I-OpenVPN ayitholi i-ca.crt nakuba iphrofayela ilayishwa

Isevisi iyaqala, ifunde iphrofayela ngaphandle kwesikhalo bese ifa emgqeni obonakala ungahlobene: ayikwazi ukuvula i-ca.crt. Akukho okushintshile esitifiketini, futhi indlela yephrofayela efayeleni le-unit iphelele. Yileyo nhlanganisela isibonakaliso. Indlela oyinikezile ikhomba ifayela elilodwa, futhi amagama angaphakathi kwalelo fayela axazululwa kwenye indawo ngokuphelele, ngakho ukuqalisa okubonakala kugcwele ngokuphelele kusengase kufunde okhiye bakho kusukela kudayirekhithri okwakungafunwa muntu.

Ukwehluleka kunezizathu ezimbalwa, futhi kufanelekile ukuzihlukanisa ngokulandelana: idayirekhithri eyisisekelo inqubo eyayinayo ngempela, umongo wokuqalisa kwesevisi, kanye nezimvume noma i-sandbox ezungeze ifayela uma indlela isilungile. Ngayinye ishiya umkhondo ohlukile — ku-unit, enqubeni nasekuhlelweni kwamafayela.

Indlela yephrofayela akuyona idayirekhithri eyisisekelo

Cabanga ngenqubo eqala ku-/tmp futhi enikezwa i-/etc/vpn/prod/tenant-a.ovpn. Ngaphakathi kwaleyo phrofayela, umugqa we-ca ca.crt usho indlela ehlobene. Akukho okukwiphikisana okwathola iphrofayela okubhala kabusha lelo gama, ngakho inqubo ifuna i-/tmp/ca.crt futhi ibike ifayela elahlekile.

Okudidayo ukulandelana kwamaphutha. I-OpenVPN ihlaziya ukumiswa kuqala futhi ivule amafayela akhonjiwe njengoba ifinyelela kuwo, ngakho iphutha lokubhala kuphrofayela libikwa ngaphambi kokuthi kuthintwe noma yisiphi isihluthulelo, kuyilapho isitifiketi esilahlekile sibonakala kuphela lapho ukuhlaziya kufinyelela khona. Ngakho iphrofayela elayishwayo iwubufakazi bokuthi isakhiwo semisho silungile, hhayi ukuthi amafayela ewashoyo atholakele.

Okuhlukaniswa yincwadi yokuhola: i---config ne---cd

Incwadi yokuhola ye-OpenVPN 2.6 ichaza izinketho ezimbili ezihlukile. Eyokuqala ilayisha ifayela lokumiswa. Enye ishintsha idayirekhithri yenqubo ngaphambi kokuba ukumiswa, isihluthulelo, iskripthi namanye amafayela kufundwe, futhi idinga idayirekhithri ephelele ngaphandle kokubhekisela kweyamanje.

openvpn --cd /etc/vpn/prod --config tenant-a.ovpn

Lokho kubiza kuyisimo, hhayi umyalo wokuqalisa iphrofayela yomunye umuntu. Okukunikezayo ukuqiniseka: isisekelo salo lonke igama elihlobene ochungechungeni sishiwo kumyalo esikhundleni sokuthi sizuzwe njengefa kunoma yiliphi igobolondo noma umphathi owaqala inqubo. Enye indlela ilungile ngokufanayo futhi ivamise ukuba ngcono kusevisi: shiya idayirekhithri yomsebenzi njengoba injalo futhi wenze wonke amafayela akhonjiwe abe maphelele ngaphakathi kwephrofayela.

Noma yini oyikhethayo, hlola lonke uchungechunge hhayi ukwehluleka kokuqala. Iphrofayela ingadonsa elinye ifayela lokumiswa, futhi amagama ahlobene efayela elifakiwe axazululwa ngokumelene naleyo ndlela yenqubo, hhayi ngokumelene nedayirekhithri yefayela eliwafakile. Izindlela zamalogi, amafayela okuqinisekisa kanye namaskripthi okusiza alandela umthetho ofanayo.

Isevisi iqala kwenye indawo

Igobolondo elisebenzisanayo kudayirekhithri yephrofayela alifakazeli lutho nge-unit epakiwe. Abaphathi basetha idayirekhithri yabo yomsebenzi, futhi iskripthi sokugoqa singayishintsha futhi ngaphambi kokuba i-binary isebenze. I-unit ehlulekayo iwukuphela kokuqalisa okufanele kucatshangwe ngakho.

systemctl show -p WorkingDirectory -p ExecStart --value openvpn@tenant-a
ls -l /proc/$(pgrep -n openvpn)/cwd

Umyalo wesibili ukhombisa idayirekhithri inqubo ephilayo eyibambile ngempela, futhi lokho kuthembeke kakhulu kunefayela le-unit uma kukhona ukugoqa. Uma zozimbili zingavumelani, ukugoqa iyimpendulo yakho futhi i-unit iwumkhondo okhohlisayo.

Ngemuva kokusesha: izimvume, i-chroot ne-sandbox

Idayirekhithri eyisisekelo elungile ingakhipha umyalezo ofanayo, ngoba ukuxazulula nokufinyelela kuyizinyathelo ezihlukene. Inqubo idinga imvume yokwenza kuyo yonke idayirekhithri engumzali kanye nemvume yokufunda efayeleni, futhi i-unit yesevisi efihla ingxenye yokuhlelwa kwamafayela ishintsha lokho inqubo engakubona nhlobo.

Izinhlobo ezintathu ezivamile zikhipha iphutha elifanayo. Ifayela lifundwa kuphela yi-root kuyilapho isevisi ishiya amalungelo ngaphambi kokulivula. I-unit isetha umbono wokuhlelwa kwamafayela ovikelayo ongafaki idayirekhithri yephrofayela. I-daemon isebenza nge-chroot, ngakho indlela ekhona kusibungu ayikho ngaphakathi kwalowo mbono.

Hlola ngobunikazi befayela nobuwena benqubo, hhayi ngokukhulula izimvume. Ukwenza ukhiye oyimfihlo ufundwe yiwonke umuntu ukuze kuthuliswe leli phutha kushintsha ukwehluleka okunomsindo ngokuthule, futhi ukhiye uyingxenye yedayirekhithri ofuna ukuyembula kancane kakhulu.

Fakazela ukulungiswa ngokuqalisa kwakho

Qalisa kabusha i-unit yangempela kusukela kudayirekhithri engahlobene nephrofayela futhi ubuke umugqa wokuqalisa ofanayo. Bese uqinisekisa ukuthi inqubo ibambe idayirekhithri ehlosiwe ngenkathi isebenza, nokuthi isitifiketi esilayishile yileso osilindele.

systemctl restart openvpn@tenant-a
systemctl status openvpn@tenant-a --no-pager
journalctl -u openvpn@tenant-a -n 20 --no-pager

Uma ukulayisha kwezindlela kuphumelela, ukuqinisekisa nokuqondisa kusezinyathelo ezihlukene ezinokwehluleka kwazo, futhi uxhumano oluphakamayo kodwa olungadlulisi thrafikhi uwuphenyo olunye. Ukulungiswa lapha kumayelana kuphela nokuthi amafayela avelaphi, futhi kufanele kubonakale ekubizeni hhayi ukukhunjulwa yilowo owayegcine ukuyisebenzisa ngesandla.

Uma iphrofayela isatshalaliswa ngumphathi wokumiswa, beka idayirekhithri eyisisekelo noma amagama aphelele amafayela lapho futhi. Ukulungiswa ngesandla kusibungu esisodwa yinguqulo yale nkinga ebuyayo ngemuva kokwakhiwa kabusha okulandelayo.