Indlela yokugcina i-OpenConnect isemuva ngemuva kokungena okusebenzisanayo

Uqeda isicelo se-MFA, ithuneli iyaphakama, futhi ukuvala itheminali kuhamba nokuxhumana. Le nkinga yokuqapha, hhayi yokuqinisekisa, futhi i-OpenConnect isivele ineswishi eyixazululayo. Isixazululo siwukuvumela iklayenti ukuba ihluke iye emuva ngemuva kokuphela kokuqala, lapho ingxenye esebenzisanayo isiphelile ngempela. Okulandelayo uhlu lwezinto zokuhlola: zihambe ngokulandelana futhi ume kokokuqala okungasebenzeli isango lakho.

Qinisekisa ukuthi isango lifunani lapho kungena

Ngaphambi kokuthayipha umyalo, bhala indlela yobufakazi obudingwa ukusetshenziswa. Isitifiketi sodwa, iphasiwedi kanye nethokheni, kanye nokuzungeza kwesiphequluli ngomhlinzeki we-SAML kuziphatha ngendlela ehlukile, futhi imodi yasemuva ayikwazi ukweqa nanye yazo. Le nketho ishintsha okwenzeka ngemuva kokuqala, hhayi okwenzeka phakathi nako.

Isilingo esikhangayo siwukwenza isicelo sizenzekele. Isembozo esithayipha impendulo eqondile lapho sibona isicelo sephasiwedi siyaphuka ngesikhathi isango lifuna ikhodi esetshenziswa kanye, futhi sishiya ubufakazi kufayela abanye abantu abangayifunda. Uma umuntu kufanele agunyaze isikhathi, gcina umuntu esizindeni.

Gijimisa isikhathi sokuqala phambili futhi ufunde okukhishwayo

Xhumana kanye ngendlela evamile futhi vumela ukuxhawulana kwandla konke kuprintwe. Bhala iphrothokholi esetshenziswayo, indlela yesitifiketi noma yethokheni, ikheli lethuneli elinikezwa iseva, kanye nazo zonke izexwayiso ngaphambi kokwamukelwa koxhumana. Lowo mbhalo uyisisekelo sakho futhi uyindlela kuphela eshibhile yokuhlukanisa inkinga yeklayenti noshintsho lwesango kamuva. Yigcine ngaphandle kwebhafa yetheminali.

Bese uphinda lokho kubiza ngemodi yasemuva kanye nefayela le-PID elengezwe, isibonelo openconnect --background --pid-file /run/openconnect.pid vpn.example.net, ugcina iphrothokholi nezinketho zokuqinisekisa ezifunwa isango lakho emugqeni ofanayo. Incwadi ye-OpenConnect ichaza le nketho njengokuqhubeka ngemuva ngemuva kokuqedwa kokuqala, futhi yikho kanye okwenza isigaba sokusebenzisana kumele siphele kuqala.

Yenza inqubo egijimayo itholakale futhi imiswe

Ifayela le-PID liwubufakazi kuphela uma lihambisana nenqubo ephilayo. Libeke kufolda ephethwe i-akhawunti yesevisi, futhi uqhathanise inombolo erekhodiwe nethebula lezinqubo ngaphambi kokuthumela noma yisiphi isignali. Ukuqala kabusha nokuphahlazeka kushiya ifayela, futhi ifayela elidala yisizathu esijwayelekile sokuthi iskripthi sokumisa sibike impumelelo ngenkathi ithuneli lisagijima. Thatha ukuhlola njengengxenye yenqubo yokumisa, hhayi isinyathelo esingakhethwa.

Thumela isignali ku-PID eqinisekisiwe, bese uqinisekisa ukuthi isixhumi sethuneli sanyamalala ngempela esikhundleni sokuthemba isimo sokuphuma. Uma iklayenti lidinga amalungelo aphezulu ukulungisa isixhumi, isignali kumele ivele ku-akhawunti evunyelwe ukuyithumela.

Ungaqoqi imodi yasemuva ngaphansi komqaphi

i-systemd nabanye abaqaphi abafanayo balindele ukuthi babe ngabanikazi benqubo abayiqalile, yingakho iklayenti elihlukayo libadida. Umqaphi ubona isiqalisi siphuma ngenkathi ukuxhumana kwangempela kusaphila, ngakho umqondo wokuqala kabusha, ukubika isimo kanye nezikhathi zokumisa kuchaza into engasasebenzi. Bhala iyunithi ngendlela yaphambili esekelwayo futhi ushiye umsebenzi we-daemon kumqaphi.

Gcina --background yezikhathi eziqalwa umuntu bese ehamba. Uma isidingo kuyithuneli ekhona ngaphambi kokuthi noma ubani angene, ingxenye engekho ubunikazi obugunyaziwe obungasebenzi kanye nohlelo lokubuyekeza, futhi akukho fegi yomugqa womyalo enikeza ezinye zazo. Ukwengeza ifegi kuskripthi sokuqala kwenza ithuneli elehluleka buthule kubufakazi bokuqala obuphelelwe yisikhathi.

Thatha ikhukhi yesikhathi njengobufakazi

i-OpenConnect ibhala isigaba sokuqinisekisa esihlukile nge---authenticate, futhi izinto ezivela kungabuyiselwa nge---cookie-on-stdin. Lolo hlamvu lwenzelwe umsebenzi wokuhlanganisa, futhi okukhiqizayo kucwebeza njengephasiwedi elikudalile.

Gcina inani ngaphandle komlando we-shell, ngaphandle kwamarekhodi kanye nangaphandle kwanoma iliphi ithikithi olivulayo. Iskripthi sokudlulisa kumele futhi sigcine ulwazi lwendawo yokugcina eqinisekisiwe iklayenti eliyitholile nekhukhi; uma ulahleka, ukugijima kamuva kungaxhumana nomphathi ongakaze umqinisekise, okuyinto embi kunokuxhumana okumane kwehluleke.

Dlula uhlu ngaphambi kokuthi uvale itheminali

Izinto ezine kumele zibe yiqiniso: ukungena okusebenzisanayo kuphele phambili, ifayela le-PID likhomba inqubo oyiqinisekisile, udaba lomqaphi luxazululiwe ngakolunye uhlangothi, futhi ikhukhi inohlelo lokugcina okungeyona ifayela lombhalo ovamile. Uma zine ziyiqiniso, ukusuka etheminalini kuphephile futhi ithuneli liyaqhubeka.

Uma elinye lihluleka, lungisa leyo nto ngaphambi kokuthinta ezinye, ngoba ukuhlola okusele akukwazi ukuyinxephezela. Gcina nombhalo waphambili wokugijima kokuqala: ngokuzayo lapho ithuneli liwa ngaphandle kwesexwayiso, yileso sisekelo esihlukanisa ushintsho ohlangothini lwesango nolohlangothini lweklayenti.