OpenVPN ngesikhathi sokuqalisa ku-Ubuntu: NetworkManager noma systemd?

Imikhombandlela eminingi iveza lokhu kukhetha njengento yokubukeka: kusala i-NetworkManager iphakamise umhubhe, noma uvule isibonelo se-systemd bese uqeda. Lezi zindlela ezimbili zihluka entweni eyodwa enquma umphumela emshinini ongenaso isikrini, futhi lokho akuhlangene nokuthi iyiphi ithuluzi elisha. I-NetworkManager ivula izimfihlo ngesikhathi somhlangano; isibonelo se-systemd asinaso isikhathi sokuvula. Khetha indlela ukusingathwa kwayo kwezimfihlo okuhambisana nomshini ophambi kwakho.

Konke okunye, kusukela ekufakeni imizila kuze kufike ekuziphatheni kokuxhuma kabusha, kuvela kuleso sinqumo sokuqala.

I-keyring iyona mehluko okungekho muntu okhuluma ngawo

Lapho i-NetworkManager iphethe iphrofayili ye-VPN, iphasiwedi ingahlala ku-keyring yokungena, evulwa lapho umsebenzisi engena. Lokho kusebenza kahle ku-laptop: umuntu ukhona, i-keyring iyavuleka, umhubhe uyaphakama. Ku-server eqala ngaphandle kokuqapha akekho umuntu ongavula noma yini, ngakho iphrofayili ilinda imfihlo engafiki neze. Uxhumano lubonakala lulungisiwe futhi alusebenzi neze.

Isibonelo se-systemd sigwema leyo nkinga ngokufunda ifayela lobufakazi kusuka kudiski, okwenza ifayela libe yinto oyivikelayo. chmod 400 kanye nobunikazi be-root yizinga eliphansi, futhi ifayela kufanele lihlale ngaphandle kwezinqamuleli kanye namathempulethi ezithombe ongazilawuli.

Ukuxhuma i-VPN kuxhumano akusona isiqinisekiso sokuqalisa

Ku-nm-connection-editor, khetha uxhumano lwentambo noma olungenantambo esikhundleni se-VPN, vula ithebhu ye-General, maka inketho yokuxhuma ku-VPN ngokuzenzakalela futhi uqambe iphrofayili igama. Ngemva kwalokho i-NetworkManager ivula i-VPN njengoxhumano lwesibili lapho uxhumano lokuqala lufinyelela isimo esixhunyiwe. Lokho kungukuncika, hhayi umthetho we-firewall. Amaphakethe asengaphuma phakathi namasekhondi ngaphambi kokuba umhubhe uphakame, futhi imfihlo egciniwe engavuleki ishiya umshini uku-inthanethi ngaphandle kwayo.

Uma imfuneko iwukuthi akukho okungaphuma ngaphandle komhubhe, shono lokho futhi wakhe iswishi yokucisha, ngoba lesi silungiselelo ngeke sinikeze eyodwa. Hlola futhi ukumisa okwesikhashana nokuqhubeka, ngoba uxhumano lwesibili luhlolwa kabusha endleleni yokubuya.

Isibonelo se-systemd sidinga igama lefayela elihambisanayo

Beka iphrofayili kudirectory yeklayenti elindelwe yiphakethe, njenge-/etc/openvpn/client/office.conf, futhi ukhombe kuyo ifayela lobufakazi nge-auth-user-pass office.cred. Igama lesibonelo yigama lefayela ngaphandle kwesijobelelo, ngakho i-openvpn-client@office ifunda ifayela i-office.conf. Ivule nge-sudo systemctl enable --now openvpn-client@office futhi uqinisekise ukuhambisana nge-systemctl cat openvpn-client@office esikhundleni sokwethemba isibonelo esivela kubhulogi.

Izindlela ezingaphakathi kwephrofayili zixazululwa ngokuphathelene nedirectory yokusebenza yeyunithi, hhayi iphrofayili uqobo, ngakho umugqa ohlobene we-ca noma we-auth-user-pass ungahluleka ngesikhathi sokuqalisa nakuba usebenza lapho uwuhlola ngesandla. Sebenzisa izindlela eziphelele kukho konke okufanele ikuthole iyunithi. Ngemva kwalokho funda i-journalctl -u openvpn-client@office -b ngemva kokuqalisa kwangempela; iyunithi ebika ukuthi iyasebenza ngaphandle komhubhe ivamise ukusho ifayela elingekho kulelo logi.

Amaphakethe amadala aletha igama lethempulethi elihlukile, ngakho i-systemctl list-unit-files 'openvpn*' inquma ukuthi iliphi elikhona kule hosti.

Ukuziphatha kokuxhuma kabusha yisinqumo esihlukile

Iphrofayili ene-ping-restart yakha kabusha umhubhe ngemva kokuwa kwawo, futhi iyunithi enomyalelo wokuqalisa kabusha yenza into efanayo ezingeni lesevisi. Leyo imigomo oyikhethayo, hhayi izinto eziyisisekelo oziwelayo. Uma uxhumano kufanele lukhuphuke kuphela lapho kuceliwe, susa ukuziphatha kokuqalisa kabusha ngamabomu futhi ubhale ukuthi kungani. Uma iyunithi iqala ngaphambi kokuba inethiwekhi isebenzeke, idinga umgomo wokuphinda uzame, ngoba umzamo owodwa ohlulekile ngesikhathi sokuqalisa awuziphinde ngokwawo.

Ukumisa nakho kucacile: i-sudo systemctl disable --now openvpn-client@office imisa isibonelo esisebenzayo futhi isuse isixhumanisi sokuqalisa. Ukukhubaza kuphela kushiya umhubhe usebenza kuze kube ukuqalisa okulandelayo, okumangaza noma ubani ohlola ngokukhubaza futhi ebona ukuthi i-interface ihlala iphakeme.

Qalisa kabusha, bese uhlola izinto ezine ngokulandelana

Ukuqalisa kabusha isevisi kuhlola isevisi; ukuqalisa kabusha umshini kuhlola indlela yokuqalisa. Ngemva kokuqalisa kabusha, qinisekisa ukuthi iyunithi iphakamile, bese ukuthi kunendlela eya kunethiwekhi engaphansi ekude, bese ukuthi umshini uveza liphi ikheli ku-inthanethi, futhi ekugcineni ukuthi amagama axazululwa ngomhubhe. Lezo zivivinyo ezine zihluleka ngalolo kulandelana lapho kukhona okungahambi kahle, okwenza ukwehluleka kokuqala kube usizo.

Iyunithi esebenzayo ngaphandle kwendlela ngokuvamile isho ukuthi iphrofayili ixhumeke kodwa i-server ayizange icindezele noma iyiphi indlela, noma ukuthi indlela yafakwa ku-interface eyanyamalala kamuva. Indlela engenakho ukusesha amagama okusebenzayo ikhomba ekulungiselelweni kwe-DNS hhayi kumhubhe uqobo.

Nquma kusengaphambili ukuthi kufanele kwenzeke ini lapho umhubhe ungakwazi ukuphakama. Ukubuyela ekuxhumaneni okujwayelekile kungumgomo, futhi kufanele kubhalwe phansi esikhundleni sokushiyelela kunoma yimuphi umphathi oqale kuqala.