Ukukopisha isithombe seseva ye-VPN ngaphandle kokukopisha ubunikazi bayo

Isithombe siyaqala, isevisi iqala futhi amaklayenti axhuma. Leso yisikhathi sokuma futhi ubuze ukuthi yikuphi kwezinto ezimbili ezihluke kakhulu okwenzekile manje. Noma ikhophi ibuyisela isango elilodwa elalingekho ngaphambili, noma yengeza isango lesibili ebuthweni. Zombili zisemthethweni, futhi zinemiphumela ehlukile kubunikazi nokufinyelela. Umshini ovuka kahle awufakazi lutho kukho kokubili.

Izimo ezintathu zinquma impendulo, futhi yizona zitsha ezintathu zezinto isithombe esingazithwala. Zihlukanise ngaphambi kokuthi isithombe sakhiwe, hhayi ngemva kokuba sisetshenziswe kabili.

Qala ngokunquma ukuthi yikuphi kwezinto ezimbili ozenzayo

Ukubuyisela kugcina ubunikazi besevisi obulodwa. Isibonelo esidala sesihambile, igama nesitifiketi kusala, futhi amaklayenti aqhubeka ethemba iphuzu elifanayo lokugcina. Ukwengeza kudala ubunikazi besibili okumele amaklayenti, amarekhodi kanye nokuhoxiswa konke bakwehlukanise.

Umehluko awuyona eyokuhlobisa. Uma abasingathi ababili abaphilayo bethula isitifiketi sesango esifanayo, iklayenti alikwazi ukubahlukanisa, nomkhondo wokucwaninga awukwazi, futhi ukuhoxiswa kwaleso sitifiketi kususa kokubili ngasikhathi sinye. Kungenzeka ukuthi yikho kanye okufunwa ukuklanywa okunenzelwe ukutholakala okuphezulu, futhi akuvamisile ukuthi yikho okuhloswe ikhophi yesithombe esheshayo.

Ngakho isinqumo sokuqala umusho owodwa, obhalwe ngaphambi kokuthi isithombe sishiye umasingathi wokwakha: le khophi ibuyisela isango A, noma le khophi iba isango B. Konke okulandela lokho ukubalwa kwemali uma kuqhathaniswa nalowo musho. Uma kungekho okwaziyo ukuwubhala, ikhophi ayikalungi ukwakhiwa.

Okokufaka okusebenzisekayo futhi, ubunikazi negunya, isimo sokusabalalisa

Isitsha esisebenzisekayo futhi yisona esilula: amaphakethe, ukulungiselelwa okubuyekezwe okungenazimfihlo, amathempulethi esevisi, izilungiselelo zokuqinisa. Yikho isithombe esikwenza kahle ngempela, futhi singaphindwa ngaphandle komkhawulo.

Isitsha sobunikazi negunya yilapho amakhophi enza iphutha khona. Ukhiye wangasese nesitifiketi sesango kukhombisa leso sango kuyo yonke iklayenti. Ukhiye wokusayina womkhandlu wezitifiketi ungenye into enamandla ahlukile: ukhipha ubunikazi. Ukuthemba umkhiphi akusho ukuthi lonke isango elisha lidinga ikhono lokukhipha, futhi ukuthumela ukhiye wokusayina ngaphakathi kwesithombe kunika lelo khono kukho konke okwazi ukufunda isithombe.

Isitsha sesimo sokusabalalisa yisona abantu abasikhohlwayo ngoba sibonakala njengokulungiselelwa. Amakheli okulalela, amachibi amakheli, imizila ephushiwe, izilungiselelo zesixazululi nokuhlanganiswa kwendawo konke kufaka izicabango mayelana nomasingathi wokuqala. Inodi yesibili eyenza ikhophi yazo ingaba nokwaba kusuka echibini esivele siphethwe elinye isango, noma iqondise amaklayenti emthonjeni okhona eduze kwasekuqaleni kuphela.

Yini okumele inodi entsha iyithole, futhi kubani

Inodi elawulwa ngokuzimela kufanele ithole ubufakazi bayo ngomgudu wokubhalisa ogunyaziwe, futhi umsebenzi wokusayina wenziwe lapho kukhona ukhiye wokusayina hhayi kumasingathi omusha. Rekhoda ukuthi yibuphi ubunikazi obungahoxiswa ngaphandle kokuphazamisa ezinye izinodi; uma impendulo ithi "konke", ukuklanywa kunobunikazi obulodwa obuzenza kubini.

Izindinganiso zenethiwekhi zifanele ukwelashwa okufanayo. Khetha ichibi, ikheli lokulalela kanye nesethi yemizila ephushiwe engashayisani nesango elikhona, futhi uzibhale kokokufaka kokuhlinzeka hhayi esithombeni. Okokufaka kungabuyekezwa; isithombe asikwazi.

Kunesimo esiphakathi esisemthethweni. Ukuklanywa kokubuyisela noma kokuphindaphinda okusekelwayo kungagcina ngamabomu ubunikazi besisevisi obulodwa kubo bonke abasingathi, ngokufinyelela okulawulwayo kwikhophi endala kanye nohlelo lokushintsha. Leso yisinqumo esinomnini, hhayi okujwayelekile okwenzeka ngoba isithombe besilula.

openssl x509 -in /etc/openvpn/server/server.crt -noout -subject -issuer -dates
find /etc/openvpn -name '*.key' -o -name '*.pem' | head -20

Umyalo wokuqala utshela ukuthi inodi ithula buphi ubunikazi ngempela nokuthi ngubani owasayinayo. Owesibili uhlu lokuqala, hhayi ubufakazi: izinto zangasese zingahlala ngaphandle kwaleyo ndawadi, ngaphakathi kwesizindalwazi sohlelo lokusebenza, noma ongaphezulu kwesithombe sesikhashana okungasabonisi uhlelo lwamafayela olusebenzayo.

Yini ikhophi yesithombe eyithwalayo ngokuthula

Ukususa ifayela kusibuyekezo sakamuva sesithombe akukususi kwizibuyekezo ezindala, kumashekezi ezendlalelo noma ezithombeni zesikhashana ezathathwa ngesikhathi sikhona. Yikho izithombe ezithwala ubufakazi kufanele ziphathwe njengezinto ezibucayi impilo yazo yonke, hhayi ngesikhathi sokwakha kuphela.

Hlola okuqukethwe yisithombe kanye nokokufaka kokuhlinzeka njengemibuzo emibili ehlukene. Isithombe siphendula "yini engaphakathi kwale ngcikithi", kanti okokufaka kuphendula "iyini le nsizakalo ezoba yiyo ekuqaleni kokuqala". Isithombe esihlanzekile esineskripthi sokuqala esiletha ukhiye owabiwe siphendula kahle umbuzo wokuqala futhi kabi owesibili.

Gcina izithombe zokubuyisela ezinezimfihlo ngokusemthethweni zilinganiselwe kulabo abazidingayo, futhi rekhoda lapho zigcinwa khona. Enye indlela, isithombe esilula ngoba sisebenza ngaphandle kokuhlinzeka, yisona sithombe esinika noma ubani ositholayo ubunikazi besango. Kungenye kuphela yale misebenzi emibili evela kurekhodi lokwakha.

Izivivinyo zokwamukela ngaphambi kokukhiqiza

Ngaphambi kokuthi inodi yamukele ithrafikhi, qinisekisa izinto ezine: ubunikazi eyethulayo, amaklayenti ezowamukela, izinsiza evunyelwe ukuzifinyelela kanye nomgudu wokubuyela wamakheli ewabelayo.

systemctl status openvpn-server@lab --no-pager
ss -lunp 'sport = :1194'
ip -4 route show table all | grep -F '10.90.'

Bese uhlola isimo esingesihle, okuyisona esibamba izingozi: ingabe inodi entsha inokufinyelela komlawuli noma kweklayenti okwakuhloselwe okwangempela? Ukulungiselelwa okukopishiwe kungathwala ukufakwa kweklayenti okungeziwe, umzila wokuphatha ozuzwe njengefa noma umyalo wokupusha owawunengqondo kumasingathi wokuqala.

Uma isithombe esinezimfihlo eziphilayo sesidlule umngcele waso ogunyaziwe, shintsha ubufakazi futhi unciphise amakhophi. Ukususa ifayela ekwakhiweni kwakamuva akufani nokuhoxisa ekusebenziseni ubufakazi amakhophi amadala asabubambile, futhi igebe phakathi kwala maqiniso amabili iyona ncaca impela iwindi umhlaseli alidingayo.