Amazinga e-script-security e-OpenVPN kusuka ku-0 kuya ku-3, nokuthi iwona ngamunye uvula ini
Izinga ngalinye le-script-security likhulisa okungaqhubekeka yikho iphrofayela: kuqala abasizi bokuphatha, bese kuba ama-skripthi omsebenzisi, ekugcineni amagama okuvuma endaweni. Funda imiyalo.
Ngenisa iphrofayela kuklayenti yedeskithophu futhi ukwehluleka kokuqala ngokuvamile kuwumugqa iklayenti elinqabayo ukuwuhlonipha: ihuku le-skripthi elingayiqhubeki, noma inani le-script-security elibona lingavumeli ngokweqile. Ukukhulisa inombolo kwenza ibhokisi lengxoxo linyamalale. Kodwa futhi kwandisa lokho iphrofayela leyo evunyelwe ukukwenza emshinini wakho, okuyinto eyisimanga ukuyinikeza ukuze uvale isexwayiso kuphela. Landela ukungenisa kuze kufike emyalweni futhi isinqumo siba sobala.
Kusukela kubhokisi lokungenisa kuya emyalweni
Iphrofayela iyifayela lombhalo elinemiyalo, futhi iklayenti iyifunda ngaphambi kokuba kube khona ithuneli. Umyalo ofana ne-up, down noma tls-verify usho uhlelo lwangaphandle okufanele OpenVPN iluqhube ngesikhathi esithile. Ukuthi i-OpenVPN ikulungele yini ukuluqhuba kuyisilungiselelo esihlukile esibizwa nge-script-security, futhi iphrofayela ngokuvamile iyasibeka futhi.
Ngakho isexwayiso asikhulumi ngombhalo oyimfihlo noma izitifiketi. Sikhuluma ngefayela lokuhlela elicela iklayenti ukuba lenze okuthile kumsingathi, nangeklayenti elihlola ukuthi izinga lalo lamanje lemvume liyayivumela yini leso sicelo.
Kulesi sigaba ukwehluleka okubili okuhlukene kubonakala kufana. Iphrofayela ecela izinga iklayenti elingeke linikeze lona ikhiqiza ukunqatshwa. Iphrofayela ecela izinga iklayenti elinikezayo kodwa i-skripthi ingekho ikhiqiza ukwehluleka ngesikhathi sokuqhubeka esikhundleni salokho, futhi kokubili kuyahlanganiswa emicubeni yokusekelwa. Okunye kuwumbuzo wemvume kanti okunye umbuzo wokupakisha.
Izinga ngalinye livula ini ngempela
Izinga 0 lenqabela ngokuphelele izingcingo zezinhlelo zangaphandle, okuyinto evumelana neklayenti elihlela ngokwalo isixhumi-simo salo ngaphandle kosizo futhi engavumelani nalo elibiza uhlelo lokusebenza. Izinga 1, elijwayelekile, livumela amafayela okusebenza akhelwe ngaphakathi adingwa ukuhlelwa kwesixhumi-simo nomzila. Alikho izinga eliqhuba noma yini enikezwe umsebenzisi.
| Level | What OpenVPN may execute | What it exposes |
|---|---|---|
| 0 | No external programs at all | Interface and route setup must not depend on helpers |
| 1 (default) | Built-in helpers such as ip, ifconfig, route or netsh | Privileged commands the platform already ships |
| 2 | Built-in helpers plus user-defined scripts | Whatever the named script does with the client's privileges |
| 3 | Everything above, plus passwords in environment variables | Credentials visible to child processes and their logs |
Izinga 2 iwumngcele othakazelisayo, ngoba livumela ama-skripthi achazwe umsebenzisi. Kusukela kulelo phuzu amalungelo eklayenti asebenza kukhodi ongakaze uyifunde, ebizwa ngezikhathi ongazikhethanga, endaweni equkethe imininingwane yoxhumano. Izinga 3 liya phambili futhi livumela ukudluliswa kwamagama okuvuma ngokusebenzisa izinto eziguqukayo zendawo, yingakho incwadi yokuhola ilichaza njengelingase lingaphephile.
Awekho kulezi zinombolo okuyisilungiselelo samandla. Iphrofayela esezingeni 3 ayinakho ukubethelwa okungcono kunaleyo esezingeni 1; inendawo enkulu yokuqhubeka kuphela, futhi ithuneli iyafana.
Nquma ukuthi iphrofayela ikufanele ini
Buza ukuthi i-skripthi iyingelani ngaphambi kokubuza ukuthi idinga eliphi izinga. Ihuku eliphushela izilungiselelo ze-DNS noma elilungisa umzila ngemva kokuxhumana iyisizathu esisemthethweni sokuqhuba okuthile. Ihuku elibiza ibhinari engaziwa kufolda yesikhashana iyisizathu sokuma.
Indlela ye-skripthi ibalulekile njenge-skripthi ngokwayo. Indlela ehlobene ixazululwa ngokuya kufolda esetshenziswa iklayenti, futhi ifolda ebhaliweyo iguqula ukungenisa kwesikhathi esisodwa kube yindawo yokuqhubeka unomphela. Izindlela eziphelele kufolda umsebenzisi angakwazi ukuyishintsha ziyisimo okufanele sikhethwe.
Ama-skripthi futhi azuza njengefa indawo yeklayenti, lapho kuhlala khona ubufakazi nemethadatha yoxhumano. Yilo fa elenzelwe ukuthi izinga 3 libe yingozi uma lihlangene ne-skripthi ebhala indawo yayo, futhi yisona sizathu sokuthi ukukhipha kokuxilonga okuvela kuklayenti elivule ama-skripthi kufanele kubhekwe okwesibili ngaphambi kokunamathiselwa kwithikithi. Susa indawo ngaphambi kokwabelana ngayo.
grep -nE 'script-security|^up |^down |tls-verify' client.ovpnShintsha into eyodwa, bese ubuka nokuhlakazwa
Uma iphrofayela idinga ngempela i-skripthi, shintsha izinga kuphela futhi kuleyo phrofayela kuphela. Qhuba iklayenti phambili ngokuphuma okunemininingwane ukuze amaphutha e-skripthi ngokwayo abonakale, hhayi ukuthi agitshelwe umphathi wesevisi.
openvpn --config client.ovpn --script-security 2 --verb 3
ip route show defaultHlola umjikelezo wokuphila wonke, hhayi ukuxhumana kuphela. Ihuku lokuhla elihlulekayo lishiya izindlela zikhomba ethunelini efile, okukhiqiza umshini obonakala uxhumekile futhi ongafinyeleli ndawo. Ngaphambi kokumemezela ukushintsha ukuthi kuphelile, xhuma kabusha kanye futhi unqamule kanye, futhi hlola ithebula lomzila ngemva kokunye ngakunye.
Gcina ikhophi yephrofayela yoqobo. Uma iklayenti yeplatifomu ingayisebenzisi imodeli yama-skripthi efanayo, ukususa imiyalo kuze kuphumelele ukungenisa kungase kususe ukuhlanganiswa kwe-DNS noma komzila okwakudingwa ithuneli, futhi ukuxhumana okuvelayo kuzoqinisekisa ngokuphelele kuyilapho kungaxazululi lutho.
Isinqumo okufanele sibhalwe sincane: iyiphi i-skripthi, kuyiphi indlela, inikezwe eliphi izinga, iyiphi iphrofayela. Konke okunye kuphrofayela akushintshi, futhi lona umusho umhloli angawuqinisekisa.