Indlela yokuqinisekisa iseva yephrofayili ye-OpenVPN ngaphambi kokuyifaka

Othile ukuthumelela iphrofayili, uyayifaka, futhi ngemva kwamasekhondi angamashumi amathathu iklaphu iyashaya indawo okungekho muntu oyihlolile. Qala ngokufunda ifayela kusihleli sombhalo, ngoba konke okubalulekile kungena kumiyalo embalwa: remote, proto, port, ca, cert, tls-crypt ne-verify-x509-name. Konke okunye kungamavelu azimisiwe, futhi izingqinamba zihlala khona.

Bhala wonke amaphuzu okugcina ifayela engawasebenzisa

Qala ngamaphuzu okugcina, ngoba iphrofayili eyodwa ingaqukatha amaningi. grep -nE '^[[:space:]]*(remote|proto|port|remote-random|connection)' profile.ovpn liphrinta wonke umuntu oqokelwe ngokulandelana kwefayela, kuhlanganise nalawo angaphakathi kwamabhulokhi e-<connection> asemgqeni.

Lapho umyalo ushiya imbobo, iklaphu libuyela emuva kumvelu wokuzenzakalela womlaleli, ngakho-ke remote vpn.example.com kuphela kusho imbobo engu-1194 nanoma yikuphi proto okuvela kamuva efayeleni. Imigqa embalwa elula ye-remote iyizindlela ezinye: iklaphu liyazama ngokulandelana ngaphandle uma i-remote-random izihlanganisa, futhi ayikaze ishintshe ngokuthula umphathi womunye umqhubi. Imigqa emibili ye-remote emazweni angahlobene iyindawo lapho ume khona futhi ubuza ukuthi iyiphi eyayihlosiwe.

Qaphela nokupelwa kwe-proto. I-tcp yamukelwa njengegama elifanayo ne-tcp-client ohlangothini lweklaphu, kodwa i-tcp-server kuphrofayili yeklaphu iyiphutha lokuhlela elivame ukulenga kunokwehluleka ngokuhlanzekile.

Qinisekisa igama, bese uqinisekisa imbobo

I-dig +short vpn.example.com ikutshela ukuthi igama likhona yini nokuthi yimaphi amakheli eliwabuyisayo, futhi iphuzu lokugcina elinamakheli amaningi noma elingemva kwe-proxy lingabuyisa amaningi ngokusemthethweni. Ukuxazululwa kwegama kuyisimo esidingekayo, hhayi ubufakazi bobunikazi; noma ubani angakhomba igama ekhelini, futhi ikheli elilodwa lingaphendula amagama amaningi.

Bese uhlola umlaleli embotsheni oyitholile, ngokuhambisana nokuthutha. Ku-TCP, i-openssl s_client -connect vpn.example.com:1194 -servername vpn.example.com liphrinta uchungechunge iseva elusethulayo. Ku-UDP udinga i-DTLS: i-openssl s_client -dtls1_2 -connect vpn.example.com:1194 yenza ukuxhawulisana okufanayo kumadathagramu. Ukuxhawulisana okuqediwe kufakazela ukuthi kukhona okulalelayo futhi okuphethe isitifiketi, okuyinto engaphezu kwalokho okukubonisa i-ping futhi engaphansi kwalokho okudingwa izilungiselelo zokuthemba zephrofayili uqobo.

Lapho ukuxhawulisana kwehluleka futhi umphathi uphendula i-ping, imbobo cishe ayilungile noma ihlungiwe. Kubheke njengesizathu sokucela imbobo efanele, hhayi isimemo sokukhanza eziseduze. I-nc -vzu nayo ibika impumelelo kwezinye izitaki noma kungelaleli lutho, ngakho-ke ukuhlola kwe-UDP okungenalutho akusho lutho ngaphandle kokuxhawulisana ngemuva kwayo.

Funda izikhonkwane zokuthemba ngokwehlukile ekhelini

Ikheli linquma ukuthi iklaphu liya kuphi; ibhulokhi lokuthemba linquma ukuthi likholwa ubani lapho lifika. I-verify-x509-name "vpn.example.com" name ikhonkwa igama elivamile lesihloko, futhi i-remote-cert-tls server idinga ukusetshenziswa kokhiye okunwetshiwe kokufakazela iseva. Iphrofayili oyinikwa umqhubi kufanele iphathe kokubili.

Funa i-ca, ibhulokhi le-<ca> lasemgqeni, kanye ne-tls-crypt noma i-tls-auth. Iphrofayili esebenzisa i-tls-auth idinga i-key-direction 1 kuklaphu lapho uhlangothi lweseva lusebenzisa isiqondiso 0, futhi ukungafani kwephula ukuxhawulisana ngephutha le-TLS elifundwa njengokonakala kwesitifiketi. I-CA yasemgqeni engeyona yomqhubi osanda kuxazulula igama lakhe isho ukuthi ifayela lahlanganiswa lisuka emithonjeni emibili, futhi leso yisimo okufanele senqatshwe ngokuphelele.

I-verify-x509-name yamukela izimo ezinge-name, ezinge-name-prefix noma ezinge-subject, futhi eyokugcina ilindele igama elihlukile eligcwele ngokulandelana okuqondile okuliphrinta iseva. Khetha indlela ehambisana nesimo senani, ngoba iklaphu lenqaba konke ukuxhumana esikhundleni sokuxwayisa ngokusondela. Efayeleni ongalibhalanga, i-name enegama lomphathi elilula iyisinqumo esingamangalisi kakhulu.

Hlola izinketho ezehluleka ngokuthula

OpenVPN 2.6 ixoxisana ngama-cipher nge-data-ciphers, futhi iphrofayili ephethe umugqa wakudala we-cipher AES-256-CBC kuphela ingaqeda itshaneli yokulawula bese ima kudatha. Ukufunda lelo velu kukutshela ukuthi ifayela lidala kunesiva ohlanganyela nayo yini; ikhasi lemanuwali le-2.6 libala ukulandelana kwezingxoxo uma udinga ukucaphuna kuwo kumqhubi.

I-auth-user-pass ngaphandle kwegama lefayela isho ukuthi iklaphu lizobuza, ngakho-ke iphrofayili ebukeka izanele yona iyodinga izifakazelo. I-auth-user-pass credentials.txt isho ukuthi ilindele ifayela okungenzeka ukuthi alithunyelwanga kuwe. I-nobind ne-resolv-retry infinite zivamile futhi azinangozi, kanti i-explicit-exit-notify ingeyase-UDP kuphela futhi ayinamsebenzi ku-TCP.

Akukho kulokhu okushintsha ukuthi iphrofayili ixhuma kuphi, kodwa ngakunye kushintsha ukuthi ixhuma nhlobo yini, futhi akukho okubonakala engxoxweni yokufaka yeklaphu.

Thatha isinqumo, bese ubhala lokho okuthathile

Ngemva kwalokhu kufunda kunemiphumela emithathu, futhi eyodwa kuphela ukufaka. Lapho iphuzu lokugcina nezikhonkwane kuhambisana nemiyalo oyithole ngesinye isiteshi, yifake. Lapho iphuzu lokugcina libukeka lilungile kodwa izikhonkwane noma i-CA akuhambisani, cela ifayela elilungisiwe. Lapho ifayela lihlanganisa amaphuzu okugcina noma izinto ze-CA ezivela emithonjeni ehlukene, lisuse futhi ucele ikhophi entsha.

Bhala i-hash oyihlolile, ukuze umuntu olandelayo azi ukuthi ifayela lishintshile yini: i-sha256sum profile.ovpn, inamatheliswe eceleni kwephuzu lokugcina kumanothi akho. Iphrofayili iwuhlelo oluphelele, hhayi uhlu lwamakheli, ngakho-ke ungalokothi ufake i-remote esebenzayo kubhulokhi lokuthemba lomunye umuntu ngelixa ugcina izifakazelo zabo.

Gcina okhiye abayimfihlo namagama okuvuma kude nezithombe zesikrini nemisakazo yezingxoxo ngenkathi uqhathanisa amanothi. Iphuzu lokugcina nezinketho ezingeyona imfihlo zanele ukubuza umbuzo onembile, futhi okunye kungokwefayela.

Uma ulifaka futhi umzamo wokuqala wehluleka, sebenzisa iklaphu nge---verb 3 futhi ufunde imigqa eyishumi yokuqala: ikheli le-remote elixazululiwe, i-proto okuxoxiswene ngayo nephutha le-TLS kuvela ngalokho kulandelana, okukutshela ukuthi yikuphi ukuhlola okungenhla okukweqile.