Tag Info

Hot answers tagged

2

You could modify the zone and add a Rich Rule which blocks all ssh traffic other than from a certain range - the Employee subnet. Find which zone your tun interface is in by listing all zones: firewall-cmd --list-all-zones | less In the output you should see something similar to: internal (active) interfaces: tun0 sources: services: dhcpv6-client ...


1

You haven't added your tun0 device to any zone, so it defaults to the default zone, which in your case is the public zone. As root, run: firewall-cmd --zone=internal --add-interface=tun0 You can then leave ssh and https enabled in the internal zone and disable it in the public zone.


1

Try starting the client with the --daemon option: openvpn --daemon From openvpn's man page: --daemon [progname] Become a daemon after all initialization functions are completed To interact with openvpn once it is a daemon, add the --management option to the command. This allows you to interact with it using telnet as described here. Alternatively, ...


1

Set your client to have a route parameter to only your home LAN. For example if your home LAN was 192.168.2.0, the the parameter would look like this in the .conf file: route 192.168.2.0 255.255.255.0 and dont push any routes from the server onto the client. This way when the tunnel comes up all you will route through it is the network you put in the ...


1

The first error is clear; the line you've commented out gives the permission that audit says is missing. The second part is more interesting, but what I suspect is the problem is the target context of the socket you're modifying (owned by unconfined_u). Because you've moved to static device nodes, your interfaces are no longer created by the openvpn process ...


1

I'm not 100% sure about whether or not storing the username/password combination in a variable will work - it definitely won't if your sudo configuration requires a password, but at the least you can implement a loop similar to what's below. If storing the username/password in the variable does work, you won't need to write a file with your credentials at ...



Only top voted, non community-wiki answers of a minimum length are eligible