OpenVPN username-as-common-name: kungani ukuhlolwa kwakho kwe-CN kungenalutho
Iskripthi se-client-connect esiqhathanisa i-common_name ne-username singaqhathanisa igama nalo uqobo. Xhuma isitifiketi ne-akhawunti ngaphambi kokuba ukushintshwa kwenzeke.
Ufaka iskripthi client-connect esenqaba zonke izixhumanisi lapho i-common_name ihluke khona ku-username, futhi lokhu kubonakala njengokuxhumana phakathi kwesitifiketi ne-akhawunti. Kusiphakeli esisebenza nge-username-as-common-name, lokho kuqhathanisa sekulahlekelwe yincazelo yako ngesikhathi iskripthi sisebenza. Womabili amanani awuchungechunge olufanayo, ngakho ukuhlolwa kuyaphumelela ngesitifiketi esinikezwe omunye umuntu ngokuphelele.
Ukuhlolwa akulona iphutha ngenxa yokuthi iskripthi sibhalwe kabi. Kulona iphutha ngenxa yokuthi inani elikufundayo lashintshwa ngaphambili kuso leso sixhumanisi.
Lokho ukuqhathanisa okubonakala kukufakazela
Ukuqinisekiswa ngesitifiketi nokuqinisekiswa ngephasiwedi kungubufakazi obuhlukene, futhi isiphakeli singafuna kokubili ngaphandle kokufuna ukuthi kube okomuntu oyedwa. Igebe lingeqiniso: isitifiketi sedivayisi esivumelekile kanye nanoma iyiphi i-akhawunti evumelekile kuyisimangalo esihlukile kunaleso sitifiketi kanye ne-akhawunti eyodwa eqanjiwe. Iskripthi esiqhathanisa i-common_name ne-username sifundeka njengengxenye engekho phakathi kwazo zombili. Bekuyoba njalo, ukube i-common_name ibisasho lokho okushiwo isitifiketi.
Ukuthi kunjalo noma cha kuncike kukhetho olulodwa lwesiphakeli, futhi lokho kukhetho kuvame ukulaywa ngesizathu esingahlobene, njengokwenza amafayela wokucushwa omsebenzisi ngamunye abe lula ukuwaqamba.
Into i-username-as-common-name eyenza egameni
Lapho i-username-as-common-name ivuliwe, OpenVPN ishintsha igama elijwayelekile lesitifiketi ngegama lomsebenzisi eliqinisekisiwe ngemuva kokuba igama lomsebenzisi nephasiwedi kuqinisekisiwe. Ingwegwe yokuqinisekisa esebenza ngesikhathi salokho kuhlolwa isathola igama elijwayelekile lesitifiketi, ngoba ukushintshwa akukenzeki. Konke okulandela, kuhlanganise ne-client-connect, kubona igama lomsebenzisi. Ngakho ukubuyiselwa kwakamuva kuthola ubunikazi obubodwa kabili futhi akukwazi ukubuqhathanisa nesitifiketi esethuliwe.
| Stage | What common_name holds |
|---|---|
| Username and password verification hook | The certificate common name, for example bob-device |
| After the replacement | The authenticated account, alice |
| client-connect callback | The account again, alice |
Landela isixhumanisi esisodwa esiyisibonelo: isitifiketi esinikezwe i-bob-device, ukungena okuphumelelayo kuhlu lwemibhalo njenge-alice, nokhetho oluvuliwe. Isigaba sokuqinisekisa sisakwazi ukubona izintambo ezimbili ezihlukene. Isigaba sokuxhumana sibona i-alice ne-alice.
Leyo sibonelo ibonisa ukuthi kungani ukuqhathanisa kungenalutho. Akubonisi ukuthi isixhumanisi besiyokwamukelwa ngenye indlela, ngoba ukuqinisekiswa kwesitifiketi nokuqinisekiswa kwephasiwedi kusasebenza ngokwako.
Beka ukuxhumana lapho zombili izinto zobunikazi zisekhona
Umthetho kufanele ugcinwe esigabeni esibona ubunikazi besitifiketi ne-akhawunti ngasikhathi sinye, okusho empeleni ingwegwe yokuqinisekisa igama lomsebenzisi nephasiwedi noma isengezo esilayishwe lapho. Isengezo esisekelwe esivele senza ukuqinisekiswa kwephasiwedi ngokuvamile siyindawo efanele yokwengeza umthetho wokubhangqa, ngoba ukusishintsha ngokuqhathaniswa kwamagama kungasususa ukuhlolwa kwephasiwedi ngokuphelele.
Chaza ukuhlelwa ngaphambi kokubhala ikhodi, ngoba ukulingana akuvamisile ukuba umgomo wangempela. Isitifiketi sivame ukukhomba idivayisi kuyilapho ukungena kukhomba umuntu, futhi idivayisi eyodwa ingasebenza abantu abaningi ngokusemthethweni. Gcina ubudlelwano ngendlela oyilawula ngayo ukukhishwa kwayo, futhi unqume ukuthi kwenzekani lapho igama lishintshwa, lapho kukhishwa kabusha nasegamagameni anezimfanelo zesizinda. Ukwenza izinhlamvu ezincane noma ukususa isiqalo sesizinda ngaphandle kokuqonda uhlu lwemibhalo kungahlanganisa ama-akhawunti amabili okwakufanele ahlale ehlukene.
Khumbula ukuthi ukhetho lushintsha nokuthi yikuphi ukucushwa komuntu ngamunye okusebenzayo, ngoba i-client-config-dir ixhunyaniswe negama elijwayelekile.
Hlola ukubhangqa ngezicucu ezimbili zokungena ezivumelekile
Qala ngababili abavunyelwe umgomo wakho futhi uqinisekise ukuthi bayaxhumana. Bese wethula leso sitifiketi esivumelekile esifanayo ne-akhawunti ehlukile kodwa evumelekile: lowo mzamo kufanele wehluleke, futhi kufanele wehluleke ngenxa yomthetho wokubhangqa hhayi ngenxa yephasiwedi ethayipwe kabi. Iphasiwedi engalungile ifakazela ukuthi ukuhlolwa kwephasiwedi kuyasebenza futhi ayisho lutho ngomthetho phakathi kwesitifiketi ne-akhawunti.
Hlola nezindlela zokungabi nasitifiketi nokuba nesitifiketi esingavumelekile, futhi uqinisekise ukuthi isiphakeli sisebenzisa luphi ubunikazi ezilungiselelweni zeklayenti ngalinye. Uma indlela eyodwa yokwenza ukuqhathanisa kusebenze iwukucisha i-username-as-common-name, linganisa izindleko zalolo shintsho kuqala, ngoba lubuyisela ukuseshwa kokucushwa kweklayenti ngalinye egameni lesitifiketi.