Ukhiye wakho we-VPN ufundeka kuwo wonke umuntu: yini okufanele ilungiswe

Isibonakaliso sokuqala ngokuvamile siyisixwayiso, hhayi ukwehluleka. Iklayenti lenqaba ukulayisha ukhiye ngoba ifayela lifundeka ngeqembu noma yiwo wonke umuntu, noma ukubuyekezwa kwezokuphepha kuthola client.key kumodi 644 endaweni yephrofayela enezinto ezithunyelwe ngaphandle. Akukho okuhlulekile okwamanje, futhi yikho kanye okwenza isixwayiso singanakwa. Ukhiye uyasebenza, ithuneli iyaphuma, futhi ifayela lifundeka yiwo wonke ama-akhawunti emshinini.

Isimpawu isixwayiso semvume, hhayi ukuphazamiseka

Kusistimu efana ne-Unix, ukhiye oyimfihlo kufanele ufundeke kuphela i-akhawunti ephethe insebenzo. Imodi engu-600 enomnikazi ofanele iwuhlelo olujwayelekile. Imodi engu-644 isho ukuthi wonke umsebenzisi wendawo angakopisha ukhiye, futhi kumsingathi wokwakha owabiwe lokho kuyizethameli zangempela.

Amaklayenti ahlola lokhu akusiza. Lawo angakuhloli awabona ubufakazi bokuthi ifayela liphephile, futhi ukuxhumana okuphumelelayo akusho lutho mayelana nokuthi ubani omunye angafunda izinto ezikwenzile ukuthi kube nokwenzeka. Thatha isixwayiso njengokutholakele konke. Sinembile, futhi safika ngaphambi kokuba noma ubani akopishe ifayela.

Vumelanisa imodi nobuwena bensebenzo

Ukufinyelela kukamnikazi kuphela kufanele ukhiye osetshenziswa yilowo mnikazi. Insebenzo eneqembu elabiwe ngamabomu ingase idinge elinye ihlelo elilawulwayo, njengokufunda kweqembu kukhiye ophethwe yi-akhawunti yensebenzo. Ukubeka ngobumpumputhe imodi eyodwa yezinombolo kuwo wonke amafayela kuphula amaklayenti asekelwayo, futhi chmod -R 777 akuyona isixazululo sanoma yini.

Hlola umnikazi ne-akhawunti yensebenzo ngaphambi kokushintsha noma yini. Izitifiketi ze-CA zomphakathi nezinkinobho zobuwena zangasese zinezimfuneko ezahlukene zokugcinwa kwimfihlo ngisho zisendaweni eyodwa, ngakho imodi ephindaphindayo kuyo yonke ifolda izithatha zombili njengento eyodwa.

ls -l /etc/openvpn/client/
stat -c '%U %G %a %n' /etc/openvpn/client/*.key
id openvpn

Kwezinye izinkundla, sebenzisa isitolo sokhiye esibhaliwe noma imodeli yokulawula ukufinyelela esikhundleni sokuhumusha amamodi e-Unix abe ukuqagela. Igama lefayela eliphela ngo-private liyilebula, hhayi indlela yokuphoqelela.

Thola amakhophi angamboziwe yimodi

Abahleli, izingobo zokugcina, amaphrofayela athunyelwe ngaphandle namabhondela esikhashana ngakunye kungagcina ubuwena obufanayo. Vikela lawo makhophi ngokuya ngokuqukethwe, ngoba ukuqinisa ifayela lasekuqaleni akwenzi lutho kulelo elikwi-tar yenyanga edlule.

Iphasiwedi kufayela lokhiye iwusizo ezintweni ezigciniwe futhi ayithetheleli ukushicilela ifayela elibethelwe eceleni kwephasiwedi yalo. Izimvume zivikela into yamanje yohlelo lwamafayela; azisho lutho mayelana nobufakazi bokungena obusekopishiwe kwenye indawo.

Funa amakhophi ngaphambi kokumemezela ukuthi umsebenzi uqediwe: grep -rl umugqa wakhanda wokhiye ezindaweni okungenzeka, kanye nokubheka okukhishiwe ekugcinweni. Umphumela uvame ukuthakazelisa ukwedlula ifayela oqale ngalo.

Ngemva kokulungisa, qinisekisa futhi ushintshe

Hlola ukuthi insebenzo ehlosiwe isaqinisekisa, bese uqinisekisa ukuthi awekho ama-akhawunti angenasidingo athole ukufinyelela. Khawulela umphumela wokuxilonga kumamethadatha, ngoba ukunyathelisa ukhiye akudingeki ukufakazela ukuthi ifayela liyafundeka futhi kubeka izinto kwilogi.

Uma ukhiye uveziwe, qinisa imodi, bese ushintsha ubufakazi bokungena futhi uhoxise obudala. Incazelo ye-POSIX chmod ichaza ukuthi ingani ngayinye yemodi isho ukuthini, okufanele kukwazi ngaphambi kokuba ukubuyekezwa okulandelayo kucele ukuthi uthethelele inombolo oyikhethile.