Inkinobho ye-VPN idinga i-sudo: nciphisa umkhawulo womthetho, qinisekisa inqubomgomo

Inkinobho ye-VPN iyasebenza kumlawuli futhi yehluleke kubo bonke abanye, ngakho othile wengeza umugqa ku-sudoers. Lowo mugqa uvame ukuphila isikhathi eside kunenkinga owawenzelwe ukuyixazulula, futhi uvame ukunikeza amandla amaningi kunalokho inkinobho ekudingayo. Ngaphambi kokuhlela inqubomgomo, hlola ukuthi umnini woxhumano osekelwe usevele engawenza yini lo msebenzi. Izimiso ezintathu ngezansi zinquma ukuthi i-sudo iyahileleka yini noma cha.

Isimo 1: umnini osekelwe angakwenza ngaphandle kwe-sudo

Kumadeskithophu amaningi e-Linux umphathi wenethiwekhi usevele ungumnikazi woxhumano lwe-VPN, futhi ukugunyazwa kwayo kudlula ku-polkit hhayi ku-sudo. Umsebenzisi ovunyelwe ukukhweza uxhumano angakwenza lokho emgqeni womyalelo ngaphandle komthetho we-root. Hlola ukuthi umphathi uvumela ini ngaphambi kokucabanga ukuthi inkinobho idinga ilungelo. Uma impendulo ingu-yebo, ukushintsha kwe-sudoers kuxazulula inkinga engekho.

nmcli connection show
nmcli connection up "Work VPN"

Uma umphathi enqaba, funda ukuthi kungani: umthetho we-polkit ongekho, uxhumano olungolomunye umsebenzisi noma iphrofayela egcinwe endaweni umsebenzisi angakwazi ukuyifunda. Ngakunye kwalokho kunesixazululo esisekelwe esincane kunomthetho we-sudo. Ukukhushulwa kwelungelo kuyisixazululo sokugcina, hhayi sokuqala.

Isimo 2: umthetho usho ifayela elilodwa elisebenzayo kanye nezimpikiswano zalo

Uma i-sudo idingeka ngempela, umthetho kufanele usho umyalelo oqondile futhi, lapho kungenzeka, izimpikiswano ongazisebenzisa. Umthetho ovumela umsebenzisi ukuthi asebenzise iskripthi sokugeza unompilo kuphela njengezimvume zalelo skripthi, ngoba umsebenzisi angahlela lokho i-root ezokwenza. Umthetho onophawu lokufanisa ngemuva komyalelo uyinkinga efanayo ngendlela emfushane.

sudo -l -U alice
ls -l /usr/local/sbin/vpn-up

Hlola yonke indlela ochungechungeni lomyalelo: i-binary, iskripthi esiyibizayo, ifayela lokuhlela eliyifundayo kanye nanoma iyiphi indawo ephakathi kwazo. Uma umsebenzisi engabhala kunoma iyiphi yazo, umthetho oncishisiwe empeleni uyi-root engenamkhawulo. Izimpikiswano nazo zibalulekile, ngoba umyalelo owamukela indlela yokuhlela ungabhekiswa efayeleni elilawulwa umsebenzisi. Bhala umthetho womsebenzi, hhayi wenkinobho.

Yima uma umyalelo udinga ifayela elilawulwa umsebenzisi ukuze usebenze. Khona-ke umklamo awulungile, futhi akukho sintaksi ye-sudoers ezozenza uphephe.

Isimo 3: inqubomgomo ephelele iyahlaziywa, hhayi umugqa wakho kuphela

Qinisekisa ngomhleli okhiya ifayela futhi ohlola isintaksi, futhi uqinisekise inqubomgomo ehlanganisiwe hhayi ucezu. Ifayela elihlaziywayo lodwa lisengaphula ukulandelana kokufakwa noma liphindaphinde umthetho ngendlela eshintsha ukuziphatha.incwadi ye-visudo ibhala kokubili umhleli okhiyayo kanye nemodi yokuhlola kuphela esetshenziswa lapha.

sudo visudo -c
sudo visudo -cf /etc/sudoers.d/vpn-launcher

Ukuhlola kubika ifayela nomugqa uma kwehluleka, futhi lowo mbiko uyingxenye ewusizo. Lungisa ushintsho oluhlosiwe ngomhleli esikhundleni sokuphoqelela ukugcina iphutha elaziwayo, ngoba inqubomgomo ephukile ingakhiya bonke abalawuli ngesikhathi esisodwa. Amafayela akusikhombisi sokufaka nawo adinga ubunikazi nemodi edingwa yincwadi, uma kungenjalo azoshaywa indiva noma enqatshwe. Isintaksi iyisango lokuqala kuphela: uma selidlulile, funda umthetho futhi ubuze ukuthi uvumela ini ngempela.

Yima uma okuwukuphela kwendlela yokwenza ushintsho lusebenze ukucisha ukuhlola kwesintaksi. Lokho akusiyo inqubomgomo, ukuphazamiseka okulindele ukuqalwa kabusha.

Ukubuyisela: gcina isikhathi sesekela esisasebenzayo

Ngaphambi kokugcina, qiniseka ukuthi isikhathi sokuphatha esigunyaziwe sesivele sivuliwe nokuthi indlela yesibili yokungena emshinini ikhona. Iphutha le-sudoers lingakuthatha amandla okulilungisa, futhi inkinobho kudeskithophu ayikufanele lokho kuyingozi. Uma i-sudo isivele yonakele, sebenzisa indlela yokubuyisela ebhaliwe yohlelo esikhundleni sokuzakhela eyakho.

sudo -n true
id

Ezinye izindlela ezifana ne-pkexec zincike ekufakweni nasekunqubomgomo yazo, ngakho aziyona imiyalelo yesibili ye-root eqinisekisiwe. Gcina ukugunyazwa kwendawo kuhlukile ekunikezeni imfihlo ye-VPN futhi: umthetho we-sudo awukwazi ukuvula i-ejenti yemfihlo engekho, futhi awukwanelisi i-MFA yesango. Ngemva kokulungiswa, hlola i-akhawunti evamile yenza kuphela umsebenzi ohlosiwe, bese usebenzisa izilawuli ezijwayelekile zomphathi.

Isinqumo siphela lapho usukwazi ukusho ukuthi yisiphi isimo esithethelela i-sudo, umthetho usho ini, ukuthi inqubomgomo ephelele iyahlaziywa, nokuthi ubungayibuyisela kanjani uma kungenjalo. Isiqalisi esinamalungelo esikulahlekela ukufinyelela kokuphatha siwuhwebo olubi, futhi ngokuvamile kungenzeka ukukugwema.