Qhathanisa amaphrofayili amabili e-OpenVPN ngaphandle kokukhipha okhiye

I-diff yombhalo ingaveza okhiye abangaphakathi kalula njengoba ikhombisa umyalelo oshintshile. Qhathanisa ngendima kumakhophi avikelwe, bese wenza ifayela lokuxilonga elihlolwe kabusha elihlukile.

Amaphrofayili amabili, elilodwa liyaxhumana elinye alixhumani, futhi indlela esheshayo yokubona ukuthi kungani yi-diff. Inkinga ukuthi i-diff efanayo iphrinta ukhiye wangasese ongaphakathi, ukhiye omile kanye nanoma iyiphi ibhlokhi yobufakazi efayela eliyithwalayo, futhi abantu banamathisela umphumela engxoxweni ngaphambi kokuthi baqaphele. Ukunquma ukuthi uqhathanisa ini kuza ngaphambi kokusebenzisa umyalo. Qhathanisa isakhiwo nezingxenye kumakhophi avikelwe, futhi wakhe ifayela elihlolwe kabusha elihlukile lapho omunye umuntu edinga ukulibona.

Ifayela le-.ovpn lithwala ini ngempela

Ifayela .ovpn liwukucushwa okunamabhlokhi angaphakathi akhethwayo. Lingaqukatha isitifiketi se-CA, isitifiketi sekhasimende, ukhiye wangasese, ukhiye tls-auth noma tls-crypt, kanye nemiyalelo ekhomba kumafayela angaphandle noma ecela ubufakazi. Amafayela amabili angabonakala acishe afane futhi ahluke kuphela ngaphakathi kwebhlokhi, noma ahluke kumyalelo owodwa oshintsha ngokuphelele ukuthutha. Inani lemigqa alikutsheli lutho ngokuthi yikuphi kwalokhu okwenzekile.

Umehluko ngaphakathi kwebhlokhi kakhiye akubona ubufakazi bomphakathi banoma yini. Isitifiketi esikhishwe kabusha nesinesikhathi esisha kungaveza uhlobo olufanayo loshintsho, ngakho ukungafani kwebhlokhi kuthi impahla ihlukile, hhayi ukuthi yisiphi isinqumo esiyidalile. Kuthatha njengophawu lokuthi uqhathanise izinkambu, hhayi njengokutholakele.

Qhathanisa ngendima, hhayi ngomugqa

Landela ukulandelana kokuxhumana uqobo: kuqala iphuzu lokugcina nokuthutha, bese ukuthembela nobunikazi obulindelekile, bese ukuqinisekiswa komsebenzisi, bese imizila, i-DNS namahuku ezikripthi. Lokho kulandelana kuhambisana nalokho okwenza iklayenti, ngakho umehluko wokuqala ohlangana nawo uyinto yokuqala eyayingase iphule ukuxhumana. Ukuqhathanisa ngama-alfabhethi esikhundleni salokho kubhubhisa izilungiselelo ezihlobene kuwo wonke umphumela.

Iphase eliqaphela izinkambu libheka lezi zinto, ngalokho kulandelana. Noma yini iklayenti eliyicela ngokuxhumana ingeyomugqa wokuqinisekisa, hhayi imigqa yokuthembela.

  • remote, proto kanye nechweba, kufaka phakathi yonke ibhlokhi yokuxhumana.
  • ca kanye cert: umkhiphi, isihloko kanye nosuku lokuphelelwa.
  • Ukuthi ngabe ukhona yini ukhiye wangasese, hhayi ukuthi uqukethe ini.
  • tls-auth noma tls-crypt ukuba khona nokuqondiswa kokhiye.
  • Imiyalelo yokuqinisekisa, kufaka phakathi noma yikuphi ukubhekisela efayeleni lobufakazi.
  • Imizila, izinketho ze-DNS namahuku ezikripthi asebenza lapho kuxhunyaniswa.

Lapho ifayela liqukethe amabhlokhi amaningi okuxhumana, gcina inketho ngayinye nephuzu layo lokugcina. Ukuqhathanisa umugqa remote wokuqala kuphela kungaphuthelwa enye indlela iklayenti eliyikhetha ngempela kule nethiwekhi.

Kungani i-diff evamile iyithuluzi elingalungile

I-diff evamile yakhelwe umbhalo, hhayi izimfihlo. Izophrinta ngokukhululekile ukhiye wangasese emlandweni wesikrini, futhi ngeke ikutshele ukuthi umyalelo ogqolozele kuwo awuhloti nehluleka. Ukukhipha izinkambu kuvikekile futhi kufundeka kalula ngesikhathi esisodwa, ngoba impahla yesitifiketi ingaqhathaniswa njengemethadatha esikhundleni samabhithi.

openssl x509 -in ca.crt -noout -subject -issuer -enddate
openssl x509 -in client.crt -noout -subject -issuer -enddate
grep -E '^(remote|proto|port|tls-auth|tls-crypt|route|dhcp-option)' profile.ovpn

Imiyalo emibili yokuqala iphrinta ubunikazi nokuvumeleka ngaphandle kokuthinta ukhiye, ngakho umphumela wayo uphephile ukuwunamathisela. I-grep iphrinta amagama nenani lemiyalelo kodwa ayiphrinti imizimba yamabhlokhi, okulenza libe yiphase yokuqala efanele lapho usola umehluko wokuthutha noma womzila. Uma ibhlokhi uqobo kufanele iqhathaniswe, qhathanisa i-hash yayo esikhundleni sokuqukethwe.

Yakha ikhophi elihlolwe kabusha yetikithi

Susa izimfihlo zangempela kanye nezihlonzi ezingadingekile ngenkathi ugcina amagama ezinkambu nesakhiwo esanele sokuchaza umehluko. Uphawu lwesimo esifanayo lusaveza ukuthi impahla ikuphi nokuthi yayide kanganani, ngakho nquma ukuthi nalokho kwemukelekile yini. Hlola isithonjelo sokugcina uqobo esikhundleni sokuthemba umyalo okhumbula uyisebenzisile. Ungalihleli kabusha ifayela lokuqala elisebenzayo ukuze nje wenze isibonelo, ngoba iphrofayili ehlolwe kabusha ayidingi ukuthi isebenze futhi akumele neze ingenwe kabusha.

Gcina amafayela okuqala ekhonakala ngokwegama lefayela ne-hash esikhundleni sokuwasusa kumafolda amathathu anamagama afanayo. Intambo ye-hash yanele ukufakazela ukuthi yiliphi ifayela elihloliwe futhi ayibizi lutho uma iphuma. Nqamula amakhophi ngemva kokuvalwa koshintsho, ukuze umuntu olandelayo azuze ifayela elilodwa eligunyaziwe.

Gcina ukuqhathanisa kuxhumene nokwehluleka

Ukuqhathanisa kufanelekile izindleko zako lapho kuphendula umbuzo mayelana nokungeniswa okukodwa noma ukwehluleka kokuxhumana okukodwa. Qamba kuqala isinyathelo esihlulekayo, bese uqhathanisa kuphela izinkambu isinyathelo eso esincike kuzo; ukuqoqa bonke ubufakazi beklayenti kufolda elilodwa kwenza ukuphepha okulandelayo kube nokwenzeka kakhulu futhi ukuxilongwa okulandelayo kube kancane. Lapho umbuzo uncane, uhlu lwezinkambu ezingaphendula luba lufushane.

Uma ifayela elisha livela kumqhubi, qinisekisa indlela yalo yokusabalalisa ngaphambi kokushintsha impahla yokuthembela. Ngemva koshintsho, hlola ikhophi engenisiwe iklayenti eliyikhethe ngempela kanye nomphumela okuxoxiswene ngawo, ngoba umyalelo ungase unganakwe noma ufundwe ngendlela ehlukile enye inguqulo yeklayenti. Ifayela elikudiski akubona ubufakazi bokuxhumana okwenzekile. Incazelo yemiyalelo ise-ncwadini ye-OpenVPN 2.6.

Izihloko ezihlobene