Heerarka script-security ee OpenVPN laga bilaabo 0 ilaa 3, iyo waxa mid kastaa furayo
Heer kasta oo script-security ah wuxuu ballaariyaa waxa profile uu fulin karo: marka hore caawiyayaasha maamulka, ka dib scripts-ka isticmaalaha, ka dib passwords-ka deegaanka. Akhri tilmaamaha.
Soo geli profile client desktop ah oo guuldarada koowaad inta badan waa sadarka uu client-ku diido inuu ixtiraamo: jillaab script ah oo uusan ordi doonin, ama qiimaha script-security oo uu u arko mid aad u fasax badan. Kordhinta lambarka waxay ka dhigtaa wada-hadalka inuu baaba'o. Laakiin waxay sidoo kale ballaarisaa waxa profile-kaas uu ku fulin karo mishiinkaaga, taas oo ah wax la yaab leh in la bixiyo si loo xiro digniin oo keliya. Raac soo-gelinta ilaa tilmaanta oo go'aanku wuu noqonayaa mid la taaban karo.
Laga bilaabo wada-hadalka soo-gelinta ilaa tilmaanta
Profile-ku waa fayl qoraal ah oo leh tilmaamo, client-kuna wuu akhriyaa ka hor inta aanu jirin tunnel. Tilmaan sida up, down ama tls-verify waxay magacaabtaa barnaamij dibadeed oo OpenVPN ay tahay inuu ordo waqti go'an. Haddii OpenVPN diyaar u yahay inuu ordo waa deegaan gaar ah oo la yiraahdo script-security, profile-kuna inta badan wuu dejiyaa taas sidoo kale.
Marka digniintu kama hadlayso sir-garaynta ama shahaadooyinka. Waxay ka hadlaysaa fayl habayn oo weydiisanaya client-ka inuu wax ku fuliyo martigeliyaha, iyo client-ka oo hubinaya haddii heerka ogolaanshaha hadda uu ogolaado codsigaas.
Marxaladdan laba guuldarrood oo kala duwan ayaa isku mid u eg. Profile weydiisanaya heer uusan client-ku siin doonin wuxuu keenaa diidmo. Profile weydiisanaya heer uu client-ku siinayo laakiin script-ka maqan yahay wuxuu beddelkeeda keenaa guuldarro waqtiga fulinta, labadana waa lagu khaldaa dunta taageerada. Mid waa su'aal ogolaansho, kan kalena su'aal baakaddayn.
Waxa heer kastaa runtii furayo
Heerka 0 wuxuu gebi ahaanba mamnuucaa wicitaannada barnaamijyada dibadda, taas oo is waafajisan client-ka isagu isku habeeya interface-kiisa caawimaad la'aan, oo aan waafajin karin kan u yeedha nidaamka hawlgalka. Heerka 1, caadiga, wuxuu ogolaadaa faylallada fulinta ee dhex-dhexaadka ah ee habaynta interface-ka iyo wadada u baahan. Midkoodna heerarku ma ordo wax isticmaalahu bixiyey.
| Level | What OpenVPN may execute | What it exposes |
|---|---|---|
| 0 | No external programs at all | Interface and route setup must not depend on helpers |
| 1 (default) | Built-in helpers such as ip, ifconfig, route or netsh | Privileged commands the platform already ships |
| 2 | Built-in helpers plus user-defined scripts | Whatever the named script does with the client's privileges |
| 3 | Everything above, plus passwords in environment variables | Credentials visible to child processes and their logs |
Heerka 2 waa xadka xiisaha leh, sababtoo ah wuxuu aqbalaa scripts-ka isticmaalahu qeexay. Laga bilaabo bartaas mudnaanta client-ku waxay khuseysaa koodh aadan waligaa akhrin, oo lagu yeedho waqtiyo aadan dooran, deegaan ay ku jiraan faahfaahinta xiriirka. Heerka 3 wuu sii socdaa oo wuxuu ogolaadaa in passwords-ka la maro doorsoomayaasha deegaanka, sidaas darteed buug-gacmeedku wuxuu ku tilmaamaa mid suurtogal ah inuusan ammaan ahayn.
Midkoodna tirooyinkan ma aha deegaan xoog. Profile heerka 3 ma leh sir-garayn ka wanaagsan kan heerka 1; waxa uun leh dusha fulin ballaaran, tunnel-kuna waa isku mid.
Go'aanso waxa profile-ku mudan yahay
Weydii waxa script-ku u jiro ka hor inta aadan weydiin heerka uu u baahan yahay. Jillaab riixaya dejinta DNS ama hagaajiya waddo xiriirka ka dib waa sabab sharci ah in wax la ordo. Jillaab ku yeedhaya binary aan la aqoon galka ku-meel-gaadhka ah waa sabab la iskaga joojiyo.
Waddada script-ku waxay leedahay muhiimad la mid ah script-ka. Waddo qaraabo ah waxaa lagu xalliyaa galka uu client-ku isticmaalo, galka la qori karo wuxuu u beddelaa soo-gelin hal mar ah meel fulin joogto ah. Waddooyinka buuxa ee galka uusan isticmaalahu beddeli karin waa qaabka la doorbidayo.
Scripts-ku waxay sidoo kale dhaxlaan deegaanka client-ka, halkaas oo aqoonsiga iyo xogta xiriirku ku nool yihiin. Dhaxalkaas ayaa heerka 3 khatar uga dhigaya marka lagu daro script diiwaangeliya deegaankiisa, sababtaas darteedna soo-saarista cilmi-baaris ee client scripts u leh waxay mudan tahay eegid labaad ka hor inta aan tikit lagu dhejin. Ka saar deegaanka ka hor inta aadan wadaagin.
grep -nE 'script-security|^up |^down |tls-verify' client.ovpnBeddel hal shay, ka dibna fiiri furitaanka sidoo kale
Haddii profile-ku runtii u baahan yahay script, beddel heerka oo keliya iyo profile-kaas oo keliya. Ku orod client-ka hore oo leh wax-soo-saar faahfaahsan si khaladaadka script-ka laftiisa u muuqdaan, maamulaha adeeggu ha liqin.
openvpn --config client.ovpn --script-security 2 --verb 3
ip route show defaultTijaabi dhammaan wareegga nolosha, ma aha oo keliya xiriirka. Jillaab xiritaan oo guuldarraysta wuxuu ka tagaa waddooyin tilmaamaya tunnel dhintay, taas oo soo saarta mishiin u eg mid xiran oo aan meelna gaarin. Kahor inta aadan ku dhawaaqin isbeddelka inuu dhammaaday, hal mar dib u xiriir oo hal mar gooy, oo kasta ka dib fiiri shaxda wadada.
Hayso nuqul ka mid ah profile-kii asalka ahaa. Haddii client platform uusan hirgelin isla qaabka script-ka, tirtirista tilmaamaha ilaa soo-gelintu guulaysato waxay meesha ka saari kartaa isku-xirka DNS ama wadada ee tunnel-ku u baahnaa, xiriirka ka dhalanayana si fiican ayuu u xaqiijinayaa isagoo aan waxba xallinayn.
Go'aanka la diiwaangelinayo wuu cidhiidhi yahay: script kee, waddo kee, heer kee loo oggolaaday, profile kee. Wax kasta oo kale oo profile-ka ku jira lama beddelo, tanina waa jumlad uu dib-u-eegistuhu hubin karo.