i-nmcli ilokhu ibuza iphasiwedi ye-VPN: gcina imfihlo endaweni

Iphrofayela efanayo, izikhathi ezimbili: ixhuma isuka kudeskithophu, kodwa nge-SSH ihlala isilindile esicelweni okungekho okungasiphendula. Akukho okonakele futhi akukho silungiselelo esilahlekile. I-NetworkManager icela imininingwane yokuqinisekisa kumenzeli wemfihlo, futhi umenzeli wemfihlo uyingxenye yedeskithophu engekho esikhathini osisebenzisayo.

Gijimisa ukulandelana okungezansi futhi umhubhe uzophuma ngaphandle kwesixhumanisi sezithombe, ngesixwayiso sokuthi ukugcina imfihlo kushintsha ukuthi ubani angayisebenzisa leyo phrofayela.

Qinisekisa ukuxilongwa ngaphambi kokushintsha noma yini

Umehluko phakathi kokusebenza okusebenzisanayo nokungasebenzisani ukuxilongwa konke. Uma i-nmcli --ask connection up iphumelela kuyilapho ukusebenza okuvamile kumile, iphrofayela ilungile futhi umthombo wemfihlo awukho. Leyo ncwadi eyodwa yokuqhathanisa ikusindisa ekubeni ubhale kabusha isakhiwo esisebenzayo.

nmcli -f NAME,UUID,TYPE connection show
nmcli connection show "Office IPsec" | grep -i flags

Funda amafulegi esikhundleni sokuwagagela. Amanani asho ukuthi "buza umenzeli" yiwo owafunayo, futhi amagama okhiye aqondile ayahluka phakathi kwezithasiselo ze-VPN ngoba ahlala kusichazamazwi sedatha sesithasiselo uqobo. Iphrofayela ye-FortiSSL nephrofayela ye-IPsec akudingeki zisebenzise amagama afanayo, ngakho sebenza kusukela kokuphuma kwephrofayela yakho.

Qinisekisa futhi ukuthi iphakethe lesithasiselo sale protokholi lifakiwe. Isithasiselo esingekho sibonakala njengohlobo lokuxhumana olungaziwa noma njengephutha lokusebenza elingasho lutho ngamaphasiwedi, futhi ukujaha imfihlo kuleso simo kuchitha ihora elifanayo kabili. Umbuzo owodwa wephakethe ushibhe kunesikhathi santambama sonke sokuhlela amafayela okhiye.

Hambisa imfihlo efayeleni lokhiye

Ifayela lokuxhumana likhona ngaphansi kwe-/etc/NetworkManager/system-connections/. Izimfihlo azigcinwa lapho ngokuzenzakalela, futhi yilokho okushiwo amafulegi owaka uwafunda. Ukushintsha ifulegi kube uziro kutshela i-NetworkManager ukuthi inani ligcinwe nephrofayela esikhundleni sokucelwa ngesikhathi sokusebenza.

[vpn]
password-flags=0

[vpn-secrets]
password=YOUR-VPN-PASSWORD

Ephrofayeleni enezimfihlo ezimbili, iphethini iyaphindeka: ifulegi elilodwa ngenkathi ngayinye esigabeni se-[vpn], futhi amanani akwisigaba se-[vpn-secrets]. Iphrofayela ye-IPsec ngokuvamile iphethe ukhiye owabiwe ngaphambili eceleni kwemininingwane yokuqinisekisa yomsebenzisi, futhi isithasiselo sizibiza ngamagama ahlukile kunesigaba esijwayelekile sephasiwedi, ngakho kopisha amagama okhiye kokuphuma kwe-vpn.data hhayi embhalweni webhulogi owasebenzisa esinye isithasiselo. Igama lokhiye elilodwa elingalungile likhiqiza iphrofayela elayishwayo bese yehluleka ekuqinisekiseni, okufundeka njengokuqondile njengephasiwedi engalungile. Qhathanisa ifayela lakho nephrofayela esebenzayo yesithasiselo esifanayo ngaphambi kokuxhuma futhi.

Faka kumacaphuno amanani anezikhala, amacaphuno noma uphawu lwedola. Inani elingenamacaphuno eline-$ lingaphakathi lizofundwa ngokwezwi noma linwetshwe kuye ngokuthi lihlaziywa kuphi, futhi ukwehluleka kokuqinisekisa okuvelayo kubonakala njengephasiwedi engalungile.

Bese ulungisa ubunikazi nemodi yefayela. Lawa mafayela okhiye afundwa isevisi enelungelo, futhi ifayela abanye abasebenzisi abangalifunda lithathwa njengelingathembekile, okuyisizathu esijwayelekile sokuthi iphrofayela elihleliwe ibonakale inganakwa. Umnikazi root, imodi 600, akukho okuhlukile.

Layisha kabusha, bese wenza kusebenze

Ifayela lifundwa lapho ukuxhumana kulayishwa, ngakho ukulihlela akwanele. Layisha kabusha amaphrofayela bese uphakamisa ukuxhumana ngokusobala.

sudo nmcli connection reload
sudo nmcli connection up "Office IPsec"

Uma ukulayisha kabusha kungayitholi inguquko, ukuqala kabusha kwesevisi ngokuphelele kuyithola, futhi kukhona imibiko mayelana nalokho ngqo. Khetha ukulayisha kabusha uma ezinye izixhumanisi zibalulekile, ngoba ukuqala kabusha kwesevisi kunqamula konke ukuxhumana okuphethwe, futhi kumhambuli wakude lokho kungaqeda isikhathi sakho ngaphambi kokuba umhubhe owufunayo uphume.

Sebenzisa i-UUID uma amagama engacaci. Imishini enamaphrofayela amaningi amakhasimende iqongelela cishe izimpinda, futhi ukwenza okungalungile kusebenze kukhiqiza ukwehluleka okubonakala njengenkinga yemininingwane yokuqinisekisa.

Uma imfihlo egciniwe kuyiyo engeyona inkinga

Iphrofayela ye-FortiSSL ingahluleka ngisho nemininingwane yokuqinisekisa egciniwe elungile ngoba iklayenti alikaze lithembe isitifiketi sesango. Leso silungiselelo asikho esigabeni esiyinhloko; sikhiyele ngemuva kwezinketho ezithuthukisiwe ze-VPN, lapho kufakwa khona isifinyezo sesitifiketi esethenjwayo. Uma ilogi ikhuluma ngesitifiketi esikhundleni sephasiwedi, usegatsheni lena futhi akukho nani lokuhlela i-[vpn-secrets] elizosiza.

Kukhona okunye ukuhlola okubili okulapha. Qinisekisa ukuthi iphrofayela ayizange ingenisiwe efayeleni elisakhomba endleleni isithasiselo esingakwazi ukuyifunda, futhi qinisekisa ukuthi iphrofayela yiyo esebenzayo hhayi ikhophi ephelelwe yisikhathi. Kokubili kukhiqiza ukwehluleka kokusebenza okufundeka njengamaphutha okuqinisekisa.

Nquma ukuthi ukugcina kwamukelekile yini

I-PSK nephasiwedi eligciniwe kungafundwa yinoma yini egijima njenge-root kuleyo mshini. Kumshini owulawulayo, lokho kuwukuhwebelana okunengqondo ngesevisi engenasixhumanisi sezithombe. Kumhambuli owabiwe, kufanele kube nengxoxo, ngoba iphrofayela manje inemininingwane yokuqinisekisa eyayivikelwe yindandatho yokhiye yedeskithophu ngaphambili. Buza ukuthi ubani omunye angafinyelela ku-root kulo mhambuli ngaphambi kokunquma, hhayi ngemuva kokuthi ushintsho selwenziwe.

Uma inqubomgomo ivimbela ukugcinwa kwezimfihlo ze-VPN, ungayephuzi iphrofayela ukuze umsebenzi we-cron usebenze. Gijimisa ukuxhumana kusukela esikhathini esinomenzeli, noma sebenzisa enye indlela yokuzenzakalela.

Ekugcineni, bhala ukuthi yimaphi amaphrofayela aphethe izimfihlo ukuze kimina umuntu akopisha elilodwa ku-laptop ngaphandle kokuqaphela. Umbhalo ongenhla kwesigaba sezimfihlo onosuku nesizathu wanele, futhi uzosindisa umuntu ekubuyekezweni okungakhululekile kamuva.