare da kasancewa haɗin kansa ba. Adireshin uwar garke, tashar, ka'ida da kuma sau da yawa takaddun shaida suna cikinsa. Kalmar wucewar shiga, jimlar wucewar maɓallin sirri da rijistar da ke ba da izinin wannan Mac ɗin yawanci ba sa cikinsa. Shi ya sa bayanin martaba zai iya shiga cikin tsafta, ya bayyana a jerin abokin ciniki kuma har yanzu ya kasa a farkon buƙatar tabbatarwa; gibin dabi'a ce ta tsarin, ba lalacewar saukewa ba.
| Part of the connection | Where it lives on the old Mac | What an export does with it |
|---|---|---|
| Server, port, protocol, routes | Client profile or managed settings | Usually included when the client exports configuration |
| Client certificate and private key | Inside the package, the login keychain, or issued by MDM | Included only if the format packs it; a keychain-held key stays behind |
| Login password, key passphrase | Login keychain | Left out by design |
| Device authorization or enrollment | Server side, bound to the certificate or the device record | Not transferable; the new device has to enroll |
Abin da fitar da fayil ɗin ya ƙunsa a zahiri
Fitarwa kwano ne, kuma tsawon fayil ɗin yana faɗi ƙasa da abin ciki. Bayanan martaba na OpenVPN rubutu ne: umarni, tare da zaɓaɓɓun tubalan <ca>, <cert> da <key> na ciki. Saitunan Tunnelblick matattun kundaye ne na tsari da saituna. .mobileconfig da ake sarrafawa plist ne na kaya. Jera biyu suna amsa mafi yawan tambayar kafin ka shigo da wani abu.
Don bayanin martabar rubutu, ƙirga tubalan PEM da yake ɗauka: grep -c "PRIVATE KEY" your-profile.ovpn. Sakamakon da ba sifili ba yana nufin fayil ɗin yana ɗauke da kayan maɓalli kuma dole a kula da shi kamar kalmar wucewa daga wannan lokacin. Don kwano, jera shi ba tare da ciro shi ba: tar -tf export.tbz, ko unzip -l export.zip idan abokin ciniki ya yi zip. Fayilolin maɓalli, fayilolin takarda da rubutun sama ko ƙasa a cikin wannan jeri su ne sassan da sake fitar da asusun mai amfani ba zai sake ƙirƙira ba.
Sabanin haka yana da muhimmanci daidai. Lokacin da bayanin martaba ya nuna maɓalli da sunan fayil maimakon saka shi, fitarwar ba ta cika da gangan kuma rabin da ya ɓace dole ya fito daga wanda ya bayar da shi. Kwafin wannan fayil ɗin gefe yana da kyau lokacin da kai ne mai kula da takardar shaida; ba shi da kyau lokacin da fayil ɗin ya zo da takardar shaidar da ke daure da na'urar da aka ƙirƙira a tsohon Mac.
Me ya sa rabin keychain ba ya tafiya
macOS yana ajiye kalmomin wucewar VPN da jimlolin wucewar maɓalli a cikin keychain ɗin shiga, kuma abokan ciniki suna ajiye su a can maimakon a cikin fayilolin saitunansu. Tunnelblick ya faɗi haka a cikin jagorar fitarwa da shigowa: kundin saitin yana ɗaukar tsari da saituna kuma yana barin sunayen masu amfani, kalmomin wucewa da jimlolin wucewar da ake ajiye a keychain. Barin na da gangan. Ana kiyaye abubuwan keychain ga kowane mai amfani da kowace na'ura, don haka abin da aka kwafa ba shi da ingantaccen kulawar shiga a inda za a kai, wanda ke barin ko fayil marar amfani ko sirri a rubutu bayyananne.
Kana iya tabbatar da inda takardar shaidar ke zaune kafin ka shirya motsi. security find-internet-password -s vpn.example.com yana buga halaye don abin da ya dace kuma yana ƙarewa da lamba marar sifili lokacin da babu ko ɗaya; wannan umarnin da -g zai nemi bayyana kalmar wucewa, shi ya sa tambayar ba tare da ita ba ita ce mafi aminci. Samun sakamako a can yana nufin bayanin martabar baya ɗaukar kalmar wucewa kuma ba za a iya tilasta shi ba. Har ila yau yana nufin za a sake neman kalmar wucewa a sabon Mac, kuma izinin «Koyaushe yarda» a tsohon ba ya ƙidaya a can.
Ba kowane sirri ne abin keychain ba, ko da haka. Takardun kunshin Tunnelblick da kansa sun lura cewa kunshi na iya ƙunsar fayilolin maɓalli, takarda da rubutu. Don haka fitarwar da ke barin abubuwan keychain ba ita ce maganar cewa fitarwar tana da aminci a aika da imel ba; ɗauki kundin a matsayin mai muhimmanci har sai ka jera abin da ke cikinsa.
VPN na asali da masu sarrafawa ba su da hanyar fitarwa
Haɗin da aka tsara ta Saitunan Tsarin ba sa bayar da fitarwa mai tallafi. scutil --nc list yana nuna ayyukan da tsarin ya sani, kuma scutil --nc show "Work VPN" yana buga tsarin aiki ɗaya, wanda ya isa ka karanta uwar garkensa da ka'idarsa. Babu ɗayansu kayan aikin ƙaura. Alamar ayyukan da aka ajiye a /Library/Preferences/SystemConfiguration/preferences.plist nuni ne cikin wannan fayil, don haka kwafin fayil ɗin da sake rubuta alamomi ba matsawa mai tallafi ba ne kuma yana iya dagula ayyukan cibiyar sadarwa marasa alaƙa a inda za a kai.
Hanyar da aka tallafa ita ce wadda Apple ke rubutawa: shigar da fayil ɗin saitunan VPN da mai gudanarwa ya bayar, ko shigar da saitunan da mai aiki ya ba ka. Lokacin da haɗin ake sarrafawa, nemi sabon fayil ko sabuwar rijista maimakon sake gina shi daga hoton allo na tsohuwar tattaunawa. Don bayanin martabar da MDM ke turawa, kayan takardar shaida na iya ɗaukar ainihi yayin da ake ƙirƙirar maɓallin sirri a na'urar, kuma a irin wannan yanayi ko da cikakkiyar kwafi na tsohon bayanin martaba ba za ta iya tabbatar da sabon Mac ba.
Tabbatar da maidowa maimakon amincewa da jeri
Bayanin martaba a cikin jeri da rami mai aiki yanayi biyu ne daban-daban, kuma ɗaya ne kawai daga cikinsu ya cancanci rahoto. Bayan shigowa da haɗawa, duba cewa ƙofar ramin tana nan, sannan duba abin da ramin yake yi.
ifconfig | grep -A3 utun yana nuna ƙofar ramin da adireshinta. scutil --dns | grep nameserver yana nuna waɗanne masu warwarewa ne ke aiki bayan haɗin, kuma a nan ne bayanan martaba na split-DNS suka saba bambanta. Sannan isa tushen da ke da muhimmanci da gaske: curl -sS -o /dev/null -w "%{http_code}" https://intranet.example.com. Idan duka ukun sun wuce, saituna, DNS da hanyoyi sun isa; alamar kore a cikin abokin ciniki ita kaɗai ba ta nufin kome daga cikinsu.
Kasawa biyu suna bayyana sau da yawa bayan shigowa kuma ana ɗora duka biyun a kan fayil ɗin. Sunayen jama'a suna warwarewa yayin da na ciki ba sa, yawanci yana nufin an bar sabar DNS na bayanin martabar ko ba a kiyaye split-DNS ba. Ramin da ya tashi ba ya wuce wani zirga-zirga yawanci yana nufin hanyoyi ko izini daga wajen uwar garke ba su bi bayanin martabar ba. Sake shigo da wannan kundin yana haifar da duka biyun.
Kafin ka yi ritaya da tsohon Mac
Share fitarwa ba sokewa ba ce. Idan tsohuwar na'urar ta tabbatar da takardar shaida, uwar garke har yanzu tana amincewa da wannan takardar har sai an soke ta ko an sake bayar da ita. Idan ta tabbatar da asusu na tarayya, zaman kan wannan asusun na iya kasancewa da rai har yanzu. Yi matakin wajen uwar garke yayin da kayan aikin har yanzu suna gabanka.
Ajiye sabon bayanin martaba tare da sauran takardun shaidarka lokacin da yake ɗauke da maɓalli, kuma rubuta kalmar wucewa a cikin abokin ciniki domin ta shiga sabon keychain maimakon fayil. Bincike na ƙarshe: haɗa daga maye gurbin yayin da tsohon Mac a kashe. Miƙawa da ke aiki kawai yayin da injin tushen yana kan layi ba ta taɓa zama cikakke ba.