Adeegga OpenVPN wuu istaagaa marka la weydiiyo furaha sirta ah ee furaha gaarka ah: sida loo hagaajiyo
Adeeg ma leh terminal, sidaas darteed fure sir ah wuxuu u baahan yahay askpass iyo fayl la akhrin karo. Kala sooc ereyga sirta ah ee furaha iyo gelitaanka serverka oo hubi unit.
OpenVPN wuxuu weydiiyaa ereyga sirta ah ee furaha gaarka ah mashiinka maxalliga ah, sidaas darteed fayl galitaan shaqeeya waligiis kama jawaabo. Adeeg ma leh terminal lagu qoro, bilowga wuxuu ama dhejiyaa ama ku guuldareystaa diiwaan journal ah oo magacaabaya gelinta halkii sababta. Laba sir ayaa ku lug leh, mid kastaana wuxuu u baahan yahay isha u gaar ah oo la akhrin karo ka hor inta aan unit dib loo bilaabin. Tallaabooyinka hoose way kala soocaan, ka dibna waxay hubiyaan aqoonsiga dhab ahaan furaya fayl kasta.
Kala sooc labada codsi
Ereyga sirta ah ee furaha wuxuu furfuraa furaha gaarka ah ee maxalliga ah; xogta akoonka waxay xaqiijisaa fadhiga serverka. Waxay ka yimaadaan meelo kala duwan, way ku guuldareystaan waqtiyo kala duwan oo waxay bixiyaan farriimo kala duwan. Iyaga oo isku qasan wuxuu dadka u dirayaa raadinta dib u dejinta furaha sirta ah iyadoo akoonku aanu ku lug lahayn. Akhri qoraalka codsiga ka hor inta aanad beddelin ikhtiyaar kasta, maxaa yeelay ereyada ayaa ah tilmaanta kaliya ee lagu kalsoonaan karo ee ku saabsan sirta maqan.
Gudaha Community OpenVPN 2.x askpass wuxuu tilmaamayaa fayl haysta ereyga sirta ah ee furaha safka koowaad, auth-user-pass na wuxuu tilmaamayaa fayl leh magaca isticmaalaha saf iyo furaha sirta ah safka xiga. Midkoodna faylasha ma buuxin karo ikhtiyaarka kale. Abka desktop ama profile NetworkManager waxay labadaba ku hayn karaan kaydkooda sirta ah, oo aan clientka khadka amarka waligiis akhrin, sidaas darteed xusuusnow clientka aad habaynayso ka hor inta aanad qorin waddo kasta.
U jeedi labada ikhtiyaar faylal la akhrin karo
Profile u baahan labada gelin wuxuu ku dhammaanayaa saddex tixraac fayl: furaha sir ah, ereyga sirta ah ee furaya, iyo lammaanaha gelitaanka. Ku dar iyaga oo aan taaban CA iyo hubinta aqoonsiga, maxaa yeelay kuwaasi waxay go'aamiyaan serverku waa ayo oo qayb ka ma aha dhibaatadan. Haddii baahinta aanu isticmaalin xogta akoonka gabi ahaanba, ku darista auth-user-pass waxay abuurtaa gelin aan cidna bixin karin.
key /etc/openvpn/client/office.key
askpass /etc/openvpn/client/office-key.pass
auth-user-pass /etc/openvpn/client/office-login.authIkhtiyaarada aan dood lahayn waxay u dhaqmaan si ka duwan ikhtiyaarada leh waddo, oo adeegga farqigaasi waa muhiim. askpass oo aan dood lahayn weli wuxuu akhriyaa console-ka, faylka auth-user-pass ee magaca isticmaalaha kaliya ku jiraana weli wuxuu ka tagaa codsi furaha sirta ah oo sugaya. Marka clientku daemon noqdo ma weydiin karo gelin terminal gabi ahaanba, sidaas darteed adeegga sidaan loo habaystay ma soo baxo.
Waddooyinka buuxa waxay meesha ka saaraan su'aasha ku saabsan galka shaqada laakiin ma bixiyaan gelitaan. Ka dib waxaa yimaada lahaanshaha, qaabka iyo gudbinta, saddexdaana waxaa lagu hubiyaa akoonka uu habsocodku ku socdo.
Akhri habaynta unit ka hor profile-ka
Waa unit, ma aha faylka aad wax ka beddelayso, ee go'aamiya habaynta uu tusaalaha soo rarto. Akhri khadka amarkiisa iyo drop-in kasta, ka dibna raac galka shaqada ilaa profile-ka dhab ahaan la isticmaalayo. Tixraac erey sir ah oo lagu daray fayl .ovpn kale waxba kama beddelo tusaalahan.
Saddex amarro akhris-kaliya ayaa ka jawaaba inta badan. Midda koowaad waxay daabacdaa unit iyo drop-in kasta, midda labaad aqoonsiga iyo dejinta sandbox ee xaddidaya habsocodka, midda saddexaadna waxa bilowgii ugu dambeeyay dhab ahaan ka cabanayay. Isticmaal magaca tusaalaha ku yaal hostka:
systemctl cat [email protected]
systemctl show [email protected] -p User -p Group -p WorkingDirectory -p ProtectHome
journalctl -u [email protected] -bFiiro gaar ah u yeelo ProtectHome iyo ikhtiyaarada profile-ka laftiisa user, group iyo chroot. Fayl ku jira galka guriga ayaa laga yaabaa inuu ku akhrisan karo shell-kaaga oo uu ku dhex qarsoonaado adeegga marka galalka guriga la qariyo. Akoonka uu systemd ku bilaabo had iyo jeer ma aha akoonka ugu dambayn furaya furaha.
Caddee in aqoonsiga waqtiga socodka uu furi karo labada fayl
Akhriska qaabka kuma filna, maxaa yeelay gal kasta oo ku yaal waddada waa inuu ahaado mid aqoonsigaas la mari karo. Mara waddada qayb qayb, ka dibna tijaabi furitaanka sida akoonka uu habsocodku isticmaalayo. Fayl leh qaab 600 oo root leeyahay wuxuu shaqeeyaa kaliya inta habsocodku weli root yahay, taas oo aan run ahayn ka dib hoos u dhigista mudnaanta ee profile badan sameeyaan. Laba amarro ayaa daboolaya gudbinta iyo furitaanka:
namei -l /etc/openvpn/client/office-key.pass
sudo -u openvpn test -r /etc/openvpn/client/office-key.pass && echo readableAmarka koowaad wuxuu daabacaa qaabka qayb kasta oo wuxuu ku guuldareystaa meesha akoonku mari karin; kan labaad wuxuu ka jawaabaa su'aasha kaliya ee muhiimka ah, taas oo ah in aqoonsiga waqtiga socodku furi karo faylka akhris. Midkoodna ma daabaco waxa ku jira faylka, taasna waa qodobka muhiimka ah marka faylku hayo erey sir ah. Ku celi tijaabada faylka gelitaanka, maxaa yeelay labada waxaa badanaa lagu kaydiyaa lahaansho kala duwan.
Haddii habsocodku isticmaalo chroot ama namespace xaddidan, ku socodsii tijaabadaas gudaha aragtidaas, haddii kale jawaabtu waxay qeexaysaa nidaam fayl oo khaldan. Erey sir ah oo lagu kaydiyay gal guri qarsoon waa tusaalaha caadiga ah ee tijaabada ka gudubta unit-ka banaankiisa kuna guuldareysta gudihiisa.
Hubi bilowga koowaad, ka dib dib u xiriir
Bilow tusaalaha hal mar oo akhri guuldareysta koowaad ee ma aha tii ugu dambaysay. Faylka gelinta ee maqan, furfurid fure oo guuldareystay iyo AUTH_FAILED serverka ka yimid waa saddex dhacdo oo kala duwan oo leh saddex hagaajin oo kala duwan. Hagaajinta digniinta ogolaanshaha waxba ma caddeyso ku saabsan in furaha la furay iyo in kale.
Sadarka journal wuxuu sheegaa mid ka mid ah saddexda. Hagaajintu waxay ka timaaddaa gelinta kee ku guuldareystay:
| What the journal shows | Which input failed | Where to look |
|---|---|---|
| A path that cannot be opened | The file the profile names | Askpass or login path, and the unit's working directory |
| A key decryption error | The key passphrase | First line of the askpass file, and read access for the runtime identity |
AUTH_FAILED from the server | The account credentials | Login file contents, and whether the account is still valid |
Ka dib tijaabi meertada nolosha ee dhab ahaan u baahan tahay: bilow marka la kiciyo iyo dib u xiriir kasta oo la taageeray, ma aha oo kaliya bilow gacan ah oo ka imanaya shell-kaaga. auth-nocache gelinta waa la tuuraa ka dib isticmaalka koowaad, sidaas darteed dib u xiriir dambe weli wuxuu u baahan yahay isha la akhrin karo. Silsilad fure oo la furay marka la galo desktop ma heli karo adeeg bilaabay ka hor inta qofna gelin, waana sababta caadiga ah ee tijaabada gacan ah ay gudubto oo dib u kicinta ay ku guuldareysto. Haddii bilowga koowaad guuleysto oo dib u xiriir dambe ku guuldareysto, akhri journal-ka dhacdada dib u xirirka ka hor inta aanad mar kale beddelin ogolaanshaha.
Kaydinta ereyga sirta ah furaha agtiisa waxay yaraysaa waxa sirta ay ku siinayso, sidaas darteed xaddid faylkaas iyo nuqulladiisa. U qaado ka saarista ereyga sirta ah ee furaha go'aan aqoonsi oo gaar ah, ma aha hagaajinta gelin maqan. Baahin ku tiirsan oggolaansho bini'aadam ama MFA is dhexgal leh waxay u baahan tahay wakiilkeeda ama is-dhexgelinta maamulka ee la taageeray; kood hal-mar ah oo si joogto ah loo kaydiyay ma aha beddelka u dhigma.