L2TP: siginar mutuwa 15, NO_PROPOSAL_CHOSEN da rashin modp1024

Haɗin ka yana tsayawa, abokin ciniki yana fita, kuma layin ƙarshe a kan allo shine death_handler: Fatal signal 15 received. Wannan layin yana bayar da rahoton katsewa, ba dalili ba. Layi ɗaya baya a cikin log ɗin IPsec kusan koyaushe akwai NO_PROPOSAL_CHOSEN, kuma ma'auratan suna nuni ga mataki na 2 na musayar, inda ɓangarorin suke kwatanta zaɓin ɓoyewa da hash kuma su tsaya lokacin da ba su da wani abin da aka raba. Ba a aika da bayanan shiga a wannan matakin ba tukuna, don haka sake rubuta kalmar sirri ba zai iya canza sakamakon ba.

Abubuwa biyu ne yawanci ke ɓata wannan haɗuwa a kan abokin ciniki na Linux. Wataƙila daemon na gida ba ya aiwatar da ƙungiyar Diffie-Hellman da bayanin martaba ke nema kuma, ko kuma bayanin martaba yana ɗauke da shawara ta mataki na 1 a cikin filin mataki na 2. Dukansu suna barin shaida a cikin log, kuma babu ɗayansu matsalar asusu.

Abin da saƙonnin biyu suke faɗa a zahiri

IKE yana tattaunawa a matakai. Mataki na 1 yana gina tashar da aka kare kuma yana zaɓar algorithms ɗinsa; mataki na 2, SA ɗan yaro, yana ɗaukar zirga-zirga a ƙarƙashin wani saiti daban. NO_PROPOSAL_CHOSEN shine sanarwar da mai amsawa yake mayarwa lokacin da babu ɗaya daga cikin haɗe-haɗen da aka bayar da ya karɓu, kuma yana bayyana a matsayin [ HASH N(NO_PROP) ] a cikin musayar INFORMATIONAL.

Siginar 15 wani lamari ne daban: wani abu ya ce wa tsarin gida ya tsaya kuma mai sarrafawa ya rubuta shi. Lokacin da layukan biyu suka bayyana tare, tsari ne na sanadi, farko ƙi sannan kashewa.

Karanta tattaunawar kafin ka taɓa bayanan shiga

Ɗaga matakin log a inda daemon yake rubutu, sannan sake haɗawa yayin kallon fitarwa. A kan mai masaukin NetworkManager L2TP plugin ɗin yana ba da wannan matakin ga backend, kuma saƙonni suna shiga cikin journal ko fayil ɗin syslog na gargajiya dangane da rarraba. Kowanne daga waɗannan zai nuna musayar: journalctl -f -u NetworkManager | grep -Ei 'pluto|charon|no_prop|proposal' ko tail -f /var/log/syslog | grep -Ei 'pluto|charon|ike'.

Layin da yake ambaton pluto ya fito daga libreswan, charon daga strongSwan, kuma dukansu suna kwatanta yanayi ɗaya da kalmomi daban-daban. Siffar da ta cancanci nema ita ce wacce take ambaton ƙungiyar da ta ɓace, kamar algorithm 'modp1024' is not supported, domin tana mai da gazawa mara tabbas ta zama takamaimai.

Inda modp1024 ya tafi

Ƙungiyar Diffie-Hellman ta 2 tana da rauni sosai har rarraba da yawa sun daina haɗa ta cikin libreswan daga 3.30 zuwa gaba. Sa'an nan bayanin martaba da aka rubuta shekaru da suka wuce, ko aka ɗauko daga jagorar ƙofar da ke lissafin aes128-sha1-modp1024 kawai, yana neman wani abu daga daemon na gida wanda ba zai iya yi kwata-kwata ba. Sabbin gine-ginen NetworkManager-l2tp suna sa wannan sakamakon ya zama mai yiwuwa: daga 1.2.16 suna maye gurbin saitin da shawarwari irin na Windows 10 da iOS kuma suna watsi da modp1024 da zarar an gano libreswan. Ƙarshen gaba yawanci ba shi da laifi kuma har yanzu yana ba da ainihin ƙungiyar da ka saita.

Wannan rashin daidaituwa shine ke sa gazawar ta ji kamar bazuwar. Tsohon abokin ciniki yana haɗawa, irin wannan bayanin martaba a kwamfutar tafi-da-gidanka da aka sabunta ba ya, kuma saitin uwar garken bai taɓa motsi ba. Bambancin sigar ne ke yin lalacewar.

Gyara biyu da tasirin daban-daban

Gyaran mai arha shine daina tsayar da algorithms da hannu. Share filayen shawara biyu a cikin edita kuma bar plugin ɗin ya zaɓi saitin da ƙarshen nesa zai karɓa; idan ƙofar tana goyan bayan ƙungiyoyin zamani, tattaunawar ta kammala ba tare da ƙarin aiki ba.

Gyaran na biyu yana kiyaye tsohuwar ƙofar cikin isa ta hanyar shigar da strongSwan, wanda fakitinsa har yanzu suna aiwatar da ƙungiya ta 2 a yawancin rarrabawa. Wannan musanya daemon ne, don haka yana da farashi: tabbatar ko wasu ramuka a kan mai masaukin sun dogara da saitin libreswan kafin cire shi, kuma yi tsammanin ƙin SELinux tsakanin NetworkManager da strongSwan plugin a Fedora. Waɗannan ƙin suna bayyana a cikin log ɗin dubawa ba a cikin sawun IKE ba, wanda shine dalilin da yasa rami zai iya zama kamar ya lalace kai tsaye bayan nasarar shigarwa. Tsarin da ke aiki shine farko dnf install strongswan, sannan rpm -e libreswan.

Igiyoyin shawara da suka dace, da tarkon da ke kewaye da su

Lokacin da dole ne a cika filayen da hannu, mataki na 1 da mataki na 2 suna ɗaukar darajoji daban-daban. Ma'auratan da aka sani suna aiki da ƙarshen irin Meraki suna ba da aes128-sha1-modp1024 a mataki na 1 tare da 3des-sha1-modp1024 a bayansa, dukansu an rufe su da alamar motsin rai da ke sa saitin ya zama mai tsauri, don haka waɗannan shawarwarin kawai ake aikawa.

Sannan mataki na 2 yana ɗimaucewa zuwa aes128-sha1 da 3des-sha1 tare da wannan alamar mai tsauri kuma babu wani ƙari na Diffie-Hellman kwata-kwata. Layin mataki na 2 da ke ɗauke da -modp1024 darajar mataki na 1 ce a cikin filin da bai dace ba, kuma mai amsawa yana ƙi shi a kowane sake gwadawa. Kwafi wannan layin zuwa wani bayanin martaba na biyu kuma na biyun yana gazawa haka, kuma haka kuskuren rubutu ɗaya ke zama lamari ga dukan jirgin.

Wasu kurakurai suna sa wannan taga ta fito ba tare da kasancewa rashin daidaituwar shawara ba. A KDE ana iya lissafa nau'in L2TP tare da shigar da plugin yayin da kowace haɗi ke mutuwa nan take, domin editan haɗi da mataimakan lokacin aiki ana kawo su a matsayin fakiti daban. Masaukai marasa allo na iya sake amfani da bayanin martaba daga tebur mai aiki: kwafa shi daga /etc/NetworkManager/system-connections/, saita yanayin zuwa 600, sannan gudanar da nmcli con reload. Ɗaga shi da nmcli con up id work-l2tp, tunda siffar tsirara tana son UUID, kuma cire duk wani tsohon shigarwar ifname, in ba haka ba manaja yana amsa Could not find source connection yayin da komai ya yi daidai.

Ana iya adana maɓallin da aka raba tukuna a matsayin bayyanannen rubutu ko a matsayin 0s sannan base64; duk siffofin biyu suna aiki, amma darajar dole ta dace da ƙofar byte da byte, gami da sararin da ka kwafa tare da ita.