Iphothi 1194 isivele isetshenziswa: ubani ongumnikazi wale socket ye-OpenVPN?

Qala iphrofayili yeseva efanayo kabili, futhi inqubo yesibili iphuma nephutha lokuthi ikheli lisisetshenziswa kakade kwiphothi 1194. Esimweni esivamile, ukuqaliswa kokuxilonga kwakudala ukungqubuzana, futhi isibonelo sokuqala sisasebenza kahle kakhulu kubakhasimende. Le ndaba ichaza ingxenye enkulu yale mibiko, futhi kufanele kuyiqaphele ngaphambi kokuqalisa kabusha noma yini. Futhi iyinguqulo eshibhile kakhulu yokuxazulula.

Iphutha lichaza ukuxhumana kwendawo futhi akukho okunye. Akubona ubufakazi bokuthi umhlinzeki uvimba iphothi, ukuthi ikhasimende lithumele iphasiwedi engalungile, noma ukuthi uchungechunge lwezitifiketi luphukile.

Funda iphutha eliqondile lokuxhumana

Amaphutha amabili kulo mkhakha asho izinto ezihlukene, futhi ukuwaxuba kukuthumela esigabeni esingalungile. «Ikheli lisisetshenziswa kakade» kusho ukuthi enye i-socket ibambe iphoyinti lokugcina olikucelile. «Ikheli alitholakali» kusho ukuthi ikheli olikucelile alikabi khona kule hosti, lokho kuyinkinga yokulungela hhayi ikhophi.

systemctl status openvpn-server@lab --no-pager
journalctl -u openvpn-server@lab -n 20 --no-pager

Kopisha umbhalo wephutha ngaphambi kokushintsha noma yini, kuhlanganise nekheli nephothi eliyishoyo. Isevisi elindele ukuthi kuvele i-interface izokubhala iphutha lesibili kaningi bese ixhuma ngempumelelo lapho ikheli likhona; isevisi ebhala iphutha lokuqala ayisoze yaphumelela kuze kuxazululwe ikhophi. Ukubhala ukuthi yiliphi ollibonile akubizi lutho futhi kusindisa ukufuna kwe-interface okuyize.

Bhala uhlu lwama-socket, hhayi lwephothi

Inombolo yephothi uhlu olungaphelele. Iphoyinti lokugcina ukuthutha, umndeni wamakheli, ikheli lendawo kanye nephothi, konke ngaphakathi kwendawo eyodwa yamagama yenethiwekhi. Isilaleli se-UDP nesilaleli se-TCP kunombolo efanayo ngama-socket ahlukene, futhi izinqubo ezimbili kunombolo efanayo ezindaweni zamagama ezihlukene azisoze zihlangane.

ss -lunp | grep -F ':1194'
ss -ltnp | grep -F ':1194'
ss -lunp 'sport = :1194'

Qala ngokugijima ukuthutha okuyikho okusetshenziswa iphrofayili ngempela. Bese ubheka ikholomu yekheli lendawo hhayi inombolo kuphela: ukuxhumana kwe-wildcard kuhlanganisa wonke amakheli endawo, ngakho inqubo yesibili ecela ikheli elithile ingashayisana nalo ngisho noma imigqa ephrintiwe ihlukile. Izinketho zokusebenzisa kabusha i-socket nemithetho yephulatifomu zinquma umphumela oqondile, yingakho lokhu kufanele kube ukubona hhayi umthetho oyisebenzisa kukho konke ukuthunyelwa.

Thola ukuthi iyiphi inqubo engumnikazi wayo

Amaphoyinti okugcina anezinombolo kanye nolwazi lwenqubo kubonakalisa umnikazi lapho amalungelo akho ekukuvumela, futhi umnikazi uyilokho okudingayo, hhayi igama lohlelo. Izinqubo ezimbili ze-OpenVPN zingagijima amaphrofayili ahlukene, futhi leyo ebambe isilaleli ingaba yileyo ongayilindele kancane.

sudo ss -lunp 'sport = :1194'
sudo fuser -v -n udp 1194

Qhathanisa lokho okutholayo nombhali wesevisi, indawo yokugijima yamakhontheyna noma inqubo yetheminali esele ekuhlolweni kwangaphambili. Ukungabikho kwemininingwane yenqubo akubona ubufakazi bokuthi i-socket ayinaye umnikazi; ngokuvamile kusho ukuthi umbuzo wagijima ngaphandle kwemvume eyanele. Ngokufanayo, uhlu lwe-TCP kuphela alususi ukungqubuzana kwe-UDP, ngakho hlola ukuthutha okushiwo kwiphutha. Igama lenqubo lodwa alisoze lisho ukuthi iyiphi iphrofayili elayishiwe, futhi iphrofayili iyona enquma iphoyinti lokugcina.

Umnikazi oyedwa, noma izibonelo ezimbili eziklanywe

Uma ukuthunyelwa kuhlose iseva eyodwa, gcina umnikazi oyedwa womjikelezo wokuphila futhi ufunde ijenele laleso sibonelo noma ilogi elilungisiwe esikhundleni sokuqalisa ikhophi yesibili ukuze ulibheke. Lapho ukugijima kwangaphambili okulawulwayo kudingeka ngempela, misa isibonelo esilawulwayo ngamabomu futhi ubheke amakhasimende eliwasebenzelayo ngaphambi kokwenza lokho.

Uma kuhlosiwe izibonelo ezimbili, zinike isilaleli esihlukile nakho konke okunye okuhlukile: amachibi amakheli, ama-interface acatshangwayo, inqubomgomo yomzila kanye nobunikazi bokulungiselela. Iphothi ehlukile yodwa ayihlukanisi lutho ngaphandle kwe-socket, futhi amaseva amabili azolwa ngokufanayo ngechibi elilodwa nemizila efanayo.

Izindlela ezintathu ezimfishane zifanele zishiwo ngoba zivela kuyo yonke ingxoxo ngaleli phutha. Ungabulali i-PID engahleliwe ebonakala njengomoni. Ungasebenzisi ukwabelana nge-socket ukuthulisa umyalezo. Ungashintshi iphrofayili yeseva iye ekulungiseleleni okungaxhunywanga kwesitayela sekhasimende ngoba lokho kwenza iphutha lokuxhumana linyamalale; iseva iba ayifinyeleleki ngendlela okunzima kakhulu ukuyihlola kunokungqubuzana kwasekuqaleni.

Ukushintsha iphothi kuyimpendulo esemthethweni kuphela lapho isilaleli esisha siyingxenye yedizayini evunyelwe, okuhlanganisa umthetho wokudlulisa kanye nephoyinti lokugcina lekhasimende. Uma lezo zingakabuyekezwa, usususe ukungqubuzana waya endaweni okungekho muntu ongakuthola.

Qinisekisa ukuxhumana ngaphambi kwanoma yini enye

Ngemva kokulungiswa okulinganiselwe, qinisekisa ukuthi isibonelo esihloselwe siyasebenza, isilaleli saso sivela kokuthutha okukulindele, futhi ikhasimende lingaxhumanisa. Ukuxhumana okuphumelelayo kuqeda isigaba se-socket yendawo kuphela; akuqinisekisi lutho mayelana nokuqinisekisa noma mayelana nokuhamba ngemva kokuba umhubhe unyukile.

ss -lunp 'sport = :1194'
systemctl is-active openvpn-server@lab
journalctl -u openvpn-server@lab -f

Uma i-socket ikhona futhi ikhasimende lisahluleka, inkinga esele ingezansi futhi iphutha lokuxhumana manje sekuyimbali. Lokho kwehlukana kuyiyo yonke inhloso yokufunda umyalezo oqondile kuqala: iphutha elilodwa, isigaba esisodwa, umnikazi oyedwa. Funda kanjalo futhi uphawu olulandelayo luzoqala kusimo esaziwayo hhayi emcabangweni.