I-OpenVPN isebenza ku-shell kodwa ihluleka ngaphansi kwe-cron: i-PATH iyinkinga

Umyalo ofanayo uxhuma usuka ku-shell futhi ufa ngaphansi kwe-cron, ngakho umbono wemvelo ukuthi i-tunnel noma isitifiketi yisona esinecala. Ngaphambi kokukholwa yilokho, bheka ukuthi yini efanayo kulezi zinto ezimbili: i-binary, ukucushwa kanye nobufakazi kuyafana, futhi kwashintsha kuphela indawo yohlelo. Uma uhlelo lungatholakali ngisho, akukho nani lokulungisa i-TLS olusiza. Ukulungiswa kuvame ukuba sendleleni, encwadini yokusebenza kanye neziguquli ezimbalwa zendawo, hhayi ku-VPN.

command -v openvpn ku-shell esebenzayo iphrinta impendulo, futhi lokho kuvame ukuba /usr/sbin/openvpn, incwadi i-cron engayifaki endleleni yayo yokusesha.

I-tunnel ayizange iqale, ngakho i-tunnel ayiyona inkinga

Imisebenzi eqalwa yi-cron izuza indawo encane, ngokwejwayelekile PATH=/usr/bin:/bin, futhi ayinayo itheminali yokulawula. Noma yini efakwe ku-/usr/sbin noma ku-/usr/local/sbin ayikho nje kulolo hlu, futhi umugqa wokubhalwa urekhoda openvpn: not found esikhundleni sephutha le-TLS. I-subprocess ye-Python ihluleka ngendlela ehlukile: izuza indawo yohlelo lolimi, engase ibe ngecebile kuneyo ye-cron kodwa ingakabi nayo i-shell yokwandisa i-tilde. Kokubili ukuhluleka kwenzeka ngaphambi kokuba iphakethe elilodwa lishiye umhambi.

Indlela esheshayo yokuhlukanisa ukufunda iphutha lokuqala esikhundleni lokugcina. I-binary engekho yenza ukuhlukana kwe-shell noma kwe-Python, ukucushwa okubi kwenza umlayezo wokusetshenziswa kwe-OpenVPN, futhi ukuhluleka kwangempela kokuxhawula kwenza izimpawu zesikhathi namakheli ontanga. Kuphela okwesithathu okuyinkinga ye-tunnel.

Izindlela eziphelele kanye nohlu lwezimpikiswano kunqoba izintambo ze-shell

Dlulisa indlela exazululiwe ngokucacile futhi weqe i-shell ngokuphelele. subprocess.run(["/usr/sbin/openvpn", "--config", config, "--verb", "4"], capture_output=True, text=True, timeout=90) ikunika ikhodi yokubuyela, i-stdout kanye ne-stderr ngaphandle kokucela i-shell ukuthi ihumushe igama lefayela. Akha indlela yokucushwa kusukela ku-os.environ["HOME"] noma ku-pathlib.Path.home(), ukuze i-tilde ingadingi ukwandiswa. Uma ngempela udinga isakhiwo se-shell, sebenzisa i-shlex.split, ngoba ukuhlukanisa intambo nge-.split() kuyaphuka kunoma iyiphi indlela enesikhala. Funda ne-stderr, ngoba i-OpenVPN ibhala iningi lokuhluleka kwayo kwasekuqaleni lapho.

Umgomo ofanayo usebenza ku-cron: umugqa womsebenzi awuyona i-shell yokungena, ngakho akukho okulayisha iphrofayili yakho futhi akukho okuchaza amagama akho asetshenziswayo.

I-crontab izuza ini ngempela

Ukufakwa ku-crontab kuthola indawo ekhonjwe yi-crontab kanye namanye amazininge azuziwe, ngakho bhala indlela ngokugcwele noma goqa ikholi kusikripthi esenza lokho. Umugqa onjenge-PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin phezulu kwefayela uhlanganisa izindawo zokufaka ezijwayelekile, futhi ukuqondisa kabusha nge->> cron.log 2>&1 yikho okwenza ukuhluleka okulandelayo kufundeke. Iphrofayili evikelwe ngegama lokungena ayinayo indlela yokucela imfihlo yayo ngaphansi kwe-cron, ngoba ayikho itheminali yokubuza. Ukuxhumana okunjalo kufanele kube kuyunithi ye-systemd ekwazi ukufunda ifayela lobufakazi, hhayi kumsebenzi ozenza ngathi uyasebenzisana.

Izindlela ezihlobene iyicupho lesibili. Ukuhlolwa kuvame ukwenzeka kusuka kufolda ephethe iphrofayili, futhi umsebenzi we-cron uqala kwenye indawo ngokuphelele, ngakho i---config office.ovpn ixazululeka kufayela elingekho lapho futhi umlayezo ufundeka njengefayela elingekho esikhundleni se-tunnel engekho.

Kufakazela ngokususa indawo

Phinda wenze indawo encane ngqo: env -i PATH=/usr/bin:/bin /usr/sbin/openvpn --config office.ovpn --verb 4. Isikhalazo sendlela noma setheminali esivela kulokho kusebenza sisho ukuthi inkinga ingaphezu kwe-VPN. Uma ixhuma, abasolwa abasele yi-akhawunti esebenza ngaphansi kwayo, incwadi eqala kuyo kanye nobufakazi obuyethulayo. Noma yimuphi kulemiphumela emibili ungcono kunomunye umjikelezo wokuhlola isitifiketi.

Bese wenza isembozo sizibika ngokwaso. Phuma nesimo esihlukile sesigaba ngasinye esifinyelelwe, bhalisa kokubili imifudlana ngesigxivizo sesikhathi, futhi ukuhluleka okulandelayo kuzokutshela ukuthi kwafa ekuxazululeni indlela, ekuqinisekiseni, noma ngemva kokuba i-tunnel isivele iphezulu.

Iyunithi idinga futhi ukulandelana okulungile: i-Wants=network-online.target kanye ne-After=network-online.target kuvimbela iklayenti ukuthi liqale ngaphambi kokuba ikheli noma indlela ezenzakalelayo ibe khona, okungukuthi kungaveli njengamaphutha esitifiketi noma e-TLS anyamalala ekubuyiseleni emuva ngesandla.