I-hook ye-client-connect ye-OpenVPN: ikheli lakho liya kuphi ngempela

Ukubuyisela ikheli kusuka ku-skripthi se-client-connect kubonakala sengathi kufanele kusethe i-IP yeklayenti. Akwenzi: indlela eyodwa ye-hook eya kuseva yifayela lesikhashana eliza negama lalo njengengxoxo yokugcina yeskripthi, futhi ikheli kufanele libhalwe lapho ngesintaksi ye-ifconfig-push. I-skripthi ephrinta ikheli noma ephuma ngoziro ngaphandle kokubhala lutho idala iklayenti elixhunyiwe elinekheli elivela echibini, futhi ilogi yeseva ibonakala iphilile ngokuphelele.

Ukudideka kuyavakala, ngoba amanye ama-hook amaningi aphendula ngempela ngamakhodi okuphuma noma iziguquguquki zemvelo. Lelina linesivumelwano salo, futhi isivumelwano siqala ngegama lefayela.

I-hook ibhala ifayela, hhayi inani lokubuyisela

Isimemezelo siyimigqa emibili: script-security 2 ukuze kuvunyelwe ucingo, bese kuba client-connect /etc/openvpn/server/assign-address.sh. Lapho iklayenti lizifakazela, iseva isebenzisa leso skripthi ngokufaka indlela yefayela elenziwe njengengxoxo yokugcina, okuyiyo kuphela $1 uma isimemezelo singadlulisi ezinye izingxoxo zaso. Konke okusetshenziswa kulelo klayenti kungena kulelo fayela njengemiyalelo evamile, eyodwa emugqeni ngamunye, ngendlela efanayo ncamashi nokuba yayizovela ngayo ekulungiselelweni. Isembozo esengeza amapharamitha aso sishintsha isikhundla, futhi uphawu lwakudala i-skripthi ebhala endleleni ebukeka njenge---verbose.

Isimo sokuphuma ingxenye yesibili yesivumelwano. Uziro usho ukuthi yamukela futhi ufunde ifayela; noma yini enye inqaba uxhumano, futhi yileyo ndlela ubunikazi obungafakwanga kumephu obenqatshwa ngayo esikhundleni sokubuyela buthule echibini. Bhala umyalelo ophelele ngaphambi kokubuyisela impumelelo, ukuze ifayela elibhalwe uhhafu lingabi ukulungiselela kweklayenti.

Imiyalelo emibili ifanele ukunakwa ngoba isebenzisana nakho konke okunye. ifconfig-push igxilisa ikheli, kuyilapho i-route ethunyelwe itshela iklayenti ukuthi yini efinyeleleka ngomhubhe; buyisela eyokuqala bese ukhohlwa eyesibili futhi uthola iklayenti elinekheli kodwa elingenandawo yokuya. Ukulandelana ngaphakathi kwefayela akubalulekile, kodwa ukuphelela kubalulekile. I-hook ethumela umzila wesiqalo esingekho ozakwabo ongafinyelela kuwo iyiphutha elifanayo elibonwa kwelinye ihlangothi.

Okokufaka kufika ngokusebenzisa iziguquguquki zemvelo: common_name, trusted_ip, ifconfig_pool_remote_ip nokunye. Kuphathe konke njengezintambo ezivela ngaphandle kweseva, hhayi njengezingcezu ze-shell.

Ukumephwa kwamakheli kuyinqubomgomo, hhayi izibalo

Indlela emfishane ekhangayo ukuhlaziya igama lesitifiketi bese usebenzisa izinombolo zaso njenge-octet yokugcina. Lokho akusona isabi sokwaba, futhi kwehluleka ngezindlela ezijwayelekile: amagama amabili anesijobelelo esifanayo ayashayisana, igama eliphela ngo-300 akulona ikheli, futhi isitifiketi esiqanjwe kabusha ngumlawuli sihambisa idivayisi buthule. Qinisekisa ubulungu be-subnet, ububanzi bamahost asebenzisekayo, amakheli agciniwe kanye nokuhluka kukho konke ukushaya, futhi gcina ukumephwa etafuleni umuntu angalifunda.

Noma ubani olawula igama ulawula ikheli, ngakho nquma ukuthi common_name imele ini ngempela kulokhu kusetshenziswa. Uma username-as-common-name kunikwe amandla, ubunikazi ukungena hhayi isihloko sesitifiketi. Ungalokothi udlulise lelo nani ekuhloleni kwe-shell, futhi ungalokothi uvumele iklayenti ukuthi lithinte indlela yefayela.

Isabi sokwaba esisekelwe kurejista kufanele simelane nokwenzeka kanyekanye. Gcina ikheli endaweni nge-atomic, phatha ukubhala okuhlulekile ngaphandle kokwamukela iklayenti elilungiselelwe uhhafu, futhi maka isabelo ngasinye ngoxhumano olusiphethe, ukuze ukunqanyulwa sekwedlule kwiseshini endala kungakwazi ukukhulula ikheli osekuvele likhona kwesisha. Izimo eziningi zeseva ezabelana ngechibi elilodwa zenza leso sidingo sibe nokubukhali esikhundleni sokuba yinto ozikhethela yona.

I-topology inquma ukuthi i-ifconfig-push isho ukuthini

Nge-topology subnet ku-10.77.0.0/24, i-ifconfig-push 10.77.0.20 255.255.255.0 iyikheli kanye nemaski yalo yenethiwekhi. Ngaphansi kwe-topology net30 ingxoxo yesibili ayisona neze imaski kodwa iyikheli lozakwabo, ngakho ukukopisha isimo se-subnet kuseva ye-net30 kukunika iklayenti elixhumayo kodwa elingakwazi ukudlulisa ithrafikhi. Shintsha i-topology ngamabomu, hhayi ukuze isibonelo sibonakale sivumelana. Iseva esevele isebenza nge-net30 inamaklayenti aphilayo ekulungeni kwamakheli amadala, ngakho ukushintsha kuwukufuduka okunewindi lokulungisa, hhayi ukuhlela umugqa owodwa.

Amakheli aqinile kufanele abe ngaphandle kwechibi eliguqukayo nangaphandle kwaso sonke esinye isabelo esiqinile, kuhlanganise nalawo anikezwa amafayela ajwayelekile e-client-config-dir. Uma izindlela ezimbili zingakhiqiza ikheli elifanayo kumaklayenti ahlukene, enye yazo ekugcineni izokwenza lokho.

Hlola izimo ezine ngaphambi kokuthembela kukho

Gijimisa ukuhlola okufanayo kubunikazi obumephwe, obungamephwanga, ukuxhuma kabusha kanye nokwehluleka kwerejista okulingisiwe. openvpn --config client.ovpn --verb 4 kukhombisa ikheli elabelwe ekuphenduleni kwe-push, futhi kuseva grep -A2 PUSH_REPLY /var/log/openvpn/openvpn.log kuqinisekisa ukuthi kwathunyelwani ngempela. Kubunikazi obungamephwanga umphumela olindelekile uxhumano olunqatshiwe, hhayi ikheli lechibi.

Bese uhlola incwadi yokugcina lapho i-daemon ibhala khona lawo mafayela esikhashana. I-skripthi sisebenza endaweni yesevisi eyehlisiwe, ngakho indlela i-root engabhala kuyo kodwa i-daemon ingakwazi ukubhala kuyo iguqula konke ukuxhumana kube ukwenqatshwa okunephutha lemvume eligqitshwe imigqa embalwa ngezansi kulogi.

Ukunikezwa akusona isigunyazo: ikheli eligxiliwe aliniki ukufinyelela kuyo yonke indawo ngemuva kweseva. Gcina inqubomgomo yomzila kanye nodonga lomlilo esigabeni sayo, futhi iqinisekise ngokumelene nekheli osanda kuligxilisa.