Ingabe kufanele ulahle i-chroot noma ukopishe i-iproute2 ejele?
Ijele elingaphelele lihluleka ngemva kokuqalisa, hhayi ngesikhathi se-boot. Khetha phakathi kokuxegisa ukuqinisa nokukopisha amabhayinari namalabhulali kumpande entsha.
Isevisi iyaqala, iklayenti liyaxhuma, futhi akukho mzila ovelayo ohlangothini lweseva. Noma i-daemon iyenqaba ukuqala futhi isho umyalo engakwazanga ukuwusebenzisa. Yomibili imiphumela ilandela imigqa emithathu efanayo, evamise ukukopishwa ndawonye kusuka kumhlahlandlela wokuqinisa: shintshela ku-akhawunti engenamandla, shiya iqembu, futhi ushintshe umpande wesistimu yamafayela. Eyodwa kuphela kwemithathu efihla amafayela, futhi eyodwa kuphela kuyo isusa ilungelo lokushintsha ithebula lomzila. Ukuhlukanisa kwayo iyona ndlela yokufunda ukuthi iyiphi imigqa oyifunayo ngempela.
Ijele lisusa ini i-daemon esayidingayo
Ushintsho lwempande lwenzeka ngemva kokuqalisa, ngakho i-daemon igcina konke esekuvulile futhi ilahlekelwa yikho konke ebizokuvula kamuva. Noma yimuphi umsizi okhishwa ukuxhumana ngemva kwalelo phuzu kufanele abe khona ngaphakathi kwempande entsha, kanye namalabhulali abiwe ayilayishayo. Ijele elakhiwe ngefayela lokucushwa nesitifiketi akanakho kokubili.
Ukushintshela ku-akhawunti engenamandla kuwumkhawulo ohlukile. Izinqubo esezishiye i-root zingase zingakwazi ukushintsha imizila noma ukuphakamisa i-interface ngisho lapho ibhayinari likhona khona, ngakho ukwehluleka kokubili kufanele kuhlolwe ngokwehlukana.
Imibandela emithathu inquma ukuthi yikuphi ukulungisa okudingayo
Umbandela wokuqala ukuthi ukwakha kwakho kufaka imizila kanjani. Izinguqulo OpenVPN ezintsha zicubungula i-interface nethebula lomzila ngaphakathi kwenqubo, kuyilapho amaphakethe amadala nezilungiselelo zakho zincike kumathuluzi angaphandle noma kumaskripthi e-up ne-down. Uma ilogi isho umyalo, ithuluzi langaphandle liyabandakanyeka futhi ijele liyalifihla. Uma ilogi ikhombisa iphutha lemingcelelo, inkinga ise-akhawuntini.
Eyesibili ukunakekelwa. Ijele elinamabhayinari akopishiwe kufanele livuselelwe ngaso sonke isikhathi lapho iphakethe eliwahlinzekayo lithuthukiswa, ngaphandle kwalokho ukuthuthukiswa kokuqala kushiya umhubhe ophukile. Eyesithathu ukuthi ingabe ukulawula okuthile kudinga ngempela i-chroot; uma isidingo simayelana nokuhlukaniswa kwamandla, ukushintsha kwe-akhawunti kungase kwanele.
| Signal in the log | Other side of the boundary | Repair direction |
|---|---|---|
| Command not found after startup | Binary and its libraries absent inside the new root | Populate the jail, or drop the chroot line |
| Operation not permitted | Account lost the privilege to edit routes | Keep the account privileged, or pre-create routes elsewhere |
| No such device | Jail lacks the tun device node | Create the node inside, or open it before the root change |
Ijele elisebenzayo kufanele libe nakho
Ijele elisebenzisa imiyalo lidinga ibhayinari, wonke ilabhulali elixhumene nalo, nanoma iyiphi i-node yedivayisi i-daemon eyivula sekwephuzile. Kopisha izingcezu bese uzihlola ngaphandle kwe-VPN esithombeni:
ldd /usr/sbin/ip
chroot /etc/openvpn/jail /sbin/ip route show
chroot /etc/openvpn/jail /sbin/ip link set tun0 upUmyalo wokuqala ubala okuncikile, futhi yiwona abantu abawushiyayo. Ibhayinari elikopishiwe elingalitholi ilabhulali lihluleka ngomlayezo ohlukile kunebhayinari elingekho, futhi kokubili kubukeka njengokwehluleka kwe-OpenVPN uma kufundwa ohlangothini lweklayenti. Ukusebenzisa umyalo ngesandla ngaphakathi kwejele kuphinda ukwehluleka ngaphandle kokuqalisa kabusha isevisi.
Kopisha futhi ukucushwa, izitifiketi nanoma iyiphi i-CRL ejele, ngoba ifayela i-daemon elilindele ukuliphinda lifundwe ngemva kokuqalisa ngeke litholakale uma umpande usushintshiwe. Bhala phansi okukupishile, ngoba ukuthuthukiswa okulandelayo kwephakethe lenethiwekhi kushintsha okokuqala futhi kushiya ijele ekopisheni endala.
Esikhundleni salokho nciphisa ukuqinisa
Uma ijele likhona kuphela ngoba umhlahlandlela usho kanjalo, ukususa lowo mugqa owodwa ngenkathi ugcina imikhawulo ye-akhawunti kuwumphumela ongavikeleka. I-daemon igcina umbono wayo wesistimu yamafayela futhi ilahlekelwa inkinga, futhi ukwehla kwamandla kususa i-root enqubweni ehlala isikhathi eside.
Bhala phansi okusele, nokuthi kungani. Ukucushwa okulahlekelwa ukulawula buthule ngaphandle kwenothi yindlela ukuqinisa okudukayo ngayo, futhi ukucwaninga okulandelayo kuzobuza ukuthi kungani umugqa wanyamalala.
Hlukanisa imigqa emithathu ngaphambi kokukhetha
Kopisha ukucushwa, khubaza imiyalelo yomithathu, futhi uqinisekise ukuthi iklayenti liyaxhuma nokuthi imizila elindelekile iyavela. Bese uvula kabusha imigqa ye-akhawunti kuphela, bese kuba yi-chroot yodwa. Isinyathelo lapho umhubhe uphuka khona sikhomba umngcele, futhi ugwema ukwakha kabusha ijele elingakaze libe yimbangela.
Uma liphinda lihambisa imizila, sebenzisa isikhathi seklayenti esisodwa ngemininingwane ephezulu futhi ufunde umugqa osho umyalo noma ilungelo elihlulekile. Lowo mugqa ubaluleka ukwedlula isikhathi sokulinda i-klayenti esikubikayo ekugcineni.