OpenVPN push-peer-info: faka amalebula kumaklayenti ngaphandle kokunikeza ukufinyelela

Inkambu ye-UV_ ihamba ngomhubhe oqinisekisiwe, kodwa inani liseyisimangalo somklayenti. Xhuma, qinisekisa okufikile, futhi gcina ukugunyazwa ohlangothini lweseva.

Amathegi okusetshenziswa yisizathu esivamile sokuthi abantu baphendukele kulesi sici: ukuxhumana ngakunye kufanele kuthwale into efana nesizinda noma indima, futhi iseva kufanele ikufunde ngaphandle kokuqamba ifomethi yesibili yobunikazi. I-OpenVPN yomphakathi isivele inayo le ndlela, futhi incane. Ingxenye ebuhlungu yilokho okulindelekile. Ukusetha okuguquguqukayo okuvamile kuphrofayela yeklayenti akwenzi lutho kuseva, futhi inani elifikayo lifakazela kuphela ukuthi iklayenti liyithumele.

Le nkombandlela isetshenziselwa indlela esebenzayo, isinyathelo sokuqinisekisa esikhombisa okufikile ngempela, kanye nokuhoxa okungashiyi i-hook elungiswe ngokwengxenye. Akukho la okudinga isitifiketi esisha, i-plugin entsha noma ukunwetshwa kweprotocol.

Setha okuguquguqukayo futhi unike amandla indlela

Imigqa emibili yenza umsebenzi kuphrofayela yeklayenti, futhi yomibili iyadingeka. Ngaphandle kowokuqala akukho okuzothunyelwa; ngaphandle kowesibili iklayenti alinikezi ngisho ulwazi lontanga. Ukulandelana akunandaba, futhi kuhle ukukwazi lokho ngoba imigqa emibili ivame ukuphelela ezingxenyeni ezahlukene zephrofayela ekhiqiziwe. Okubalulekile ukuthi yomibili isinde kunoma yini ebhala kabusha iphrofayela ngaphambi kokuthi iklayenti iyifunde.

setenv UV_DEPLOY field-support
push-peer-info

UV_ isiqalo asiwona umhlobiso. Okuguquguqukayo okuvamile DEPLOY kuhlala kuyindawo yenqubo yeklayenti futhi akukaze kudluliselwe, kuyilapho ifomu elinesiqalo liyindawo yamagama evikelwe iprotocol yezinkambu ezichazwe umsebenzisi. Shiya ingxenye esele yephrofayela egunyaziwe ingathintekile futhi uqinisekise ngaphambi kokusetshenziswa ukuthi ukwakhiwa kweklayenti okusebenzisayo kusekela imiyalelo yomibili.

Ukuhlola okusebenzayo kufanele kube lapha, hhayi ekugcineni: qinisekisa ukuthi umyalelo ufinyelela kubhinari yeklayenti futhi awugwinywa isembozo. Iklayenti lesithombe elizakhela umugqa walo womyalelo, noma isixhumi sikhathi sokuphatha esilayisha kabusha iphrofayela egciniwe, kungase kulahle imigqa engayazi. Uma iseva ingaboni lutho, lena indawo yokuqala okufanele ibhekwe.

Funda inkambu ku-hook yeseva

Ohlangothini lweseva, ulwazi lontanga olutholakele luqinisekiswa futhi lufakwa endaweni yomsebenzi wokuxhumana, futhi yikho okukwenza kufundeke ku-hook ngaphandle komsebenzi weprotocol ovela kuwe. Iseva ayidingi ukuhlaziya isiteshi sokulawula noma ukugcina into yakho; inani likhona nje ngesikhathi kusungulwa ukuxhumana. Umbhalo omncane we-client-connect obhala ilebula eceleni kwegama eliqinisekisiwe ubukeka kanje.

#!/bin/sh
# /etc/openvpn/server/hooks/label.sh
printf '%s %s\n' "$common_name" "${UV_DEPLOY:-unset}" \
  >> /var/log/openvpn/deploy-labels.log

Funda okuguquguqukayo ngokwendawo esikhundleni sokuhlaziya ilogi, futhi uhlale ukunikeza inani elizenzakalelayo. ${UV_DEPLOY:-unset} igcina umbhalo usebenza kumaklayenti angakaze athumele inkambu, okuyisimo esijwayelekile phakathi nokusetshenziswa kwesigaba. Ungakhaquli yonke indawo elogini ukuze uthole igama; iqukethe okuningi kunelebula, kuhlanganise namagugu obungahlosile ukuwagcina.

Sebenzisa umbhalo ngesandla futhi uzobika unset kukho konke, ngoba igobolondo lesandla alithwali indawo yokuxhumana. Lokho akulona iphutha embhalweni futhi akulona ubufakazi bokuthi inkambu ayikho. Yihlole ngokuxhumana kwangempela, okuyisimo kuphela lapho okuguquguqukayo kukhona.

Qinisekisa okufikile ngempela

Xhumanisa iklayenti elilodwa elinelebula nelinye elingenalo, bese ufunda ifayela. Ipheya yiyo impicabadala: umugqa owodwa kufanele uthwale inani kanti omunye uthwale elizenzakalelayo, futhi womabili kufanele asho ubunikazi obuqinisekisiwe obulindele ukubona.

tail -n 5 /var/log/openvpn/deploy-labels.log
# field-support deployed-client-07
# unset         legacy-laptop-02

Imigqa yamazwana iwukuma kokuphuma, akusona isiqeshana esivela kuseva yakho; funda ifayela lakho. Uma iklayenti lesibili likhombisa inani, okuguquguqukayo kusethwe kwenye indawo endaweni, futhi ufunda isilungiselelo esidala esikhundleni senkambu yontanga.

Hlola nelogi yeseva yokuxhumana. Ulwazi lontanga lungavela lapho, okulula ekulungiseni amaphutha futhi kuyisizathu sokugcina amanani eyisicefe: awekho amagama abantu, awekho izinombolo zamathikithi, akukho ongakuthanda ukuthi umfundi welogi akubone.

Thatha ilebula njengesimangalo, hhayi ubunikazi

Noma ngubani ongahlela iphrofayela yeklayenti angashintsha ilebula, futhi ukuthi umhubhe uqinisekisiwe akwenzi ilebula libe negunya. Ukuthutha kuvikela inani endleleni; akufakazeli isimangalo. Ukugunyazwa kusengokobunikazi obuqinisekisiwe kanye nerekhodi lokubhalisa eliphethwe iseva, futhi ilebula liqhathaniswa nalelo rekhodi uma kubalulekile.

Umehluko lowo unquma ukuthi ilebula lingasetshenziswa kuphi. Ukusetshenziswa okuhle ukuhambisa isikhathi segesi efayeleni lelogi elifanele, ukukhetha iqembu lokubonisa kudashibhodi, noma ukufaka ilebula esikhathini sosekelo ukuze umuntu asithole kamuva. Ukusetshenziswa okubi ukuvumela idivayisi kusubneti, ukukhetha umgomo we-firewall, noma ukunquma ukuthi idatha yeklayenti liphi isikhathi esingayifunda.

Qinisekisa inani ngaphambi kokuthi lifinyelele indlela, umbuzo noma umyalelo wegobolondo. Uhlu lwezimvume lwemifaniswano elindelekile lwanele ilebula lokusetshenziswa, futhi akubizi lutho. Ungalokothi ufake umfaniswano onikezwe untanga emugqeni womyalelo wegobolondo, futhi ukhawulele noma yikuphi ukuqaphela okugciniwe esikhathini hhayi kukheli lomhubhe ozosetshenziswa futhi yiklayenti elilandelayo.

case "${UV_DEPLOY:-}" in
  field-support|field-qa|lab) : ;;
  *) UV_DEPLOY=unknown ;;
esac

Hoxa ngokuhlanzekile

Ukususa isici ukususa okubili nokuqinisekisa okukodwa. Susa imigqa setenv ne-push-peer-info kuphrofayela yeklayenti, bese ususa noma ukhubaza i-hook nendawo yalo yelogi kuseva.

grep -rn 'UV_DEPLOY\|push-peer-info' /etc/openvpn/
tail -n 3 /var/log/openvpn/deploy-labels.log

Xhumanisa futhi iklayenti elilodwa ngemuva kwalokho futhi uqinisekise ukuthi umugqa welogi uyeka ukuvela. I-hook eqhubeka isebenza ngemuva koshintsho lwephrofayela ivamise ukuba iphrofayela yesibili esasetshenziswa kudivayisi yokuhlola, futhi ukuyithola manje kushibhile kunokuyithola ngesikhathi sokuhlolwa.

Okusele ekugcineni iyingxenye encane neboshiwe yemetadata yesikhathi enomsuka obhaliwe: iklayenti liyayimangalela, iseva iyayibhala, futhi akukho okumayelana nokufinyelela okuncike kuyo. Leli yivershini ewusizo yesici, futhi alidingi ubunikazi obusha ukufinyelela lapho.

Izihloko ezihlobene