Xosha iklayenti elilodwa le-OpenVPN: kill, deny noma hoxisa isitifiketi?

Unayo i-common name nekheli emibhalweni yakho, kanye nemiyalo emithathu ebonakala yonke isusa iklayenti. Yinye kuphela eyenza okufunayo, futhi ukukhetha kuncike ekutheni udinga ukuqeda iseshini esebenzayo manje, ukwenqaba ukungena okulandelayo, noma ukususa ilungelo lokuxhuma ngokuphelele. Funda ubunikazi onabo ngempela ngaphambi kokuthinta noma yini, ngoba ichibi le-OpenVPN linikeza ikheli elifanayo lomhubhe kuseshini enye kamuva.

Yibuphi ubunikazi onabo ngempela

Ifayela lesimo lenguqulo 3 iyindawo evamile yokuqala. Ingxenye ye-CLIENT_LIST ithwala i-common name, ikheli langempela, izibali zamabhayithi nesikhathi sokuxhuma; ingxenye ye-ROUTING TABLE ihlanganisa ikheli elingelona langempela ne-common name kanye nesitembu sesikhathi sokubhekisela kokugcina. I-common name ubunikazi obuzinzile. Ikheli elingelona langempela liwukwabiwa, futhi ikheli langempela ngemuva kwe-NAT lingashintsha phakathi kwamaseshini ngaphandle kokuthi kushintshe lutho kuseva.

Isixhumanisi sokuphatha sibonisa umbono ofanayo ngomyalo waso status futhi sengeza i-ID yeklayenti kuseshini ngayinye. Yiloyo ID elindelwe yi-client-kill, futhi akulona ikheli lomhubhe. Uma udinga ukwazi ukuthi iyiphi i-common name eyathola ikheli eliphi ngesikhathi sokuxhuma, imvelo yeskripthi se-client-connect inakho kokubili, kanye nekheli langaphandle elithembekile, kodwa leso skripthi sisebenza njengomsebenzisi we-OpenVPN futhi sidinga indlela yelogi elibhalelekayo.

Bulala manje, enqaba ekungeneni, hoxisa unomphela

Yomibili imiyalo yokususa ku-sixhumanisi sokuphatha iyizenzo zesehini. I-kill ithatha i-common name noma ikheli langempela kanye nechweba; i-client-kill ithatha i-ID yeklayenti futhi iqede leso sibonelo ngokushesha. Akukho kokubili okuyisithiyo: iklayenti elixoshiwe elinesitifiketi nephasiwedi elivumelekile lixhuma kabusha ngemizuzwana, okuyinto enhle uma usebenzisa kabusha i-peer yokuhlola futhi engenamsebenzi uma ilaptop yebiwe.

I-client-deny wuhlobo oluhlukile lwesinqumo. Ngokuvamile ikhishwa ku-hook yokuqinisekisa noma ye-client-connect futhi yenqaba iseshini ngesizathu, ngakho ifanele inqubomgomo eyenqaba ukungena hhayi leyo ephazamisa ukuxhumana. Imibhalo iphinde ixwayise ukuthi ukwenqaba okukhishwe ngesikhathi sokuxoxisana kabusha kwe-TLS kwenza ukhiye oxoxiswane ngawo kabusha ungasebenzi kuyilapho iseshini ekhona ingaqhubeka kuze kuvalwe iwindi lokushintsha. Uma imfuneko iwukuthi iklayenti lisseshamsile manje, impendulo ebhalwe phansi yi-client-kill.

Ukususwa okuhlala njalo kungaphansi kwakho konke lokhu. Hoxisa isitifiketi futhi uqinisekise ukuthi i-crl-verify ikhomba ohlwini iseva elilayisha kabusha ngempela, khubaza ifayela lokuhlela eliqondene neklayenti kumbhalo we-ccd, noma khubaza i-akhawunti kunoma iyiphi i-backend ebuzwa i-hook yokuqinisekisa. Ukuhoxiswa nakho akusheshi: ngezilungiselelo ezizenzakalelayo ze-reneg-sec iseshini esunguliwe ingaqhubeka ize ixoxisane kabusha, ngakho isenzo seseshini kanye nesenzo semininingwane kuyagcwalisa, akuzona izindlela ezihlukile.

Ingabe i-socket yokuphatha ikhululekile?

Isixhumanisi sokuphatha sisebenzela iklayenti elilodwa ngesikhathi. Uma i-GUI noma i-daemon yokuqapha isivele ibambe ukuxhumana, iskripthi sakho asikwazi ukuxhuma eceleni kwayo, futhi kuye ngeklayenti ungase uxoshe elikhona esikhundleni sokwehluleka ngokuhlanzekile. Iphasiwedi yayo ihamba ngombhalo ocacile kuleyo socket, ngakho ingeyekheli lendawo noma i-socket ye-unix, hhayi neze eyesixhumanisi esivulekile.

Uma ungeke ukwazi ukuthatha i-socket, usenazo izinketho, futhi zonke zihamba kancane. Khulula iseshini ye-GUI kuqala uma uyilawula, noma amukele indlela yesigaba semininingwane bese ulinda ukuxoxisana kabusha okulandelayo. Ongakufanele ukwenze ukuqalisa kabusha isevisi ukuze uxoshe iklayenti elilodwa, ngoba lokho kuphinde kuqede zonke ezinye izeshini futhi kucekule ubufakazi befayela lesimo lale seshini.

Ukulandelana engikwenzayo kuseva ephilayo

Xhuma, funda isimo samanje, thatha isinyathelo nge-ID osanda kuyifunda, bese uyifunda futhi. Amanani akopishwe kumbhalo iyona ndlela evamile yokubulala umuntu ongafanele.

status                     # note the client ID and common name
client-kill 3              # end that session now
kill Test-Client           # alternative: by common name
status                     # confirm the session is gone

Igama nenombolo ngenhla kuyizikhala, futhi ama-ID asetshenziswa kabusha ngemva kokuba amanye amaklayenti exhumile. Qinisekisa ukuthi umugqa awukho ngaphambi kokubhala noma yini njengeqediwe, futhi uhlole ukuthi inani lamaklayenti axhunyiwe lihambile ngelilodwa hhayi ngeziningana.

Qinisekisa ukuthi lahlala kude

Rekhoda i-common name, ikheli lomhubhe, ikheli langaphandle kanye nomzuzu wokususwa. Uma i-common name efanayo ibonakala futhi ngemva komzuzu, isenzo seseshini sisebenzile futhi isigaba semininingwane asisebenzanga, okuyinto ewukulungisa okuhluke ngokuphelele kulokho komyalo ongakaze uqale ukusebenza.

Bese uhlola ohlangothini lweklayenti. Isitifiketi esihoxisiwe kufanele sehluleke ekuxhumaneni kwesandla okulandelayo; uma sisaxhuma, i-CRL ayifundwa nhlobo, futhi lokho ukutholakala okufanele kubikwe. Khetha isenzo ngokusho okudinga ukukuqeda, qinisekisa nge-status yesibili, futhi ulungise isigaba semininingwane uma impendulo kufanele ihlale isikhathi eside kuneseshini.