Ifayela lobufakazi noma isokhethi yokuphatha ye-OpenVPN: yikuphi okufanele kusikripthwa

Isikripthi esiqala i-OpenVPN futhi esingaxhumani neze ngokuvamile akulona inkinga yenethiwekhi: iklayenti lihlezi emibuzweni ngaphandle kwethemini elingayidweba. OpenVPN inezindlela ezimbili ezisekelwe ngqo zokuphendula lowo mbuzo ngaphandle komuntu, ifayela lobufakazi ngemuva kwe-auth-user-pass kanye nesokhethi yokuphatha, futhi azikwazi ukushintshana. Ifayela libiza umyalo owodwa futhi liphendula umbuzo owodwa; isokhethi liphendula yonke imibuzo futhi linikeza noma yini engavula imbobo ye-loopback isiteshi sokulawula esingaqinisekisiwe. Yikuphi okufanele ukuthunyelwa kwakho kuncike ekutheni yiwuphi umbuzo ovimbayo ngempela, nokuthi iyiphi imfihlo ongayeka ilele buthule.

Qamba umbuzo ngaphambi kokukhetha indlela

Imibuzo emine ibukeka ifana kuthemini. Iphere lama-akhawunti livela ekuhlelweni kwe-PAM noma i-auth-user-pass-verify yesiphakeli, futhi i-auth-user-pass iyaphendula. Umusho wemfihlo wokhiye wangasese ungowefayela lokhiye futhi ufundwa nge---askpass noma ubhalwe ngesandla. Iphakethe le-PKCS#12 licela iphasiwedi yalo. Ukuqinisekisa kwe-proxy kusebenzisa ifayela le-auth elithathwa yi---http-proxy, hhayi ubufakazi be-akhawunti.

Lapho i-OpenVPN isebenza njengengane ye-systemd, i-PHP noma i-Node akukho themina, ngakho konke lokhu kuvimbela buthule. Inqubo ihlala lapho, ilogi iyama ngemuva komugqa wokubethela, futhi iyunithi ekugcineni idlula isikhathi; lokho kuthula yikona okwenza abantu bangeze iluphu yokuzama futhi noma i-sleep esikhundleni sokubheka ukuthi yiwuphi umbuzo olindile. Isokhethi yokuphatha kuphela elingaphendula konke okune. Ifayela lobufakazi liphendula okokuqala futhi akukho okunye.

auth-user-pass: ifayela elilodwa, umbuzo owodwa

Ifayela ligcina igama lomsebenzisi emugqeni wokuqala nephasiwedi emugqeni wesibili, futhi akukho okunye: azikho izicaphuno, awekho amagama okhiye, awukho umbhalo wencazelo. Setha imodi engu-600 futhi wenze umnikazi abe yi-akhawunti esebenzisa i-openvpn, okuthi enkonzweni ngokuvamile kube umsebenzisi okhethiwe hhayi ukungena kwakho. Ifayela eliphethwe yi-root ngaphansi kwe-/root umehluko phakathi komyalo osebenza kushel yakho neyunithi ehlulekayo lapho kuqalwa.

Imininingwane emibili iguqula ifayela elifanele libe umbuzo. Isihleli esigcina i-CRLF sishiya ukubuya kwenqola kunamathele kuphasiwedi, ngakho isiphakeli senqaba iphasiwedi ebonakala ilungile efayelini; hlola nge-cat -A noma i-od -c hhayi ngamehlo. Futhi i-auth-user-pass engenawo umqondo ngaphakathi kwephrofayela isho ukuthi «buza umsebenzisi» ngokwakhiwa, okungenzeka umyalo wesibili emugqeni womyalo ungakunqobi, ngoba iphrofayela ihlaziywa lapho ikhona.

Ukulandelana kwezinketho kuwugibe lwesithathu, futhi kuncike kunguqulo. Ezinye izakhiwo ze-OpenVPN 2.4 ziyayishaya indiva i---auth-user-pass uma iza ngaphambi kwe---config, ngakho lezo zinketho ezimbili ngokulandelana okunye ziyaxhumana. Beka umyalo ngaphakathi kwephrofayela, noma ngemuva kwe---config emugqeni womyalo, futhi usebenzise i-grep kwiphrofayela ukuthola konke ukuvela ngaphambi kokushintsha okunye.

auth-nocache ingeyale ndlela kodwa ayinikezi lutho. Ikhawulela isikhathi iklayenti eligcina ngaso ubufakazi ememorini, okusiza ngemuva kokuphahlazeka futhi akusizi nhlobo uma ifayela lingekho. Ukuxhumana kabusha ngemuva kokuphelelwa yisikhathi kweseshini ohlangothini lwesiphakeli kufunda ifayela futhi, ngakho ubufakazi obusebenzile lapho kuqalwa busengaphela phakathi nosuku.

Isokhethi yokuphatha: wonke umbuzo, indawo enkulu

Qala iklayenti ngomlaleli futhi umemezele ngokusobala ukuthi imibuzo izobikwa kulo, usebenzisa imiyalo ebhalwe ku-incwadi ye-OpenVPN 2.6:

management 127.0.0.1 3030
management-query-passwords

Kusuka ku-bash, gcina ukuxhumana kusichazi sefayela esengeziwe futhi uphendule ngokwegama lombuzo hhayi ngendawo, ngoba ukuxhumana kabusha kungabuza ngokulandelana okunye:

exec 3<>/dev/tcp/127.0.0.1/3030
while read -r -u 3 line; do
  case "$line" in
    *"Need 'Auth' username/password"*)
      echo 'username "Auth" alice' >&3
      echo 'password "Auth" secret' >&3 ;;
    *"Need 'Private Key' password"*)
      echo 'password "Private Key" secret' >&3 ;;
  esac
done

Umngcele ukuthutha. Iphrothokholi yokuphatha ingumbhalo osobala phezu kwe-TCP ku-loopback, ngakho umlaleli akumele ushicilelwe ekhelini le-LAN noma lomhubhe ukuze isilawuli esikude sifinyelele; isilawuli esikude sisho ukudluliswa kwe-SSH, hhayi ukubopha okubanzi. I-daemon yomphakathi yamukela iklayenti elilodwa lokuphatha ngesikhathi, ngakho i-GUI noma isibukeli asikwazi ukwabelana ngesokhethi nesikripthi sakho. Ukuxhumana kwesibili kwenqatshwa, akubekwa emgqeni, futhi ukwehluleka kubukeka njengesikripthi esithe cwaka.

Leyo sokhethi iyisiteshi sokulawula futhi. Ngaphandle kwephasiwedi yokuphatha, noma yini engaxhumana no-127.0.0.1:3030 ingafunda isimo, ibulale umhubhe noma iphendule umbuzo ngokwayo. Iphasiwedi yokuphatha nefayela lobufakazi kuyimfihlo yekilasi elifanayo, futhi kokubili kufanele ukunakekelwa okufanayo.

Yikuphi okufanele ukuthunyelwa

Khetha ifayela lobufakazi lapho umbuzo oyedwa kuyiphere lama-akhawunti, iklayenti lisebenza njengenkonzo enomnikazi ozinzile, futhi ungagcina ifayela elingu-600 ngaphandle kwezisizo ongazilawuli. Khetha isokhethi yokuphatha lapho umusho wemfihlo wokhiye noma iphasiwedi ye-PKCS#12 ihilelekile, lapho isembozo sesivele siqondisa inqubo, noma lapho udinga ukubuka isimo nemibuzo ngenkathi ulungisa ukuxhumana kabusha.

Izimo ezimbili zihambisa isinqumo. Uma isembozo kuyi-/bin/sh, iyunithi ye-systemd ebiza ibhinari ngqo, noma isiqukathi esincane, iglu lesokhethi le-bash kuphela alitholakali futhi ifayela liyimpendulo eshibhile. Uma imfihlo izungeza kaningi, alikho ifayela eliyingcezu yasekhaya enhle yayo: buza iringi yokhiye kusembozo esincane futhi uvumele iyunithi ibize isembozo, okugcina ukuzungeza endaweni eyodwa nephasiwedi ngaphandle komlando weshel.

Ukufaka endaweni kwenqubo kumi phakathi kokubili futhi akukho kukodwa. Umugqa owodwa ongezansi uyasebenza ngoba i-bash iyakwandisa ngaphambi kokuthi i-openvpn iqale, hhayi ngoba iklayenti liqonda uhlelo lolimi:

openvpn --config client.ovpn --auth-user-pass <(printf "%s
%s
" "$USER" "$PASS")

Iyaphuka ngaphansi kwe-/bin/sh, kuyunithi edlula ishel, nakuzithombe ezingenayo i-bash noma i-/dev/fd. Yigcinele ukuhlola okusebenzisanayo, hhayi neze njengesivumelwano inkonzo encike kuso.

Vikela imfihlo, bese uqinisekisa kusuka kulogi

Zombili izindlela zishiya imfihlo efundeka inqubo ye-OpenVPN. Ungalokothi ubeke iphasiwedi emugqeni womyalo noma efayelini leyunithi, lapho i-ps ne-systemctl ziyikhombisa khona wonke umsebenzisi wendawo; dlulisa indlela eya efayelini, hhayi inani elingaphakathi. Lapho izitifiketi zingathatha indawo yephere lama-akhawunti, lokho kususa isigaba sombuzo esikhundleni sokulifihla.

Ukusebenza okulungile kukhombisa ukulandelana kwemibuzo kuqeda nokuthi iseshini ifinyelela ku-«Initialization Sequence Completed». Uma iklayenti lima embuzweni ofanayo, ukufanisa kuhlulekile: phrinta imigqa eqondile eyathunyelwa isokhethi, hlola izicaphuno negama lombuzo, futhi ulungise iphethini esikhundleni sokwengeza i-sleep. Umhubhe obika impumelelo futhi ongathwali lutho uyinkinga yomzila noma ye-push, hhayi yobufakazi.

Bese uhlola ukuxhumana kabusha, hhayi ukuqala kokuqala kuphela. Nqamula iseshini ohlangothini lwesiphakeli noma linda isikhathi sayo siphele; iklayenti liyabuza futhi, futhi yilapho ifayela elabonakala lilungile lapho kuqalwa likhombisa ukuthi lisafundeka yini yi-akhawunti exhumana kabusha.