Ungaqongeleli ukuqiniswa kwe-systemd phezu kokwehla kwe-user ye-OpenVPN

Izincomo ezimbili zamalungelo amancane ezincanyathiselwe ndawonye azikhiqizi ukusetshenziswa okuqinile kakhulu. Imodeli eyodwa ivumela i-daemon ukuthi iqale ngamalungelo bese yehla iye ku-akhawunti engenawo amalungelo ngemva kokuqalisa; enye ivumela umphathi wesevisi ukuthi ayiqalise ngaphansi kobunikazi obulinganiselwe kusukela kumyalo wokuqala. Ngayinye isebenza yodwa, futhi inhlanganisela ivamise ukukhiqiza isevisi engakwazi ukwenza kahle nokukodwa kwale misebenzi emibili. Okusele kudlula esinqumweni ngokulandelana.

Amamodeli amabili, umnikazi oyedwa wokushintsha

Imodeli yokuqala ingeye-daemon. Izinketho ze-OpenVPN zomphakathi user kanye group zishintsha ubunikazi ngemva kokusethwa kwethumbu nezinkinobho, futhi persist-key kanye persist-tun zigcina lezo zinsiza zisetshenziswa ngemva kwalokho.

Imodeli yesibili ingeye-umphathi wesevisi. Isethingi ye-systemd User= noma Group= inquma ubunikazi inqubo eqala ngaphansi kwabo, futhi imiyalo yamandla inquma ukuthi ingabamba ini. Ukukhetha phakathi kwamamodeli kuyindaba yokupakisha ngaphambi kokuba kube yindaba yokuphepha, futhi umgcini wephakethe usuphendulile. Umsebenzi wakho ukuthola leyo mpendulo hhayi ukuqamba inketho yesithathu.

Womabili asemthethweni. Iphutha ukuziphatha njengezingqimba zomklamo owodwa, ngoba imodeli yesibili ingenza ukushintshwa kobunikazi kowokuqala kube umsebenzi inqubo engasavunyelwe ukuwenza.

Nquma ukuthi ubunikazi bushintsha kuphi

Uma iyunithi isiqala njenge-akhawunti ezinikezelwe, ukwengeza umyalo we-daemon wokuba enye i-akhawunti kudinga uguquko lwe-setuid isevisi eqinisiwe eyayingakufanele yikwenze. Ukwehluleka kuvela njengephutha lemvume ekuqaleni, hhayi njengomlayezo womgomo ocacile. Lokhu kufundwa njengamandla angekho, okusukumelela abantu ngaseqoqweni elibanzi lemikhawulo hhayi embuzweni wobunikazi.

Funda ukuthi iphakethe elifakiwe linikeza ini ngempela ngaphambi kokuhlela noma yini, kuhlanganise nendlela yalo ye-drop-in. Amanye amayunithi ashiya ngamabomu ukwehla kwe-daemon ngoba umphathi usukubhekile, futhi amanye ancika kulezo zinketho ekushintsheni ngemva kokuqalisa. Ukususa okukodwa kwalezi ngaphandle kokwazi ukuthi iyiphi imodeli oyizuzile ngofuzo iyona ndlela isevisi esebenzayo eyeka ngayo ukuqala.

Bhala imodeli ekhethiwe emugqeni owodwa: eyedatha noma eyomphathi. Wonke umyalo olandelayo kufanele uvumelane nalo mugqa, futhi iyunithi exubile kufanele ithathwe njengephutha hhayi njengesivumelwano.

Amandla ayimikhawulo, awazona izipho

Iqoqo lemikhawulo yamandla lisho ukuthi inqubo ingabamba ini kakhulu. Liwuphahla, futhi ukubala amandla lapho akunikezi lutho ngokwalo, yingakho iyunithi eneqoqo lemikhawulo elivulekile ingase yehluleke ukwakha ithumbu.

Okubeka amandla eqoqweni elizungezile lesevisi AmbientCapabilities= yikho. Incwadi yokusebenza ye-systemd ibhala imiyalo emibili ngokwehlukana, futhi umehluko lowo uchaza iningi lezeluleko ezididayo ngamandla ku-inthanethi.

Engeza amandla kuphela ngemva kokuba umsebenzi ohlulekayo uwabonile. Iqoqo lemikhawulo elibanzi lifihla imbangela yangempela futhi lishiya isevisi inamalungelo amaningi kunalokho okwakuhloswe umklamo. Kwenza futhi iyunithi ibe nzima ukuyihlola, ngoba uphahla akusachazi umsebenzi. Susa amandla engeziwe lapho isici sangempela sesilungisiwe.

Hlanganisa igunya kulo mjikelezo wokuphila

Bhala ukuthi inqubo kufanele yenze ini esigabeni ngasinye: ukuqalisa, isimo esizinzile, ukuqinisekisa kabusha nokuhlakaza. Ukwakha isixhumi, izinguquko zemizila, ukufunda ukhiye ovikelwe nokubiza umsizi akwenzeki konke ngesikhathi esisodwa noma ngaphansi kwezimfuneko ezifanayo. Hlela uhlu ngokwesigaba ngaphambi kokuluhlela ngamandla.

Izinketho zokuqina zigcina izinsiza phakathi kwezingxoxo kabusha, futhi azinikezi izimvume ezingakaze zibe khona. Ukhiye inqubo engakwazi ukuwufunda ekuqaleni uzohlala ungafundeki ngisho ngemva kwalokho, noma ngabe amafulegi okuqina athini. Amafulegi agcina lokho obekusuvele kusebenza.

Sebenzisa i-akhawunti ezinikezelwe hhayi eyabiwe. Abathuthukisi be-OpenVPN baxwayisa ngomkhuba wokusebenzisa nobody njengesibonelo esivamile, ngoba ezinye izinsiza kusibungu zingase zivele zisebenza ngaphansi kwaleyo akhawunti futhi ukwahlukaniswa ocabanga ukuthi unakho akukho lapho.

Izici ezishintsha umthwalo wasekhaya, njengokwehliswa kwesiteshi sedatha noma ukwakhiwa okuxhuma ngendlela ehlukile, zingasusa ukuthi imiphi imisebenzi edingekayo. Buyekeza imephu lapho iphakethe lishintsha, hhayi kuphela lapho kukhona okwephukayo.

Bhala isu bese ugcina ukufinyelela kokubuyisela

Irekhodi lokusetshenziswa kufanele lisho umphathi, ubunikazi bokuqalisa, ubunikazi obuzinzile obuhlosiwe kanye naso sonke isipho kanye nomsebenzi osidingayo. Yilo rekhodi elenza ushintsho olulandelayo lubuyekezwe hhayi ukuba ukuhlolwa.

Gcina ukufinyelela kwekhonsoli kutholakala ngenkathi uhlela, ngoba iyunithi ehlulekayo ekuqaleni inzima ukuyilungisa kude. Hlola ukuqalisa kabusha nokuqalisa kabusha okuphelele ngaphambi kokumemezela ushintsho luphelile. Iyunithi esinda ekuqaliseni kabusha ingase yehluleke ngaphambi kokuba inethiwekhi ikhuphuke.

Impumelelo iwumjikelezo wokuphila wamandla amancane oqondakele, hhayi inqubo evele isebenza ngaphansi kwegama elingelona elika-root.