Iskripthi se-auth-user-pass-verify se-OpenVPN: ikhodi yokuphuma efanele

OpenVPN sisebenza ngokusho kokukodwa okuphumayo kwiskripthi sokungena: isimo sokuphuma. Konke okunye okwenziwa yiskripthi kungumhlobiso. I-hook ingafinyelela kumqinisekisi ofanele, ihlaziye impendulo futhi iphrinte umugqa onomusa kodwa ibuyisele isimo esisho okuphambene nalokho okwakuhlosiwe umbhali. Funda isivumelwano kuqala bese ubhala i-adaptha kuso, bese loo sigaba sonke samaphutha sinyamalala.

Isivumelwano sincane: khomba i-akhawunti ethunyelwe, buza umqinisekisi ogunyaziwe umbuzo ohlosiwe futhi wamukele kuphela umphumela omuhle obhaliwe walowo mqinisekisi kuleso sicelo. Konke okunye kuyingqalasizinda.

Izimo ezintathu i-hook engazibuyisela

Ku- auth-user-pass-verify, incwadi yokuhola ye-OpenVPN 2.6 ichaza ikhodi yokuphuma 0 njengokwamukela, 1 njengokwenqaba kanye no-2 njengokuqinisekisa okuhlehlisiwe. Lezi yizimpendulo ezintathu kuphela eziziqondayo iseva, futhi ngayinye inomphumela ohlukile ekuxhumaneni. Iskripthi esiphuma ngesimo somyalo waso wokugcina sidlale ngempela ukuthi ucingo lwe-log noma isinyathelo sokuhlanza livote. Bhala isimo ngokusobala kugatsha ngalunye, kuhlanganise amagatsha angakaze afinyelele kumqinisekisi.

Ukuphumelela kwe-HTTP nokuphumelela kokuqinisekisa kuyizingqimba ezihlukene, futhi ukuzihlanganisa kuyindlela evame kakhulu yokuthi le hook yehluleke. Impendulo engu-202 isho ukuthi isicelo samukelwe ukuze sicubungulwe, hhayi ukuthi iphasiwedi iqinisekisiwe. Chaza isimo esilindelekile, ukuma kwempendulo kanye nesinqumo sokugcina kusivumelwano se-API osinikiwe, futhi ungazenzi igama lensimu ngoba kubonakala kukholakala.

Uma impendulo ifika ngempela kamuva, lowo umzila ohlehlisiwe futhi kufanele wakhiwe kanjalo. Umzamo ohlehlisiwe ongalokothi uqedwe ubamba izinsiza kuze kuphele isikhathi sokulinda.

Funda ifayela lobufakazi ngqo njengoba libhaliwe

Ngendlela ebhaliwe yefayela, iseva ibhala igama lomsebenzisi nephasiwedi njengemigqa emibili yokuqala yefayela lesikhashana, idlulisele leyo ndlela kuskripthi futhi isuse ifayela lapho iskripthi sibuya. Funda leyo migqa emibili njengedatha: ungalokothi wenze i-source yefayela, ungalokothi ulihlole, futhi ungalokothi unamathisele okuqukethwe kwalo emugqeni womyalo lapho ithebula lezinqubo lingakubona khona. Gcina iphasiwedi ngebhayithi ngebhayithi, ngoba ukuyenza ibe ngokujwayelekile njengoba wenza igama lomsebenzisi kushintsha ubufakazi buthule. Umqulu walezo zefayela lesikhashana yisinqumo sokusabalalisa, ngakho qinisekisa ukuthi ukhona futhi awufundeki yiwo wonke umuntu kusibungu.

Gcina ubufakazi bomqinisekisi uqobo buhlukile kobomsebenzisi: bungobokuhlanganiswa kwesango, buhlala esitolo sezimfihlo sepulatifomu futhi budinga kuphela imvume yokuqinisekisa, ngakho abusobufakazi bokuthi umuntu othile uqinisekisiwe. Ungavumeli ne-hook ukuba ibe umqinisekisi wesibili wamaphasiwedi. Ukubhala kabusha ngokwakho ukuqhathanisa kwe-hash akuphephile ngokuthuthukisa umjikelezo, futhi umqinisekisi ogcinwayo usivele uqonda uhlelo olunosawoti nolunezindleko lwesitolo sama-akhawunti.

Nquma ukuthi impendulo engahlukaniseki isho ukuthini

Izikhathi zokulinda, amaphutha okuthutha, izimpendulo ezimoshakele kanye ne-backend engatholakali zabelana ngesici esisodwa: akukho kuzo okuwukuqinisekisa okuhle. I-hook kufanele yehluleke ivaliwe kukho ngakunye futhi irekhode isizathu umsebenzisi angathatha isinyathelo ngaso. Leso sizathu singeselog evikelwe, hhayi esigijimini esibuyiselwa kumuntu ozama ukuxhuma.

Qaphela ngokulinganayo emizileni engafinyeleli kumqinisekisi nhlobo. Inani lokumiswa elingekho, imfihlo engafundeki noma okuncikile okungafakiwe kufanele kukhiqize ukwenqaba okunophawu oluhlukile lokusebenza esikhundleni sokwamukela okungazelelwe. Hlola lawo magatsha ngokususa okuncikile elabhu esikhundleni sokucabanga ngakho. Lapho ukwehluleka kwe-log kungashintsha isimo sokuphuma, i-log isiyisigaba sesinqumo futhi kufanele yenziwe ingenabungozi.

Ukumiswa kweseva nakho kubalulekile lapha: iskripthi ezichazwe umsebenzisi zihlonishwa kuphela lapho ukumiswa okusebenzayo kuzivumela ezingeni lokuphepha elidingekayo, futhi leso silungiselelo isinqumo ngamabomu hhayi inani elizongezwa.

Qinisekisa isinqumo, hhayi umugqa ophrintiwe

Yakha ukuhlolwa okuhlola isimo sokuphuma ngqo. Bhala ifayela lobufakazi lesibonelo, sebenzisa i-hook kulo nge-akhawunti eyaziwayo enhle neyaziwayo embi, bese ufunda isimo esibikwa yi-shell esikhundleni sombhalo ophrintwa yiskripthi. Lokho kuhlolwa okukodwa kubamba iningi lamaphutha esivumelwano ngaphambi kokuba iklayenti lixhume.

Bese usebenzisa lawo macala afanayo ngeklayenti langempela ngokumelene nesilaleli esingesona esokukhiqiza futhi uqinisekise lokho okuqoshwe yiseva: kwamukelwe, kwenqatshwa noma kuhlehlisiwe. Hlanganisa i-akhawunti ekhutshaziwe, iphasiwedi engalungile, impendulo yomqinisekisi emoshakele, isikhathi sokulinda kanye nomqinisekisi ongafinyeleleki. Uma noma isiphi isimo siwela esimweni ongakwazi ukusiqamba, i-adaptha ayikaqedwa.

Gcina ukuhlangana komphumela womqinisekisi nesimo sokuphuma eduze kweskripthi endaweni yokugcina, ukuze unjiniyela olandelayo afunde isivumelwano ngaphandle kokuhlanza ikhodi.