Iyiphi i-instance ye-OpenVPN esebenzisa ngempela iphrofayili yakho ye-PiVPN?

I-PiVPN ibhala ukucushwa kweseva nephrofayili yeklayenti, bese iyaphuma; ayikaze ibe inqubo ethwala ithrafikhi yakho. Ngakho ukuxhumana okwehlulekile, iklayenti elishaya iphoyinti lokugcina elingalungile, noma isevisi ebuya kabi ngemva kokuqalisa kabusha akukwazi ukuchazwa kusukela kumamenyu wesifaki. Lezi zimpawu zingezaseva ye-OpenVPN esebenza manje, ukucushwa okwalayishwa ngempela yileso sevisi, kanye nelogi eyayikhonjiswe kuyo. Imiyalo emine yokufunda kuphela ivamise ukukuxazulula lokhu, futhi akukho none eyodwa eshintsha izitifiketi zakho noma okhiye bakho.

Umsizi nedemoni kuyizinto ezihlukene

Ukudideka kulula ukukuchaza: umkhombandlela owodwa ugcina ifayela elakhiwe umsizi, ifayela elifundwa idemoni, futhi kwesinye isikhathi ikhophi endala yakho kokubili. Umsizi uyiskripthi sokuhlinzeka. Ifaka amaphakethe, ibhala amafayela eyunithi futhi iphrinta iphrofayili yeklayenti, bese umsebenzi wayo uphela. Okusele inguqulo kumphathi wesevisi kanye nomugqa womyalo.

Kusibungu se-systemd, qala ngeyunithi esebenzayo esikhundleni sohlu lomkhombandlela. Igama lincike ekupakishweni: izithombe ze-Debian ne-Raspberry Pi OS zivamise ukunikeza i-instance yesifanekiso efana ne-openvpn-server@server, kuyilapho ukufakwa okudala kusebenzisa openvpn@server. Buza umphathi ukuthi iyiphi esebenzayo esikhundleni sokuqagela ngokusuka egameni lefayela.

systemctl list-units --type=service --all | grep -i openvpn
systemctl cat openvpn-server@server

Funda ExecStart= kulokho okukhishiwe. Ikhipha ifayela elisebenzayo kanye nezinketho umphathi aziqalisa ngempela, kuhlanganise noma yimuphi --config umkhondo; ifayela lokucushwa eliseduze futhi okungekho myalo okubhekisela kulo akulona ingxenye yethaneli esebenzayo.

Landelela uchungechunge lokucushwa oluxazululwe idemoni

OpenVPN ayihloli umkhombandlela ukuthola izilungiselelo. Ifunda ifayela elidluliswe nge---config, ilandela noma yisiphi config isiyalelo ngaphakathi kwaso, bese isebenzisa izinketho zomugqa womyalo. Incwadi ye-2.6 ichaza lokho kuhleleka, futhi lokho kubalulekile lapho amafayela amabili engavumelani ngephothi, idivayisi noma i-cipher.

Qala ukhiphe ukubizwa kwangempela, bese ubheka iziyalelo ezinquma ubunikazi nokufinyeleleka. Yomibili imiyalo yokufunda kuphela futhi iphephile kuseva ephilayo, nakuba eyesibili iphrinta imikhondo ongase ungayifuni ethikithi lomphakathi.

systemctl show -p ExecStart --value openvpn-server@server
grep -E '^(config|dev|proto|port|local|log|log-append|status|ca|cert|key|tls-auth|tls-crypt)' /etc/openvpn/server/server.conf

Ifayela le-.ovpn kumkhombandlela wasekhaya liyingxenye yeklayenti. Idemoni leseva alilifundi nakancane, ngakho ukuhlela lelo fayela ukuze kulungiswe ukwehluleka kokuxhumana ohlangothini lweseva akuzuzi lutho.

Ukufakwa ngaphakathi kungenye ingibe. Umugqa we-config udonsa ifayela lesibili elinezinketho ezicutshungulwa kulelo phuzu, ngakho isiyalelo senani elilodwa esizayo singadlula lokho ifayela eliyinhloko elibonakala likusho. Uma ifayela elibonakalayo libonakala lilungile kodwa idemoni lisaziphatha ngendlela ehlukile, funda ifayela elifakiwe ngaphambi kokushintsha noma yini.

Fanisa ilogi nenqubo, hhayi nephutha olikhumbulayo

Izindawo ezimbili zelogi zivamile, futhi kungenye kuphela yazo i-journal. Uma i-log-append isethiwe, idemoni libhala kulelo fayela futhi i-journal igcina okuncane ngaphandle kwemigqa yokuqalisa. Ngaphandle kwalokho i-journalctl ingumthombo wezigameko.

journalctl -u openvpn-server@server -n 80 --no-pager

Xhumanisa umzamo owodwa wokuxhumana newindi yesikhathi eyodwa. Qopha iphoyinti lokugcina leklayenti, bese ufunda izigameko zeseva kusukela kuleyo mizuzwana. Ukuxhumana kwe-TLS okungafinyeleli ekushintshisweni kwezitifiketi kukhombisa ukufinyeleleka noma ukungafani kwephrothokholi, kuyilapho ukwenqatshwa kokuqinisekisa kufika ngemva kokuba amapharamitha ethaneli esevunyelwene ngawo.

Isiqopha selogi esidala asifakazeli lutho ngephrofayili oyilande emizuzwini emihlanu edlule. Phinda ukhiqize ifayela leklayenti, xhumana kanye, futhi ufunde kuphela imigqa evelile phakathi nalowo mzamo.

Qopha ukwehluleka kokuqala okuqondile, hhayi kokugcina okuvamile. Iphutha le-bind, ukushintshisana kwangaphandle okungaphenduliwe, ukwenqatshwa kwesitifiketi kanye nokwenqatshwa kwe-akhawunti ngakunye kukuhambisa ezingeni elihlukile, futhi isiphetho sesikhathi ekugcineni sivamise ukufihla isigameko esiwusizo esingaphezulu.

Ukwakha kabusha ithaneli akusona isinyathelo sokuxilonga

Indlela emfushane ekhangayo ukumisa ithaneli lesibili elilula: ukhiye ongaguquki, azikho izitifiketi, akukho ukuqinisekisa okwengeziwe. Livamise ukuxhumana, futhi likhombisa kuphela ukuthi amasibungu amabili angadlulisa i-UDP noma i-TCP phakathi kwawo. Alisho lutho ngokuthi kungani ukusetshenziswa okuqinisekiswe ngezitifiketi kwehluleka, futhi lishintsha buthule imodeli yokuphepha obekufanele uyigcine.

Kunjalo futhi ngoku-tls-auth noma i-tls-crypt, ukukhulula i-verify-x509-name, noma ukushiya ingxenye yesibili ukuze uthole isimo esiluhlaza. Ithaneli elixhumayo ngenxa yokuthi ukuqinisekisa kwasuswa liwuhlelo olunye, hhayi olulungisiwe.

Yenza ushintsho olulodwa olunomkhawulo esigabeni esishiwo ilogi, qalisa kabusha iyunithi efanayo, futhi uphinde umzamo owodwa wokuxhumana. Lokho kugcina ukuqhathanisa kunenjongo, futhi kushiya ushintsho ongakwazi ukulubuyisela.

Yini okufanele uyidlulisele kumuntu olandelayo

Bhala amaqiniso amane ngenkathi usenawo: inguqulo ye-OpenVPN evela ku-openvpn --version, iyunithi esebenzayo, uchungechunge lokucushwa kanye nokufakwa kwalo ngaphakathi, kanye newindi yelogi ehlanganisa umzamo owodwa. Lawo mane enza isikhalo esingacacile sibe yicala elingaphindwa.

Fihla idatha ebucayi ngaphambi kokwabelana. Okhiye abayimfihlo, auth-user-pass amafayela, impahla yokhiye ongaguquki kanye namaphakethe eklayenti aphelele akufanele abe sethikithini; amagama ezinketho kanye nokuma kochungechunge ngokuvamile kwanele kubabili bamehlo besibili.

Uma uchungechunge luphelele futhi ilogi isakhomba kunethiwekhi, isinyathelo esilandelayo umkhondo phakathi kweklayenti neseva, hhayi okunye ukufakwa. Leyo yingxenye eyodwa yendaba umsizi angakaze abe nayo.