Kungani iklayenti le-Linux le-GlobalProtect lihluleka ku-Ubuntu emisha

Umqondo ofanele ukuthi i-.deb evela kuphothali yakho ye-GlobalProtect yephukile, noma umkhiqizi uthumele ukwakhiwa okungalungile. Ngokuvamile akunjalo. Ingaphandle ye-Linux yomkhiqizi isaxhumanisa ne-Qt5 WebKit, futhi izinguqulo ezintsha ze-Ubuntu azisanikezi, ngakho iphakethe licela ilabhulali ahoxise ngamabomu uhlelo lwakho lokwaba. Lokho kungukungafani kokupakisha, hhayi ukulandwa okonakele, futhi lowo mehluko unquma ukuthi uzochitha intambama uphoqa amaphakethe noma imizuzu eyishumi ukhetha iklayenti elinye.

I-.deb ayiphukile

Ukuncika okungasakuthwalwa uhlelo lokwaba kungumphumela ojwayelekile wokuhoxiswa kwelabhulali emsebenzini. I-Qt5 WebKit yasuswa kuma-archives e-Ubuntu akamuva naku-Debian, futhi isizathu kwakuwukugcinwa kwezokuphepha hhayi ukuntuleka kwesidingo. Uma lokho kwenzeka, yonke iphakethe esaxhumana nayo iyeka ukufakwa, kungakhathaliseki ukuthi yakhiwa kahle kangakanani.

Ukwehluleka okubili kubikwa njengephutha elilodwa futhi akunjalo. Kwinguqulo engenayo ilabhulali, isifaki siyama ekuncikeni okungagcwalisiwe. Kwinguqulo lapho iklayenti lifakwa khona bese lihluleka ekungeneni, empeleni ubona inkinga yokuxhawula kwe-TLS noma i-SAML ngaphakathi kwengxenye yesiphequluli esifakiwe. Okokuqala ukupakisha; okwesibili isikhathi sokusebenza, futhi akukho kukho okubili okulungiswa ngokukopisha amalabhulali amadala kudeskithophu yesimanje.

Qinisekisa ukuncika esikhundleni sokukuphoqa

Faka iphakethe ngokusobala ukuze ithuluzi likhiphe igama lokuncika okungaxazululiwe esikhundleni sokukunikeza isifinyezo. Bese ubuza ukuthi inguqulo yakho inayo yini noma yimuphi umfakisicelo, ngoba „akutholakali lapha” kanye „kuntula okwesikhashana kulesi sibuko” kuholela ezinqumweni ezihluke ngokuphelele:

sudo apt install ./GlobalProtect_UI_deb-*.deb
apt-cache policy libqt5webkit5
apt-cache rdepends --installed libqt5webkit5

Uma apt-cache policy kungabiki mfakisicelo, yeka ukuzama ukuyifaka bese uqala ukukhetha enye indlela. Okuthakazelisayo akulona igama lephakethe elilahlekile; okuthakazelisayo iqiniso lokuthi igrafu yokuncika yomkhiqizi ayihambisani nezinhlelo zokwaba ezisetshenziswa abasebenzisi bakho.

Ukuthi ukuphoqa amaphakethe amadala kwenzani kudeskithophu

Isixazululo esizungezayo siwukudonsa ilabhulali kwinguqulo endala. Ku-Ubuntu yamanje lokho kuphelela engxabanweni yenguqulo encane ye-Qt5: amaphakethe amadala adonsa libqt5core5t64 emuva, bese amaphakethe e-KDE ne-PyQt afakiwe aqala ukufuna inguqulo ye-ABI ilabhulali eyehlisiwe engasanikezi. Umphumela ukuthuthukiswa okuyingxenye okwephula izinhlelo ezingahlobene, okuyintambama embi kakhulu kunaleya oqale ngayo.

Lowo mphumela ulindelekile hhayi inhlanhla embi. Izinto eziqondile ze-ABI ze-Qt ezinguqulweni ezincane ziqinile, futhi uhlelo lokwaba luletha isethi eyodwa ehlangene. Ukuhlanganisa ilabhulali eyodwa evela kwenye inguqulo akulona ukulungiswa okuqondiwe; kungukuthuthukiswa kwesibili okungalawulwa kahle.

Isiphakamiso esifanayo sisebenza kuhlobo lwesikhathi sokusebenza lokwehluleka. Ukwehlisa izinga lokuphepha le-OpenSSL kulo lonke uhlelo ukuze ukuxhawula kweklayenti elidala kuphumelele kushintsha yonke ukuxhumana kwe-TLS emshinini ukulungisa uhlelo olulodwa, kuhlanganise nomphathi wamaphakethe ozowudinga lapho okunye kuphuka.

I-openconnect ikhuluma iphrothokholi

I-OpenConnect isebenzisa iphrothokholi ye-GlobalProtect ngokuqondile, futhi amanothi ephrothokholi achaza kokubili ukubizwa kanye nokwehlukana phakathi kwezingaphandle ezimbili zeseva. Iphothali isabalalisa izilungiselelo kanye nohlu lwamasango; isango liqeda ithaneli:

openconnect --protocol=gp vpn.example.com
openconnect --protocol=gp --authgroup=staff vpn.example.com

Uma iphothali ishiya isango olidingayo, --usergroup=gateway noma /gateway ekupheleni kwe-URL kudlula isinyathelo sephothali. Uma amasango amaningi enikezwa, --authgroup=NAME ikhetha phakathi kwawo. Ukuqinisekisa iqiniso kuyigama lomsebenzisi nephasiwedi, ngokuzikhethela ngesitifiketi seklayenti, futhi amasango e-SAML asebenza ngokoqobo nge-network-manager-openconnect hhayi umugqa womyalo obhalwe ngesandla.

Isango elinomgomo oqinile we-posture lingadinga umbiko we-HIP ngaphambi kokunikeza ithaneli. I-OpenConnect ingakhiqiza futhi iwuthumele, kodwa uma isango lifuna uhlu lwempahla elingakwazi ukulukhiqiza, akukho ifulegi elishintsha lowo mgomo; leso yisinqumo sohlangothi lweseva.

Qinisekisa ithaneli, futhi wazi ukuthi i-openconnect ngeke ilungise ini

Hlola ukuthi ithaneli lasisebenzisa ini ngempela esikhundleni sokuthemba umlayezo wempumelelo. Isango lithumela umzila kanye nokucushwa njenge-XML futhi iklayenti liyakusebenzisa, ngakho umzila ongekho uyinkinga yokucushwa noma yokukhetha hhayi iphutha leklayenti:

ip -4 addr show
ip route
resolvectl status

I-MTU ifanele ukubhekwa ngokwayo. Ukucushwa kwe-GlobalProtect kuhlale kubika i-MTU enguziro, ngakho iklayenti ilinganisela eyodwa kusukela ekusetshenzisweni okungeziwe kokufaka. Ukudluliswa okukhulu okumayo ngenkathi izicelo ezincane zidlula kuwuphawu olujwayelekile, futhi ikhambi i-MTU ecacile ekuxhumaneni hhayi ukuvala ukutholakala komzila.

I-IPv6 ingenye indaba futhi. I-PAN iyengeze ku-GlobalProtect 4.0, futhi ukusekelwa kwe-OpenConnect kuchazwa njengokokuhlola kusukela kunguqulo 9.0, ngakho ungacabangi ukuthi umndeni wamakheli uziphatha njenge-IPv4 ngoba nje ithaneli lenyukile. Futhi uma isango liphoqa ukuhlolwa kwe-posture iklayenti lomthombo ovulekile elingakwazi ukukugcwalisa, sebenzisa iklayenti lomkhiqizi kunguqulo ye-LTS esekelwayo, kumshini wobuciko uma isiteshi sakho sokusebenza sesiqhubekile. Lokho kugcina ideskithophu iphilile futhi kubeka ukuncika kwakudala ngaphakathi komngcele ongawakha kabusha.