document/TranslateProject
2
0
Fork 0
mirror of https://github.com/LCTT/TranslateProject.git synced 2025-02-03 23:40:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

work complete

Browse Source
This commit is contained in:
chenjintao_ii 2013-11-21 20:46:49 +08:00
parent 187c2d4d02
commit 6a8f7e3275
1 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
translated/How to Set Up Secure Remote Networking with OpenVPN on Linux, Part 2.md
View File

@ -1,6 +1,6 @@
OpenVPN 安全手册[part 2] OpenVPN 安全手册[part 2]
================================================================================ ================================================================================
欢迎所有 Linux 用户回来继续看我们的 OpenVPN 系列的第二部分。上次我们讲到如何让远端计算机（如笔记本电脑）[通过简单的加密隧道]登录到家里的服务器。今天我们接着讲进阶部分：比如设置 OpenVPN 开机启动，省得我们每次重启服务器的时候都要手动开启 OpenVPN 服务；比如使用 Network Manager 简化访问到远程服务器的过程。 欢迎你们回来继续看我们的 OpenVPN 系列的第二部分。上次我们讲到如何让远端计算机（如笔记本电脑）[通过简单的加密隧道]登录到家里的服务器。今天我们接着讲进阶部分：比如设置 OpenVPN 开机启动，省得我们每次重启服务器的时候都要手动开启 OpenVPN 服务；比如使用 Network Manager 简化访问到远程服务器的过程。
### 整合到 Network Manager ### ### 整合到 Network Manager ###
@ -42,43 +42,43 @@ Ubuntu使用 Upstart 管理服务进程，Debain 使用的老的 SysV，而 Fedo
# systemctl start openvpn@studio.service # systemctl start openvpn@studio.service
Where "studio.service" references our example /etc/openvpn/studio.conf file from part one. This invocation does not survive a reboot, so it's just like running openvpn /etc/openvpn/studio.conf, which is how we started OpenVPN sessions manually in part 1. You should be able to daemonize OpenVPN on systemd with chkconfig: 这里的“studio.service”与我们在第一部分讲过的例子中的 /etc/openvpn/studio.conf 配置的服务相对应。用这些方法启动的后台进程，在系统重启后会失效，所以这些方法都和第一部分讲的启动方式一样，仅能使 OpenVPN 运行一次。你可以将启动 OpenVPN 进程的任务交给 chkconfig：
# service openvpn start # service openvpn start
# chkconfig openvpn on # chkconfig openvpn on
That should daemonize OpenVPN in the usual way, which is as a monolithic daemon and not individually per .conf file in /etc/openvpn/. systemd supports the chkconfig and servicecommands so it should work. However, the distros that use systemd are quite variable, so if yours is different please let us know in the comments. 上面列出的是启动 OpenVPN 后台进程最常见的方式，这个命令启动了一整个进程，而不是对 /etc/openvpn/下面的所有 .conf 配置文件都维护一个进程。systemd 支持chkconfig 以及 service 命令，所以上面两条命令能够正常工作。然而使用 systemd 的发行版非常多，如果你的工作环境和我们的不一样，请通过发表评论的方式通知我们。
### Strengthening Your Connection ### ### 强化你的连接 ###
OpenVPN is robust and is good at maintaining a persistent connection, even with service interruptions. You can make your connection even stronger by adding these lines to your .conf files on clients and server: OpenVPN 的健壮性足够维持一条持久的连接，即使服务宕掉。而你可以令这个连接变得更加稳定，只需要在服务器端和客户端的 .conf 文件内添加下面两条属性：
persist-tun persist-tun
persist-key persist-key
These are helpful for laptop users who disrupt their connection a lot with power-save and being on the move. 这两条属性对于那些笔记本电脑用户来说非常有用，他们的电脑会因为电源保护或需要移来移去而经常断开 OpenVPN 的连接。
### Now What? ### ### 现在，该做些什么？ ###
Now that you have this all set up and working, what do you do with it? If you're used to using OpenSSH for remote operations you might be stuck in the SSH mindset of being able to log into specific machines and run applications. It doesn't work that way. Rather, think of OpenVPN as a virtual Ethernet cable to your server or LAN, all wrapped in a nice stout layer of encryption. You can run unencrypted and encrypted services over the same tunnel, and you only have to open a single hole in your firewall. 你已经完成了所有设置，并且你的服务工作正常，你接下来能用这个干点什么？如果你以前一直用 OpenSSH 来远程你的服务器，你会有这样的思维定势：你可以利用 OpenVPN 登录到远程机器，然后跑上面的应用。你要是那样做，就太浪费 OpenVPN 了。你可以将 OpenVPN 想像成是一条虚拟的以太网电缆接到你的服务器上或者是你的局域网内，这条电缆还包着厚厚的加密保护。你可以在它提供的隧道上跑任何加密的不加密的服务，并且只需要在防火墙上开一个端口。
So you can run SSH in the way you're used to over your OpenVPN tunnel, and do remote administration and run applications. You can access network resources such as fileshares and Web applications. You can force all networking on the client to go through your VPN tunnel, but for this series I've assumed that you want to be able to use both your native and VPN networks. 所以你可以利用 OpenVPN 隧道来建立 SSH 连接，然后远程到服务器，然后在服务器上跑应用。你可以访问到网络资源，比如文件共享和 Web 应用。你可以强制让你的电脑通过 VPN 隧道访问到网络，但我认为你会想要同时能够使用本地网络和 VPN 网络的。
So there you are on your trusty laptop and you can surf the Web, run SSH, do whatever you want on whatever network you're connected to. Then when you want to run something over your OpenVPN tunnel open it up and specify the IP address, like this: 所以，在你的笔记本上你可以上网冲浪，使用 SSH，做你想做的任何事，上你想上的任何网络。当你想利用 OpenVPN 隧道做一些事情时，你只需要打开它，然后输入 IP 地址：
$ ssh carla@10.0.0.1 $ ssh carla@10.0.0.1
Web applications are easy: point your Web browser to the virtual IP address of your OpenVPN server and log in as usual. For example, I run various Web services for testing on my home server. So I access Drupal at [http://10.0.0.1/drupal][2] and OwnCloud at [http://10.0.0.1/owncloud][3]. I use the nice gFTP graphical FTP client, so all I need to connect is the virtual IP address on the Host line, username, and password. Or use the command line: 对于一些 Web 服务，操作也简单：让你的 Web 浏览器访问到 OpenVPN 的 IP 地址然后登录进去。举个例子，我在我家的服务器上跑了多个 Web 服务做测试，我可以通过[http://10.0.0.1/drupal][2]访问 Drupal，可以通过[http://10.0.0.1/owncloud][3]访问 OwnCloud。我电脑上有优秀的图形界面 FTP 客户端 gFTP，所以只需要填入 IP 地址、用户名、密码就能访问到 FTP 服务器，或者使用下面的命令：
$ ftp 10.0.0.1 21 $ ftp 10.0.0.1 21
You can administer your MySQL database from afar, using your own username and password: 你可以远程管理你的 MySQL 数据库，输入帐号密码：
$ mysql -h 10.0.0.1 -u admin -p $ mysql -h 10.0.0.1 -u admin -p
So the main thing you need to know is how to add the host specification to whatever command you want to run. 所以最重要的是你要知道怎么去配置一个你想要玩的功能。
Obviously, this would all be easier with name services instead of having to use IP addresses, so one of these days we'll learn how to implement name services in OpenVPN. Meanwhile, please enjoy your nice secure OpenVPN tunnel. 很显然，当我们使用名称服务（name service）时，会比直接使用 IP 地址更方便。所以某一天我们可以学学如何在 OpenVPN 上布署一个名称服务。现在，先享受一下 OpenVPN 带给你的乐趣吧。
-------------------------------------------------------------------------------- --------------------------------------------------------------------------------