auth-nocache nefayela lobufakazi: kuyasiza noma kuyalimaza?

OpenVPN ishicilela isexwayiso ekuqaleni esiphakamisa auth-nocache, futhi impendulo ekhangayo ukwengeza inketho bese ubuka umugqa unyamalala. Leso seluleko sithatha ukungena okusebenzisanayo. Lapho igama lomsebenzisi nephasiwedi sezihlala efayeleni, ukuqhathanisa kuyashintsha: inketho iyeka ukuvikela ikhophi ehlala isikhathi eside, futhi kuklayenti elahla amalungelo ingase ngokuhamba kwesikhathi iphule ukuxoxisana kabusha. Amamodeli amabili okugcina kufanele ahlukaniswe ngaphambi kokuhlela iphrofayela.

Izindlela ezimbili zokuphendula isicelo sobufakazi

Imodeli yokuqala umuntu obhala ubufakazi kutheminali, noma isixhumanisi sokuphatha esibubamba ngesikhathi seseshini. I-OpenVPN igcina leyo khophi ukuze ikwazi ukuphendula ukuxoxisana kabusha okulandelayo ngaphandle kokuphinda ibuze, futhi isexwayiso sikhuluma ngakho kanye. Akukho lutho kudiski oluhilekayo, ngakho into kuphela okufanele ivikelwe inqubo ebamba lelo nani. Vala iklayenti futhi ikhophi ihamba nayo.

Imodeli yesibili auth-user-pass ekhomba efayeleni, lapho ifayela liyisitolo futhi iklayenti liyifunda lapho kudingeka inani. Ukuchayeka okubalulekile lapha akusiyo imemori yenqubo kodwa izimvume nobunikazi balelo fayela. Isexwayiso sokuqala sivela emiyalweni ekusethweni, hhayi ekuhloleni ukuthi unikeza kanjani iphasiwedi, ngakho sivela kuwo womabili amamodeli futhi asikho esisikhombayo.

Okusele kwalokhu kuqhathanisa kuvela kulokho kwehlukana: ukuphathwa kwememori kwemodeli eyodwa, ukuphathwa kwefayela nobunikazi benqubo kwelinye.

I-auth-nocache ilahla ini ngempela

Ngokungena okusebenzisanayo, --auth-nocache isusa ikhophi egciniwe emkhumbulweni ngemva kokuba isetshenzisiwe. Izindleko isicelo esisha kuzo zonke izikhawu zokuxoxisana kabusha, ngoba umjikelezo olandelayo awukwazi ukusebenzisa futhi lokho okulahlisiwe.

Ngokungena okusekelwe efayeleni iklayenti lingafunda ifayela futhi, ngakho ukulahla akubonakali kakhulu. Kubonakala endaweni eyodwa abantu abangayilindele: ngemva kokuba i-daemon ilahle amalungelo, uma ifayela lobufakazi lingafundeki yikhodi esebenza ngaphansi kwayo manje.

Engeza inketho ngoba uyakuqonda lokho kushintshana, hhayi ngoba kuvele isexwayiso. Inketho engezwe ukuze i-log ithule kakhulu iyinketho okungekho muntu olinganise umphumela wayo.

Kuphi lapho indlela esekelwe efayeleni iphuka khona

Iklayenti eliqala njenge-root ukuze livule idivayisi yomhubhe bese lishintshela ku- user futhi group , lifunda ifayela lobufakazi kabili: kanye ngaphambi kokushintsha, kanye ekuxoxisaneni kabusha okulandelayo. Uma ifayela likumodi engu-600 futhi lingelika-root, ukufunda kwesibili kwehluleka, futhi ukwehluleka kubonakala ngemva kwehora njengephutha lokufakaza elibonakala njengenkinga yeseva. Hlola i-log yeklayenti eduze kwesikhawu sokuxoxisana kabusha, bese uhlola ikhodi nefayela ndawonye.

stat -c '%a %U:%G' /etc/openvpn/client.creds
ps -o user:12,args -C openvpn | head

Yomibili imigqa ibalulekile. Eyokuqala isho ukuthi ubani angalifunda ifayela, eyesibili isho ukuthi i-daemon esebenzayo ingubani ngempela, futhi ukungafani phakathi kwabo kuchaza ukwehluleka okungeke kulungiswe yinoma ukuphinda kubhalwe iphasiwedi.

Izilungiso ezingokoqobo azikhazimuli: hambisa ifayela liye kusigcawu nakumnikazi okwaziwa yikhodi ye-daemon, noma gcina ukufunda okunelungelo futhi uqinisekise ukuthi iklayenti lakho lifunda kanye kuphela. Ungakuxazululi ngokwenza ifayela lifundeke kuwo wonke umuntu.

Icala elifuna inketho ngempela

Ukungena okuphethe ikhodi esetshenziswa kanye kufuna auth-nocache ngesinye isizathu. Ikhodi esetshenziswa kanye isetshenziswa ukufakaza kokuqala, ngakho ikhophi egcinwe kucishi ayilutho ekuxoxisaneni kabusha okulandelayo, futhi inani elidala lingase liphinde lidlalwe.

Lona umbuzo mayelana nohlobo lobufakazi, hhayi mayelana nokuthi bugcinwa kuphi. Iphasiwedi engashintshi efayeleni elivikelwe inomumo ophambene: kufanele ifundeke kukho konke ukuxoxisana kabusha, futhi ukuvikelwa okudingayo kusefayeleni.

Gcina lezo zizathu ezimbili zihlukene emibhalweni yephrofayela, ngaphandle kwalokho umphathi olandelayo uzothatha ukuthi inketho ikhona ngesizathu ayezokhetha sona.

Ukuqhathanisa esinqumweni esisodwa

Khetha imodeli esebenzisanayo lapho umuntu ekhona futhi ukusha kubalulekile, futhi wamukele isicelo esiphindwayo njengezindleko zaso. Khetha imodeli yefayela lapho iklayenti lisebenza ngaphandle kokuqondisa, bese usebenzisa umzamo kubunikazi, kumodi nasekulahlekeni kwamalungelo.

Awekho amamodeli enza iphasiwedi egciniwe iphephe ngokwayo, futhi awekho enza isexwayiso sokuqala sibe nencazelo.

Uma isexwayiso kuyisona sizathu kuphela sokuvula iphrofayela, bhala isinqumo esikhundleni senketho engachazwanga: ubufakazi buvela efayeleni elingafundwa yikhodi ye-daemon, ukuxoxisana kabusha kuye kwabonakala kuphumelela, futhi ngaphambi kokushintsha isikhawu sayo isigaba sokuxoxisana kabusha encwadini yesandla ye-OpenVPN 2.6 safundwa. Lowo mbhalo uhlala isikhathi eside kunanoma yiliphi ifulegi elilodwa.