Misa iklayenti elilodwa le-OpenVPN ikhefu: kungani ukuhoxiswa kuyisigxobo esingalungile

Ukumisa ukufinyelela kweklayenti elilodwa nokulisusa unomphela kubonakala kungumsebenzi ofanayo kuze kube yilapho uzama ukuhlehlisa okukodwa kwalokhu. Ukuhoxisa isitifiketi kubhala irekhodi iseva elithatha njengelokugcina, futhi ukulihlehlisa kusho ukuhlela ngesandla idathabhezi yomkhiphi. Ukulahla ithuneli esebenzayo kuwumyalo wokuphatha ongashintshi lutho ekuthembeni. Khetha isigxobo ngokubuza ukuthi ukhiye usathembekile yini, hhayi ngokubuza ukuthi isicelo sibonakala siphuthuma kangakanani.

Inkolelo: okuhoxisiwe nokumisiwe kuyinto eyodwa

Usokontileka umiswa iviki futhi impendulo yokuqala ukuhoxisa, ngoba ukuhoxisa kuzwakala njengokucisha into. Kubukeka kukuhle, kuthatha imizuzwana eyishumi, futhi kushiya ukuhlela idathabhezi njengendlela eyodwa yokubuya. Le mpendulo iyaqondakala futhi iseduze nokushisa iphasiphothi kunokuthi uvala umnyango. Idivayisi emisiwe nokhiye ovesile kudinga ukuphathwa okuhlukile, futhi kukodwa kuphela okushibhile ukukuhlehlisa.

Umehluko usemazini wokuqinisekisa hhayi kumuntu. Ukhiye osesezandleni ezifanele ungamiswa futhi uqhubeke ngaphandle kokulahlekelwa ukuthemba. Ukhiye okungenzeka ukuthi ukhotshelwe akufanele ubuyiselwe neze, ngoba ukubuyisela kuthi ikhophi ayikho.

Bhala impendulo phansi ngaphambi kokuthinta noma yiluphi lwezinhlelo ezimbili. Uma ungakwazi ukusho ukuthi ukhiye uveziwe yini, impendulo eqaphile ukushintshwa.

Lahla iseshini esebenzayo ngesixhumi sokuphatha

OpenVPN sinikeza isixhumi sokuphatha esingabala izeshini futhi sibulale esisodwa sazo ngokwegama elivamile. Sivule ku-localhost, sigcine kude nesixhumi somphakathi, futhi sithumele umyalo wokubulala lapho iseshini kufanele inyamalale manje. Umyalo uvala leyothuneli kuphela, futhi wonke amanye amaklayenti ayaqhubeka nokusebenza.

Lokhu kuyimpendulo enkingeni esebenzayo, hhayi inqubomgomo yokumisa. Iphrofayela efanayo ingaxhuma futhi phakathi nomzuzu owodwa, ngoba akukho okushintshile emazini ayo wokuqinisekisa. Yisebenzise lapho iseshini kufanele ihambe futhi isinqumo esihlala njalo sisathathwa.

Qinisekisa ukuthi iseshini yayixhunyiwe ngaphambi kokuyibulala, ukuze ungazingeli iklayenti elingakaze lixhume. Umyalo wesimo ongezansi uphrinta lokho okuxhunyiwe manje.

printf 'status 2\nquit\n' | nc 127.0.0.1 7506
printf 'kill kiosk-14\nquit\n' | nc 127.0.0.1 7506

Uma ukubulala kubika ukuthi akekho iklayenti elinjalo, igama elivamile esitifiketini akulona ucingo olulotshile. Funda umphumela wesimo esikhundleni segama lefayela lephrofayela.

I-CRL ilawula ini ngempela

Iseva ayibheki ifulegi lokuhoxisa eligcinwe esitifiketini. Ifunda uhlu lokuhoxiswa kwezitifiketi olushiwo ku-crl-verify kukho konke ukuxhumana okusha, futhi inqaba isitifiketi esinombolo yaso yokulandelana ekhona kulolo hlu. Kukhona imiphumela emibili elandela, futhi yomibili ibalulekile ekusebenzeni. Ifayela kufanele lifundeke ku-akhawunti iseva elehlisela kuyo amalungelo ayo, futhi iklayenti eselixhunyiwe liyaqhubeka nokusebenza kuze kube yilapho lixhuma futhi.

Umiphumela wesibili ushaqisa abantu ngesikhathi zezingozi. Ukuhoxisa isitifiketi akuvalelethi ithuneli elisisebenzisa njengamanje. Hlanganisa ukuhoxisa nokubulala kokuphatha uma iseshini kufanele iphele ngokushesha, futhi thatha lezi zenzo ezimbili njengezinyathelo ezihlukene encwadini yokuhola.

Hlola uhlu ukuze ubone ukuthi iseva izogcizelela ini ngempela, esikhundleni sokwethemba isigxivizo sesikhathi sefayela lokugcina olikhopishile. Ingxenye ebalulekile inombolo yokulandelana.

openssl crl -in /etc/openvpn/server/crl.pem -noout -text | sed -n '1,14p'
ls -l /etc/openvpn/server/crl.pem

Uhlu olungenakho okufakiwe kanye nohlu olunezinto ezifanele zibonakala zifana ekubhalweni kohlu lwedirectory, yingakho kufanelekile ukuphrinta inani lezinombolo zokulandelana. Umugqa wemvume nawo ubaluleke ngokufanayo, ngoba ifayela i-daemon engakwazi ukulifunda ikhiqiza ukwehluleka okubonakala njengeklayenti elinqatshiwe.

Buyisela irekhodi, ngokuqapha

Ukubuyisela isitifiketi kusho ukuhlanekezela irekhodi kudathabhezi yokukhishwa nokushicilela uhlu olusha. I-easy-rsa 3 igcina leyodathabhezi njenge-index.txt ngaphansi kwedirectory ye-PKI, kuyilapho izakhiwo ezindala zisebenzisa enye indlela. Umugqa uqala ngohlamvu lwesimo nedethi yokuphelelwa. Umugqa ohoxisiwe ufaka isigxivizo sesikhathi sokuhoxisa ngaphambi kokuqhubeka ngenombolo yokulandelana, igama lefayela lesitifiketi kanye negama elihlukanisayo. Ukubuyisela umugqa endaweni kusho ukususa lesosigxivizo sesikhathi nokuhlanekezela uhlamvu, kuyilapho konke okunye kushiywa njengoba kunjalo.

Qala ngokwenza ikhophi yokugcina yefayela, futhi wenze ukuhlela njenge-skripthi esikhundleni sokuthayipha kusihleli sombhalo. Iphutha lokuthayipha elishintsha ukuthi umugqa unamakhasi amangaki lizophula ukukhishwa kwazo zonke izitifiketi ezingezwa ngemuva kwalokho. Yiso leso isizathu sokwenza ushintsho ngokuzenzakalela nokukhopisha ifayela ngaphambi kokulithinta.

Ukuhoxiswa kwesibili kwegama elifanayo nakho kuvame ukwehluleka, ngoba ukusebenza kokuqala kwahambisa lesositifiketi nokhiye waso ngaphandle kwezikhombisi lapho ithuluzi lilindele ukuzithola khona. Ithuluzi alikwazi ukuthola lokho elacelwa ukuba likuhoxise, futhi umlayezo wephutha awusichazi ngaso sonke isikhathi isizathu.

cp /etc/easy-rsa/pki/index.txt /root/index.txt.$(date +%F-%H%M)
grep -c '^R' /etc/easy-rsa/pki/index.txt
easyrsa gen-crl

Shicilela uhlu olusha, lungisa ubunikazi balo, futhi wenze iseva ilufunde. Ukulayisha kabusha kwanele ezifakweni eziningi, kodwa ukuqinisekisa kufanele kuvele ekuxhumaneni okusha, ngoba iseshini ekhona ayizange iphinde ihlole lutho.

Hlola ukuthi icala lifanele isiphi isigxobo

Buza umbuzo owodwa onquma yonke incwadi yokuhola: ingabe ukhiye oyimfihlo uselapho kuphela lapho kufanele ube khona. Uma kunjalo, ukubulala iseshini kanye nekhefu elibhaliwe kuhlanganisa icala futhi akushiyi rekhodi laphakade. Uma kungenjalo, impendulo ephephile eyodwa ukhiye omusha kuyilapho isitifiketi esidala sishiywe sihoxisiwe.

Bese uqinisekisa umphumela ngomzamo wokuxhuma hhayi ngomehluko wokuhlelelwa. Umehluko ukutshela okuhlosile, futhi ukuxhumana kukutshela okugcizelelwa yiseva.

openssl crl -in /etc/openvpn/server/crl.pem -noout -text | grep -c 'Serial Number'
printf 'status 2\nquit\n' | nc 127.0.0.1 7506

Lapho iklayenti elibuyiselwe lixhuma futhi livela kumphumela wesimo, ukuhlelwa kwerekhodi kusebenzile. Lapho iklayenti elihoxisiwe linqatshwa futhi ilogi ibala i-CRL, ukuhoxiswa kusebenzile. Noma yini phakathi kwako kunkinga yemvume noma yokulayisha kabusha, futhi kufanelekile ukuyilungisa ngaphambi kokuba isicelo esilandelayo sifike.