Umkhawulo wemihlangano ye-akhawunti ye-VPN eyabiwe: kungani idivayisi eyodwa iwa

Wengeza ikhompyutha yesibili ku-akhawunti esivele isebenza ocingweni lwakho, bese umhubhe wocingo uwela phakathi komzuzu owodwa. Noma idivayisi entsha ayiqedi ukuxhumana nhlobo, futhi iklayenti liphetha ngomlayezo wenqubomgomo esikhundleni sokuphela kwesikhathi. Inethiwekhi ilungile kuzo zombili izimo; isinqumo sithathwe ngaphezu kwayo. Ukungena okwabiwe kuwubunikazi obubodwa, futhi izinsizakalo eziningi ze-VPN zibala lobo bunikazi, hhayi inani lamadivayisi onawo. Ngiqala kusukela kusikrini seklayenti ngiye ngaphandle, ngoba ngokuvamile sikhombisa ukuthi isiphi isendlalelo esikunqabile.

Funda umlayezo weklayenti ngaphambi kokuthinta inethiwekhi

Ukwehluleka okuthathu kubukeka kufana futhi akufani. Ukuphela kwesikhathi kusho ukuthi amaphakethe akho awafikanga ndawo. Iphutha le-TLS noma lesitifiketi lisho ukuthi iphoyinti lokugcina laphendula kodwa ukuxhawulana kwehlulekile. Ukunqatshwa kokuqinisekisa noma kwenqubomgomo kusho ukuthi isango lafunda imininingwane yakho labe selinqaba. Okwesithathu kuphela okuhlangene nendaba yomkhawulo wemihlangano, ngakho qinisekisa lokho kuqala.

Amaklayenti e-OpenVPN agcina imigqa ethakazelisayo kuphaneli yawo yelogi. Skrolela emzamweni wokuxhumana wokugcina hhayi emjikelezweni wokuphinda uzame olandelayo, futhi ufune AUTH_FAILED noma umbhalo wesizathu othunyelwe. Iklayenti livamise ukubika ukunqatshwa okujwayelekile ngaphandle kwencazelo, ngakho isinyathelo esilandelayo yiseva, hhayi izilungiselelo zeklayenti. Izinhlelo zomhlinzeki zimbi kakhulu: umlayezo womkhawulo wedivayisi uyawusizo, kodwa ukuxhumana okuwa ngemva kwemizuzwana emibili yisinqumo senqubomgomo, hhayi iphasiwedi embi. Kunoma yikuphi, bhala igama ledivayisi nesikhathi esiqondile; umqhubi angafanisa lolo dali nerekhodi lokufinyelela ngemizuzwana.

Bala imihlangano lapho iseva ibala khona

Isibali esibalulekile sihlala esangweni. I-OpenVPN ibhala ifayela lesimo lapho iseva iqaliswa nge---status, futhi ibala iklayenti ngayinye exhunyiwe negama layo elijwayelekile, ikheli langempela kanye nezibali zethrafikhi.

cat /var/log/openvpn-status.log
# or query the management socket directly
echo "status 2" | socat - UNIX-CONNECT:/run/openvpn/server.sock

Imigqa emibili enegama elifanayo elijwayelekile iyimihlangano emibili ephilayo ngaphansi kwesitifiketi esisodwa. Ngokujwayelekile i-OpenVPN ayigcini yomibili: ngaphandle kwe---duplicate-cn, ukuxhumana kwesibili okusebenzisa isitifiketi esifanayo kuthatha indawo yokuqala, futhi idivayisi endala ilahlekelwa umhubhe wayo. Lokho kuthatha indawo wuphawu lomkhawulo wobunikazi. Ukulahleka kwamaphakethe okungahleliwe akunqamuli ngomusa idivayisi eyodwa ngqo ngesikhathi esisodwa lapho enye ivelela khona.

I-WireGuard ayinalo ithebula lemihlangano elingahlolwa. I-wg show wg0 iphrinta ontanga nokuxhawulana kwabo kwakamuva, futhi yonke idivayisi ebhalisiwe iwuntanga onokhiye wayo. I-akhawunti eyabiwe lapho iyifayela lokumiswa elikopishwe kumashini amaningi, futhi umkhawulo uvela kulokho okusabalalisa lokho kumiswa: ingosi yomhlinzeki, inani lezihlalo, noma umthetho oboshelwe ekhelini lakho lomphakathi. Uma ugcina isango lakho mathupha, incwadi ye-OpenVPN 2.6 ibhala izinketho zohlangothi lweseva.

Hlukanisa imikhawulo emine ecashile ngemva komlayezo owodwa

Iningi lamathikithi e-akhawunti eyabiwe ingenye yezinqumo ezine zokungena. Iklayenti ayikwazi ukuzihlukanisa, kodwa iphethini yokuthi iyiphi idivayisi ehlulekayo ingakwazi.

Ubunikazi obufanayo, ukuxhumana kwesibili. Idivayisi entsha iyasebenza futhi endala ifa ngesikhathi esisodwa. Lona umthetho wobunikazi obubodwa ngesikhathi esisodwa ogcinwa isango noma uhlelo lwe-akhawunti. Akukho okonakele; insizakalo yenza lokho okushiwo yinqubomgomo yayo.

Inani lezihlalo noma lamadivayisi ohlelweni. Amadivayisi okuqala ahlala exhunyiwe futhi elandelayo linqatshwa ngenkathi amanye eqhubeka. Bheka uhlu lwamadivayisi omhlinzeki ngaphambi kokushintsha iklayenti, ngoba umkhawulo welayisense awukwazi ukulungiswa ohlangothini lweklayenti.

Umkhawulo oboshelwe ekhelini lakho lomphakathi. Amakhompyutha amabili ngemva kwerutha yasekhaya ayehluleka ngenkathi ukungena okufanayo kusebenza kusuka endaweni yocingo. Hambisa idivayisi yesibili kwenye inethiwekhi ukuze uyihlole. Uma ixhuma lapho, ubheka umthetho wekheli ngalinye noma umthetho we-NAT, hhayi inani le-akhawunti.

Umkhawulo ophezulu weseva yonke. Wonke umuntu esangweni uyehluleka ngehora elifanayo elimatasa, kuhlanganise nama-akhawunti ayelungile izolo. I---max-clients ye-OpenVPN yenza kanjalo, futhi ayihlobene nhlobo namadivayisi akho abhalisiwe.

Hlanza imihlangano endala ngaphambi kokuthenga izihlalo ezengeziwe

Umhlangano ophele kabi usengabamba isihlalo. Ukubalwa kwe-RADIUS kubhala irekhodi lapho umhlangano uqala futhi likuvale lapho umhlangano uma; uma iklayenti linyamalala, ukuma akufiki nhlobo futhi iseva igcina umhlangano kuze kuphele isibuyekezo esiphakathi noma isikhathi sokuphela. Esangweni le-FreeRADIUS ungabona amarekhodi avuliwe:

SELECT username, acctsessionid, acctstarttime
FROM radacct WHERE acctstoptime IS NULL;

Irekhodi elivuliwe elinesikhathi sokuqala esidala nangaphandle kwethrafikhi lingeledivayisi esivele ihambile. Vala ngokusebenzisa ikhonsoli yomqhubi noma ngesicelo sokunqamula, ngaphambi kokucabanga ukuthi umkhawulo wawungokoqobo. Ocingo baxhuma kabusha lapho i-Wi-Fi idlulisela kunethiwekhi yeselula, futhi ikhompyutha ingaba nomhubhe owodwa kuhlelo lokusebenza kanye nomunye ngaphakathi kohlelo lomthengisi, okubalwa njengemihlangano emibili evela emshinini owodwa.

Yeka ukwabelana ngobunikazi obubodwa phakathi kwamadivayisi asebenza ndawonye

Isilungiso esihlala njalo sihlelekile. Nika idivayisi ngayinye isitifiketi sayo esinegama eliyingqayizivele elijwayelekile, noma i-akhawunti yayo, futhi bhala ukuthi muphi umuntu nomsihini oyiphethe. Ku-OpenVPN lokho kusho isitifiketi seklayenti esisodwa ngedivayisi, futhi i---duplicate-cn ihlala ivaliwe ngaphandle uma ufuna ukuziphatha kokuthatha; ku-WireGuard, ipheya lokhiye elilodwa ngedivayisi, elakhiwe lapho futhi elingakopishwanga nhlobo.

Ukukopisha iphrofayela ukuze ugweme umkhawulo wedivayisi kuphula ukuhoxiswa: ukuhoxisa ikhophi eyodwa kunqamula yonke idivayisi eyabelana ngayo, futhi ilogi ayisakwazi ukusho ukuthi imuphi umshini wenze ini. Uma umkhawulo ungowezentengiso, isilungiso esithembekile isihlalo esengeziwe; uma kuwumgomo wangaphakathi, cela ubunikazi besibili obunamalungelo afanayo okufinyelela.

Qinisekisa ngokulandelana okumile

Hlola isilungiso ngendlela efanayo njalo, ukuze umphumela ube nencazelo.

• Phuma kuyo yonke idivayisi futhi uqinisekise ukuthi uhlu olusebenzayo lweseva lungenalutho; ingxenye engahlanjwanga imihlangano endala, hhayi isici seklayenti.
• Xhuma amadivayisi elinye ngelinye futhi ubheke uhlu phakathi kokuxhumana.
• Uma amabili kufanele asebenze ndawonye, qinisekisa ukuthi imigqa yomibili inobunikazi obuhlukene futhi womabili agcina ukuxhawulana kukusha.
• Phinda ngemva kokudlula ku-Wi-Fi ukuya kunethiwekhi yeselula, ngoba ukuxhuma kabusha kungakha irekhodi lesibili.

Uma idivayisi endala isawa lapho entsha ixhuma, isango ligcina umthetho wobunikazi owodwa ongakutholanga umandulo kuwo. Yisa amagama amadivayisi, izimpawu zesikhathi kanye nohlu lwemihlangano esebenzayo kumqhubi; lokho kuphendula isikhalazo esingacacile sibe umbuzo wenqubomgomo abangawuphendula.