OpenVPN auth-user-pass: ifayela, stdin noma umbuzo? Indlela yokukhetha

Izinto ezintathu zinquma ukuthi imuphi umthombo wobufakazi okufanele uwusebenzise: ukuthi kukhona yini umuntu ohlezi ekhonsoli, ukuthi imfihlo ingahlala yini kudiski, nokuthi ngabe enye inqubo kufanele iphendule umbuzo. Uma ukhetha kabi, iklayenti libika inkinga ye-stdin kuyilapho iphasiwedi isemthethweni ngokuphelele, futhi lokho kuthumela iningi kubaseva ngaphandle kwesizathu. Khetha indlela kuqala; imilayezo yamaphutha inencazelo kuphela uma wazi ukuthi iyiphi indlela eyikhiqizile.

Imibandela emithathu eyinqumayo

Umbuzo wekhonsoli uyindlela eyodwa edinga umuntu, ngakho-ke iyona kuphela ehluleka buthule kuyunithi ye-systemd noma ku-container. Uma umuntu eqalisa iklayenti futhi ethayipha iphasiwedi, akukho fayela elihilelekile futhi akukho lutho olubucayi olufika kudiski. Uma iklayenti liqala ngesikhathi sokuqalisa, umbuzo ofanayo uba ukulenga, futhi isikhathi sokuphela ngokuvamile sivela njengokwehluleka kokuxhumana okuvamile hhayi njengephutha lobufakazi.

Ifayela lobufakazi liyimpendulo efanele uma inqubo iqala ngaphandle kokuqondisa futhi imfihlo ingaphila kudiski ngaphansi kweqoqo lezimvume elilawulwayo. Uma imfihlo ingamelanga ukubhalwa nhlobo - inqubomgomo yevault kuphela, ithokheni yesikhathi esifushane - udinga ukugeleza iklayenti elingakwazi ukulivula, okusho ukuthi empeleni ukushintshwa kwenqubo noma umsizi obhala kusichazi sefayela. Isixhumi esibonakalayo sokuphatha sihlanganisa icala lesine: isilawuli esivele silawula umjikelezo wempilo yethuneli futhi esingaphendula imibuzo ngesokhethi.

• Umuntu ekhonsoli, akukho ukuzenzakalela: umbuzo osebenzisanayo.
• Ukuqala ngaphandle kokuqondisa, imfihlo ingagcinwa: ifayela lobufakazi elinemodi engu-0600.
• Ukuqala ngaphandle kokuqondisa, imfihlo ayikwazi ukugcinwa: ukushintshwa kwenqubo noma i-fd ebhalwa yi-ejenti yemfihlo.
• Enye inqubo ingumnikazi weklayenti: isixhumi esibonakalayo sokuphatha.

Uma izimpendulo ezimbili zifaneleka, khetha leyo egcina imfihlo ngaphandle kwe-argv nangaphandle komlando we-shell. Iphasiwedi edluliselwe njengengxenye yohlelo ingafundwa yinoma yimuphi umsebenzisi wendawo ngohlu lwez inqubo, futhi ukuchayeka kwalokho kunzima ukukuhoxisa.

Yini eyenziwa yindlela ngayinye yokufaka ngempela

--auth-user-pass yedwa libuza igama lomsebenzisi nephasiwedi ekhonsoli. Uma linikezwa igama lefayela, iklayenti lithatha umugqa wokuqala njengegama lomsebenzisi nomugqa wesibili njengephasiwedi; akukho lutho olusekela izingcaphuno, imibono noma isintaksi yokhiye-nenani. Yilokho kuphela ukuhleleka, ngakho-ke noma ubani okuhlelayo elindele ifayela le-INI uyakuphula. Ibhlokhi ye-<auth-user-pass> engaphakathi igcina imigqa emibili efanayo kuphrofayela, okwenza iphrofayela ngokwayo ibe imfihlo futhi iyibeka ekilasini elifanayo lokusingatha njengokhiye wangasese.

Ezinye izindlela ezimbili ukugeleza nesokhethi. OpenVPN idinga kuphela isichazi sefayela esifundekayo, ngakho-ke izokwamukela ukushintshwa kwenqubo, umgeniso we-/dev/fd osekelwa yipayipi noma igama lefayela eliyi-FIFO ngempela. Isixhumi esibonakalayo sokuphatha sihlukile ngemvelo: iklayenti libuza inqubo eqondisayo ngamanani esikhundleni sokuwafunda ngokwalo. Lowo mehluko ubalulekile lapho uxhuma kabusha: ifayela lobufakazi, i-FIFO umsizi wemfihlo angabhala kuyo futhi kanye nesixhumi sokuphatha kungahlinzeka futhi ngaphandle komuntu; ukushintshwa kwenqubo akukwazi, ngoba isichazi sisetshenziswa ekufundeni kokuqala.

Ifayela kufanele libe yimigqa emibili ngqo

Izimo ezimbili zokwehluleka zihlanganisa iningi lamafayela obufakazi aphukile. Isihleli se-Windows sishiya iziphetho ze-CRLF, ukubuyela kwekhariji kuba yingxenye yephasiwedi, futhi iseva yenqaba inani elibonakala lilungile esikrinini. Umugqa wesibili ongenalutho - umugqa ongenalutho lapho iphasiwedi kufanele ibe khona - ushiya iklayenti nephasiwedi engenalutho, iseva eyenqabayo noma inani esikrinini libonakala lilungile. Umugqa omusha owengeziwe ngemuva kwephasiwedi awunangozi. Bhala ifayela kusuka ku-shell, hhayi kusihleli, futhi uhlole amabhayithi:

install -m 600 /dev/null /etc/openvpn/client.creds
printf '%s\n%s\n' "$VPN_USER" "$VPN_PASS" > /etc/openvpn/client.creds
od -c /etc/openvpn/client.creds | head -3

Indlela ibalulekile njengokuqukethwe. Indlela ehlobene ixazululwa ngokuya kwisikhombisi sokusebenza senqubo, okungavamile ukuba yisikhombisi owahlola kuso uma kuyisevisi. Sebenzisa indlela ephelele, yenza ifayela libe ngumnikazi we-akhawunti eqalisa iklayenti, futhi gcina imodi engu-0600 ukuze iqembu nabanye bangakwazi ukulifunda. Incwadi ye-OpenVPN 2.6 ibala izinhlobo ezamukelwayo zomyalelo; yihlole ngaphambi kokusungula eyesithathu.

Hlola ifayela ngaphambi kokusola iseva. Ukusebenzisa i-openvpn --config client.ovpn --auth-user-pass /etc/openvpn/client.creds --verb 4 kuphrinta ukuthi ifayela lavulwa yini futhi kamuva ukuthi ubufakazi bwamukelwa yini, okukutshela ukuthi iyiphi ingqimba okufanele uyishintshe ngokulandelayo.

Ukugeleza, i-stdin namaphutha eziwakhiqizayo

Ukudlulisela iphasiwedi epayipini yinto yokuqala iningi eliyizamayo futhi iyindlela enezimangaliso eziningi. Ukushintshwa kwenqubo kuyasebenza ngoba iklayenti lidinga kuphela isichazi esifundekayo: openvpn --config client.ovpn --verb 3 --auth-user-pass <(printf '%s\n%s\n' "$VPN_USER" "$VPN_PASS"). Ukudlulisela i-/dev/stdin kusebenza kuphela uma i-stdin isavuliwe futhi ifundeka ngesikhathi iklayenti libuza, okungeyona into eyiqiniso kumugqa wepayipi osewuyisebenzisile.

I-ERROR: could not read Auth username from stdin inezimbangela ezimbili ezihlukene. Kwamanye amaklayenti e-2.3.x umlayezo wawuvela esihibeni sokusingatha i-stdin esalungiswa izinhlobo ze-2.3 zakamuva, ngakho-ke iklayenti elidala kangako lihlala lilungile kuphela ngokuthuthukisa. Kuklayenti lamanje wona lawo mazwi asho ukuthi iklayenti lacela okokufaka kwekhonsoli futhi i-stdin yayingeyona itheminali - ngqo isimo esiku-unit ye-systemd, umsebenzi we-cron noma i-container eqalwe ngaphandle kwe--t.

I-auth-nocache yengeza umjikelezo wesithathu obonakala njengephasiwedi ephukile. Ilahla ubufakazi emqondweni ngemva kokusetshenziswa, ngakho-ke ukuxhumana kabusha okubangelwa ukushintsha kwenethiwekhi akunakho okokudlala futhi umbuzo uyabuya. Lowo umyalelo osebenza njengoba uklanyelwe. I-auth-nocache ishintsha okugcinwa yiklayenti emqondweni, hhayi lokho iseva noma umhlinzeki wobunikazi acabanga ngakho nge-akhawunti, ngakho-ke ukulungiswa konke ukuhlinzeka ifayela elifanayo futhi, elifundwe kabusha ekuqaleni kabusha - futhi okuxhumana okuphathwayo lokho kuhlinzeka kufanele kuvele endaweni yemfihlo evunyiwe, hhayi iphasiwedi kusikripthi.

Isixhumi esibonakalayo sokuphatha uma umbuzo ungumnikazi wenye inqubo

Isilawuli esivele siqondisa ithuneli singaphendula nemibuzo yayo. Qalisa iklayenti nge---management 127.0.0.1 7505, funda imigqa yesimo, futhi ubheke i->PASSWORD:Need 'Auth' username/password. Isilawuli siphendula nge-username "Auth" alice elandelwa i-password "Auth" ... emigqeni yemiyalelo ehlukene. Ithokheni ye-'Auth' iphinda isihlonzi esisuka esicelweni futhi kufanele ifane, kungenjalo impendulo iyashiwa futhi iklayenti lilindile.

Intengo ingumshini wesimo manje ongumnikazi wawo: ukulandelana kokuxhumana, ukuqalisa kabusha kweklayenti kanye nesokhethi yendawo abanye abasebenzisi kusihloko okufanele bangayifinyeleli. Okukuthengayo ubufakazi obuhlinzekwa ngesikhathi sokusebenza, ngaphandle kwefayela kudiski nangaphandle kombuzo ongase ulenge. Uma kungekho okunye esitakini sakho esivele sikhuluma le phrothokholi, le ndlela yengeza ingxenye edinga ukunakekelwa.

Ukwehluleka okubonakala njengezinkinga zobufakazi

Ukuxhawulisana kwe-TLS okungapheli neze, noma i-VERIFY ERROR: depth=0, error=certificate signature failure, kuyinkinga yokuthembana futhi kwenzeka ngaphambi kokuba kufundwe noma yiliphi igama lomsebenzisi. Iklayenti le-proto tcp eliqondiswe kumlaleli we-UDP lehluleka endaweni efanayo: amaphakethe awafiki neze esigabeni sokuqinisekisa, ngakho-ke yonke iphasiwedi ibonakala ingalungile ngenxa yokuhlotshaniswa. Gcina ukuqinisekiswa kwesitifiketi kuvuliwe ngaphambi kokuba ubufakazi buthunyelwe; umbuzo ojwayelekile awusho lutho mayelana nokuthi ngubani othola iphasiwedi. Hlola iketanga yesitifiketi, igama elivamile kanye nokuthutha ngaphambi kokuthinta ubufakazi.

Amaphutha e-shell kusikripthi esihlanganisa iphrofayela angomunye umkhondo wamanga. Isikhala esingekho ngaphakathi kwe-[ ! -f "$file" ] sikhiqiza i-command not found, isikripthi siyama ngaphambi kwesikhathi, iphrofayela alilokothi lakhiwe futhi, futhi iklayenti liqala ngaleyo yangaphambilini. Lelo phutha lingelokwe-shell, hhayi elokuqinisekisa, futhi noma uthayipha iphasiwedi kabusha izikhathi ezingaki akususi.

Akuwona wonke umbuzo kulokhu kugeleza ongubufakazi lobu. Umusho wemfihlo wokhiye wangasese, ukungena nge-proxy ye-HTTP nephasiwedi yesevisi kuyizimfihlo ezintathu ezihlukene ezibuzwa ezigabeni ezihlukene, futhi umusho wemfihlo wokhiye uvamise ukusingathwa yiklayenti noma i-ejenti esikhundleni se-auth-user-pass. Uma umbuzo uvela ngaphambi kokuba iseshini ye-TLS ime, uphendula umbuzo ongelungile futhi akukho ukusetha kabusha kwe-akhawunti okuzosiza. Uma umbuzo ongelungile usukhishiwe, ukuhlola okusele kuqala engqimbeni yokuqala kakhulu:

• Funda iphutha lokuqala lephrothokholi, hhayi umugqa wokugcina wobufakazi: i-TLS, bese kuba ukuqinisekisa, bese kuba i-push.
• Qinisekisa ukuthi ifayela linemigqa emibili, alinakho ukubuyela kwekhariji futhi likhonjwa ngendlela ephelele.
• Qinisekisa ukuthi iphrofayela nomugqa womyalelo awaphikisani ngomyalelo.
• Hlukanisa "ubufakazi bumukelwe" kusuka "ithrafikhi iyahamba" - ukuhlela kanye ne-DNS kuyingqimba yakamuva.

Uma iklayenti lifinyelela isigaba se-push, yeka ukubheka ubufakazi futhi uqale ukufunda imizila namaseva e-DNS iseva ewathumile. Leyo yinkinga elandelayo, futhi ayihlobene nhlobo nephasiwedi oyilungise njengamanje.