Indlela yokuhlanganisa iphrofayili yeklayenti ye-OpenVPN ngamafayela akhishiwe

Umqhubi wakho unikeza ibhantshi le-CA, isitifiketi seklayenti kanye nokhiye waso, futhi iklayenti ngeke liqale kuze kube yilapho lezi zixhunywe ephrofayilini eyodwa. Iphrofayili iwukulungiselela: ikhomba kulawo mafayela, ayiwafaki ngaphakathi, futhi ukuhlela akukwazi ukuyiguqula ibe isitifiketi. Umhlahlandlela uqala kukhompyutha ephathekayo esivele igunyaziwe futhi uphela ngephrofayili ongayiqalisa kusuka kudijithali eyaziwayo. Awedali i-CA, awubhalisi isitifiketi esisha futhi awuthinti iseva.

Umgomo lapha iwukuthi iklayenti lomugqa womyalo le-OpenVPN 2.6 le-Linux, elihamba nge-TUN phezu kwe-UDP, ngokuqinisekiswa kwesitifiketi.

Qoqa amafayela ohlangothi lweklayenti kuphela

Sebenza kudijithali evikelwe futhi uqoqe izinto zokwethemba ze-CA ezigunyaziwe, isitifiketi seklayenti okhishiwe kanye nokhiye oyimfihlo ohambisana naso. Kulesi sibonelo amagama yi-ca.crt, laptop-a.crt kanye ne-laptop-a.key. Amagama amafayela ayizimpawu nje; awasho lutho mayelana nalokho okuqukethwe yifayela ngalinye.

Uma wakha ukhiye ngesikhathi sokubhalisa, awuzange uwushiye umshini; kumkhiphi kufanele kubuye kuphela isitifiketi esisayiniwe kanye nechungechunge lomphakathi. Hlola ukuthi isitifiketi sinesikhundla seklayenti okulindelwe yisevisi. Hlola futhi ukuthi ukhiye ungowaleso sitifiketi hhayi owesitifiketi esidala esivela emzameni wangaphambilini. Ibhangqwana elingahambisani lidala ukwehluleka kwe-TLS kusemva kakhulu, futhi lokho kubonakala njengenkinga yeseva.

Shiya ngaphandle kwale bhantshi ukhiye wokufaka isiginesha oyimfihlo we-CA, ukhiye oyimfihlo weseva kanye namapharamitha e-DH.

Xhumanisa amafayela abe iphrofayili encane

Iphrofayili engezansi imfushane ngamabomu. Umgqa ngamunye ukhetha indawo yokugcina, uvimbela ubunikazi eklayenti elizobamukela, noma ukhomba kwelinye lamafayela amathathu.

client
dev tun
proto udp
remote vpn.example.net 1194
nobind

remote-cert-tls server
verify-x509-name vpn-gateway name
ca ca.crt
cert laptop-a.crt
key laptop-a.key

Umgqa we-remote ukhetha indawo yokugcina yenethiwekhi. I-remote-cert-tls server ifuna ukuthi uhlangothi olubhekene nalo lwethule isitifiketi esinesikhundla seseva. I-verify-x509-name igxilisa igama elilindelekile, lapha i-vpn-gateway njenge-Common Name yesitifiketi seseva ngensimu yegama ezenzakalelayo ye-OpenVPN. Lelo nani alitholakali egameni lomsingathi we-DNS, ngakho sebenzisa uhlelo lobunikazi olunikezwe umqhubi.

Ungawashiyi lawo mahlolwa ngenxa nje yokuthi indawo yokugcina yokuhlola ikhombisa esinye isitifiketi.

Le phrofayili eyisisekelo ithatha ukuthi akukho nselelo ye-akhawunti ehlukile futhi akukho khiye yesiteshi sokulawula. Uma isevisi idinga i-auth-user-pass, i-tls-auth noma i-tls-crypt, gcina ukulungiselela kanye nezinto okunikezwe zona, ngoba imfihlo yesiteshi sokulawula oyenzayo ngokwakho ngeke ihambisane naleyo ephethwe yiseva. Gcina futhi inqubomgomo yokubethela yesevisi esikhundleni sokungenisa imigqa yokucindezela noma yokubethela kusukela esibonelweni esidala.

Yenza idijithali yokusebenza icace

Amaphuzu omzila ahlobene alandela idijithali yokusebenza yenqubo, hhayi indawo yefayela le-.ovpn.

Lokho kuyamangaza abantu abahambisa iphrofayili iye kufolda entsha futhi balindele ukuthi ukhiye uzolandela. Kudijithali ekhethwe umlawuli, umyalo ongezansi ushintshela emzileni ophelele ngaphambi kokufunda iphrofayili kanye nezikhombo zayo.

sudo openvpn --cd /etc/openvpn/client/laptop-a --config laptop-a.ovpn

Isihlinzeki sokungenisa samadeshibhodi noma isevisi yohlelo ingase ihlanganise izincikelela esikhundleni sakho futhi isebenzise imithetho yayo. Ingase futhi isebenzise idijithali yokusebenza ehlukile kunaleyo oyihlole. Qinisekisa ukuthi indlela yakho yokuqalisa ixazulula kanjani amaphuzu okhiye, esitifiketi ne-CA. Ukuhambisa ifayela le-.ovpn kuphela akuhambisi ukhiye oyimfihlo ohlukile.

Gcina ukhiye ufundeka kuphela kumsebenzisi ohlosiwe noma kubunikazi besevisi.

Qinisekisa ukudluliswa, hhayi amagama amafayela

Ngaphambi koxhumano lokuqala olugunyaziwe, hlola indawo yokugcina, ubunikazi besitifiketi, umkhiphi kanye nesikhathi sokusebenza. Bese uqinisekisa ukuthi izikhombo zamafayela zixazululwa kusukela kudijithali yokusebenza ozoyisebenzisa ngempela. Ngemuva kokuxhumana, hlola ukuziphatha kohlelo lokusebenza kanye ne-DNS okufanele kuhlinzekwe inqubomgomo yomzila. Amafayela amathathu afundekayo awafakazi lutho mayelana nogunyazwa lweseva noma ngomzila wensiza osebenzisekayo.

Uma kuvela isicelo sebinzana lokhiye wokungena, ingeyokhiye oyimfihlo, hhayi eye-akhawunti ye-VPN.

Ekugcineni, bhala uhlu lwebhantshi njengezinto zobufakazi. Ukunikeza isitifiketi kanye nokhiye ofanayo kukhompyutha yesibili kukopisha ubunikazi, futhi ukushintsha igama lefayela akukunikezi ukubhaliswa kwesibili. Lokho kuwumehluko phakathi kokuhlanganisa iphrofayili nokuyikhipha.