Isevisi ye-OpenVPN ima lapho icela iphasiwedi yokhiye oyimfihlo: indlela yokulungisa
Isevisi ayinayo itheminali, ngakho ukhiye obethelwe udinga i-askpass nefayela elifundekayo. Hlukanisa ibinzana lokhiye nokungena kuseva bese uhlola i-unit.
OpenVPN icela ibinzana lokhiye oyimfihlo kumshini wasekhaya, ngakho ifayela lokungena elisebenzayo aliliphenduli neze. Kwisevisi akukho theminali yokubhala, futhi ukuqala kuyalenga noma kwehluleke ngerekhodi le-journal elisho okokufaka hhayi imbangela. Kukhona izimfihlo ezimbili, futhi ngayinye idinga umthombo wayo ofundekayo ngaphambi kokuthi i-unit iqalwe kabusha. Indlela engezansi iyazihlukanisa, bese ihlola ubunikazi obuvula ngempela ifayela ngalinye.
Hlukanisa izicelo ezimbili
Ibinzana lokhiye lixazulula ukhiye oyimfihlo wasekhaya; ubufakazi be-akhawunti buqinisekisa iseshini kuseva. Zivela ezindaweni ezahlukene, zihluleka ngezikhathi ezahlukene futhi zinikeza imiyalezo ehlukene. Ukuzihlanganisa kuthumela abantu ukuba bayofuna ukusethwa kabusha kwephasiwedi kuyilapho i-akhawunti ingekho nhlobo. Funda umbhalo wesicelo ngaphambi kokushintsha noma yikuphi ukukhetha, ngoba amazwi ayiwona kuphela iseluleko esithembekile sokuthi iyiphi imfihlo engekho.
Ku-Community OpenVPN 2.x, askpass ikhomba ifayela eligcina ibinzana lokhiye emugqeni wokuqala, futhi auth-user-pass ikhomba ifayela elinegama lomsebenzisi emugqeni owodwa nephasiwedi emugqeni olandelayo. Alikho ifayela kula mabili elingagcwalisa okunye ukukhetha. Uhlelo lwedeskithophu noma iphrofayela ye-NetworkManager kungagcina kokubili esitolo saso sezimfihlo, ikliyenti yomugqa womyalo engasoze isifunde, ngakho qaphela ukuthi yiliphi ikliyenti olilungiselelayo ngaphambi kokubhala noma yimuphi umzila.
Khombisa kokubili ukukhetha kumafayela afundekayo
Iphrofayela edinga kokubili okokufaka igcina izikhombo ezintathu zamafayela: ukhiye obethelwe, ibinzana eliwuvulayo, kanye nombhangqwana wokungena. Faka lezi ngaphandle kokuthinta i-CA noma izivivinyo zobunikazi, ngoba lezo zinquma ukuthi iseva ingubani futhi azizona ingxenye yale nkinga. Uma ukusetshenziswa kungasebenzisi ubufakazi be-akhawunti nhlobo, ukwengeza auth-user-pass kudala okokufaka okungekho muntu ongakunikeza.
key /etc/openvpn/client/office.key
askpass /etc/openvpn/client/office-key.pass
auth-user-pass /etc/openvpn/client/office-login.authUkukhetha okungenayo ingxabano kuziphatha ngendlela ehlukile kunokukhetha okunomzila, futhi kwisevisi lo mehluko ubalulekile. I-askpass engenayo ingxabano isafunda ikhonsoli, futhi ifayela le-auth-user-pass elinegama lomsebenzisi kuphela lisashiya isicelo sephasiwedi silindile. Uma ikliyenti isiba yi-daemon ayikwazi nhlobo ukucela okokufaka kutheminali, ngakho isevisi elungiselelwe kanjena ayinyuki.
Imizila ephelele isusa umbuzo womqulu wokusebenza kodwa ayinikezi ukufinyelela. Kulandela ubunikazi, imodi nokudlula, futhi kukho konke kuhlolwa ngokumelene ne-akhawunti inqubo esebenza ngaphansi kwayo.
Funda ukulungiselelwa kwe-unit ngaphambi kwephrofayela
I-unit, hhayi ifayela obukuhlela, inquma ukuthi yikuphi ukulungiselelwa okulayishwa yisenzakalo. Funda umugqa womyalo wayo noma yikuphi drop-in, bese ulandela umqulu wokusebenza uze ufike kuphrofayela esetshenziswa ngempela. Isikhombo sebinzana esengezwe kwenye ifayela le-.ovpn asishintshi lutho kulesi senzakalo.
Imiyalo emithathu yokufunda kuphela iyaphendula iningi lalokhu. Eyokuqala iphrinta i-unit noma yikuphi drop-in, eyesibili ubunikazi nezilungiselelo ze-sandbox ezibopha inqubo, eyesithathu lokho ukuqala kokugcina okwakukhalela ngakho ngempela. Sebenzisa igama lesenzakalo elikhona kumsingathi:
systemctl cat [email protected]
systemctl show [email protected] -p User -p Group -p WorkingDirectory -p ProtectHome
journalctl -u [email protected] -bQaphela i-ProtectHome kanye nokukhetha kwephrofayela uqobo user, group kanye ne-chroot. Ifayela elingaphansi komqulu wasekhaya lingafundeka ku-shell lakho kodwa lingabonakali ngaphakathi kwisevisi uma imiqulu yasekhaya ifihliwe. I-akhawunti i-systemd eqala ngayo ayiyona njalo i-akhawunti egcina ivule ukhiye.
Fakazela ukuthi ubunikazi besikhathi sokusebenza bungavula womabili amafayela
Ukufunda imodi akwanele, ngoba yonke imiqulu esendleleni kufanele idlulwe ubunikazi obufanayo. Hamba umzila ngezingxenye, bese uhlola ukuvulwa njenge-akhawunti esetshenziswa inqubo. Ifayela elinemodi 600 eliphethwe i-root lisebenza kuphela ngesikhathi inqubo iseyi-root, okuyinto engelona iqiniso ngemva kokwehliswa kwamalungelo okwenziwa amaphrofayela amaningi. Imiyalo emibili ihlanganisa ukudlula nokuvula:
namei -l /etc/openvpn/client/office-key.pass
sudo -u openvpn test -r /etc/openvpn/client/office-key.pass && echo readableUmyalo wokuqala uphrinta imodi yengxenye ngayinye futhi uyahluleka lapho i-akhawunti ingakwazi ukudlula; owesibili uphendula umbuzo oyedwa obalulekile, okungukuthi ingabe ubunikazi besikhathi sokusebenza bungavula ifayela ukuze lifundwe. Akukho kukho okukhipha okuqukethwe kwefayela, futhi lokho kuyiphuzu lapho ifayela ligcina ibinzana. Phinda isivivinyo sefayela lokungena, ngoba womabili avame ukugcinwa ngobunikazi obuhlukene.
Uma inqubo isebenzisa i-chroot noma i-namespace elinganiselwe, sebenzisa isivivinyo esifanayo ngaphakathi kwalowo mbono, kungenjalo impendulo ichaza uhlelo lwamafayela olungalungile. Ibinzana eligcinwe ngaphansi komqulu wasekhaya ofihliwe yisibonelo esivamile sesivivinyo esidlula ngaphandle kwe-unit futhi sehluleke ngaphakathi kwayo.
Hlola ukuqala kokuqala, bese uhlola ukuxhumana kabusha
Qala isenzakalo kanye futhi ufunde ukwehluleka kokuqala hhayi kokugcina. Ifayela lokokufaka elingekho, ukwehluleka kokuxazulula ukhiye kanye ne-AUTH_FAILED evela kuseva kuyizigameko ezintathu ezahlukene ezinokulungiswa okuthathu okuhlukene. Ukulungisa isexwayiso semvume akufakazeli lutho mayelana nokuthi ukhiye wavulwa yini.
Umugqa we-journal utshela ukuthi yikuphi kokuthathu onakho. Ukulungiswa kuvela kulokho okokufaka okwehlulekile:
| What the journal shows | Which input failed | Where to look |
|---|---|---|
| A path that cannot be opened | The file the profile names | Askpass or login path, and the unit's working directory |
| A key decryption error | The key passphrase | First line of the askpass file, and read access for the runtime identity |
AUTH_FAILED from the server | The account credentials | Login file contents, and whether the account is still valid |
Bese uhlola umjikelezo wokuphila owudinga ngempela: ukuqala ngesikhathi sokubhutha kanye nanoma yikuphi ukuxhumana kabusha okusekelwayo, hhayi ukuqala ngesandla ku-shell lakho kuphela. Nge-auth-nocache okokufaka kuyalahlwa ngemva kokusetshenziswa kokuqala, ngakho ukuxhumana kabusha kwakamuva kusadinga umthombo ofundekayo. Isikhiya esivulwa ekungeneni kwedeskithophu asitholakali kwisevisi eyaqala ngaphambi kokuthi noma ubani angene, futhi lesi yisizathu esivamile sokuthi isivivinyo sesandla sidlule kanti ukuqalisa kabusha kwehluleke. Uma ukuqala kokuqala kuphumelela futhi ukuxhumana kabusha kwakamuva kwehluleka, funda i-journal ngomcimbi wokuxhumana kabusha ngaphambi kokushintsha izimvume futhi.
Ukugcina ibinzana eceleni kokhiye kunciphisa lokho okukunikezwa ukubethela, ngakho khawulela lelo fayela nezinto zalo eziyisipele. Thatha ukususwa kwebinzana lokhiye njengesinqumo esihlukile sobufakazi, hhayi njengokulungiswa kokokufaka okungekho. Ukusetshenziswa okuncike ekugunyazweni komuntu noma i-MFA esebenzisanayo kudinga i-ejenti yayo noma ukuhlanganiswa kokuphatha okusekelwayo; ikhodi yesikhathi esisodwa egcinwe unomphela ayiyona indawo elinganayo.