Me ya sa Linux client na GlobalProtect ke gazawa a sabbin Ubuntu

Zato mai ma'ana shi ne cewa .deb daga portal ɗin GlobalProtect ɗinka ya lalace, ko kuma mai samarwa ya fitar da gini mara kyau. Yawanci ba haka yake ba. Interface ɗin Linux na mai samarwa har yanzu yana haɗi da Qt5 WebKit, kuma sabbin fitowar Ubuntu ba sa bayar da shi kuma, don haka fayil ɗin yana neman ɗakin karatu da rarraba ɗinka ya cire da gangan. Wannan rashin daidaituwar fakiti ne, ba lalacewar saukewa ba, kuma wannan bambancin ne ke ƙayyade ko za ka ciyar da yammacin wajen tilasta fakiti ko minti goma wajen zaɓar wani client.

.deb ɗin bai lalace ba

Dogaro da rarraba ba ta ɗauka kuma shi ne sakamakon da aka saba na cire ɗakin karatu daga aiki. An cire Qt5 WebKit daga taskokin Ubuntu na baya da kuma daga Debian, kuma dalili shi ne kula da tsaro ba rashin buƙata ba. Idan hakan ta faru, kowane fakiti da har yanzu yake haɗi da shi ya daina iya shigarwa, komai kyawun gininsa.

Ana ba da rahoton gazawa biyu a matsayin bug ɗaya kuma ba haka suke ba. A fitowar da babu ɗakin karatu, mai shigarwa yana tsayawa a kan dogaro da ba a biya ba. A fitowar da client ɗin ke shigarwa sannan ya kasa a lokacin shiga, kana ganin matsalar musayar hannu ta TLS ko SAML a cikin ɓangaren burauza da aka saka. Na farko fakiti ne; na biyu lokacin aiki ne, kuma ba a gyara ko ɗaya daga cikinsu ta hanyar kwafin tsoffin ɗakunan karatu zuwa tebur na zamani.

Tabbatar da dogaro maimakon tilasta shi

Shigar da fayil ɗin a fili domin kayan aikin ya ambaci dogaron da ba a warware ba maimakon ya ba ka taƙaitawa. Sannan ka tambaya ko fitowarka tana da wani ɗan takara kwata-kwata, domin „ba a samu a nan” da „na ɗan lokaci babu shi a wannan madubi” suna kaiwa ga shawarwari daban-daban:

sudo apt install ./GlobalProtect_UI_deb-*.deb
apt-cache policy libqt5webkit5
apt-cache rdepends --installed libqt5webkit5

Idan apt-cache policy bai ba da rahoton ɗan takara ba, daina ƙoƙarin shigar da shi kuma fara zaɓar wata hanya. Abin sha'awa ba sunan fakitin da ya ɓace ba ne; abin sha'awa shi ne gaskiyar cewa jadawalin dogaro na mai samarwa bai motsa tare da rarraban da masu amfani da kai suke gudanarwa ba.

Abin da tilasta tsofaffin fakiti ke yi wa tebur

Magani da ke yawo shi ne a jawo ɗakin karatu daga wata fitowa da ta wuce. A kan Ubuntu na yanzu hakan yana ƙarewa a rikicin ƙaramin sigar Qt5: tsofaffin fakiti suna ja libqt5core5t64 baya, sannan fakiti KDE da PyQt da aka shigar suna fara neman sigar ABI da ɗakin karatu da aka saukar bai bayar da ita kuma. Sakamakon shi ne ɗagawa na wani ɓangare da ke karya manhajoji marasa alaƙa, wanda ya fi yammacin da ka fara da shi muni ƙwarai.

Wannan sakamakon ana tsammani ne ba rashin sa'a ba. Tsammanin ABI na Qt ga ƙananan sigogi tsanani ne, kuma rarraba ɗaya tana kai da saiti ɗaya mai daidaito. Haɗa ɗakin karatu ɗaya daga wata fitowa ba gyara mai niyya ba ne; ɗagawa na biyu ne da ba a cika sarrafawa ba.

Irin wannan shawara ta shafi nau'in lokacin aiki na gazawar. Rage matakin tsaro na OpenSSL a faɗin tsarin don musayar hannun tsohon client ya yi nasara yana canza kowace haɗin TLS a na'urar don gyara manhaja ɗaya, har da mai sarrafa fakiti da za ka buƙata idan wani abu ya lalace.

openconnect yana magana da wannan yarjejeniya

OpenConnect yana aiwatar da yarjejeniyar GlobalProtect kai tsaye, kuma bayanin yarjejeniya sun bayyana kira da kuma rabo tsakanin interfaces biyu na uwar garke. Portal ɗin yana raba saituna da jerin ƙofofi; ƙofar tana ƙarewar rami:

openconnect --protocol=gp vpn.example.com
openconnect --protocol=gp --authgroup=staff vpn.example.com

Idan portal ɗin ya tsallake ƙofar da kake buƙata, --usergroup=gateway ko URL da ke ƙarewa da /gateway yana tsallake matakin portal. Idan ana ba da ƙofofi da yawa, --authgroup=NAME yana zaɓa daga cikinsu. Tabbatarwa ita ce sunan mai amfani da kalmar sirri, bisa zaɓi da takardar shaidar client, kuma ƙofofin SAML a aikace suna aiki ta network-manager-openconnect maimakon layin umarni da aka rubuta da hannu.

Ƙofa mai tsayayyen manufar posture na iya buƙatar rahoton HIP kafin ta bayar da rami. OpenConnect na iya ƙirƙira da aika ɗaya, amma idan ƙofar tana buƙatar lissafin da ba za ta iya ƙirƙira ba, babu tuta da ke canza wannan manufar; wannan shawara ce daga ɓangaren uwar garke.

Tabbatar da ramin, kuma ka san abin da openconnect ba zai gyara ba

Duba abin da ramin ya yi amfani da shi da gaske maimakon amincewa da saƙon nasara. Ƙofar tana aika tuƙi da tsari a matsayin XML kuma client ɗin yana amfani da su, don haka hanyar da ta ɓace matsalar tsari ce ko zaɓi ba kuskuren client ba:

ip -4 addr show
ip route
resolvectl status

MTU ya cancanci dubawa daban. Tsarin GlobalProtect kullum yana ba da rahoton MTU na sifili, don haka client ɗin yana kiyasta ɗaya daga kuɗin rufewa. Manyan aikawa da ke tsayawa yayin da ƙananan buƙatu ke wucewa alama ce ta gargajiya, kuma maganin shi ne bayyanannen MTU a kan haɗin, ba kashe gano hanya ba.

IPv6 wata magana ce daban. PAN ya ƙara shi a cikin GlobalProtect 4.0, kuma ana bayyana tallafin OpenConnect a matsayin na gwaji tun daga sigar 9.0, don haka kada ka ɗauka cewa dangin adireshin yana yin kamar IPv4 kawai saboda ramin ya tashi. Kuma idan ƙofar tana tilasta dubawar posture da client na buɗaɗɗen tushe ba zai iya cikawa ba, gudanar da client ɗin mai samarwa a kan fitowar LTS da ake tallafawa, a cikin injin kama-da-wane idan tashar aikinka ta riga ta ci gaba. Hakan yana kiyaye tebur ɗin lafiya kuma yana sanya tsohuwar dogaro cikin iyakar da za ka iya sake ginawa.