Yini i-persist-tun ne-persist-key ezikudlulayo ku-OpenVPN
Zombili izinketho zihlanganisa ukuqala kabusha okuthambile ngaphakathi kwenqubo ephilayo. Azigcini isixhumanisi ngemva kokuma, futhi aziyona inqubomgomo yokuvimba ithrafikhi.
Ukumisa isevisi kususa isixhumanisi ngisho noma i-persist-tun isethiwe. Lokhu ukusebenza kwensetho ngendlela ebhalwe kuyo, hhayi ukwehluleka. Insetho ichaza indlela eyodwa yokuqala kabusha ngaphakathi kwenqubo esebenzayo, futhi i-systemctl stop akuyona leyondlela.
Funda amagama amabili ndawonye futhi umklamo uyacaca. Eyodwa igcina isichazi, enye igcina into yokhiye, futhi zombili zikhona ngenxa yalokho okwenzeka ngemva kokushiywa kwamalungelo.
Izinsiza ezimbili nokuqala kabusha ezizihlobene nakho
OpenVPN ikhombisa ukuqala kwayo kabusha ezimweni ezimbili ezijwayelekile. I-SIGUSR1 ecacile iyakwenza lokho, futhi i-ping-restart ebangelwa umlingani ofile yenza okufanayo. Zombili zishiya inqubo iphila futhi ziphinde ziqalise ukusethwa kokuxhumana, futhi yilapho izinketho zithola indawo yazo.
| Event | TUN/TAP device | Key and auth files | Addresses and routes | up/down hooks |
|---|---|---|---|---|
Soft reset, from SIGUSR1 or from a ping-restart the daemon sends itself | survives only with persist-tun | survive only with persist-key | survive with the device, otherwise rebuilt | run again only when restart hooks are enabled |
Configuration reload, SIGHUP | recreated | re-read from disk | rebuilt once the device returns | run again |
| Service stop | lost | re-read at the next start | removed | run at the next start |
Umugqa wokuqala kabusha okuthambile kuphela yikho okushintshwa yilezi zinketho ezimbili, futhi umsebenzi abawudlulayo uyingxenye ebizayo kusixhumanisi esimatasa. Ukuvula kabusha idivayisi kudabula amakheli nemizila exhunywe kuyo, futhi ukuyakha kabusha kungawisa amaphakethe ayesezindleni lapho ukuqala kabusha kuqala. Ukuma kubhubhisa lezo zinto ngaphandle kwanoma iyiphi inketho yokuzigcina.
Kungani lezi zinketho zikhona nhlobo
Iseva ye-OpenVPN eqinisiwe ivamise ukuqala njenge-root, ivule okhiye bayo nedivayisi yayo, bese yehla iye kumsebenzisi ongenalungelo. Ngemva kwalokho kwehla, eminye imisebenzi imane ilahleke. Ukufunda ifayela lokhiye elikwimodi 0600, ukwakha isixhumanisi senethiwekhi noma ukushintsha imizila konke kungase kunqatshwe.
Ngaphandle kwezinketho ze-persist, umlingani othula isikhathi esanele ukubangela i-ping-restart uzophoqa impela leyo misebenzi. Ukuxhuma kabusha kuzohluleka ngisho noma kungashintshanga lutho kumisindo. Inqubo izobonakala sengathi ifa ngaphandle kwesizathu, futhi ilogi izobonisa iphutha lemvume esikhundleni sephutha lenethiwekhi.
Nazo, ukuqala kabusha okuthambile kusebenzisa kabusha lokho isigaba esinalungelo esivele sikutholile. Awukho umlingo futhi inqubo ayidluli lutho. Ukutholwa kwezinsiza kumane kubekwe emuva.
Funda iphutha lokuqala, hhayi lokugcina
Lapho ukuqala kabusha kuhluleka, funda iphutha lokuqala esikhundleni selokugcina. Ukhiye ovikelekile, ifayela le-auth, i-ioctl yesixhumanisi kanye nehuku langaphandle kuyizinsiza ezine ezihlukene. Ukugcina enye akusho lutho ngokufinyelela kwezinye. Ihuku elibiza ithuluzi le-firewall lisadinga amalungelo aludingayo lelo thuluzi.
Amahuku anesishintshi sawo. Imanuwali ye-OpenVPN ihlanganisa izinketho ze-persist ne-up-restart, okunquma ukuthi ama-skripthi e-up ne-down azophinda asebenze ngemva kokuqala kabusha. Ngakho-ke isixhumanisi esihleli phezulu akukutsheli lutho mayelana nokuthi ukuhlanganiswa kwakho kwe-resolver kuvuselelwe yini.
# which restart path just happened?
journalctl -u openvpn-client@office --since '10 min ago' | grep -E 'SIGUSR1|ping-restart|Restart pause|NOTE:'
# did the interface survive, and do its routes still exist?
ip -brief link show tun0
ip route show dev tun0Lokhu kubiza imiyalo emibili kwehlukanisa izindlela ezimbili zokwehluleka ngamasekhondi. Isixhumanisi esikhona kodwa imizila ingekho inkinga yehuku noma yomzila. Isixhumanisi esinyamalele sisho ukuthi inqubo iphele ngempela.
Isixhumanisi esigciniwe akusona isikhiya sokubulala
Uma imfuneko iwukuthi ithrafikhi ingaphumi ngaphandle komhubhe, idivayisi egciniwe ayikunikezi lokho. Imizila yomunye umndeni wamakheli, umzila wokuqala oyisisekelo wesibili, kanye nesimo lapho inqubo iphuma ngokuphelele kuhlala kungaphandle kobubanzi bensetho.
Phatha izimfuno ezimbili ngokwehlukana. Ukugcina into yomhubhe phakathi kokuphinda kuxhunyaniswe kuwukusiza i-daemon. Ukuvimba ukuphuma lapho umhubhe uphansi kuyinqubomgomo ye-firewall enemithetho yayo nokuhlolwa kwayo. Ukuhlanganisa kokubili kukhiqiza ukumiswa okubonakala kuvikela kodwa okuziphatha njengokuphinda kuxhumane komzamo omuhle.
Qamba isigameko ngaphambi kokusihlola. Ukuqala kabusha okuthambile, umzamo wokuxhumana ohlulekile kanye nokumisa isevisi kuyizigameko ezintathu ezinokuziphatha okuthathu, futhi eyesokuqala kuphela iyona echazwa yilezi zinketho.