I-OpenVPN Access Server ne-Community: yini ngempela ethuthwayo

Amaphrofayili ayathutha; izinhlu zabasebenzisi zisala. Ithimba elishintsha phakathi kwe-Access Server ne-Community Edition lihlangabezana nalesikhala ngemva kwehora lokushintsha, lapho iklayenti lalo lokuqala lifakaza khona bese lingenaso isu leqembu, lingenayo indlela yomsebenzisi ngamunye futhi lingenakho ukusetha kabusha iphasiwedi kokuzisebenzela. Yomibili imikhiqizo ikhuluma iphrothokholi efanayo futhi yamukela iklayenti elifanayo, futhi yikho kanye okwenza lesikhala sihlale singabonakali ngesikhathi sokuhlela. Empeleni okukhethayo isendlalelo sokuphatha kanye nabantu abasinikezwe amandla.

Thatha isinqumo njengombuzo wokubala impahla hhayi ithebula lezici. Buza ukuthi ubani wenza abasebenzisi, ubani uhoxisa izitifiketi nokuthi ubani uphendula ucingo ngo-02:00.

Kungani ifayela le-.ovpn lingakuthwali ukulungiselela

Iphrofayili ye-.ovpn ichaza ubudlelwano beklayenti elilodwa nesiphakeli esisodwa: isiphakeli esikude, iphrothokholi, i-CA, isitifiketi sekilayenti nokhiye, kanye nanoma yini ye-tls-crypt engaphakathi. Phonsa lelo fayela ekwakhiweni okusha futhi iklayenti lisazogcwalisa ukuxhawulana, ngakho ukufuduka kubonakala kuphelile. Akukho lutho kulo olubala abasebenzisi, amaqembu abo, izindlela zabo ezingashintshi noma inqubomgomo eyanquma ukuthi ubani uvunyelwe ukuxhuma. Leyo mibhalo ihlala esitolo sesiphakeli uqobo, futhi yomibili imikhiqizo iyigcina ngezindlela ezihlukene.

Ku-Community Edition okulinganayo ngamafayela owagcinayo ngokwakho: okufakiwe kwe-client-config-dir okunezinketho zeklayenti ngalinye njenge-ifconfig-push ne-iroute, i-CRL yokuhoxiswa kanye nokhiye we-tls-crypt. I-Access Server igcina imiqondo efanayo kusizindalwazi sayo futhi iyidalule ngekhonsoli yewebhu kanye nethuluzi lomugqa womyalo i-sacli. Imiqondo ihambisana ngayinye kuqondile; izinto zobuciko azihambi nhlobo.

Amaphrofayili futhi ashushumbisa ukuziphatha okungeke kubonwe muntu kuze kushintshe. Iklayenti eline-redirect-gateway def1 lithumela konke ukuphequlula ngesiphakeli; liyise ekwakhiweni okungenalo lolo mugqa futhi isikhalazo siyoba ukuthi i-internet iphukile. Ukungafani kwe-CA noma isilungiselelo esingalungile se-remote-cert-tls kwehluleka ngomsindo, okuwumphumela omuhle. Ukhiye we-tls-crypt ongekho wehluleka njengesikhathi sokuphela esithule, okungewona umphumela omuhle.

Yini isendlalelo sokuphatha esinayo

Bala okungeyona iphrothokholi: ukwakha ama-akhawunti, ukusetha kabusha iphasiwedi, ukwabela amaqembu, ukubhalisa i-MFA, amalungelo okuxhuma kanye nomkhondo wokucwaninga ophendula ukuthi ubani waxhuma nini. I-Community Edition ayikunikezi lokhu ngqo. Ukhetha ingemuva lokufakaza, uxhuma i-PAM, i-LDAP noma i-RADIUS ngesengezo noma nge-auth-user-pass-verify, bese ugcina okunye ngokwakho. I-Access Server ihlinzeka ngezingosi zabasebenzisi, ikhonsoli yokuphatha kanye nokuhlanganiswa nabahlinzeki bamazisi abajwayelekile. Akukho kulokhu kuhlelo okuphephile ngokuzenzakalela, ngoba inqubomgomo kusafanele ibhalwe umuntu owaziyo inethiwekhi.

Amalungelo umehluko ocijile kakhulu wokusebenza. I-Access Server inikezwa ilayisense ngenani lokuxhuma ngesikhathi esisodwa futhi iphoqelela lelo nani kusofthiwe. Ku-Community Edition, umkhawulo womhlaba jikelele uwumugqa owodwa we-max-clients, kanti noma yini ngomsebenzisi noma ngeqembu isho umsebenzi omningi we-client-config-dir nokuphoqelela kwakho. Ithimba elingenalo isifiso salolo kubheka linanzelela kanye lokho lapho likhokhela umkhiqizo wezohwebo.

Ilayisense nokusekela: umugqa ongenawo umuntu kubhajethi

I-Community Edition imahhala futhi inomthombo ovulekile. I-Access Server yeyohwebo, futhi izinga layo lamahhala ngokomlando lalihlanganisa inani elincane lokuxhuma ngesikhathi esisodwa ngelayisense ekhokhelwayo ngaphezulu. Noma yiliphi inani elicashunwe empendulweni endala yenkundla seliphelelwe yisikhathi manje, ngakho hlola imigomo yamanje yomhlinzeki ngaphambi kokubala izindleko zephrojekthi. Ukuqhathanisa okuqotho kunezela amahora asetshenziswe ekwakheni ukuphathwa kwabasebenzisi, i-MFA nokuqapha ohlangothini lomphakathi emugqeni welayisense ohlangothini lwezohwebo.

Ubunikazi bokusekela bulandela ukwahlukanisa okufanayo. Ne-Community Edition uwena indlela yokunyusa izinga kukho konke iklayenti elingajwayelekile nakho konke ukubuyekezwa kwe-kernel. Ne-Access Server unomhlinzeki ongamshayela ucingo, futhi uzuza njengefa isigqi sayo sokukhishwa, kungakhathaliseki ukuthi siyafanelana newindi lakho lokushintsha noma cha.

Izindlela zokuhlola ngaphambi kokushintsha

Yenza uhlu lwalokho isiphakeli esisebenza ngempela esikugcinayo ngaphambi kokushintsha kunoma yiluphi uhlangothi. Ohlangothini lwe-Access Server, khipha uhlu lwabasebenzisi nezabelo zamaqembu futhi qaphela ukuthi yimaphi ama-akhawunti athembele ku-MFA. Ohlangothini lwe-Community Edition, bala izitifiketi ezikhishiwe, i-CRL kanye nawo wonke amafayela ngaphansi kwe-client-config-dir. Qhathanisa izinhlu zombili umugqa ngomugqa, ngoba umehluko phakathi kwazo uwumsebenzi wokufuduka.

Hlola amaklayenti amelela ngesikhathi isevisi endala isasebenza. I-openvpn --config client.ovpn --verb 4 ngaphambili iphrinta ukuxhawulana, izindlela ezithunyelwe nezinketho ze-DNS, futhi i-openssl x509 -in client.crt -noout -subject -enddate ibonisa ukuthi yisiphi isitifiketi iklayenti elisethula ngempela. Iklayenti elixhumayo kodwa elingafinyeleli isiphakeli sangaphakathi linomgodi wendlela noma we-iroute, hhayi ukwehluleka kokufakaza.

Gcina indlela endala yokululama iphila kuze kube yilapho okungena esikhundleni kudlula kokubili ukuhlolwa kokungena okunqatshiwe nokuhlolwa okuphumelelayo. Bhala imephu yokugcina ekhasini elilodwa: imfuneko ngayinye, into yobuciko eyiyo yanelisayo namuhla kanye nento yobuciko ezoyanelisa ngemuva kwalokho.