I-AnyConnect ku-Linux: ukubhala ngokuphepha ukulandelana kokungena

Iklayenti le-vpn eliza ne-Cisco AnyConnect liziphatha njengengxoxo: liphrinta umbuzo, lilinda umugqa, bese liphrinta olandelayo. Uma ufaka leyo ngxoxo isuka efayeleni noma epayipini, leyo binary efanayo isebenza ngaphandle kokuqashelwa. Indlela iwukudluliswa okukodwa kanye nohlu lwezimpendulo oluhleliwe, futhi uhlu, hhayi ukudluliswa, yilona olunquma ukuthi iskripthi sithembekile yini.

Ezintweni ezenzekayo izinto ezimbili ziliphazamisa lokhu. Ukulandelana kwemibuzo kuyashintsha lapho isango libuza okunye, futhi iphasiwedi egciniwe iguqula iphutha elilodwa lokuthayipha libe ukuvalwa kwe-akhawunti. Thatha ukulandelana njengedatha enezinguqulo ongayiqhathanisa ngemuva kwanoma yiluphi ushintsho lwesango. Yehluleka ngomsindo esikhundleni sokuzama futhi, ngoba umjikelezo yiwo kanye indlela iphasiwedi ethayiphiwe kabi eba i-akhawunti evaliwe ngayo.

Ukulandelana okukodwa, ngokulandelana okubuza ngakho iklayenti

Gijimisa iklayenti ngendlela yokuxhumana kanye kuphela bese ubhala phansi wonke umbuzo ngokulandelana okubonakala ngakho. Lowo mbhalo uba ifayela lezimpendulo. Uma udlulisela ifayela ku-binary, umugqa wokuqala kufanele ube umyalo wokuxhuma uqobo, yingakho ukulandelana kuqala ngegama lomsingathi hhayi igama lomsebenzisi.

connect vpn.example.com
0
<username>
<password>
y
exit

0 engenalutho ikhetha iphrofayela yokuqala yokuxhuma lapho isango linikeza uhlu; sebenzisa inkomba ephrintwa isango lakho. y yamukela ibhana yokungena, ngakho susa lowo mugqa uma kungekho bhana futhi ufake owodwa lapho isango lakho libuza umbuzo owengeziwe. exit yokugcina iyona evumela iklayenti ukuthi liqede ngokuhlanzekile lapho impendulo yokugcina isetshenzisiwe.

/opt/cisco/anyconnect/bin/vpn -s < anyconnect.txt

Indlela engenakho ukuxhumana ayikona ukuzikhethela lapha. Ngaphandle kwe--s iklayenti lingathatha itheminali futhi lishaye indiva okokufaka okudlulisiwe; nayo izimpendulo zifundwa emfuleni futhi inqubo iyabuya. Lapho i-binary idinga amalungelo aphakeme, songa ukushaywa ku-sudo -n ukuze iskripthi sehluleke ngokushesha esikhundleni sokumisa embuzweni wephasiwedi.

Lapho ifayela lezimpendulo livuza khona

Ifayela eliqukethe iphasiwedi liwubufakazi bokuqinisekisa, ngakho linikeze izimvume zobufakazi: imodi 600, liphethwe i-akhawunti eqhuba umsebenzi, futhi lingalokothi libe ngaphakathi kwedirekhthori okwabelwana ngalo noma elivumelanisiwe. Lidale selivele linemodi esetshenzisiwe esikhundleni sokulilungisa kamuva, ngoba ifayela lifundwa yiwo wonke umuntu isikhashana phakathi kokubhala ne-chmod.

install -m 600 /dev/null ~/.config/anyconnect.txt
chmod 700 ~/.config

Ingxenye yesibili yi-argv. Iphasiwedi edluliswa njengengxabano ibonakala kuwo wonke umsebenzisi wendawo obala izinqubo, futhi ingena emlandweni we-shell. Yifunde kusihlukanisi sefayela noma kusiguquguquki sendawo esikhundleni salokho, futhi ubeke umthwalo kuzicaphuno ukuze i-shell ingakwazi ukwandisa lutho ngaphakathi kwawo.

printf '%s\n' 'connect vpn.example.com' '0' "$VPN_USER" "$VPN_PASS" 'y' 'exit' \
  | sudo -n /opt/cisco/anyconnect/bin/vpn -s

Qaphela izicaphuno. Ngaphakathi kwezicaphuno ezimbili iphasiwedi equkethe i-! ingandiswa yi-shell exhumanayo ngaphambi kokuba iklayenti liyibone, futhi ukwehluleka kufika njengephutha elijwayelekile le-event-not-found elibonakala njengenkinga yephrothokholi.

Fakazela ithumbu, bese ulivala

Isimo sokuxhumeka sifakazela kuphela ukuthi iklayenti likholelwa ukuthi linesikhathi. Khetha umsingathi ophendula kuphela ngaphakathi kwenethiwekhi yebhizinisi bese uwuhlola kanye ngaphambi kokwenza enye into. Ukwehluleka lapho kuyiphutha lokuhamba noma lenqubomgomo, futhi ukugijimisa ukungena futhi ngeke kukushintshe.

/opt/cisco/anyconnect/bin/vpn state
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 10 https://<internal-host>/
/opt/cisco/anyconnect/bin/vpn disconnect

Hlola okukhiphayo kwesimo ngaphambi nangemuva kokunqamula. Iklayenti elishiywe linesikhathi esidala lingala ukuxhumeka okulandelayo kuyilapho iskripthi sisabika impumelelo, futhi leyo ndlela yokwehluleka ayibonakali uma ubheka kuphela amakhodi okuphuma. Qhathanisa ukufundwa kokubili esikhundleni sokuthemba okwesibili wedwa. Ama-aliyasi kuphrofayela ye-shell anele ukusetshenziswa kwansuku zonke, kuyilapho noma yini ehleliwe ifanele ukubuyekezwa kobufakazi nokuthi ungubani njenganoma yimuphi omunye umsebenzi ongenakuqashelwa.

Lapho uhlu olungaguquki lungasaphephile

Ifayela lezimpendulo lifaka ikhodi yokulandelana kwemibuzo yanamuhla. Ibhana eshintshiwe, ushintsho lwephasiwedi oluphoqelelwe noma inselelo yesici sesibili kuyenza ibe umjikelezo ongavala i-akhawunti, yingakho iskripthi kufanele siphume embuzweni wokuqala ongalindelekile esikhundleni sokuqala kabusha.

Bamba lokho okwaphrintwa iklayenti, buyisela isimo esingesona uziro futhi ushiye isinqumo kumshayeli. Lapho isango lifuna isici sesibili, impendulo eqotho iwukuthi ukungena ngaphandle kokuqashelwa akutholakali kuleyo phrofayela, hhayi ukuthi ukulandelana kudinga omunye umugqa.

Ukujikeleza kuyingxenye yalokho kubuyekezwa. Uma ubufakazi bugcinwa, nquma ukuthi ubani angabufunda, bushintsha nini futhi yini ebukhiphayo uma umsingathi wakhiwa kabusha. Iskripthi esisebenza unyaka ngoba akekho othinte iphasiwedi akusona isakhiwo, kuyingozi elindele inqubomgomo yokujikeleza.

Amafayela angesona i-AnyConnect

Izitayela ezimbili zakudala zobufakazi be-Cisco zididaniswa nalokhu. Iphrofayela ye-vpnc icela i-IPSec ID, okuyigama leqembu ngempela, bese kuba imfihlo yeqembu, bese kuba ubufakazi bakho, futhi zontathu zivela kulowo ophethe isango. I-Cisco IPsec yakudala iyiphrothokholi ehlukile kwi-AnyConnect, ngakho i-vpnc ayikwazi ukufinyelela isevisi ye-AnyConnect kuphela; i-openconnect --protocol=anyconnect iyiklayenti elivulekile lalowo msebenzi.

Ifayela le-.pcf lichaza iphrofayela yeklayenti lakudala. Umsingathi, igama leqembu kanye nephasiwedi yeqembu elikulo kungafakwa kabusha ngesandla kuklayenti elikhuluma i-Cisco IPsec, nakuba ifayela lingenisi eliphelele futhi noma yiliphi ichweba noma imodi yethumbu engeyona ezenzakalelayo ngokuvamile iyanyamalala ekudlulisweni.

Qala ngalokho isango elikunikeza ngempela, bese ukhetha iklayenti elikhuluma leyo phrothokholi. Ukukopisha iphrofayela kusuka kwenye isayithi yiyo indlela abantu abagcina ngokulungisa ubufakazi obungakaze bube yinkinga.