Yadda ake ƙirƙirar maɓallin abokin ciniki na VPN da aika CSR don sa hannu

Ba da jimawa ba, mai amfani da VPN zai ba da shawarar aika maɓallin sirri ta imel domin mai gudanarwa ya yi takardar shaida, kuma wannan shawara ce ya kamata a ƙi. Hanyar da ke aiki tana riƙe maɓallin a wurin abokin ciniki tun daga umarnin farko: abokin ciniki yana ƙirƙirar shi, yana aika buƙatar sa hannu kan takardar shaida, mai bayarwa yana tabbatarwa kuma yana ba da izini, kuma takardar shaidar da aka sa hannu tana dawowa ta zauna kusa da maɓallin da ya ƙirƙire ta. Jerin dubawa da ke ƙasa yana gazawa a rufe a kowane mataki, kuma wannan shi ne batun, domin biyu daga cikin matakai biyar su ne waɗanda mutane ke tsallakewa sa'ad da suke gaggawa.

Mataki 1: ƙirƙiri maɓallin a inda zai rayu

Ƙirƙira a kan injin da zai riƙe maɓallin, kuma ka bar shi a can. Maɓallin software yana shiga fayil mai tsauraran izini; maɓallin da kayan aiki ke goyan bayansa ko kuma a cikin ajiya mai kulawa ba ya zama fayil kwata-kwata, kuma hanyar yin rajistarsa yawanci kayan aiki ne daban maimakon umarnin OpenSSL. Ko yaya, babu wanda yake buƙatar ganin rabin sirri.

Hanyar software tana kama da wannan, ana ƙirƙirar maɓallin da buƙatar a zama ɗaya:

umask 077
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out client.key
openssl req -new -key client.key -out client.csr -subj "/CN=alice-vpn/O=Example"

Layin umask yana da muhimmanci fiye da yadda yake gani. Idan babu shi ana rubuta maɓallin a yanayin da kowa zai iya karantawa a tsarin da ke ba da izini ta tsohuwa, kuma kwafin fayil ɗin daga baya yana yada hakan. Sake amfani da maɓallin da ke akwai ya halatta idan an riga an kare shi kuma ya dace da manufofinka; ƙirƙirar sabo ga kowace na'ura ya fi sauƙin bayani.

Mataki 2: saka ainihi a cikin buƙatar, ba a cikin imel ba

Yanke shawara kan abin da VPN ke tabbatarwa da gaske kafin a ƙirƙiri buƙatar, domin wannan amsar tana cikin CSR. OpenVPN a al'ada yana ɗaure ainihin abokin ciniki da sunan gama gari na takardar shaida, kuma kayan aiki kamar strongSwan suna daidaita igiyar ainihi da batun ko sunan madadin batun. Imel da ya ce sunana alice ba hujja ba ne, kuma buƙatar da batunta ya faɗi haka ya fi ɗan kyau kawai.

Ƙara sunan madadin batun lokacin da mai tabbatarwa naka yake duba ɗaya, domin daidaitawa ta zamani tana yawan yin watsi da tsohon CN:

openssl req -new -key client.key -out client.csr \
  -subj "/CN=alice-vpn/O=Example" \
  -addext "subjectAltName=DNS:alice-vpn"

Riƙe CN gajere, tsayayye kuma an ɗaure shi da asusu maimakon samfurin kwamfutar tafi-da-gidanka. Sunan da ke ɗauke da lambar serial na na'urar mai amfani matsala ce ta tallafi da ke jiran maye gurbin kayan aiki na farko.

Mataki 3: tabbatar da buƙatar kafin ka sa hannu

Mai bayarwa yana tabbatar da abubuwa biyu daban-daban, kuma haɗa su shi ne kuskuren gargajiya. Na farko, cewa buƙatar tana da daidaito a ciki: ana tabbatar da sa hannun da maɓallin jama'a da yake ɗauka. Na biyu, cewa mai nema yana da hakkin abin da buƙatar ke nema, kuma babu wani bincike na sirri da zai iya amsa hakan.

Sashin inji umarni ɗaya ne, kuma ya kamata ya buga sakamakon tabbatarwa tare da batun:

openssl req -in client.csr -noout -verify -subject
openssl req -in client.csr -noout -pubkey | openssl pkey -pubin -noout -text

Ka lura da abin da hakan ke tabbatarwa. Buƙatar da aka tabbatar tana nuna kawai cewa mai aikawa yana da maɓallin sirri mai dacewa a lokacin aikawa; ba ta tabbatar da cewa mai aikawa shine mutumin da aka ambata a cikin batun ba, kuma ba ta ba da izinin shiga ƙungiyar ko hanyar da ake nema ba. Bitar yin rajista wata ƙofa ce daban, kuma buƙatar da ke neman ƙungiyar da babu wanda ya amince da ita ya kamata a ƙi ta maimakon a gyara ta a hankali.

Mataki 4: ba da izini, sannan ka sa hannu da ƙarin bayani bayyananne

Sa hannu shi ne inda CA ke yanke shawara kan manufa maimakon karɓar buƙatar da baki ɗaya. Inganci, amfani da maɓalli da ƙarin bayanin rawar suna cikin fayil ɗin ƙarin bayani, ba a cikin tsoffin saiti waɗanda ba za ka tuna bayan wata shida ba. Takardar shaidar abokin ciniki don tabbatar da VPN tana buƙatar tabbatar da abokin ciniki a matsayin manufarta.

cat > client.ext <<'EOF'
basicConstraints = CA:FALSE
keyUsage = digitalSignature
extendedKeyUsage = clientAuth
EOF
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
  -CAcreateserial -days 365 -extfile client.ext -out client.crt

Yi amfani da -CAserial tare da fayil ɗin serial da ke akwai idan an riga ana amfani da ɗaya, kuma ka ajiye maɓallin CA a wajen layi ko a cikin ajiyar da aka kare da manufofinka ya ambata. Lambobin serial na takardar shaida dole ne su zama na musamman ga kowane mai bayarwa; sake ƙirƙirar fayil ɗin serial daga farko yana haɗarin rikice-rikice waɗanda ke sa soke ya zama marar tabbas.

Yi rikodin abin da aka bayar: serial, batun, ainihin da aka nema, mutumin da ya amince, da lokacin ƙarewa. Wannan rikodin shi ne abin da shawarar soke ta dogara da shi daga baya, kuma ba za a iya sake gina shi daga takardar shaida kaɗai ba idan alamar yin rajista tana rayuwa a cikin akwatin wasiƙa kawai.

Mataki 5: shigar da shi kusa da maɓallin da ya dace kuma ka tabbatar da ma'auratan

Abokin ciniki yana karɓar takardar shaidar da sarkar mai bayarwa, ba maɓalli ba har abada. Kafin haɗawa, tabbatar da cewa takardar shaidar tana haɗuwa da maɓallin da ke kan faifai, domin ma'auratan da ba su dace ba suna haifar da gazawar musafaha mai rikicewa da yawa daga baya:

openssl x509 -in client.crt -noout -pubkey | openssl pkey -pubin -outform DER | openssl sha256
openssl pkey -in client.key -pubout -outform DER | openssl sha256

Digests biyu dole ne su dace. Sannan ka haɗa kuma ka tabbatar da cewa ainihin da uwar garken ke rubutawa shine wanda ka ba da izini, ba kawai cewa ramin ya tashi ba. Idan maɓallin ya ɓace ko an maye gurbin na'urar, amsar ita ce soke da sabon buƙata daga sabuwar na'urar; neman mai gudanarwa ya mayar da maɓalli daga wani wuri ba ya dawo da ainihin kuma yana karya samfurin da ya sa buƙatar ta kasance lafiya a hankali.