OpenConnect csd-wrapper: hlola iskripthi ngaphambi kokungena

Ukufaka i---csd-wrapper kuphrofayela kunikeza iskripthi sasendaweni kudaemon eyisebenzisayo ngesikhathi sokungena, ngakho isinqumo esiphambi kwakho ukubuyekezwa kwekhodi, hhayi iswishi yokuthanda. Le nketho ikhona ukuze ingxenye yokuhlola umsingathi yengosi ishintshwe, futhi ithatha indlela eya kuskripthi oyinikezayo. Konke okungezansi kucabanga ukuthi umnikazi wokufakwa usevele wathi ukuhlolwa kwesimo kuni okudingekayo; uma leyo ngxenye isavuliwe, yixazulule kuqala. Umhlahlandlela unezinyathelo ezine: thola isigaba esihlulekile, funda iskripthi, khetha ubunikazi esisebenza ngaphansi kwaso, futhi ufakaze umphumela.

Isinyathelo 1: Thola isigaba esihlulekile

Umlayezo wokugcina weklayenti uvamise ukuba mayelana nekhukhi, okuwukuphela kochungechunge hhayi ukuqala kwalo. Ukungena nge-HTTPS, ukuhlolwa kwesitifiketi seseva, ukushintshana kokuqinisekisa kanye nengxenye yesimo konke kumi phambi kwalowo mlayezo.

Rekhoda inguqulo nekheli lokungena elisetshenziswayo, bese uphinda umzamo ugcina okukhiphayo okuningiliziwe kutheminali yakho. Funda iphutha lokuqala okungewona umzamo wokuphinda, hhayi umugqa wokugcina wombhalo. Uma ilogi ima ngaphambi kokuthi kubizwe noma iyiphi ingxenye yokuhlola, isisongelo awakona inkinga yakho okwamanje. Ukusifaka ngaleso sikhathi kwandisa kuphela indawo okufanele uyivikele kamuva.

openconnect --version
openconnect --verbose --user="$VPN_USER" vpn.example.com </dev/null

Gcina umbhalo endaweni, ngoba amakhukhi nezimpendulo zokuqinisekisa ziyimpahla yokufinyelela. Umkhondo onanyathiselwe engxoxweni uwukuvuza kwezinkomba zokungena ngisho lapho isinyathelo sokuhlola sibonakala singenangozi. Yabelana ngombhalo wephutha nendawo emfudumalweni lapho kwavela khona, hhayi umthwalo nakancane.

Isinyathelo 2: Funda iskripthi ngaphambi kokuba singene kuphrofayela

Isisongelo sithembekile ngokulingana nokubuyekezwa okuhlolile, ngakho bopha lokho kubuyekezwa futhi ugcine i-hash yaso eduze nombhalo wokugunyaza. Imiyalo emibili engezansi ikunikeza uphawu lweminwe nokuhlolwa kwe-syntax okushibhile ngaphambi kokuthi ufunde ngisho umugqa owodwa. Iphinde inikeze umuntu olandelayo ireferensi eqinile, okuyinto ebalulekile lapho ifayela lihlala ngaphandle kokuphathwa kwamaphakethe. Awekho umyalo otshela ukuthi iskripthi senzani, ngakho yisebenzise bese uqhubeka ufunda.

sha256sum ./vpn-csd-wrapper.sh
bash -n ./vpn-csd-wrapper.sh

Funda ifayela lonke ngemibuzo emine engqondweni: ingabe yenza izingcingo ze-HTTP eziphumayo, ingabe ifunda amafayela ezinkomba noma izinto eziguquguqukayo zemvelo, ingabe ibhala ngaphandle kwedijithali yesikhashana, futhi ingabe igatsha elithile libika isimo esidlulile ngaphandle kokulinganisa lutho. Leyo phethini yokugcina ukwedlula umgomo okunanyathiselwe umugqa welogi. Izisongelo ezikopishiwe zivame ukukufihla ngemuva kokuhlolwa okubonakala kukholakala. Uma iskripthi sinquma ukuthi idivayisi ilungile ngaphambi kokubheka idivayisi, ma lapho.

Hlola namamithwalo apakishiwe, ngoba isihloko esifundekayo asifakazi lutho ngengxenye esele yefayela. Ukulanda iskripthi kumcuphi weforum akusenzi sithembeke ngoba nje igama laso lihambisana nengxenye yangempela yokuhlola umsingathi. Rekhoda ukuthi ngubani osifakile, sivelaphi, futhi sizobuyekezwa kanjani.

grep -nE 'base64 -d|xxd -r|eval |curl |wget ' ./vpn-csd-wrapper.sh

Isinyathelo 3: Khetha ubunikazi isisongelo esisebenza ngaphansi kwaso

I---csd-user yehlisa amalungelo ngenkathi uhlelo lwe-CSD, TNCC noma HIP lusebenza. Leyo akhawunti iyingxenye yokuhleleka kokusebenza kwasendaweni, hhayi igama lomsebenzisi elinikezwa ingosi.

Nika isisongelo i-akhawunti ehlukile engenaso isheli esisebenzisanayo, ingenamalungelo e-sudo futhi ingenabo ubudlelwane beqembu engakudingi. Nika imvume yokufunda kuskripthi nakumafayela athile esiwahlolayo, bese uhlola ukwehla kwamalungelo ngaphambi kokuthinta iphrofayela ye-VPN. Ukuthola inkinga lapha kushibhe ukwedlula ukuyithola ngaphakathi kweklayenti.

sudo -u vpn-csd /usr/local/libexec/vpn-csd-wrapper.sh

Ukwehlisa amalungelo kunciphisa umonakalo iskripthi esibi engawenza. Kodwa akubuyekezwa ikhodi, akwenzi umbiko ube yiqiniso, futhi akufakazi ukuthi umphathi wengosi uyayamukela le ndlela njengokuhlangabezana nomgomo wedivayisi.

Isinyathelo 4: Gcina ushintsho lukwazi ukubuyiselwa

Yenza ikhophi yokulondoloza yephrofayela ngaphambi kokuyihlela, futhi ugcine isisongelo ngaphansi kokulawulwa kwenguqulo ukuze ukubuyisela kubuyise i-hash eyaziwayo esikhundleni sokufuna ikhophi. Bhala indlela yeskripthi, i-hash, umsebenzisi wokusebenza kanye nomgunyazi endaweni eyodwa.

Ukuze ubuyisele, susa inketho, qalisa kabusha iklayenti futhi uqinisekise ukuthi iphutha lokuqala liyabuya. Uma ingosi isenqaba ukungena ngemuva kokubuyisela, kukhona okunye okushintshile, futhi ukuthola lowo mehluko kuza ngaphambi kokuphinda uzame isisongelo. Gcina ikhophi yangaphambilini isikhathi sonke sewindi loshintsho, okusho ukuthi emaqenjini amaningi kuze kudlule iwindi lokulungisa elilandelayo.

Ngemuva kokufakwa okuphumelelayo, hlola izinto ezimbili hhayi eyodwa: umhubhe uyenyuka, futhi idivayisi okufanele yehluleke ekuhlolweni kwesimo isenqatshwa. Ukuxhumana okusebenza kubo bonke akubona ubufakazi bokuthi ukuhlola kwasinda oshintsheni lwakho.

Izindlela ezimfishane ezidala inkinga yesibili

Ungavumeli umsizi ukuthi abike isimo esihambisanayo ngaphandle kokuqalisa ukuhlola okudingekayo, futhi ungagcwali ubunikazi beplatifomu ukuze buhambisane nohlelo olunye lokusebenza. Ukusho ukuthi iplatifomu ihlukile akubona ubufakazi bokuthi idivayisi yangempela iyawuhlangabezana umgomo. Kukushiya neklayenti eliqamba amanga kukho konke ukungena okuzayo.

Ukucisha ukuqinisekiswa kweseva, ukuphinda kudlalwe ikhukhi endala kanye nokugcina izkripthi ezingakahlolwa konke kushintshanisa ukwehluleka okubonakalayo nokungabonakali. Uma iklayenti efakiwe ingakwazi ukuqeda umfudumalo osekelwe, cela enye indlela egunyaziwe esikhundleni sokugoba leyo onayo.

Incwadi yomhlahlandlela ye-OpenConnect ibhala i---csd-wrapper ne---csd-user ngokwehlukana, futhi yilowo mkhondo obalulekile: iskripthi nobunikazi yizinqumo ezimbili. Zihlole ngokwehlukana futhi ubhale zombili. Khona-ke isikhuthazo sokungena asisaba yindida oyixazulula ngokunamathisela ikhodi.