status=200/CHDIR: i-systemd ayizange iqale i-OpenVPN

Isevisi yehluleka, amalogi akhuluma nge-spawn kanye nesikhombisi, futhi umuzwa wokuqala ukuhlola ukulungiselelwa kwe-VPN. Akukho okufundiwe kulelo faeyela okwamanje. I-systemd yehlulekile ngesikhathi ilungiselela inqubo, ngaphambi kokuthi ifayela elisebenzayo liqale, ngakho akukho parser, akukho sitifiketi futhi akukho host ekude okwabuzwa kuyo. Ukufunda ikhodi yesimo njengesitatimende mayelana ne-systemd hhayi nge-OpenVPN kuyikho okwenza lokhu kube uphenyo olufushane.

Funda ikhodi yesimo ngaphambi kohlelo

Ikhodi yezinombolo ngemuva kwegama lesevisi ibiza isigaba esehlulekile. Ukwehluleka kwesikhombisi kubikwa njengesimo se-CHDIR, kuyilapho ifayela elisebenzayo elingakwazanga ukusetshenziswa liyikhodi ehluke ngokuphelele. Kokubili kubonakala kufana emgqeni wesifinyezo futhi akukho okufanayo ezimbangeleni zazo.

Lowo mehluko ubalulekile ngoba izilungiso zisemafayeleni ahlukene. Ukwehluleka kwe-CHDIR kumayelana nendlela nokuthi isevisi iyibona kanjani. Ukwehluleka kwe-exec kumayelana nebhayinari, umhumushi wayo noma i-mount engahlobene. Ukushintsha i-remote ye-VPN, uhlu lwezinsila noma indlela yesitifiketi akukwazi ukuxazulula nokukodwa kwalokhu.

Qinisekisa ukuthi ukwehluleka kusekuqaleni hhayi ngemuva kokusebenza okuphumelelayo. Uma isevisi ibisebenza izolo futhi manje yehluleka esigabeni esifanayo, kukhona okushintshile mayelana nesikhombisi, izimvume zaso noma i-unit ngokwayo, futhi lolo shintsho yiwubufakazi okufanele ubufune.

Buza i-unit ukuthi ifuna ukuba kuphi

Funda i-unit esebenzayo esikhundleni sefayela ocabanga ukuthi lifakiwe, ngoba ama-drop-in angadlula isikhombisi sokusebenza ngaphandle kokuthi uke uhlele i-unit eyinhloko. Umphumela we-show uphendula umbuzo ngqo:

systemctl cat [email protected]
systemctl show [email protected] -p WorkingDirectory -p RootDirectory -p User -p ProtectHome
journalctl -u [email protected] -b --no-pager | tail -30

Kusifanekiso seseva ye-upstream, isikhombisi sokusebenza yisikhombisi sokulungiselelwa kweseva futhi igama le-instance likhetha iphrofayili ngaphakathi kwaso. I-instance ebizwa nge-branch ngakho ilindele ifayela layo kuleso sikhombisi, futhi iphrofayili ebekwe kwenye indawo ayihlangabezani neze nemfuneko yesikhombisi sokusebenza.

Qhathanisa lokho i-unit ekucelayo nalokho okukhona. Indlela eyayikhona, isixhumanisi esingokomfanekiso manje esikhomba kwenye indawo, noma igama le-instance elingasahambisani nesikhombisi konke kuyizinguquko ezivamile ezikhiqiza lokhu kwehluleka kanye.

Hlola indlela ngendlela isevisi eyibona ngayo

I-shell yakho nesevisi akwabelani umbono ofanayo wesistimu yamafayela. Isikhombisi sezimpande noma isithombe sezimpande esilungiselelwe sishintsha okushiwo indlela ephelele ngaphakathi kwe-unit, futhi indlela ebonakala ngokusobala kuhost ingase ingabikho kuleyo namespace. Funda izilungiselelo ze-unit ngaphambi kokuthemba ukuhlolwa kwesandla.

Izimvume zenza inkinga ibe nzima. Isevisi isebenza njengomsebenzisi othile, futhi lowo msebenzisi kufanele akwazi ukudabula yonke isikhombisi somzali ukuze afinyelele ilitshe, hhayi nje ukufunda ilitshe ngokwalo. Isikhombisi esifundeka nge-root futhi esingadabuleki ngumsebenzisi wesevisi sikhiqiza ukwehluleka okubonakala njengendlela engekho.

namei -l /etc/openvpn/server
systemctl show [email protected] -p ProtectSystem -p ReadOnlyPaths

Izilungiselelo zokuqinisa nazo ziyingxenye yalesi sithombe. I-unit efihla izikhombisi zasekhaya noma eyenza ingxenye yesistimu yamafayela ifundeke kuphela yenza kanye lokho eyayilungiselelwe ukukwenza, futhi isikhombisi sokusebenza kufanele sihlale endaweni lapho i-sandbox isasibonisa khona.

Lungisa umnikazi, bese ulindela elinye iphutha

Lungisa isakhiwo noma i-unit ngomuntu ophethe lokho kulungiselelwa. Ukuhambisa iphrofayili iye esikhombisini esilindelekile kuyisilungiso esifanelekile uma isakhiwo singalungile, kodwa akuchazi isikhombisi okungeke kungene kuso, ngakho ungakuthathi njengempendulo evamile.

Mela indlela emfushane yokwandisa izimvume esihlahleni sokulungiselelwa noma yokukhipha i-sandbox. Kokubili kwenza uphawu lwenyamalale ngesikhathi kukhipha izivikelo ezazibekwe lapho ngamabomu, futhi ukwehluleka okulandelayo kuzoba nzima ukukuhumusha.

Qala kabusha i-instance futhi ufunde umcimbi olandelayo esikhundleni sokucabanga impumelelo. Iphutha elilandelayo okungenzeka ukuthi i-OpenVPN ayikwazi ukuvula ifayela layo lokulungiselelwa, okuyintuthuko: isikhombisi sokusebenza singeniwe futhi i-parser isiyasebenza manje. Landela ukuhlelwa kwangempela kwamafayela e-unit ukusuka lapho esikhundleni sokubuyela ekuxazululeni izinkinga zenethiwekhi.

Incwadi yokubhekisela yokusebenza ye-systemd ichaza ukuthi isikhombisi sokusebenza sihumushwa kanjani kanye nezikhombisi zezimpande ne-sandbox. Iphethini okufanele uyikhumbule ilula: ikhodi ngayinye yesimo ibiza isigaba esihlukile, futhi amaphutha ohlelo ngokwalo kuphela achaza uhlelo.