Ukuphela kwesikhathi sekhukhi ye-ConnMan OpenConnect, hhayi inkinga yesitifiketi
Amaphutha amabili abukeka efanayo kumugqa wokubhalwa. Qhathanisa umkhondo womunwe oboshelwe nekhukhi yesikhathi, vuselela inkambu ephelelwe yisikhathi, bese uqala kabusha i-daemon.
I-ConnMan isebenza intambama bese iyala, futhi umugqa wokubhalwa ukhuluma ngokuqinisekiswa kwesitifiketi. Lowo mugqa uthumela abantu emaqenjini we-CA angakaze aphuke. Amaphutha amabili ahlukene akhiqiza cishe isimo esifanayo sokwehluleka: ikhukhi yesikhathi iyaphela, noma isitifiketi seseva sishintshile ngempela. Kungahlukaniswa cishe ngomzuzu owodwa, futhi kukodwa kuphela okuhilela umkhondo womunwe.
Amaphutha amabili, umugqa wokubhalwa owodwa odidayo
Ahlukana ngokubhekwa okubili, futhi akukho okudinga ukufundwa kwesibili. Okokuqala ukuthi ukwehluleka kwaqala nini: ikhukhi ephelelwe yisikhathi ifika ngemuva kwamahora noma izinsuku zokusebenza, futhi isitifiketi esishintshiwe sifika ngokushesha ngemuva koshintsho lwesango.
| Signal | Expired cookie | Changed certificate |
|---|---|---|
| When it started | after hours or days of working | right after a gateway change |
| Fingerprint from a fresh authenticate | unchanged | different value |
| Usual log tail | HTTP CONNECT 401 / unauthorized | signer not found / verify failed |
| Repair | replace the cookie, restart | re-pin deliberately, then restart |
Ukuhlolwa komzuzu owodwa ukusebenza kwe-authenticate ngezansi. Qhathanisa i-FINGERPRINT yayo ne-OpenConnect.ServerCert efayeleni. Umkhondo womunwe ofanayo ne-COOKIE ehlukile kusho ukushintsha ikhukhi kuphela. Umkhondo womunwe ohlukile kusho ukuthi isitifiketi seseva sishintshile ngempela, ngakho siphinde usibose ngamabomu futhi ubhale ukuthi ubani okugunyazile.
Khiqiza into esikhundleni sokuyibhala
I-ConnMan ayinalo igxathu lokungenisa iphrofayela ye-OpenConnect, ngokungafani ne-NetworkManager. Ifunda ifayela lokuhlinzeka okumele amanani alo akhiqizwe kusengaphambili, futhi indlela esekelwayo yokuwakhiqiza imodi ye-authenticate ye-OpenConnect.
sudo openconnect --csd-wrapper=/home/user/.cisco/csd-wrapper.sh \
--authenticate --user myuser vpn.example.comOkuphumayo kuphrinta amanani amane: POST, COOKIE, HOST kanye ne-FINGERPRINT. Umkhondo womunwe, onesiqalo esingu-sha256:, ukuboshelwa kweseva. Ikhukhi iyingxenye yesikhathi enobude obunqunywa isango. Zithathe njengezinhlobo ezahlukene zemfihlo: ziphela ngezikhathi ezihlukene, futhi kukodwa kuphela okulindeleke ukuthi kushintshe.
Ifayela lithwala kokubili, futhi kuguga ngendlela ehlukene
Ifayela lokuhlinzeka likhona ngaphansi kwe-/var/lib/connman-vpn/ futhi lifundwa ngokuxhumana ngakunye yi-daemon ye-VPN, hhayi i-applet yetreyi. Gcina igama lokuxhumana esigabeni somhlaba wonke kanye nemininingwane yephrothokholi esigabeni somhlinzeki.
[global]
Name = Company VPN
[provider_openconnect]
Type = OpenConnect
Name = Company Cisco VPN
Host = vpn.example.com
Domain = corp.example
OpenConnect.ServerCert = sha256:...
OpenConnect.Cookie = ...Sebenzisa igama lomsingathi elisetshenziswa ngempela yipothali. Ikheli le-IP elingenalutho lingadlula ukuhlolwa kwesitifiketi futhi lehluleke, ngoba idivayisi ihamba ngomsingathi obonakalayo futhi ilindele igama.
systemctl status connman-vpn --no-pager # is the daemon even installed and running
sudo systemctl restart connman-vpn # after the file edit
journalctl -u connman-vpn --since '1 hour ago' # after the connection attemptUkubhalwa kubonisa ini ngempela
Ithiphu yetreyi ngeke ikutshele ukuthi yiluphi uphutha onalo. Ukubhalwa kuzokutshela, uma ufunda ukulandelana hhayi umugqa wokuqala othusayo. Ikhukhi endala ivamise ukubonisa ukuthi izingxoxo ze-TLS ziqedile futhi isendlalelo se-HTTP sanqaba ngemuva kwalokho, yingakho amagama mayelana nezitifiketi emi eceleni kokwehluleka kwegunya.
Qhathanisa ukusebenza okusha kwe-authenticate namanani asefayeleni. Uma umkhondo womunwe ufana futhi kuhluke ikhukhi kuphela, usunayo impendulo yakho ngaphandle kokuthinta izilungiselelo zokwethemba.
Vuselela inkambu ephelelwe yisikhathi
Phinda umyalo we-authenticate, shintsha i-OpenConnect.Cookie, bese uqala kabusha i-daemon. Shiya umkhondo womunwe njengoba unjalo ngaphandle uma okuphumayo okusha kubonisa inani elihlukile; lapho isitifiketi seseva sashintshwa ngempela futhi ukuboshelwa kabusha kuyisinqumo okufanele umuntu asibhale, hhayi ukunamathisela emlayezweni wephutha.
Ukwenza ukuvuselela kube okuzenzakalelayo kuyafaneleka: iskripthi esincane sifunda iphasiwedi kusuka kokufakiwe okujwayelekile, sisuse imodi ye-authenticate futhi sibhala kabusha umugqa wekhukhi kuphela. Gcina ubufakazi ngaphandle kweskripthi futhi bufundwe kuphela i-akhawunti eyisebenzisayo, futhi wenze ukubhala kabusha kube ngokwe-athomu ukuze ukusebenza okwehlulekile kungashiyi ifayela elibhalwe uhhafu.
Uma ukuvuselela kudingeka njalo emahoreni ambalwa, bhala isikhawu. Kuyisici senqubomgomo yezikhathi yesango, futhi kunquma ukuthi ukuvuselela kufanele kwenziwe okuzenzakalelayo noma kucelwe isikhathi eside.