Ingabe iskripthi sehhuku ye-OpenVPN ingasebenzisa umhubhe esiwusungule manje?
I-OpenVPN isebenzisa amahhuku ngaphakathi kokuqala kwayo, ngakho iskripthi esidinga umhubhe silinda umhubhe olindele sona. Hlukanisa umsebenzi bese ukhetha ihhuku ngokwesigameko.
Ukuthi iskripthi sehhuku siyafinyelela yini kolunye uhlangothi lomhubhe kuncike ezimweni ezintathu: ukuthi sixhunywe kusiphi isigameko, ukuthi i-OpenVPN isekuqaleni kwayo yini ngesikhathi iskripthi sigijima, nokuthi umsebenzi uhlukanisiwe yini nalolo hlelo. Izikripthi eziningi zehluleka kwesesithathu. Ukwengeza ukulala kuthatha inkinga yomjikelezo wokuphila njengenkinga yesikhathi, futhi kusebenza ngokwanele ukuduksisa.
Qala ngokunquma isigameko, bese kuba yindlela yokuhlehlisa umsebenzi, bese kuba yindawo lapho umsebenzi ohlehlisiwe ugijima khona. Lezi zinqumo ezintathu zizimele, futhi ukuzihlanganisa yikho okwenza ihhuku lemigqa emibili libe ngunthambama wonke.
Kungani ihhuku lilinda umhubhe olindele lona
OpenVPN ibiza amahhuku ayo ngendlela efanayo, ngaphakathi kwenqubo efanayo ehambisa amaphakethe. up icishe ivuleke lapho idivayisi ye-tun noma ye-tap isikhona kodwa ngaphambi kokwengezwa noma yimuphi umzila, kanti route-up icishe ivuleke ngemva kwemizila; akukho sikhathi kulezi ezimbili esithembisa ukuthi uhlangothi olulandelayo luzophendula. Uma iskripthi sanoma yiliphi ihhuku sisagijima, i-daemon ayidlulisi, ngakho umyalo olindele ukuthi ithrafikhi iwele umhubhe ulinda umhubhe olindele lowo myalo. Lokhu kulinda okuyindilinga yikho okwenza ukugijima ngesandla kudlule kanti ihhuku liphelelwa isikhathi.
Isixazululo esisobala, ukulala imizuzwana embalwa, ngezinye izikhathi siyasebenza ngoba uhlangothi olukude lwaziphakamisa ngokwalo, hhayi ngoba ukulala kwalungisa okuthile. Umsizi obuza ngokulungela uyimpendulo ehlukile: ihhuku liyabuya, ukudlulisa kuyaqala, futhi umsizi uthola akudingayo lapho kukhona ngempela.
Khetha ihhuku ngokwesigameko, hhayi ngokulula
Xhumanisa up nomsebenzi odinga idivayisi kuphela, route-up nomsebenzi odinga imizila, bese ugcina client-connect kanye ne-client-disconnect zemisebenzi yeklayenti ngalinye ohlangothini lweseva. Ukuhlanza lapho kunqanyulwa kumele kukwazi ukugijima kabili, ngoba ukuxhuma kabusha ngokusebenzisa isixhumanisi esihlala njalo akulandeli uhlelo olufanayo njengokuqala kabusha okuphelele. Kuseva, i-client-connect icishe ivuleke lapho iklayenti lizifakazela khona, hhayi lapho i-daemon iqala, okuyinto okufanele iqinisekiswe ngaphambi kokuhambisa ingqondo yokucabanga lapho. Uma umsebenzi ungowezinga lokuphila lwesevisi hhayi lowokuxhumana okukodwa, iyunithi ye-systemd iyikhaya elingcono kunanoma yiliphi ihhuku.
Imiyalo yamahhuku isetshenziswa yi-daemon ngokuqondile, ngaphandle kwe-shell phakathi, ngakho i-ifconfig_remote emgqeni we-up ifika njengombhalo oqondile. Sonta umyalo ku-shell ecacile, noma gcina ingqondo yokucabanga kuskripthini efunda indawo ezungezile. I-ipchange iyisiyalelo esisodwa esengeza izimpikiswano zaso: inikeza umyalo ikheli kanye nechweba, ngakho iskripthi esibhalelwe okungekho siyasibona okubili okungalindelekile.
Izindlela ezintathu zokuhlukanisa umsebenzi
Inketho yokuqala ukuthumela umsizi ngemuva ngaphakathi kwehhuku: qalisa nge-setsid noma nge-systemd-run --scope, vala izincazelo ezitholwe njengefa, bese uphuma ngokushesha ngoziro. Eyesibili ukuvumela ihhuku ukuthi libhale ifayela lesimo elincane bese isikhathi se-systemd noma iyunithi yendlela yenza okuthile kulo, okugcina ihhuku lilula futhi kubeka inqubomgomo yokuphinda ezindaweni ezinamalogi. Eyesithathu ukushiya ihhuku ngokuphelele bese uhambisa umsebenzi kuciyunithi ehlelwe ngemva kwesevisi ye-VPN, okuyimpendulo efanele lapho umsebenzi awuwona neze owokuxhumana ngakunye. Zontathu zabelana ngomthetho owodwa: ihhuku kumele libuye ngaphambi kokuba lidinge umhubhe.
Noma yini oyikhethayo, yenza umsizi angaguquguquki futhi abonakale. Izingcingo ezimbili ezigqagqene akumele zenze isenzo esifanayo esingabuyiseki kabili, futhi umsizi ohlulekayo kumele ashiye okuthile umuntu angakufunda.
Hlukanisa ukwehluleka kwe-sandbox nokwehluleka komjikelezo wokuphila
Uma iskripthi sigijima sisuka kusikhombisi se-root futhi sehluleka njengesevisi, imbangela ngokuvamile i-sandbox hhayi inethiwekhi. I-ProtectHome evimbelayo, i-ProtectSystem efundwa kuphela, noma incwadi yokusebenza engekho kungase kwenze iskripthi noma idatha yaso ingafinyeleleki, futhi kumsingathi we-SELinux ifayela lidinga nomongo ovumela ukusetshenziswa. Funda iyunithi nge-systemctl cat openvpn-server@server kanye nephephandaba nge-journalctl -u openvpn-server@server -n 80, bese ufuna iphutha lemvume noma lomongo esikhundleni sokuphelelwa isikhathi koxhumano. Ukukhubaza i-sandbox kufanele kube yisinyathelo sokugcina, hhayi sokuqala.
Ukwehluleka komjikelelo wokuphila kubonakala ngendlela ehlukile: ihhuku liyaqala, umsizi uyagijima, futhi isokhethi ayikakabi lapho. Bhala umugqa onesigxivizo sesikhathi usuka ehhukwini ngokwalo, nqamula bese uxhuma futhi, bese ufunda izehlakalo ngokulandelana. Uma umsizi udinga umhubhe ngempela, mvumele abuze ngokulungela esikhundleni sokulala isikhathi esinqunyiwe.
Izinkambu ezintathu zenza umbiko olandelayo ube wusizo: iliphi ihhuku eligijimile, yiliphi i-akhawunti eliyisebenzisile, nokuthi lagcina kuphi. Ngaphandle kwazo, uphenyo ngalunye olulandelayo luqala phansi.