TLS da ba a yarda ba a AnyConnect a Linux: fara auna iyakar gyaran

Wannan kuskuren yana zuwa kafin tambayar kalmar sirri, kuma wannan shi ne ɓangaren amfani: babu abin da aka tabbatar da shi tukuna, don haka bayanan shiga ba su ne matsalar ba. A Linux, wannan taga ta AnyConnect na iya zuwa daga tsohuwar sigar yarjejeniya, ƙungiyar musayar maɓalli ta 1024-bit, ko tarin sirrin da manufar sirrin tsarin ta ƙi. Na kawar da ita ta hanyoyi uku daban-daban a injuna uku, kuma abin da ke bambanta waɗannan gyare-gyaren shi ne iyakar tasiri, ba wayo ba. Kowanne yana da hujja a wurin da ya dace kuma mummunan zaɓi ne a kowane wuri.

Karanta saƙon kafin ka taɓa manufar

Riƙe ainihin igiyar daga tagar. Korafin siga yana nuni ga matakin yarjejeniya, korafin takardar shaida yana nuni ga amana ko suna, kuma gazawar shiga tana nuni ga bayanan shiga. Ƙofar da ke bayar da TLS 1.0 tare da ƙungiyar DHE ta 1024-bit, AES-256-CBC da sa hannun SHA-1 na iya samun ingantacciyar takardar shaida kuma duk da haka manufa ta zamani ta ƙi ta kafin a aika bayananka.

Duba ƙarshen wurin da OpenSSL na tsarin, ta amfani da ainihin sunan host da tashar da abokin ciniki ke amfani da ita.

Gazawar openssl s_client -connect vpn.example.com:443 -servername vpn.example.com yayin da -tls1 -cipher DEFAULT@SECLEVEL=0 ya yi nasara yana gaya maka cewa iyaka ita ce siga da girman maɓalli tare. Idan umarni na farko ya ba da rahoton ƙaramin maɓallin DH maimakon faɗakarwar yarjejeniya, sigar tana da kyau kuma ƙungiyar kaɗai ke buƙatar kulawa. Kada ka taɓa saka maɓalli na sirri ko kalmar sirri cikin binciken.

Zaɓi 1: sassauta dukan host da manufar sirri

A Fedora da RHEL 8 da 9, update-crypto-policies --set LEGACY yana saukar da manufar tsarin OpenSSL, kuma update-crypto-policies --show yana tabbatar da abin da ke aiki. Yawancin lokaci yana maido da rami, amma ana karanta manufar lokacin da tsari ya fara, don haka sake kunna abokin ciniki da duk wani mataimaki da ya ƙirƙira kafin sake gwadawa. Hakanan yana ba da izinin tsofaffin yarjejeniyoyi da ƙungiyoyi marasa ƙarfi ga kowane abokin cinikin TLS a kan na'urar, daga burauza a taga na gaba zuwa mai sarrafa fakiti da ke sabunta kernel.

Wannan faɗin shi ne dukan manufar kuma dukan matsalar. LEGACY ya shafi dukan host, yana dawwama kuma ana manta da shi cikin sauƙi, don haka ya kamata ya zama matakin bincike ko keɓancewar da aka rubuta a kan ginin da ake sarrafawa, ba ya zama yanayin hutu na wurin aiki ba. Na ga ɗaya da ya zauna a LEGACY tsawon shekaru biyu saboda wata tashar cikin gida ɗaya tana buƙatar shi, kuma babu wanda ya iya cewa yaushe ya fara.

Debian da Ubuntu ba su da maɓalli ɗaya don wannan. Makamancin shi ne gyara ga /etc/ssl/openssl.cnf wanda ke saita MinProtocol mafi ƙasa da CipherString = DEFAULT@SECLEVEL=0 a sashen tsoffin tsarin. Iyaka ɗaya, fayil daban, ɗan sauƙin ɓacewa daga gani yayin haɓaka sigar.

Zaɓi 2: fayil ɗaya na saiti ga abokin ciniki ɗaya

Saitin OpenSSL na kowace tsari yana riƙe canjin cikin bishiyar tsari ɗaya, amma kawai idan an haɗa fayil ɗin yadda ɗakin karatu ke tsammani. Sunan sashe ssl_conf bai isa ba: OpenSSL yana karanta maɓallin matakin sama openssl_conf, yana binsa zuwa sashen farawa, sannan ya isa tsoffin SSL.

openssl_conf = openssl_init

[openssl_init]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.0
CipherString = DEFAULT@SECLEVEL=0

Nuna OPENSSL_CONF ga wannan fayil ɗin kuma ƙaddamar da abokin cinikin VPN ta hanyar nade da ke fitar da shi. Duk sauran abubuwa a kan host suna riƙe da manufar tsoho, kuma wannan ita ce sifar da ke da muhimmanci idan tambayar bin ka'ida ta zo. Tabbatar fayil ɗin yana aiki da gaske kafin ka zargi ƙofar: ya kamata OPENSSL_CONF=/path/to/file openssl ciphers -s -tls1 ya lissafa sirrin TLS 1.0, kuma sakamako mara kyau yana nufin sarkar ta karye kuma abokin ciniki ya riƙe tsoffin tsarin a shiru.

Fayil ɗin yana kula da siga. OpenSSL 1.1.1 da 3.x suna karɓar sunayen sashe ɗaya, amma yadda ake sarrafa umarni game da masu bayarwa ya canza a 3.x, don haka tabbatar da log ɗin abokin ciniki da musafaha na gwaji maimakon ɗauka cewa an karanta fayil ɗin. Kuskuren rubutu a sunan sashe yana gazawa a buɗe, kuma abokin ciniki yana amfani da tsoffin tsarin a shiru.

Iyakar ita ce ɗaukar nauyi. Duk abin da aka haɗa da GnuTLS ko NSS yana watsi da OPENSSL_CONF, haka ma duk wani tsarin taimako da abokin ciniki ya ƙaddamar ba tare da gado muhalli ba. Duba da ldd wace ɗakin karatun TLS binary ɗin ke haɗawa da ita kafin ka gina nade, domin amsar ita ce ke yanke shawarar ko wannan zaɓi yana wanzuwa kwata-kwata.

Zaɓi 3: VM ko kwantena da za a jefa

Ga ɗan kwangila da ke buga tsohuwar ƙofa ɗaya tsawon makonni biyu, VM ɗin da aka keɓe da manufar sassauci ita ce iyaka mafi tsabta fiye da wurin aiki. Tsohon fili da bayanan burauza na yau da kullum sun daina raba manufar kernel, kuma zubar da shi gogewa ne maimakon binciken audit.

Har yanzu na'ura ce mai hanyar sadarwa, don haka iyakance hanyar shigarta kuma ka nisanta ta daga burauzar gama gari. Kuɗin kulawa shine wani hoton da za a yi faci, wanda yake na gaske amma iyakance kuma a bayyane, sabanin tutar LEGACY da aka manta a kwamfutar hannu.

Abin da kwatancen ya bar maka

Zaɓi bisa tambayoyi uku: wa ke buƙatar tsohuwar yarjejeniya, har yaushe, kuma wa zai lura idan keɓancewar ta wuce dalilinta. Aiki ɗaya, mutum ɗaya, kwanaki kaɗan, suna nuni ga saitin kowace tsari. Dukan rundunar da ke bayan na'ura ɗaya tana nuni ga ita kanta ƙofar. Duk abin da ke buƙatar manufar LEGACY ta dindindin a kan host shi ne shawarar saye sanye da rigar fasaha.

Gyaran dawwama na na'urar ne: TLS 1.2 ko sabo, ƙungiya mai aƙalla 2048-bit, sirrin AEAD, da takardar shaida mai sa hannu na zamani. Nemi wannan canjin daga mai na'urar, sannan ka tabbatar da sigar da sirrin da aka tattauna a log ɗin abokin ciniki. Rubuta keɓancewar tare da host, ƙofar, yarjejeniyar da aka tattauna, mai yarda da ranar ƙarewa, domin rubutun shi ne ke hana wucin gadi zama tsoho.