Ukukhetha i-OpenVPN okungahleliwe ku-systemd: kungani i-ExecStart yehluleka

Amafayela angamashumi amane e-.ovpn ezwe elilodwa afika evela kumhlinzeki, futhi uhlelo lubonakala lucacile: kopisha elilodwa ngokungahleliwe endaweni yalo, bese uqala ithumbu. Uma kubhalwe njengepayipi ngaphakathi kwe-ExecStart, lolo hlelo luyafa ngesikhathi sokuqalisa ngekhodi yesimo engachazi lutho. Ifayela leyunithi aliyona iskripthi, futhi ukulungiswa iwukuthi kufakwe i-shell ngokucacile noma kuyekwe ngokuphelele ukukhetha amafayela.

Uphawu: iyunithi eqala bese ifa ngokushesha

Isimo sibonisa ukuthi isevisi yehlulekile engxenyeni yomzuzwana, futhi umugqa wejenali ubala umyalo ongasoze watholwa yinoma iyiphi i-shell. Akukho okumayelana nethumbu okuvelayo, ngoba ithumbu alizange liqale.

Ukufunda umugqa womyalo oqondile kusuka kujenali iyona ndlela esheshayo yokuqinisekisa lokhu. I-systemd iphinda okukusebenzisile, futhi umucu uzobonisa izinhlamvu zepayipi njengezimpikiswano ezingokoqobo hhayi njengama-opharetha.

Kungani i-ExecStart ingakwazi ukugijima ipayipi

I-systemd ihlukanisa yona ngokwayo umugqa womyalo, isebenzisa ukucaphuna kwayo nokushintsha okuguquguqukayo, bese isebenzisa umphumela ngokuqondile. Amapayipi, ukuqondisa kabusha, ukwandiswa kwe-glob nge-shell nokushintshwa komyalo akuzona neze izingxenye zalolo hlelo lolimi. Lokhu kuwukukhetha komklamo hhayi ukushiywa: iyunithi isho ngokucacile ukuthi yini okufanele igijinywe, futhi ingqondo ye-shell ingeyeskripthi iyunithi eliyibizayo. Zombili izindlela zokulungisa zilandelayo kulokhu, futhi akukho nanye edinga ukunika iyunithi amalungelo engeziwe.

Lokhu futhi kuchaza ikhodi yokuphuma ekhohlisayo. Impikiswano yokuqala ithathwa njengebhayinari, ngakho umugqa ongalungile wehluleka ngaphambi kokuthi noma iyiphi ingxenye yengqondo yakho igijinywe.

Yenza ukukhetha ku-ExecStartPre

Ukulungiswa okuqondile iyisinyathelo sokulungiselela esibiza i-shell ngokucacile, futhi sigcina ukukhetha nokuqalisa kuyunithi eyodwa ukuze ukwehluleka kwelinye kungashiyi elinye ligijima lodwa.

[Service]
Type=notify
ExecStartPre=/bin/bash -c "ls /etc/openvpn/profiles/au* | shuf -n 1 | xargs -r -I{} cp -f {} /etc/openvpn/%i.conf"
ExecStart=/usr/sbin/openvpn --config /etc/openvpn/%i.conf

Imininingwane emithathu inquma ukuthi lokhu kuzosinda ekuhlanganyeleni nomshini wangempela. Ukuqanjwa ngamagama kuwugibe lokuqala: i-systemd ishintsha i-%i ngenkathi ihlaziya iyunithi, kudala ngaphambi kokuthi i-bash igijinywe, ngakho isicacisi kumele sime ngaphandle kwezimpawu zokucaphuna ezilodwa. I-xargs -r ivimbela i-cp ukuthi igijinywe ngaphandle kwempikiswano uma i-glob ingahambisani nalutho. Futhi isinyathelo sokulungiselela esihlulekayo simisa iyunithi, futhi lowo umphumela ofanele: ukuqala ngokucushwa kwangayizolo kubi kunokungaaliqali neze. Ukukhetha okungahleliwe njalo okuthatha ifayela elilodwa ngokuvamile akusona ishwa elibi. Hlola ukuthi ifayela elikopishiwe liyagqitshwa yisibuyekezo sephakethe, noma ukuthi i-glob ihambisana nokufakwa okukodwa okugugile.

Noma vumela i-OpenVPN ikhethe iphuzu lokugcina

OpenVPN isivele ingagcina amaphuzu amaningi okugcina kuphrofayela eyodwa futhi ikhethe ngokungahleliwe phakathi kwawo, lokhu kususa i-shell, ikhophi nelungelo lokubhala endleleni yokuqalisa ngokuphelele.

client
remote-random
<connection>
remote au1.example.net 1194 udp
</connection>
<connection>
remote au2.example.net 1194 udp
</connection>

Leli fomu ligcina ukukhethwa kweseva ngaphakathi kwefayela elibhalwe umhlinzeki, ngakho ukushintshwa okushintsha amagama amafayela akuliphuli iyunithi. Futhi kwenza uhlu lwabazongenela ukhetho luhlolwe, into i-glob phezu kwedirectory engasoze yaba yiyo. Ukuxuba kusenendawo yako lapho amaphrofayela ehluka ngezinto ezingaphezu kwephuzu lokugcina: izitifiketi ezihlukene, imiyalo yomzila ehlukene, inqubomgomo ye-cipher ehlukene. Kuleso simo ukukhetha kuphakathi kokucushwa okuphelele futhi isinyathelo se-shell iyona ndlela eqotho yokukuveza.

Funda futhi i-instance nefayela eliyisebenzisile

Qinisekisa ukuthi iyiphi iyunithi egijima ngempela ngaphambi kokulungisa ingqikithi yayo. Isevisi ye-meta ephakethekile nesifanekiso kuyingqalasizinda; amayunithi ahambisana namafayela akho yiwo ma-instance aqanjwe ngawo.

systemctl list-units 'openvpn*'
systemctl cat [email protected]
journalctl -u openvpn@au -n 30 --no-pager

I-instance okungekho muntu okhumbulayo ukuthi wayinikisa amandla ngokuvamile iholela efayeleni lokucushwa elilahlekile kudirectory yephakethe. Vala leyo instance eqanjiwe hhayi isifanekiso, kungenjalo ukuthuthukiswa kwephakethe okulandelayo kuzoyibuyisa. Ngemva koshintsho, qalisa iyunithi futhi ufunde umugqa womyalo okubikwa yijenali, bese uqinisekisa indlela yokucushwa eyayivula ngempela. Lokho kubhekwa okukodwa kuhlukanisa ukukhetha okungahleliwe okusebenzayo nesevisi esebenzisa futhi ngokuthula ifayela lanyanga edlule.