Yimaphi amakhono e-Linux adingwa inqubo yakho ye-VPN?
Ukusethwa kwesixhumi, imizila, ukufinyelela kudivayisi namasokhethi avamile kungamalungelo ahlukene. Shono umsebenzi ohlulekile ngaphambi kokunikeza i-CAP_NET_ADMIN.
I-daemon ye-VPN idinga imisebenzi yenethiwekhi enegunya ikakhulukazi nakuba izinhlelo ezijwayelekile zivula amasokhethi aphumayo ngaphandle kwanoma yiliphi igunya. Kulelo gebe kuqala iningi lamaphutha amakhono: umuntu ubona iphutha lemvume, unikeza lonke iqoqo, futhi insizakalo isebenza ngezizathu okungekho muntu ongazichaza kamuva. Uhambo olungezansi luqala emsebenzini ohlulekile, luwuxhumanisa negunya elilodwa, bese lihlola umongo inqubo esebenza kuwo ngempela. Ukusebenza njenge-root engavinjelwe kuyimpendulo evumelekile kwabanye abasebenzisi, kodwa kufanele kube isinqumo hhayi ivala elijwayelekile.
Qala emsebenzini ohlulekile
Funda iphutha ngaphambi kokufunda isifundo. «Umsebenzi awuvunyelwe» ekushintsheni isixhumi, ukwenqaba ukuvula inodi yedivayisi nokuhluleka kwe-bind embobeni ephansi kuyizinkinga ezintathu ezahlukene ezinamalungelo amathathu ahlukene. Uma inqubo iqala futhi ihluleka kuphela ekushintsheni komzila wokuqala, lokho kusisho futhi ukuthi ukwakhiwa kwesixhumi sekuvele kwaphumelela, okunciphisa kakhulu impendulo.
Phinda uhluleke ngensizakalo imisiwe, bese uyiqala ngaphambili ngaphansi komsebenzisi ofanayo uma ukuqaliswa kukuvumela. Iphutha olibonayo lingcono kunomugqa welogi okufanele uqagele, futhi kwenza kucace umehluko phakathi kwenkinga yamakhono nokwenqatshwa yi-SELinux noma i-AppArmor.
Xhumanisa umsebenzi ngamunye negunya elilodwa
Ithebula iyimephu yokuqala, hhayi indawo yemibhalo yokuqaliswa:
| Operation | Usual authority | Watch for |
|---|---|---|
| Create or configure tun/tap | CAP_NET_ADMIN in the relevant namespace | Creating the device and opening it are separate steps |
| Add routes, rules, firewall entries | CAP_NET_ADMIN | Same capability, different namespace than you think |
| Open /dev/net/tun | Device permissions, not a capability | Group membership or a udev rule may be enough |
| Raw sockets | CAP_NET_RAW | Needed by some user-space tunnel implementations |
| Bind a port below 1024 | CAP_NET_BIND_SERVICE | Irrelevant for most modern tunnel ports |
Imigqa emibili kulelo thebula yiyo abantu abayididanayo. Ukuvula i-/dev/net/tun kuwumbuzo wemvume yefayela; ukucela i-kernel ukuthi ilungiselele lokho okukuvulile kuwumbuzo wamakhono. Ukunikeza i-CAP_NET_ADMIN akulungisi inodi yedivayisi umsebenzisi wensizakalo yakho angakwazi ukuyifunda, futhi ukulungisa inodi akukunikezi igunya lomzila. Hlola kokubili ngaphambi kokushintsha noma yikuphi.
I-WireGuard yase-kernel nezinhlelo zomhubhe endaweni yomsebenzisi nakho akunazimfuno ezifanayo. Indlela yemojuli ye-kernel ilungiselela isixhumi esivele sikhona nge-netlink, kuyilapho ukuqaliswa endaweni yomsebenzisi kungase futhi kudinga idivayisi futhi, kwezinye izindlela zokuthutha, amasokhethi aluhlaza.
Funda umongo: insizakalo, i-container noma i-shell
Ikhono endaweni yamagama yenethiwekhi yomsingathi lingaba nomthelela omkhulu kunomsebenzi ofanayo ngaphakathi kwesitaki esihlukaniswe ngamabomu. Indawo yokusebenza ye-container ivamise ukuqala ngeqoqo lemikhawulo elincishisiwe; ukwengeza i-NET_ADMIN ku-container eyabelana ngenethiwekhi yomsingathi kuyimvume enkulu kakhulu kunokuyengeza kuleyo enendawo yayo yamagama yenethiwekhi futhi engenakho ukukhwezwa komsingathi.
Emayunithi e-systemd funda okusetshenziswayo ngempela hhayi lokho ifayela leyunithi elibonakala likusho: i-systemctl show -p CapabilityBoundingSet -p AmbientCapabilities ibika amanani asebenzayo, okungenzeka asethwe yi-drop-in oyikhohliwe. Buza inani elisebenzayo, hhayi unomphela lelo obekuhloswe lona. Amakhono e-ambient abalulekile ngoba insizakalo engeyona ye-root ilahlekelwa amakhono phakathi kwe-exec ngaphandle kwawo.
Thatha ukusethwa okusekelwayo kwephakethe noma kwesithombe njengesisekelo. Ungangezi izimvume zamasokhethi aluhlaza noma imodi yegunya ikakhulukazi ngenxa yokuthi esinye isifundo sizibalule kunelinye ithuluzi; lokho kucabanga akudlulisi lutho futhi kukulahlekisela ngokuhlukaniswa okukhokhelile. Uma ungaqiniseki, unganikezi lutho futhi ufunde amanothi okuqaliswa omsebenzi oqondile owudingayo.
Buka okwenzekayo ngemva kokwehla kwamalungelo
Ama-daemon amaningi aqala ngegunya, alungiselela isixhumi, bese eshintshela kumsebenzisi ongenalo igunya futhi agcine umhubhe. Kusukela ngaleso sikhathi inqubo ayisakwazi ukwengeza umzila, ukubhala kabusha umthetho we-firewall noma ukuvula idivayisi entsha enegunya, okulungile kuze kube yilapho ukuxhumana kabusha kudinga khona lokho. Ukufunda amafayela nokusebenzisa ama-hook kamuva kungahluleka ngesizathu esifanayo.
Hlola umjikelezo wokuphila wonke hhayi isekhondi yokuqala: ukuqala, ukuvuselela noma ukuxhumana kabusha, nokuhlanza lapho kumiswa. Ukwakhiwa kwesixhumi okuphumelelayo kokuqala akufakazeli ukuthi wonke umsebenzi onegunya olandelayo usazosebenza, futhi ukuhluleka kuvamise ukuvela emahoreni kamuva ekukhiqizeni.
Ukuqaliswa okugcina umhubhe uvulekile phakathi kokushintsha komsebenzisi kuvamise ukukuhambisa nezinketho zokugcina umhubhe nezinkhiye. Ngakolunye uhlangothi lwe-systemd, umbuzo olinganayo ukuthi iqoqo lamakhono leyunithi liyasinda yini ekushintsheni komsebenzisi okukulungiselele.
Rekhoda imvume enikeziwe nesizathu sayo
Bhala imvume eqondile, umsebenzi eyiwuvulayo kanye nephutha eyalilungisa. Umgqa owodwa kumanothi okusetshenziswa — «i-CAP_NET_ADMIN endaweni yamagama yenethiwekhi yeyunithi, iyadingeka ekushintsheni kwemizila ngemva kokuxhumana kabusha» — kwanele ukuvimbela umuntu olandelayo ukuthi andise imvume futhi.
Bese ufunda futhi iqoqo elisebenzayo ngemva kwakho konke ukuthuthukiswa. Abadayisi bangeza izici, izithombe zishintsha amanani ajwayelekile, futhi ikhono ebelingadingeki ngonyaka odlule lingaba okusekelayo ngaphandle kokuthi umuntu abone.