Izilungiselelo ze-OpenVPN ku-router ziyabuya ngemuva kokuqala kabusha: lungisa umakhi

I-firmware ku-router yomsebenzisi noma i-NAS ivamise ukwakha kabusha ukulungiselelwa kwe-OpenVPN njalo lapho iqala, ngakho umyalelo owengezayo uhlala ngqo kuze kube ukuqala okulandelayo. Kufana nokhiye abafakwa efomini lewebhu, lapho inani eligciniwe lingabuya lonakele ngemuva kokugcina. Azikho lezi zimpawu ezisho ukuthi ushintsho lwenqatshiwe. Kusho ukuthi ukuhlela kungene efayeleni i-firmware elibheka njengokukhishwayo, nokuthi indawo ehlala njalo ingaphambi kwesinyathelo esisodwa ekulandeleni kokuqala.

Kungani ifayela elihleliwe lakhiwa kabusha

Isikripthi sokuqala sakha ukulungiselelwa kweseva kusuka kusifanekiso bese siqalisa i-daemon, okwenza ifayela elenzisiwe libe yinto yokwakha esikhundleni somthombo. Noma yini engezwa ngemuva kokuqala ayibonakali ekusebenzeni okulandelayo kwalelo sikripthi. Iphethini yesibili icashile kakhulu: okokufaka kokhiye nesitifiketi kusixhumi esibonakalayo sewebhu kugcinwa ngendlela ephunyukile, futhi ukugcina ifomu kungase kusunduzele lowo mbhalo ophunyukile efayeleni elifundwa i-daemon. Kunoma yikuphi, ukulungiselelwa okwenzisiwe akuyona indawo efanele yoshintsho oluhlala njalo.

Bheka ukuthi ukulandela kokuqala kubhala ini futhi nini. Impendulo cishe njalo yisikripthi esisekhwabeni le-init noma lokuziqalela lwe-firmware.

Faka umyalelo lapho isikripthi sakha khona ifayela

Amathuluzi e-QTS akha kabusha ukulungiselelwa kweseva ye-OpenVPN ngaphakathi kwesikripthi se-init esiqalisa i-daemon, ngakho ukuhlela kumele kwenzeke khona. Engeza isengezo ngqo ngaphambi komyalelo wokuqala esikhundleni sokuhlela ifayela elenziwe.

sed -i '/daemon_mgr/i echo client-config-dir clientconfig >>/etc/openvpn/server.conf' /etc/init.d/vpn_openvpn.sh
grep -c client-config-dir /etc/openvpn/server.conf

Bophela ukufakwa kumyalelo ongeke unyakaze, ngoba izinombolo zemigqa ziyashintsha phakathi kokwakhiwa. Njengoba isikripthi se-init ngokwaso sishintshwa ngesikhathi sokuqala, ushintsho kumele lukhishwe futhi kusuka engwegweni yokuziqalela ye-firmware njalo lapho uhlelo luqala. Ngemuva kokuqala kabusha okukodwa, bala izehlakalo efayeleni elenziwe: umugqa owodwa usho ukuthi isichibiyelo sisebenzile, kuyilapho imigqa emibili isho ukuthi ingwegwe isebenza ngaphezu kwesisodwa. Phenya ukusebenza okuphindwe kabili ngokwahlukile, ngoba akusona isici esifanayo nokushintsha okwashabalala.

Lungisa ifomu eligcine okhiye abaphunyukile

Kumakhasi esitayela se-Asus izinkambu zesitifiketi nokhiye zibonisa umbhalo ophunyukile, futhi ukugcina ngemuva kokulungisa okungahlobene kungase kubhale lezo zinto zibuyele kudiski. Sebenza kusuka ekopisheni ekhululiwe futhi gcina kanye kuphela, lapho izinguquko zonke sezilungile.

openssl dhparam -out dh2048.pem 2048
grep -n "BEGIN DH PARAMETERS" dh2048.pem

Lapho ushintsha isethi entsha yamapharamitha, namathisela umthwalo we-base64 kuphela uma ilebula icela umzimba wokhiye, futhi gcina imigqa yezikhali kuphela lapho inkambu ilindele ibhlokhi ye-PEM ephelele. Ukubuyisela ikhasi eseligciniwe ngendlela yalo ephunyukile ngokuvamile kusho ukusula okokufaka okuthintekile nokusebenzisa, okuvumela i-firmware ukuthi ikwakhe futhi. Khiqiza noma yini engaphezu kwamabhithi angu-2048 esiteshini sokusebenza, ngoba ukuhlinzekwa kwe-entropy kwe-router kwenza umsebenzi ube ngesikhathi futhi ngezinye izikhathi ungathembeki. Gcina ifayela lamapharamitha endaweni ongafinyelela kuyo ngemuva kokusetha kabusha kwefektri.

Hlola futhi ngemuva kwezibuyekezo

Izibuyekezo ze-firmware zishintsha izikripthi ze-init futhi zingase zisule ikhwabi lokuziqalela, ngakho isichibiyelo kumele sifakwe futhi sihlolwe kabusha. Qhathanisa ifayela elakhiwe kabusha nekhophi oyigcinile futhi uqinisekise ukuthi umyalelo ukhona kanye ngqo. Inani elibonakalayo kusixhumi esibonakalayo sewebhu akusona ubufakazi bokuthi i-daemon ilitholile, ngoba ikhasi lifunda izinkambu ezigciniwe. Bhala umyalelo wesichibiyelo kanye nenguqulo ye-firmware kumanothi okunakekela ukuze isibuyekezo esilandelayo sizihambise phambili.

Bese uxhuma iklayenti futhi ufunde ilogi yeseva yohlu lokukhetha olusuthiwe. Isilungiselelo esake saba khona efomini kuphela yisilungiselelo esingakaze sihlolwe muntu.