Umyalelo owodwa we-OpenVPN ngomugqa ngamunye, nokuthi kungani ukugoqa kukhohlisa

Iphrofayela eyayiqala ngaphambili manje yehluleka ngephutha lezinketho, futhi umugqa ocashunwa umhlaziyi ubonakala unengqondo ngokuphelele esikrinini. Lona ngumgibe: ifayela lokucwangisa uhlu lwemigqa ebonakalayo, ngamunye unegama elingukhiye lenketho nezimpikiswano zalo, futhi umugqa omude ogoqwe isihleli ubonakala ufana nemigqa emibili kuze kube yilapho ubheka amabhayithi. Akukho lutho lwenethiwekhi, isitifiketi noma ithumbu oluhilekayo kulolu hlobo lokuhluleka. Imigqa emibili ebonakala ifana esikrinini ingase ihluke ngebhayithi elilodwa.

Yenza izivivinyo ezingezansi ngokulandelana futhi ume kokokuqala okuhlulekayo. Ngayinye ishibhile kunelandelayo, futhi ngayinye isusa incazelo ehlukile.

Umugqa owodwa, umyalelo owodwa

Umhlaziyi ufunda umugqa, uthatha igama lokuqala njengenketho futhi ubheka okusele njengezimpikiswano zale nketho. Ngakho umugqa ofana ne-cert server.crt port 1194 awuyona imiyalelo emibili elandelanayo. Kuyinketho eyodwa ye-cert enezimpikiswano ezintathu, futhi eyesithathu akulona igama lefayela elamukelwa inketho. Ukufunda iphutha njengokuntuleka komugqa kuhle; ukulifunda njengomyalelo ongekho akukuhle.

# malformed: one option, three arguments
cert server.crt port 1194

# intended: two options, one argument each
cert server.crt
port 1194

Leyo migqa emibili elungisiwe iyingxenye, hhayi ukucwangisa. Ikhona ukukhombisa ukuthi umngcele uhlala kuphi. Wonke umyalelo ojwayelekile kuphrofayela ulandela umthetho ofanayo, futhi umugqa ohlanganisa emibili yawo ukhiqiza iphutha lezimpikiswano noma inani inketho engalilindelanga.

Fakazela ukuthi ukwephuka komugqa kungokoqobo

Izihleli ziyagoqa ukuze zibonise. Ezinye zifaka nokwephuka okuqinile uma unamathisela, ezinye azifaki, ngakho umphumela ofanayo obonakalayo ungavela kumafayela amabili ahluke kakhulu. Khombisa iziphetho zemigqa futhi ubale imigqa ngaphambi kokushintsha noma yini. Ukulinganisa kubiza umyalelo owodwa; ukuqagela kubiza ubusuku.

cat -A /etc/openvpn/server/lab.conf | sed -n '10,20p'
awk 'NR>=10 && NR<=20 {printf "%d:%s\n", NR, $0}' /etc/openvpn/server/lab.conf

Kokuphuma kokuqala konke ukuphuka komugqa kwangempela kubonakala njengophawu lwe-$, ngakho umugqa ogoqiwe kodwa ongahlukanisiwe awubonisi lutho lophawu lapho isikrini sakho sigoqa. Umyalelo wesibili uprinta imigqa enezinombolo, okuyindlela eshesha kakhulu yokuqhathanisa lokho umhlaziyi akubikayo nalokho okukuqukethe ifayela.

Izikhala ezengeziwe nazo azenzi umyalelo. Ukuhlehlisa kungukuhlobisa, futhi umugqa oqala ngesikhala usewuyinketho eyodwa efanayo. Uma umlayezo wephutha ukhomba inombolo yomugqa, funda lowo mugqa ngqo hhayi indima ewuyingxenye yayo.

Cashuna indlela, hhayi uhlu lwemiyalelo

Izimpawu zokucaphuna zikhona zezimpikiswano ezinezikhala, hhayi zokuqoqa izinketho. Indlela yesitifiketi enesikhala idinga izimpawu zayo zokucaphuna; imiyalelo emibili eyabelana ngazimbili zezimpawu zokucaphuna isewumugqa owodwa okhohlisayo.

cert "/etc/openvpn/pki/lab certs/server.crt"
key "/etc/openvpn/pki/lab certs/server.key"

Hlola amagama ezinketho kanye nokuhlelwa, ngoba umugqa ohlanganisiwe ungakhiqiza ithokheni ebonakala ithembekile engakaze ibe khona. Umyalelo wechweba yi-port; iphrofayela esebenzisa enye into kuwona lowo mqondo izohluleka ngisho nangemva kokulungisa imingcele yemigqa. Uma igama libonakala lingaziwa, liqhathanise nohlu lwezinketho zenguqulo oyisebenzisayo hhayi ngesibonelo sasemkhandlwini.

Gcina amabhulokhi angaphakathi njengamabhulokhi

Amaphrofayela angathwala izitifiketi nezikhali ngaphakathi, futhi lawo mabhulokhi ayidatha hhayi ukucwangisa. Imigqa ye-PEM engaphakathi kwebhulokhi akuyona izinketho okufanele zisicazwe, zifakwe kabusha noma zihlanganiswe, futhi izimpawu zebhulokhi kufanele zihlale emigqeni yazo.

Phatha ibhulokhi langaphakathi njengendawo engabonakali: lungisa imigqa yezinketho ezizungezile, shiya okuqukethwe kwayo kungathintwanga ngebhayithi ngalinye, futhi ungayinamathiseli emculwini wokusekela womphakathi. Uma ithuluzi lokuhlela libhale kabusha ibhulokhi, yibuyise ku-PKI yakho esikhundleni sokuyilungisa ngesandla.

Lungisa ingxenye encane kakhulu, hhayi isifanekiso

Ukulungisa okuyenga ukushintsha ifayela lonke ngokucwangisa okuvela kusifundo esisebenzayo. Lokho kushintsha umugqa owodwa okhohlisayo ngeqoqo lezinguquko zenqubomgomo ezingakaze zibuyekezwe: amapharamitha e-DH ahlukile, izilungiselelo zokucindezela, ukukhethwa kwe-cipher, abalaleli abaphindwe kabili. Inkinga yasekuqaleni incane futhi yasendaweni, futhi okushintshwayo akuyona nakukodwa kwalokho.

Kopisha iphrofayela efayeleni lomsebenzi elivikelekile, lungisa imingcele yemigqa kuleyo kopi, futhi vumela umnikazi ojwayelekile wensizakalo ukuthi ayilayishe. Bese uqala isenzakalo futhi ufunde iphutha lokuqala, uma likhona, kusukela ekuqaleni.

openvpn --config /etc/openvpn/server/lab.conf --verb 3 --log /tmp/parse.log
grep -n 'Options error' /tmp/parse.log

Uma isigaba sokuhlaziya sidlula, ukuhluleka okulandelayo kuzokuba mayelana nefayela, isitifiketi noma i-cipher hhayi isilulumagama, futhi lokho kuyinqubekela phambili yangempela. Gcina ikhophi yomsebenzi kanye nenothi lomugqa owodwa mayelana nalokho okuhlanganisiwe; ukunamathisela okufanayo kuzokwenzeka futhi komunye umuntu eqenjini elifanayo.