Funda ilogi yakho ye-VPN ngaphambi kokuyithumela: inkambu ngenkambu

Uvula ithikithi lokusekela, unamathisela ukuthunyelwa kwangaphandle kokuxilonga okwenziwe yiklayenti, bese ulinda. Ifayela cishe alinawo umlando wokuphequlula nhlobo, futhi yikho okulenza libonakale liphephile. Noma kunjalo liqukethe ukuthi ungubani, imuphi umshini owusebenzisile, imaphi amakheli angaphakathi owafinyelela kuwo nini, futhi ngezinye izikhathi ukhiye wangasese okopishwe yiklayenti elirekhoda ukulungiselelwa kwalo. Ukuhamba kule fayela ngaphambi kokulithumela kuthatha cishe imizuzu emihlanu futhi kuvimbela ukudalulwa okungenasiphetho.

Yivule futhi ufunde imigqa engamashumi amane yokuqala

Qala phezulu, lapho amaklayenti evamise ukuthela khona inguqulo, ipulatifomu nokulungiselelwa. Imigqa yokuqala itshela ukuthi ifayela linemininingwane engakanani, futhi lokho kunquma ukuthi yingaki ingxenye esele okufanele uyinake. Ilogi ezenzakalelayo nelogi yokulungisa amaphutha kuyizinto ezihlukene ezinokuchayeka okuhlukene.

head -n 40 vpn-support.log
sed -n '1,40p' vpn-support.log | grep -nE 'version|platform|config|option'

Futhi hlola usayizi nesimo sefayela ngaphambi kokufunda noma yini kulo. Ifayela lombhalo wamamegabhayithi amabili anomcimbi owodwa ophindaphindayo kulula ukulinquma. Ukubanjwa kokubili kwezinto kufolda elilodwa kuyinkinga ehluke ngokuphelele, futhi kudinga ingxoxo ehlukile nalowo ocela ukuthunyelwa.

Ku-Windows okulingana nakho kuyi-cmdlet eyodwa ngalinye, futhi eyokuqala ifanele ukugijinywa kunoma yiliphi ifayela ongalenzanga ngokwakho:

Get-Content .\vpn-support.txt -TotalCount 40
Get-Item .\vpn-support.txt | Select-Object Length,LastWriteTime

Izinkambu ezikhomba umuntu

Amagama abasebenzisi avela ezindaweni abantu abangazilindele: i-akhawunti esetshenziselwa ukuqinisekisa, isihloko sesitifiketi, indlela yephrofayela ngaphansi kwekhosombe lasekhaya, negama lomshini elivamise ukubhala igama langempela. Ilogi ehlela inkambu ye-akhawunti kodwa ishiye indlela yasekhaya ingathintekile ayihlelanga lutho.

Ukuhambisana kubaluleke kakhulu kunokuphelela lapho unjiniyela wokusekela kufanele alandele iseshini eyodwa kulo lonke ifayela. Shintsha amanani ngamalebula azinzile esikhundleni sokuwasusa, ukuze konke ukuvela komsebenzisi ofanayo kusafundwe njengomsebenzisi ofanayo. Ukususa inkambu ngokuphelele kuphula intambo edingwa unjiniyela futhi akwenzi ifayela liphephe kakhudlwana.

Isitembu sesikhathi naso siyidatha yomuntu siqu uma sihlanganiswa. Izikhathi lapho i-akhawunti ixhumeke khona, uma zithathwa ngenyanga, zichaza amahora omsebenzi nohambo. Uma umbuzo ungadingi ububanzi obugcwele, nquma ifayela kuya efasiteleni elizungeze umcimbi.

Izinkambu ezikhomba inethiwekhi

Amakheli wokugcina, imizila yangaphakathi nezinketho eziphushelwe zichaza isimo senethiwekhi yangasese. Yilokho kanye ulwazi umhlaseli angathanda ukuba nalo, futhi ngokuvamile lukhona ngemininingwane eminingi kakhulu kunalokho okudingwa yithikithi.

Funa umndeni wamakheli osetshenziswayo, hhayi kuphela lokho obukulindele. Iklayenti elinezitezi ezimbili lingarekhoda indawo yokugcina ye-IPv6 neqoqo lemizila ye-IPv6 okungekho muntu owacabanga ukuyihlela, ngoba ukubuyekezwa kwakufuna kuphela izingcezu ezine ezinamachashazi.

grep -nEo '([0-9]{1,3}\.){3}[0-9]{1,3}' vpn-support.log | sort -u | head -n 40
grep -nEo '([0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}' vpn-support.log | sort -u | head -n 20

Uhlu oluhlukile yilona oluwukhiye. Lutshela ukuthi ifayela likhuluma ngamakheli amangaki ahlukene, futhi ngokuvamile mancane kakhulu kunalokho okuzwakala ngenkathi uskrola. Lunikeza futhi uhlu lokuhlola lokuhlela nendlela yokuqinisekisa ukuthi uwamboze wonke. Amakheli ayishumi awumsebenzi wemizuzu emihlanu, futhi ikhulu litshela ukuthi ukuthunyelwa kubanzi kunombuzo.

Gcina i-topology uma unjiniyela eyidinga. Ukushintsha i-octet yesibili neyesithathu ngenkathi kugcinwa ubudlelwano be-subnet kuphendula umbuzo ngaphandle kokushicilela ububanzi. Iqhinga elifanayo lisebenza kuma-prefix e-IPv6. Okudingwa unjiniyela isimo sokwehluleka, futhi isimo siyasinda ngemva kokushintshwa okuhambisanayo.

Izimfihlo zicasha ezimweni, hhayi emalebula

Ukhiye wangasese awudingi igama elithi “password” eduze kwawo. Uvela njengebhlokhi phakathi kwemigqa yezimpawu, njengomucu omude we-base64, noma njengokukhipha ukulungiselelwa okuphakathi komugqa. Amathokheni avela njengezimo zokubuza, futhi izifakaziso zivela ngaphakathi kwama-URL iklayenti eliwabhale ngokwezwi nezwi.

grep -nE 'BEGIN [A-Z ]*PRIVATE KEY|password|passwd|token|secret|psk|auth-user-pass' vpn-support.log
grep -nE 'https?://[^ ]*:[^ ]*@' vpn-support.log

Iphethini yesibili yileyo abantu abayikhohlowayo. I-URL enesimo sohlelo, umsebenzisi, iphasiwedi, isikhungo siyisifakaziso esigcwele, futhi amaklayenti arekhoda ama-URL anjalo noma nini lapho i-proxy noma ifidi ilungiselelwe ngokuqinisekisa okungaphakathi komugqa.

Ungalokothi uthumele ifayela langempela njengobufakazi bokuthi awulihlelile. Uma umsebenzisi wesistimu efuna ukuthunyelwa okungashintshiwe, buza ukuthi ukudingela ini, kuthumele ngesiteshi sabo sokusekela esiqinisekisiwe, bese ususa ikhophi yakho yendawo. Leso sicelo sifanelekile; ukunamathisela esidlangalaleni akusona.

Yakha ikhophi ehlongoziwe bese uthumela isiqeshana

Sebenza ekhophini, gcina eyangempela endaweni evikelwe, futhi uhlele ngomyalo ongaphindwa esikhundleni ngesandla. Ukudlula kanye emaphethinini amakheli kubamba ingxenye enkulu yako:

cp vpn-support.log vpn-support.original.log
sed -E 's/([0-9]{1,3}\.){3}[0-9]{1,3}/ADDR/g; s/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+/USER@DOMAIN/g' \
  vpn-support.original.log > vpn-support.redacted.log
grep -cE 'PRIVATE KEY|password|token' vpn-support.redacted.log

Inombolo yokugcina kufanele ibe uziro. Uma kungenjalo, ukudlula kokuhlela kweqe isimo futhi kufanele ubheke leyo migqa ngaphambi kokuthumela noma yini. Funda nefayela elihlongoziwe kanye ngamehlo akho; iskripthi sibamba amaphethini, hhayi umongo.

Thumela isiqeshana esincane kunakho konke esisabonisa ukwehluleka. Imigqa eyishumi ezungeze iphutha ngokuvamile yanele, futhi kulula ukuyibuyekeza kunefayela lamamegabhayithi amabili. Bese ugcina ukuhlangana phakathi kwamalebula akho namanani angempela endaweni oyilawulayo, ngoba umbuzo olandelayo uzoyidinga.

Imibhalo yokuloga ye-OpenVPN ichaza ukuthi amazinga emininingwane ashintsha kanjani lokho okurekhodiwe, okuwumongo owusizo wokunquma ukuthi inkinga idinga ingxenye engakanani yefayela.