Okuqukethwe ukuthunyelwa kwe-VPN ye-Mac, nokushiyelelayo
Ukuthunyelwa kwe-VPN ye-Mac kuthwala izilungiselelo futhi ngezinye izikhathi ukhiye oyimfihlo, kodwa hhayi iphasiwedi ye-keychain noma ukubhaliswa kwedivayisi. Hlola ingxenye ngayinye kuqala.
Chofoza i-Export kuklayenti ye-VPN ye-Mac bese uthola ifayela elichaza uxhumano ngaphandle kokuba uxhumano uqobo. Ikheli leseva, imbobo, iphrotokholi futhi ngezikhathi eziningi izitifiketi zingaphakathi kwayo. Iphasiwedi yokungena, umusho wokhiye oyimfihlo kanye nokubhaliswa okugunyaza le Mac ngqo ngokuvamile akukho. Yingakho iphrofayela ingangena ngokuhlanzekile, ivele ohlwini lweklayenti futhi yehluleke esicelweni sokuqala sokuqinisekisa; leli gebe iyisici sefomethi, hhayi ukulanda okonakele.
| Part of the connection | Where it lives on the old Mac | What an export does with it |
|---|---|---|
| Server, port, protocol, routes | Client profile or managed settings | Usually included when the client exports configuration |
| Client certificate and private key | Inside the package, the login keychain, or issued by MDM | Included only if the format packs it; a keychain-held key stays behind |
| Login password, key passphrase | Login keychain | Left out by design |
| Device authorization or enrollment | Server side, bound to the certificate or the device record | Not transferable; the new device has to enroll |
Ifayela elithunyelwe likuqukethe ini ngempela
Ukuthunyelwa kuyisitsha, futhi isandiso sefayela sisho okuncane kunokuqukethwe. Amaphrofayela e-OpenVPN awumbhalo: imiyalelo, kanye namabhulokhi <ca>, <cert> kanye no-<key> angenzeka angaphakathi. Izilungiselelo ze-Tunnelblick zingama-akhivi acindezelwe eziqoqo nezilungiselelo. .mobileconfig ephethwe i-plist yemithwalo. Uhlu olubili luphendula ingxenye enkulu yombuzo ngaphambi kokuba ungenise noma yini.
Kumaphrofayela ombhalo, bala amabhulokhi e-PEM ewathwalayo: grep -c "PRIVATE KEY" your-profile.ovpn. Umphumela ongewona uziro usho ukuthi ifayela liqukethe into yokhiye futhi kusukela ngaleso sikhathi kufanele liphathwe njengephasiwedi. Ku-akhivi, yibhale ngaphandle kokuyivula: tar -tf export.tbz, noma unzip -l export.zip uma iklayenti lenze i-zip. Amafayela okhiye, amafayela ezitifiketi kanye namaskripthi aphezulu noma aphansi kulolo hlu yizingxenye ezingeke zenziwe kabusha ukukhishwa kabusha kwe-akhawunti yomsebenzisi.
Icala eliphambene libalulekile ngokufanayo. Uma iphrofayela ikhomba ukhiye ngegama lefayela esikhundleni sokuwufaka, ukuthunyelwa akuphelele ngamabomu futhi ingxenye engekho kufanele ivele kulowo oyikhiphile. Ukukopisha lelo fayela eceleni kulungile uma ungumnikazi wesikhungo sezitifiketi; akulungile uma ifayela lafika nesitifiketi esiboshelwe kudivayisi esakhiwe ku-Mac endala.
Kungani ingxenye ye-keychain ingahambi neze
I-macOS igcina amaphasiwedi e-VPN nemisho yokhiye ku-keychain yokungena, futhi amaklayenti ayigcina lapho esikhundleni samafayela awo ezilungiselelo. I-Tunnelblick isho lokho ku-umhlahlandlela wayo wokuthumela nokungenisa: i-akhivi yokuhlela ithwala iziqoqo nezilungiselelo futhi ishiya ngaphandle amagama abasebenzisi, amaphasiwedi nemisho yokhiye egcinwe ku-keychain. Ukushiya kungenziwa ngamabomu. Izinto ze-keychain zivikelwe kumsebenzisi ngamunye nakumshini ngamunye, ngakho into ekhophishiwe ayinakho ukulawula ukufinyelela okuvumelekile endaweni ekuyiwa kuyo, okushiya kungaba ifayela elingasizi noma imfihlo kumbhalo osobala.
Ungaqinisekisa ukuthi izifakazelo zihlala kuphi ngaphambi kokuhlela ukuthutha. security find-internet-password -s vpn.example.com liphrinta izici zento ehambisanayo futhi liphetha ngekhodi engeyona uziro uma kungekho; umyalo ofanayo no--g uzocela ukudalula iphasiwedi, yingakho umbuzo ngaphandle kwayo ukuwukuhlola okuphephile. Ukuthola lapho kusho ukuthi iphrofayela ayithwali iphasiwedi futhi ayikwazi ukuphoqeleka ukuthi ikwenze. Kusho futhi ukuthi iphasiwedi izobuzwa futhi ku-Mac entsha, futhi imvume ethi «Vumela njalo» kweyendala ayibalulekile lapho.
Nokho akuzona zonke izimfihlo eziyizinto ze-keychain. Imibhalo yephakheji ye-Tunnelblick ngokwayo iphawula ukuthi iphakheji ingaqukatha amafayela okhiye, ezitifiketi namaskripthi. Ngakho ukuthi ukuthunyelwa kushiya ngaphandle okubhalwe ku-keychain akusona isitatimende esifanayo nokuthi ukuthunyelwa kuphephile ukukuthumela nge-imeyili; phatha i-akhivi njengento ebucayi kuze kube yilapho usubhalile okukuyo.
Ama-VPN omdabu naphethwe awanawo umzila wokuthumela
Ukuxhumana okuhlelwe ngokusebenzisa Izilungiselelo Zesistimu akunikezi ukuthunyelwa okusekelwayo. scutil --nc list likhombisa izinsizakalo ezaziwa isistimu, futhi scutil --nc show "Work VPN" liphrinta ukuhlelwa kwensizakalo eyodwa, okwanele ukufunda iseva yayo nephrotokholi. Kokubili akuwona amathuluzi okufuduka. Izihlonzi zensizakalo ezigcinwe ku-/Library/Preferences/SystemConfiguration/preferences.plist ziyizikhombo kulelo fayela, ngakho ukukopisha ifayela nokubhala kabusha izihlonzi akulona ukudlulisa okusekelwayo futhi kungaphazamisa izinsizakalo zenethiwekhi ezingahlobene endaweni ekuyiwa kuyo.
Umzila osekelwayo yilowo oubhalwe i-Apple: faka ifayela lezilungiselelo ze-VPN elinikezwe umphathi, noma faka izilungiselelo ozinikezwa umqhubi. Uma uxhumano luphethwe, cela ifayela elisha noma ukubhaliswa okusha esikhundleni sokulakha kabusha ngokuthwebula isikrini kwinkulumo endala. Ephrofayeleni eliphushelwa yi-MDM, umthwalo wesitifiketi ungathwala ubunikazi ngenkathi ukhiye oyimfihlo wakhiwa kudivayisi, futhi kuleso simo ngisho ikhophi engenaphutha yephrofayela endala ayikwazi ukuqinisekisa i-Mac entsha.
Qinisekisa ukubuyiselwa esikhundleni sokwethemba uhlu
Iphrofayela esohlwini nomhubhe osebenzayo kuyizimo ezimbili ezihlukene, futhi eyodwa kuphela yazo efanele ukubikwa. Ngemva kokungenisa nokuxhuma, hlola ukuthi ikhasi lomhubhe likhona, bese uhlola ukuthi umhubhe wenzani.
ifconfig | grep -A3 utun libonisa ikhasi lomhubhe namakheli alo. scutil --dns | grep nameserver libonisa ukuthi izixazululi ziphi ezisebenza ngemva kokuxhuma, futhi yilapho amaphrofayela e-split-DNS evame ukwehluka khona. Bese ufinyelela isisetshenziswa esibaluleke ngempela: curl -sS -o /dev/null -w "%{http_code}" https://intranet.example.com. Uma zontathu zidlula, izilungiselelo, i-DNS kanye nemizila kufikile; isithonjana esiluhlaza kuklayenti asisho lutho kwalokho sisodwa.
Ukwehluleka okubili kubonakala kaningi ngemva kokungenisa futhi kokubili kusolwa ifayela. Ukuthi amagama omphakathi ayaxazululeka kanti awangaphakathi awaxazululeki ngokuvamile kusho ukuthi amaseva e-DNS ephrofayela alahliwe noma i-split-DNS ayigcinwanga. Umhubhe ophuma ungenzi lutho lokuhamba ngokuvamile usho ukuthi imizila noma ukugunyazwa ohlangothini lweseva akulandelelanga iphrofayela. Ukungenisa kabusha i-akhivi efanayo kuphinda kukhiqize kokubili.
Ngaphambi kokuthatha umhlalaphansi i-Mac endala
Ukususa ukuthunyelwa akukona ukuhoxiswa. Uma idivayisi endala yaqinisekisa ngesitifiketi, iseva isathemba leso sitifiketi kuze kube sihoxisiwe noma sikhishwe kabusha. Uma yaqinisekisa nge-akhawunti eyabiwe, izikhathi zokuhlala kuleyo akhawunti zingase zisaphila. Yenza isinyathelo sohlangothi lweseva ngenkathi ihadiwe isaphambi kwakho.
Gcina iphrofayela entsha kanye nezinye izifakazelo zakho uma iqukethe ukhiye, futhi uthayiphe iphasiwedi kuklayenti ukuze ingene ku-keychain entsha hhayi efayeleni. Ukuhlola kokugcina: xhuma kusuka kokungena esikhundleni ngenkathi i-Mac endala icishiwe. Ukudluliselwa okusebenza kuphela ngenkathi umshini womthombo uxhumekile akukaze kuphelele.