OpenVPN PAM: i-agumenti yokungena iwusevisi, hhayi umsebenzisi

Umsebenzisi wengezwe kuseva, iphasiwedi yathayipha kahle, futhi ukuxhumana kusaphela nge-AUTH_FAILED. Umugqa we-plugin ngokuvamile uchaza ukuthi kungani: igama elingemva kwendlela ye-plugin iyigama lesevisi ye-PAM, futhi linquma ukuthi iyiphi isitaki samamojuli ephendula umbuzo. Akulona igama lomsebenzisi, futhi akusona isikhombisi sefayela lephasiwedi elilifunda OpenVPN ngokwalo.

Yini ekhethwa igama lesibili

Umugqa wokumisa uthatha indlela ye-plugin kanye ne-agumenti eyodwa:

plugin /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn

Leyo agumenti idluliselwa kumtapo wezincwadi we-PAM njengegama lesevisi, okwenza isitaki esiku-/etc/pam.d/openvpn kube yisona esisebenza. Bhala i-login lapho futhi uzothola inqubomgomo yokungena esebenzisanayo esikhundleni salokho, kanye namamojuli ale nqubomgomo eyawafaka ekusabalaliseni kwakho.

Sebenzisa indlela ye-plugin enikezwa yiphakethe elifakiwe, hhayi indlela ekhotshelwe kwelinye ihosti. Igama lefayela kanye nedirekhthori kuyahluka phakathi kokusabalalisa, futhi indlela engalungile yehluleka ekuqaleni ngephutha lokulayisha i-plugin, hhayi ngesikhathi sokuqinisekisa.

Isitaki siwafunda kuphi ama-akhawunti ngempela

I-PAM iyisihambisi. Ifayela lesevisi libala amamojuli ngokulandelana, futhi elokuqala elingaphendula linquma umphumela. Isitaki esibiza i-pam_unix sifunda ama-akhawunti endawo; isitaki esibiza imojuli ye-LDAP noma ye-RADIUS sithumela ubufakazi kwenye indawo ngokuphelele.

Funda ifayela okuxazululeka kulo igama lesevisi, kufaka konke elikufakayo:

cat /etc/pam.d/openvpn
grep -H pam_ /etc/pam.d/openvpn /etc/pam.d/common-auth

Uma isitaki sithumela emkhakheni, ukwengeza i-akhawunti yendawo akushintshi lutho. Uma sifunda ama-akhawunti endawo, ukudala umsebenzisi emkhakheni nakho akushintshi lutho. I-akhawunti kufanele ibe khona lapho isitaki sibheka khona, futhi yilokho kuphela ukuxilongwa eminingi yale mibiko.

Umzamo owodwa, amalogi amabili

Hlanganisa ukuxhumana okukodwa okwehlulekile kuzo zombili izinhlangothi. Ilogi ye-OpenVPN ibonisa umphumela we-plugin kanye nokunqatshwa yiklayenti; ilogi yokuqinisekisa yesistimu ibonisa ukuthi iyiphi imojuli esebenzile nokuthi yathatha siphi isinqumo. Ukuzifunda esikhathini esifanayo yikho okuhlukanisa ifayela lesevisi elingekho nesikhathi sokuphela se-backend. Isikhala elogini yokuqinisekisa sisho ukuthi isitaki asizange sifinyelelwe nhlobo.

journalctl -u openvpn-server@server --since "-2 min"
journalctl -t sshd -t sudo --since "-2 min"

Hlola isevisi ngokuqondile ngethuluzi elikhuluma i-PAM, ukuze ungahloli i-VPN nesitaki ngasikhathi sinye. Ukuhlola okuqondile okuphumelelayo ngegama lesevisi ne-akhawunti efanayo kunciphisa inkinga endleleni i-daemon edlulisa ngayo ubufakazi, hhayi ku-akhawunti ngokwayo.

pamtester openvpn alice authenticate

Uma ukuhlola okuqondile kwehluleka nobufakazi obufanayo obusebenza kukhonso, isitaki asifundi umthombo wama-akhawunti obuwucabanga. Uma siphumelela, bheka ingxoxo eyenziwa yi-plugin kanye nalokho iklayenti elikuthumele ngempela. Kugijime futhi kanye nephasiwedi okwakhiwe ngamabomu ukuthi ibe yiphutha, ukuze ubone umehluko phakathi kokunqatshwa nephutha lemojuli. Le miphumela emibili ibukeka ifana elogini ye-VPN futhi ihluke ngokuphelele lapha.

Isevisi eyisipesheli ingcono kunokuhlela ukungena

Nikeza i-VPN ifayela layo lesevisi uma izidingo zayo zihlukile kukokungena okusebenzisanayo, okuyinto evamile. Ukuhlela i-login noma i-common-auth kushintsha inqubomgomo yohlelo ngalunye oluzifakayo, futhi umuntu olandelayo ohlela inkinga yokungena engahlobene uzofuza ushintsho lwakho.

Kopisha amamojuli owadingayo kufayela lesevisi elincane, gcina ukulandelana kucace, futhi ubhale ukuthi ngubani umnikazi. Leyo fayela yiyo okufanele ihlolwe uma ukusethwa kabusha kwephasiwedi kubonakala kungenamphumela.

Yini ethunyelwa yiklayenti, nokuthi yini engayithumeli

Iklayenti linikeza igama lomsebenzisi nephasiwedi ngokusebenzisa isicelo noma ifayela laso elisekelwayo. I-plugin yeseva idlulisa lawo manani engxoxweni ye-PAM; ayiwafundi kusuka ekumiseni kveseva. Umugqa ohlangothini lweseva obonakala uchaza iphasiwedi awukwenzi lokho, futhi akukho kuhlela kwephrofayili okuzodala i-akhawunti.

Igama lomsebenzisi nephasiwedi kungaba khona kanye nezitifiketi zeklayenti, futhi ukunika amandla i-PAM akusona isizathu sokuyeka ukuqinisekisa izitifiketi. Gcina izingqimba okwakuhloswe ngukusetshenziswa futhi lungisa umthombo wama-akhawunti kuphela.

Ukwamukelwa kuyizinhlangothi ezimbili: i-akhawunti ehlosiwe iyaphumelela, futhi i-akhawunti okufanele yenqatshwe isehluleka. Ifayela i-README ye-plugin ye-auth-pam lichaza i-agumenti yesevisi kanye nama-backend engawakhandlela, futhi yilapho uqinisekisa khona ukuhlelwa ozama ukukwakha.