Ukungena ku-OpenConnect kuhamba kukhasi elingalungile? Hlola indlela kuqala

Unamathisela ikheli elisuka ku-imeyili yokuqala, iklayenti lifinyelela isango, futhi ifomu lokungena elivelayo iwukusiza okujwayelekile, hhayi okwabambisene nalabo abachazwe umqhubi. Akukho okubonisa iphutha, futhi yikho kanye okudidayo: ithumbu lingase likhuphuke, kodwa ngemuva kwendawo yokungena engalungile. Indlela kuleyo URL yayisenza umsebenzi, futhi noma yini eyayithatha indawo yayo yawushiya lowo msebenzi.

Hlukanisa izinto ezimbili ezifika njengocingo olulodwa kuthikithi: ikheli elifinyelela insiza, kanye nokufakwayo okunquma ukuthi ukuqinisekiswa kuqala kuphi. Ukulungisa okokuqala ngokunganaki okwesibili yiyo indlela igama lomsingathi elifanele lisaveza ukungena okungalungile.

Iklayenti lithumela ini ngaphambi kokuba ubone ifomu

Ngekheli elifana ne-https://vpn.example.net/partners, isenzo sokuqala seklayenti isicelo se-HTTPS kuleyo ndlela hhayi kumsingathi ongenalutho. Okubuyayo ngokuvamile ukuqondiswa kabusha endaweni yokungena, noma ifomu ngokwalo. Iklayenti elinikezwa kuphela i-vpn.example.net liqala ekhasini lokuhla elizenzakalelayo elikhona, futhi lokho kungaba enye ingosi, olunye uhlu lwamaqembu, noma ikhasi elilindele iphrothokholi ehluke ngokuphelele. Umehluko ubonakala kumakhanda ompendulo kude kakhulu ngaphambi kokuthi kufakwe noma yiluphi ubufakazi.

Yingakho ithebhu yesiphequluli esisebenzayo nephrofayela yeklayenti ehlulekayo kungasho isango elifanayo futhi kungavumelani. Isiphequluli salandela indlela; iphrofayela yayingenayo neze.

Izinto ezimbili zokufaka ezibonakala zishintsheka futhi zingashintsheki

I-OpenConnect iveza indlela yokuqala ye-HTTPS njenge---usergroup, futhi ikhasi lemanuwali libheka i-URL ephelele ethwala leyo ndlela njengesicelo esifanayo esibhalwe ngenye indlela. I---authgroup iyinketho ehlukile: ikhetha okufakiwe ohlwini isango elikwethula ngaphakathi kwefomu lokungena. Amanye amaphrothokholi abiza lokho kufakiwe ngokuthi iqembu, amanye ngokuthi isizinda noma isango, futhi yilapho kanye amafulegi amabili adideka khona.

Insiza ingadinga kokubili ngokomthetho. Indlela ingakuholela engosini efanele kuyilapho ifomu lisacela ukuthi ukhethe phakathi kwamaqembu ngaphakathi kwayo. Ukunikeza igama lengosi njengegama leqembu, noma okuphambene, kukhiqiza ukungena okubonakala kwamukelwe bese kwehluleka ukugunyaza, ngoba inani lalivumelekile ngokolimi kodwa lalingalungile ngomqondo.

Cela umqhubi inani ngalinye emgqeni walo: indlela yokungena, ukukhetha efomini, nokuthi kokubili kuyadingeka yini. Ungaqhageli okunye kokunye ngoba amalebula azwakala efana.

Kungani ukusika indlela kushintsha umphumela

Amaklayenti amukela kuphela umsingathi nechweba avame ukuxhuma noma kunjalo, ngakho uphawu akuvamisile ukuba ukwehluleka okuqinile. Esikhundleni salokho uthola ikhasi lokungena elingalungile, uhlu lwamaqembu olungenalutho, igama lesitifiketi elingasahambisani nalokho okwashicilelwa umqhubi, noma ithumbu elikhuphuka ngaphandle komzila oya ensizeni oyifunayo. Ngakunye kwalokhu kuhlezi kungqimba ehlukile, futhi akukho ngisho okukodwa okulungiswa ngokunamathisela ucingo olude endaweni ebhalwe njengegama lomsingathi. Okubili kwalokhu akukwazi nokuphawuleka ngaphandle, ngoba kokubili kufika njengefomu lokungena elimane lingaqhubeki.

Ukushintsha igama lomsingathi ngekheli le-IP kuyiphutha elihlukile elivame ukuhamba nalena. Ukukhetha insiza ngokusekelwe egameni nokuqinisekiswa kwesitifiketi kokubili kuncike egameni, ngakho ikheli lezinombolo lingaguqula inkinga yefomethi yendlela ibe yiphutha le-TLS.

Amakheli esiphequluli nawo athwala okungaphezu kwezindlela. Izihlonzi zesikhathi, izinto eziqondiswa kabusha, izandulela zolimi kanye namapharamitha okungena esikhashana konke kuvela kubha yekheli, futhi akukho ngisho okukodwa kwalokhu okungafanele kube kuphrofayela yeklayenti egciniwe.

Qinisekisa indawo yokungena ngaphambi kokuhlela enye into

Funda amakhanda endlela oyinikiwe. Isicelo esifana ne-curl -sS -o /dev/null -D - https://vpn.example.net/partners siphrinta umugqa wesimo nanoma yiliphi ikhanda le-Location ngaphandle kokulandela ukuqondiswa kabusha. I-302 ekhomba endaweni yokungena enegama iqinisekisa ukuthi indlela ikhona futhi ikhombisa ukuthi iya kuphi; i-404 isho ukuthi ikheli lomqhubi liphelelwe yisikhathi.

Bese uphinda ukhuphe leyo ndawo yokungena ekliyentini egunyaziwe, isibonelo openconnect --usergroup=partners vpn.example.net, futhi ubheke ukuthi yiliphi ifomu elivelayo. Uma ifomu lilungile futhi ithumbu lisahluleka, indlela ayizange ibe yinkinga futhi isigaba esilandelayo inqubomgomo noma umzila.

Qopha igama lomsingathi, ichweba, iphrothokholo, indlela yokungena nokukhetha efomini njengezinkambu ezinhlanu ezihlukene kuthikithi. Lolo hlu yilona olwenza unjiniyela olandelayo akwazi ukuhlukanisa iseva engafinyeleleki, ukwenqatshwa kwe-TLS, ukukhetha okwenqatshiwe kanye nethumbu elikhuphuke ngaphandle kwemizila edingekayo.