I-OpenVPN iqhubeka nokuzama ngemuva kwephutha le-TLS: indlela yokuyimisa

Iklayenti liyaxhuma, lehluleka phakathi nokuxoxisana kwe-TLS, lilinde bese lizama iseva efanayo futhi ngomphumela ofanayo. Ngaphansi komqaphi oqalisa kabusha inqubo ehlulekile, leyo mizamo iba umjikelezo ongapheli kujenali, futhi umugqa wokuqala wokuxilonga uyaphuma ekufinyeleleni. OpenVPN inokukhetha okuguqula lokho kwehluleka kokuxoxisana kube ukuphuma okubonakalayo esikhundleni somunye umzamo. Lesi isilungiselelo sokuxilonga nokuqapha, hhayi ukulungisa, ngakho sihlanganise nenqubomgomo evumela inqubo ukuthi ihlale imile ngempela.

Umjikelezo ofihla iphutha lokuqala

Okubonayo akusona ukwehluleka okukodwa kodwa ibhlokhi ephindayo: umzamo wokuxhuma, iphutha le-TLS, ikhefu bese kulandela ukulandelana okufanayo. Ukuphindwa ngakunye kusunduza umugqa wangempela phezulu kujenali. Uma iyunithi iqala kabusha lapho yehluleka, umjikelezo ungase uqhubeke amahora ngaphandle kokuthi othile afunde isizathu. Uphawu umjikelezo, nakuba iphutha eliyisisekelo liyinkinga eyodwa yokuxoxisana.

Amaseshini okusebenzisana ayakubekezelela lokhu ngoba ukwehluleka kwesikhashana kungase kuphele emzamweni olandelayo. Ukuxhumana okuzenzakalelayo akukwazi ukuthola ithemba elifanayo: inqubo kumele ime ukuze umuntu noma umqaphi abone isimo.

Ngaphambi kokushintsha noma yini, thatha umjikelezo owodwa ogcwele. Bhala ikheli elikude, isigaba se-TLS esishiwo kuphutha nokuthi inqubo iyaphuma noma cha.

Umshini wokuzama futhi ngemuva komjikelezo

Ukuzama futhi kuyizimiso ngoba izikhathi zokuphela eziningana ezingahlobene zabelana ngomshini ofanayo. I-connect-retry ibeka igebe phakathi kwemizamo yokuxhuma, i-connect-retry-max ingakhawulela ukuthi kungaqanjwa kangaki okufakiwe okukude ngakunye, futhi i-resolv-retry ilawula ukusesha kwamagama okuphindayo. Ukwehluleka kokuxoxisana kwe-TLS kufika kulo mshini njengomcimbi wezokuthutha, ngakho iklayenti lihlela omunye umzamo esikhundleni sokubika. Inani elizenzakalelayo liyasiza kuxhumano olungazinzile futhi liyalahla ephutheni elingakwazi ukululama.

Ukukhetha i---tls-exit kushintsha kuphela icala lokuxoxisana. Incwadi yokuhola ikuchaza njengokuphuma lapho ukuxoxisana kwe-TLS kwehluleka, okuwukuncane kunokuphuma kuwo wonke amaphutha. Izikhathi zokuphela, ukwehluleka kwesixazululi nokwenqatshwa kokuqinisekisa kugcina ukuziphatha kwako.

Yenza iklayenti liphume lapho i-TLS yehluleka

Beka i-tls-exit kuphrofayela iklayenti eliyilayisha ngempela, noma nikeza i---tls-exit lapho uyiqala, bese uyisebenzisa kanye ngaphambili. Funda isimo sokuphuma kanye nomugqa wokugcina wejenali, ngoba umqaphi usebenza ngesimo. Ukuphuma okungewona uziro ngemuva kokwehluleka kokuxoxisana kungumphumela ohlosiwe. Uma inqubo iqhubeka nokuzama esikhundleni sokuqeda, ukukhetha akukho kuphrofayela iklayenti eliyilayisha ngempela.

Umqaphi unquma ukuthi lokho kuphuma kuyabonakala yini. Iyunithi ye-systemd ene-Restart=always noma i-Restart=on-failure iqalisa iklayenti futhi, ngakho umjikelezo uyaqhubeka futhi ukukhetha kubonakala kungasebenzi lutho. Hlola inqubomgomo ngaphambi kokusola iklayenti:

systemctl show -p Restart -p RestartSec openvpn-client@office
journalctl -u openvpn-client@office -n 40 --no-pager

I-Restart=no iyeka inqubo imile, kanti i-Restart=on-failure isaqalisa kabusha ngemuva kwesimo okungewona uziro. Uma ufuna ukwehluleka kubonakale kodwa insiza ilulame emashumini ahlukene, setha i-Restart=on-failure futhi usebenzise i-StartLimitBurst ne-StartLimitIntervalSec ukuvimba isivunguvungu sokuqalisa kabusha. Bese ufunda isimo seyunithi ukuqinisekisa ikhodi yokugcina yokuphuma: i-systemctl status iyibika, futhi ijenali igcina iphutha lokuqala phezu kokuqalisa kabusha.

Bhala isinqumo kuyunithi noma kumanothi ephrofayela. Iphrofayela ephuma lapho i-TLS yehluleka ibonakala iyingozi kumuntu olandelayo ngaphandle uma isizathu sibhaliwe. Shono ukuthi yikuphi ukwehluleka okufanele kumise inqubo nokuthi yikuphi okufanele kuzanywe futhi.

Fakazela ngendawo yokugcina yokusebenzisa kanye

Ukuze ubone ukuziphatha ngaphambi kokukuthemba, kopisha iphrofayela bese ukhomba ikhophi endaweni yokugcina eyamukela ukuxhumana kwe-TCP kodwa engakhulumi nge-OpenVPN. Isilaleli esiphendulayo bese sithula sanele. Nge-tls-exit, iklayenti kufanele liqede lapho ukuxhawula kwehluleka; ngaphandle kwayo, iphrofayela efanayo kufanele iqhubeke izungeza. Sebenzisa ikhophi, hhayi iphrofayela esebenzayo neze.

Qhathanisa ukugijima okubili ngesimo sokuphuma nangomugqa wokuqala wephutha, hhayi ngokuthi ngakunye kuthathe isikhathi esingakanani. Isimo sisho ukuthi ukukhetha kusebenzile yini, futhi umugqa wokuqala usho ukuthi yisiphi isigaba esihlulekile.

Susa iphrofayela yokuhlola uma usuqedile. Ikhophi elinendawo yokugcina eyiphutha ngamabomu iwugibe kwanoma ubani oqalisa kamuva wonke amaphrofayela kusikhombisi.

Izigaba ukukhetha okungalokothi kufinyelele kuzo

Ukwenqatshwa kokuqinisekisa kuyisigaba sakamuva. Uma iseva ihlola i-akhawunti bese iyinqaba, i-TLS isike yaxoxiswana, ngakho i-tls-exit ayisebenzi. Izilungiselelo zokuzama futhi kokuqinisekisa iyindawo elandelayo yokubheka, futhi isizathu seseva sibaluleke ukudlula umugqa wokugcina weklayenti. Iphasiwedi engalungile nesitifiketi esingekho kungakhiqiza imilayezo efanayo ohlangothini lweklayenti.

Umzila ongekho, isixazululi esingalungile noma isango elingafinyeleleki nakho kungaphandle kokukhetha, ngoba akusikho ukwehluleka kokuxoxisana. Ukulahleka kwamaphakethe buthule yicala elicace kancane: kuye ngokuthi ukushintshana kwaqhubeka kude kangakanani, iklayenti lingabika ukwehluleka kokuxoxisana noma limane lidlule isikhathi.

Gcina umehluko kumanothi akho. Isilungiselelo senzelwe ukuxilonga nokuqapha hhayi ukulungisa, ngakho asilungisi ukungafani kwe-cipher, inkinga yesitifiketi noma imbobo engalungile. Lungisa kuqala imbangela yokuxoxisana okwehlulekile, bese unquma ukuthi ukuphuma ngokushesha kusafanele ukuthunyelwa yini.