Gcina Ukhiye Wokusayina we-CA ye-OpenVPN Ngaphandle kwe-/etc/openvpn

Imibhalo emibili ebukeka ifana kusifundo yenza imisebenzi ehluke ngokuphelele. Enye igcina isiphathimandla sesitifiketi: ukhiye waso oyimfihlo, isibali sezinombolo zokulandelana kanye nerekhodi yakho konke okusayinile. Enye igcina lokho i-daemon ekudingayo ukuze iqale futhi isebenzele amaklayenti. Ukubeka kokubili kusisebenzi esisodwa ngaphansi kwe-akhawunti eyodwa kulula usuku olulodwa futhi kuyabiza impilo yonke yokwethulwa, ngoba i-daemon ibe isihamba eceleni kokhiye oyedwa ongakha noma yibuphi ubunikazi obufunayo.

Indawo yokusebenza ye-CA iqukethe ini

Uhla lwamafayela lwe-PKI luyisimo somkhiphi, hhayi ukuhleleka. Luqukethe ukhiye oyimfihlo nesitifiketi se-CA, ifayela lenombolo yokulandelana, inkomba yezitifiketi ezikhishiwe kanye nempahla yobunikazi ngabunye eyakhiwe kuzo.

Ukusayina isicelo kushintsha leso simo, yingakho indawo yokusebenza ingeyokwe-akhawunti elawulwa umlawuli kusisebenzi lapho insiza ye-VPN ingasebenzi khona. Noma ubani ongafunda ukhiye oyimfihlo we-CA angakhipha isitifiketi iseva ezokwethemba, ngakho ukuvikelwa kokhiye yiyo yonke imodeli yokwethemba efayeleni elilodwa. Ukukopisha endaweni yesibili ukuze ugcine isinyathelo kwakha into yesibili okufanele ivikelwe nento yesibili okufanele ikhohlakale. Isiginesha ngayinye futhi yenyusa inombolo yokulandelana futhi yengeza ingeno enkombeni, yingakho indawo yokusebenza iyikhophi eyodwa yesimo hhayi ifolda lamafayela.

Isitifiketi somphakathi se-CA sihlukile. Senzelwe ukusatshalaliswa, futhi yiso esisetshenziswa amaklayenti namaseva ukuqinisekisa omunye nomunye.

I-daemon ifunda ini lapho iqala

Iseva esebenzayo isebenzisa isethi encane: isitifiketi sayo, ukhiye wayo oyimfihlo, isitifiketi se-CA sokuqinisekisa ontanga kanye nanoma iyiphi impahla yokhiye edingwa yimodi ekhethiwe. Ifunda lezo zindlela ekuqaleni nasekufakweni kabusha.

Ubunikazi kufanele buhlolwe ngokumelene neyunithi eqala ngempela, hhayi ngokumelene ne-shell ye-root esebenzisanayo. I-sandbox emenyezelwe ingenza ingxenye yesistimu yamafayela ifundwe kuphela noma ingabonakali ngisho lapho ukuhlolwa ngesandla njenge-root kuphumelela.

systemctl show -p User -p Group -p ReadOnlyPaths [email protected]
stat -c '%a %U:%G' /etc/openvpn/server/server.key
runuser -u openvpn -- test -r /etc/openvpn/server/server.key; echo $?

Umugqa wesithathu yiwo abantu abawudlulayo. Ubuza i-akhawunti ye-daemon uqobo ukuthi ingakwazi yini ukufunda ukhiye, futhi yilowo kuphela umbhalo wombuzo obalulekile ngemva kokuba amalungelo ehlisiwe. Ukuphuma ngoziro njenge-root akusho lutho ngalokho okwenzeka ngemva kokuhlisa.

Izindlela ezimbili zephutha kufanele zihlukaniswe ngaphambi kokushintsha noma iyiphi imvume. Ukwehluleka kokusayina kukhombisa uhla lwamafayela lwe-PKI, imvume yokusesha kumafayela angaphezulu kwayo kanye ne-akhawunti eqhuba umkhiphi. Ukwehluleka kokuqala kukhombisa iyunithi, uhla lwamafayela lokusebenza kwayo kanye nezindlela ezishiwo ekuhleleni kweseva. Ukwenza isihlahla sonke sifundeke kubo bonke akulungisi noma yikuphi kwalokho, futhi kususa umngcele kokubili okuncike kuwo.

Kungani ukukopisha ukhiye we-CA eseveni kwehluleka kamuva

Ikhophi ivamise ukuqala njengesinyathelo sokulungisa iphutha: othile ufuna ukuvuselela iklayenti kusisebenzi se-VPN, ngakho ukhiye we-CA ugcina usungene /etc/openvpn futhi ukuvuselelwa kuyasebenza. Umsebenzi osheshayo uyaphumelela, futhi umngcele awusekho.

Bese iseva yenziwa isipele, futhi isiphathimandla sokusayina sihlanganyela nezipele. Isithombe, inqwaba yosekelo noma ikhophi yohla lwamafayela lokuhlela manje isithwala amandla okukhipha ubunikazi obuthembekile isikhathi eside i-CA isemthethweni. Noma ubani ophethe leyo khophi angakha isitifiketi sanoma yiliphi igama iseva elamukelayo, kuhlanganise namagama angakaze akhishwe. Irekhodi okuwukuphela kwayo yalokho kukhipha yilelo abakhetha ukuligcina.

Ukuphulukisa kuleso simo akusiyo indaba yokufuta ifayela. Kufanele unqume ukuthi ukhiye wadalulwa yini, uphendule i-CA uma kwenzeka, futhi usabalalise kabusha ukwethemba kuwo wonke ontanga. Indawo yokusebenza ehlukile igwema yonke ingxoxo.

Ama-akhawunti, amafolda, izipele

Nika umkhiphi i-akhawunti yakhe kanye nohla lwamafayela lwasekhaya, lugcinwe kude nesisebenzi se-VPN lapho kungenzeka. Nika i-daemon enye i-akhawunti, enokufinyelela kokufunda empahleni esetshenzisiwe nokufinyelela kokubhala kokungekho okukhipha izitifiketi. Sethula ngokukopisha izitifiketi zomphakathi ngaphandle futhi ungalokothi udonse isimo esiyimfihlo somkhiphi ngaphakathi. Gcina izipele zalezi zindima ezimbili ngokuhlukana, ngoba ukuzwela kwazo kanye nezindaba zazo zokubuyisela kuyahluka.

Ngemva kokuhoxiswa, buyekeza ifayela le-CRL elishiwo ukuhleleka kweseva, bese ulayisha kabusha insiza ukuze ukuxhumana okusha kulifunde. Imibhalo ye-Easy-RSA ihlanganisa ukuhlelwa kwendawo yokusebenza nokuhamba kokusayina; imithetho yobunikazi elizungezile ihlala iyisinqumo mayelana nesisebenzi sakho. Qinisekisa lokho insiza ekulayishile nge- openssl crl -in /etc/openvpn/crl.pem -noout -lastupdate -nextupdate esikhundleni sokucabanga ukuthi ukulayisha kabusha kukuthathile.

Ukuhlolwa okufakazela ukuhlukaniswa

Hlola icala elibi, hhayi kuphela elisebenzayo. Sayina isitifiketi kusukela ku-akhawunti yomkhiphi njengoba kuklanyelwe, bese uqinisekisa ukuthi leyo akhawunti ayikwazi ukuqala insiza noma ukufunda ukhiye oyimfihlo weseva. Bese uqinisekisa ukuthi i-akhawunti ye-daemon ayikwazi ukufunda ukhiye oyimfihlo we-CA.

Lezo zivivinyo ezintathu zithatha imizuzu embalwa futhi zisinda izinguquko zabasebenzi, ngoba ziyizitatimende mayelana nemvume hhayi mayelana nomkhuba. Bhala umphumela kanye nezindlela nama-akhawunti ekubandakanyile, kanye nosuku owazigxumile. Umuntu olandelayo ozuza le mfakelo uma kungenjalo uzophinda athole umngcele kusifundo esingakaze sibe nawo. Irekhodi elinosuku futhi yilo elenza ukubuyekezwa okulandelayo kuthathe imizuzu esikhundleni sentambama.