Umbiko wengcuphe ye-VPN awunakwa? Bhala isinqumo, hhayi amaphuzu

Inothi lengcuphe eliphetha ngohlu lwamazinga okushubisa linikeza umphathi isinqumo futhi linganikezi isinyathelo. Yingakho eziningi zazo zibuya ngo-«ngiyabonga, ngikuqophile» futhi kungasekho okunye. Amanothi avunywayo abelana isimo esisodwa: isimangalo esisodwa esincane esingahlolwa, izinketho ezimbili ezinamagama ezinentengo, kanye nomuntu oyedwa okufanele aphendule ngaphambi kosuku. Konke okungezansi kumayelana nokukhiqiza leso simo ngaphandle kokwedlulele kulokho okwaziyo.

Amaphuzu aphendula umbuzo ongakaze ubuzwe muntu

Izibalo zamathuba ziphindwe ngomthelela zikhiqiza inombolo ehlela okutholakele ngokulingana. Ayitsheli umqondisi ukuthi kufanele asayine ini, futhi imema impikiswano ngesiphindaphindo esikhundleni sesinqumo ngesango. Ngike ngabona inombolo yokuchayeka enamadesimali amabili igwinya umhlangano wonke ngesikhathi umbuzo wangempela — ukuthi kufanele kuxhaswe ngemali ukuthuthukiswa kule kota — ungakaze ubuzwe.

Kunezinqumo zangempela ezimbalwa kulo mkhakha. Xhasa ngemali ukuthuthukiswa, amukele ukuchayeka okulinganiselwe kuze kufike usuku olushiwo, noma wehlise labo abangafinyelela insizakalo. Ngayinye inombhekele ohlukile kanye nezindleko ezihlukile, futhi akukho eyodwa eyithi «wehlisa ingcuphe ngamaphesenti angu-40».

Ukukhushulwa kwezinga lokushubisa kwenza inkinga ibe yimbi kakhulu. Lapho konke okutholakele kubalulekile, uhlu luyeka ukuhlukanisa futhi umfundi ubuyela esibonakalisweni esisodwa esisele, okuwukuthi ubani okhale kakhulu. Inothi elithi ukukhishwa akusekho ekusekelweni, ukuthi leli yikota yesibili lingasekho ekusekelweni, nokuthi iqembu elithile labasebenzi lincike kulo, lisebenza kakhulu kunebheji elibomvu.

Ukungacaci kungenye inselelo. «I-VPN ayiphephile» akukwazi ukuxazululwa, ngoba akusho ukuthi yikuphi ukusatshalaliswa, yiluphi uhlobo, noma ubani angafinyelela ini. Umshwana umfundi angawuhlola uyiyunithi encane kakhulu yombiko owusizo.

Nciphisa isimangalo kuze kube ubani angasihlola

Bophela isimangalo emkhawulweni oshicilelwe, hhayi emcabangweni. Ukuba ngaphandle kokusekelwa komhlinzeki, isinyathelo sokufakazela esidingekayo esingekho, noma ukufinyeleleka osexyeni lwenethiwekhi okungafanele kusibone — konke kuyizimangalo ezinokuhlolwa ngemuva kwazo. Kweyokuqala, ukuhlolwa imiyalo emithathu esangweni uqobo:

openvpn --version | head -n 1
dpkg-query -W -f='${Version}\n' openvpn
openssl x509 -in /etc/openvpn/server.crt -noout -enddate

Umugqa wenguqulo kanye nombuzo wephakethe ngokuvamile kuyavumelana, futhi uma kungavumelani uthole inkinga yesibili efanele umbiko ohlukile. Usuku lokuphelelwa kwesitifiketi iyinkambu abantu abakhohlwa ukuyihlola kuze kube amaklayenti ehluleka ukuxhuma, futhi ingeyenye yenselelo yobufakazi efanayo nomucu wokukhishwa.

Qopha ukuthi umphumela ngamunye uqhamuka kuphi nalapho uthathwa khona. Inothi elithi «isango gw1, liqoqwe ngoLwesibili» lisengaphindwa lisetshenziswe umuntu ongabazayo; isithombe-skrini esigawulwe safinyelela umugqa othakazelisayo asikwazi. Susa okhiye, amakheli angasese namagama ama-akhawunti ngaphambi kokuba ifayela liphume emshinini wakho.

Bhala inothi njengokukhetha phakathi kwezinketho ezinamagama

Inothi lesinqumo lifushane ngoba lenza umsebenzi owodwa. Lesi yisimo engisisebenzisayo, sigcwalisiwe inhlangano esatshwayo yosayizi omaphakathi eyayikhipha inguqulo yokufinyelela kude ekusekelweni:

Ask: approve one of two upgrade paths for remote access before 30 June.
Claim: gw1 runs a release that left vendor support in January.
Evidence: version output and vendor notice, attached, collected 14 March.
Option A: upgrade in place, one maintenance window, staff on the current client build.
Option B: replace the gateway, two windows, client reinstall for 180 staff.
Cost of waiting: no security fixes for a service 180 staff use daily.
Owner: platform team. Decision needed from: IT director, by 28 March.

Umgqa ngamunye ufanele indawo yawo. Isicelo umushwana owodwa futhi siqukethe usuku. Isimangalo siyahlolwa. Inketho B ikhona ukuze inketho A ibe ukukhetha hhayi umkhuba, futhi isho ukufakwa kabusha kweklayenti ngoba yilezo izindleko abantu abazibukela phansi. Izindleko zokulinda zichaza umphumela, hhayi amathuba.

Inothi okungafanele likwenze ukuqhubeka nokufaka isiphetho ongakwazi ukusisekela ngasese. Uma kungaboniswanga kuphulwa, shono ngomugqa owodwa, ngoba umfundi ozothola ukwedlulela kamuva uzokwehlisa namanye amanothi akho amathathu alandelayo.

Okufanele kube nakho ukwamukelwa kwengcuphe

Ukwamukela akusikho ukungabi nasinqumo futhi akusikho ukuthula. Uma impendulo iwukuhlala nokuchayeka isikhathi, inothi lidinga izengezo ezintathu: usuku lokuphela, isinyathelo sokuqapha umuntu akwenzayo ngempela, kanye nomuntu ogama lake ovula umbuzo futhi lapho usuku lufika.

Ukuphatha kwesikhashana kudinga ukwelashwa okufanayo. Ukunciphisa insizakalo kuqembu elincane kwehlisa ukuchayeka kuphela uma umkhawulo ugcinwa endaweni ethile futhi ubani egcina uhlu. Ukuvimba okumisa buthule umsebenzi weqoqo lasebusuku akusikho ukuphatha, kuwukuphazamiseka okunamaphepha angcono.

Hlukanisa umbhekele woshintsho nombhekele wesinqumo lapho bengabantu abahlukene. Ithimba leplathifomu liyasebenzisa; umqondisi uyavuma. Ukubhala womabili amagama enothi kususa isithiyo esivamile: uhlelo olulungiswe kahle olulinde umuntu ongalubonanga.

Qinisekisa inothi ngokuqondene nokusatshalaliswa ngaphambi kokulithumela

Izimangalo ziguga kabi ezinhlanganweni ezinamagethi amabili. Okutholakele okukotshiwe kusuka emucu wengxoxo mayelana nokunye ukukhishwa, noma kusuka kusibungu esakhiwe kabusha ngenyanga edlule, kuzophikiswa emhlanganweni futhi ingxenye esele yenothi ihambe nakho. Phinda usebenzise ubufakazi kusibungu ngasinye inothi elisho ngalo:

for h in gw1 gw2; do
  ssh "$h" 'openvpn --version | head -n 1; systemctl is-active openvpn@server'
done

Uma izibungu ezimbili zingavumelani, inothi manje likhuluma ngeqembu elixubile, okuwukutholakala okuhlukile futhi ngokuvamile okuyisikholiselo kakhulu. Uma insizakalo ingasebenzi kusibungu obucabanga ukuthi sisebenza ithrafikhi, mawo, ulungise uhlu ngaphambi kokuba inothi liye ndawo.

Bese unamathisela umphumela, faka usuku lwesinqumo emugqeni wesihloko, bese ulithumela kumuntu ongasho yebo hhayi eqenjini elizokuxoxa. Uma impendulo ibuya «hhayi manje», buza usuku eliba «manje» ngalo futhi ubhale lolo suku enguqulweni elandelayo yenothi.