Ngemva kokwehliswa kwamalungelo: yimaphi amafayela e-OpenVPN asasebenza?
Ama-descriptor avulwe ngaphambi kokwehliswa ayaqhubeka nokusebenza; izindlela ezivulwa kabusha kamuva azenzi njalo. Nquma ukuthi iyiphi kumafayela amathathu esikhathi sokusebenza okumele ivulwe kabusha.
Isikhathi eside sokusebenza sifakazela kuphela ukuthi ukuqalisa kwaphumelela ngamalungelo ayenawo i-daemon ngaleso sikhathi. Ukwehluleka okubalulekile lapha kuza kamuva: iklayenti elisha liyaxhuma, uhlu lokuhoxiswa luyashintshwa, iskripthi elisizayo kufanele libhale ifayela. Ngakunye kwalokhu ukuvulwa okusha okwenziwa i-akhawunti engenawo amalungelo, nombuzo wayo wemvume nomlayezo wayo wephutha. Izinqumo ezintathu zihlukanisa ukuhlelelwa okuqhubeka kusebenza kulokho okuzohluleka ngomcimbi olandelayo.
Hlukanisa okwalayishwa kusenesikhathi kulokho okuvulwa kamuva
I-descriptor iyisibambo phezu kwencazelo yefayela evuliwe, futhi imodi yokufinyelela yanqunywa ngesikhathi kudalwa leyo ncazelo. Ukushintsha umsebenzisi wenqubo kamuva akusicishi isibambo, yingakho ifayela lokhiye elifundwe njenge-root liqhubeka lisebenza ngemva kokwehliswa. Imodi nayo ayishintshi: isibambo esivulelwe ukufunda asibi ngokubhalelekayo, futhi isibambo esibhalelekayo asihoxiswa kuphela ngoba i-akhawunti ilahlekelwe amalungelo ayo endleleni. Lawa maqiniso amabili achaza ingxenye enkulu yokuziphatha okumangazayo kulemibiko.
Ingxenye yesibili ingumemori. I-daemon ingahlaziya isitifiketi, igcine impahla ehlaziyiwe bese ivala ifayela; okusalayo kusetshenziswa idatha, hhayi ifayela elivuliwe. Ngakho ukuhamba okuqhubekayo akufakazeli ukuthi i-descriptor ivuliwe noma ukuthi igama lendlela liyafinyeleleka. Kufakazela kuphela ukuthi impahla edingekayo seshini yamanje yatholakala ngaphambili.
Ukuvulwa kamuva kungenye into. Kwenzeka ngaphansi kobunikazi bamanje, umongo wokuphepha wamanje kanye nombono wokufaka wamanje, ngakho indlela eyayifundeka ekuqaleni ingase yenqatshwe ekuxhumaneni okulandelayo. Ukujikeleza kwengeza ugibe: ukubhala ifayela elisha phezu kwegama elifanayo lendlela kushiya i-descriptor ekhona iboshelwe entweni endala, ngakho ukulayisha kabusha kungabonakala kuphumelele kuyilapho i-daemon isasebenzisa okuqukethwe kwangaphambili. Qhathanisa i-inode ephethwe inqubo naleyo esediski ngaphambi kokukholelwa ukujikeleza.
Shono ukufunda okuthathu kwesikhathi sokusebenza nokuthi kwenzeka nini ngakunye
Izinsiza ezintathu zivame ukuvulwa isikhathi eside ngemva kokuqalisa, futhi ziyahluleka ngezikhathi ezihlukene. Ifayela lokuhlelelwa leklayenti elithile lifundwa lapho lelo klayenti lixhuma, ngakho lingaphuka kumsebenzisi oyedwa kuyilapho abanye baqhubeka. Idatha yokuhoxiswa ibhekwa ngesikhathi sokuqinisekisa uzakwabo naphinda lapho ifayela lishintshwa. Indawo yesikhashana ithintwa kuphela lapho iskripthi noma isengezo libhala okuthile.
Akukho kokuthathu okungokwendlela yokuqalisa, yingakho iseva ebilokhu iphilile amasonto ingahluleka ekuxhumaneni okulandelayo. Isigaba sisho nomnikazi wesilungiso: ezimbili zokuqala yimvume yokufunda kuhlelelwa ngaphansi kwe-akhawunti ye-daemon, kanti eyesithathu indawo ebhalelekayo enomgomo omncane.
| Path reopened later | What triggers the open | First sign when it fails |
|---|---|---|
| Client configuration file | A connection for that client identity | One client rejected while others connect |
| Revocation data | Peer authentication, including after replacement | Revoked and valid peers both refused |
| Script or plugin temporary directory | A helper needs to create a file | The helper exits with a path error |
persist-key liphendula umbuzo omncane kunalokho abaningi abakucabangayo. Ligcina ifayela lokhiye livuliwe phakathi nokuhlelwa kabusha okubhaliwe kwe-SIGUSR1 ne-ping-restart, futhi akwenzi lutho kumafayela e-CCD, idatha yokuhoxiswa, izinhlelo ezisizayo eziphumelelayo noma ukuqalisa kabusha okuphelele kwenqubo. Lokho kusalandela izindlela zako zokuvula, ngaphansi kwanoma iyiphi i-akhawunti esebenzayo ngaleso sikhathi.
Qinisekisa i-akhawunti kanye nombono enawo ngempela
Buza i-daemon esebenzayo ukuthi isebenzisa iyiphi i-akhawunti esikhundleni sokwethemba ifayela le-unit, bese uqhathanisa impendulo nalokho okubekwa yi-unit. Ukungafani yinto yokuqala okufanele ixazululwe, ngoba konke ukuhlolwa kwemvume okulandelayo kwenzeka njengalowo inqubo eyikho ngempela. Bese uhamba indlela ingxenye ngengxenye; ukudlula kuhlolwa ezingeni ngalinye, ngakho ifayela elifundekayo ngaphakathi kwendawo engadluleki lihlala lingafundeki. Imodi yokugcina yefayela umbuzo wokugcina, hhayi owokuqala.
Izikhala zamagama namabhokisi esihlabathi esevisi zengeza imingcele engachazwa ubunikazi namabhithi emodi. Indlela ebonakala kushelakhi yakho ingase ingabikhona noma ifundeke kuphela ngaphakathi kwe-chroot, indawo yamagama yokufaka noma i-unit efihla izikhombisi zasekhaya. Amamojula okuphepha engeza olunye ungqimba, ngakho ifayela elibonakala lifundeka lingase lenqatshwe lapho livulwa.
ps -o user:12,pid,args -C openvpn
systemctl show -p User -p Group -p ProtectHome -p RootDirectory [email protected]
sudo -u openvpn namei -l /etc/openvpn/ccd/aliceUkufunda okuphumelelayo kushelakhi yomlawuli akuhloli nesinye salezo zimo ezihlangene. Sebenzisa ukuhlola njenge-akhawunti ye-daemon, nendawo yamagama kanye nebhokisi lesihlabathi elifanayo, noma wamukele ukuthi umphumela uchaza ishelakhi yakho hhayi iseva. Umyalo wesithathu uyinguqulo eshibhile yalokho kuhlola: uprinta imodi yengxenye ngayinye futhi uhluleka engxenyeni yokuqala i-akhawunti ye-daemon engakwazi ukuyidlula.
Nika ukubhala kwesikhathi sokusebenza indawo yako
Ukufunda ingxenye kuphela yohlu. Iskripthi esisizayo singase sidinge ukudala ifayela lesimo, isengezo singase sidinge ukubhala isimo eceleni kohlelelwa lwaso, futhi lokho kubhala akumbozwa ukwenza isihlahla sohlelelwa sibhaleleke. Nika indawo ethile imvume yokubhala edingwa umsebenzi wayo, nomnikazi nemodi ongayichaza. Khetha ukufinyelela kokufunda kuphela kukho konke okufundwa kuphela.
Gcina izimvume zokhiye wangasese zihlukile kumafayela wenqubomgomo. Ukhiye okufanele ufundwe kabusha ngemva kokuhlelwa kabusha unesidingo esihlukile kunefayela leklayenti elifundwa ekuxhumaneni ngakunye, futhi imodi eyodwa evulekile kukho kokubili inika ukufinyelela okungaphezu kwalokho okudingwa inkinga. I-akhawunti ye-daemon ezinikezelwe enobunikazi obuncane ilula ukuyihlola kun Iqembu elibanzi. Lapho ukhiye kufanele umelane nokuhlelwa kabusha, persist-key isusa ukufunda kabusha esikhundleni sokwandisa indawo.
Nquma ngomcimbi ongawuphinda
Umhubhe ophilayo ufakazela indlela eyodwa kukhodi. Umcimbi odinga ifayela uwukuhlola kuphela okuhlanganisa ukuvulwa okukhathazayo, kungaba ukuxhumana kweklayenti elisha, ifayela lokuhoxiswa elishintshiwe, ukuhlelwa kabusha okuthambile okuvunyelwe noma ukuqalisa kabusha okuhleliwe. Khetha umcimbi, wusebenzise, futhi gcina iphutha lokuqala hhayi lokugcina.
Ekuhlelweni kabusha okuthambile, isignali eyodwa kanye nelogi ye-unit kukhombisa ukuthi ukhiye ufundwe kabusha yini. Thumela isignali, bese ufunda imigqa yokugcina ebhalwe yi-unit:
systemctl kill -s SIGUSR1 [email protected]
journalctl -u [email protected] -n 40 --no-pagerUngaphethi ngokuthi i-daemon ehlanjelwe ayisakwazi ukushintsha amafayela ngoba nje amalungelo ehlisiwe. Lokho esakwazi ukukwenza kuncike kobunikazi obusele, amakhono ayo, izindawo ezingabhaleleka kuzo kanye nanoma iyiphi i-descriptor ekhona ebhalelekayo esayiphethe. Ukwehlisa amalungelo kunciphisa igunya, futhi uhlu lokuvulwa kwesikhathi sokusebenza yilona olukhombisa ukuthi kungakanani. Bhala lowo mngcele eceleni kohlelelwa ukuze umuntu olandelayo angadingi ukuwuthola futhi.