Kuskure ɗaya, sirri uku: wane bayanin shiga VPN ya kasa?
Abokin ciniki yana nuna kuskure ɗaya ga kowane mataki. Karanta haɗin kai, musayar mai amfani da hanyar kafin sake saita kalmar wucewa da babu wanda ya bincika.
«Tabbatarwa ta kasa» na iya nuna takardar shaidar uwar garke, maɓallin da aka riga aka raba na na’ura ko kalmar wucewar mai amfani. Wanne ne ake nufi ya dogara da ladabi, domin kowane ladabi yana bayyana wani tsari na sirri daban. Sake saita wanda bai dace ba kuma kuskuren zai ci gaba ba canzawa. Hanyar fita ita ce a tabbatar da adadin hujjojin da ladabin yake buƙata kafin a gyara wani abu.
Hujjoji biyu a kan hanyoyi saɓani
Tunnel dole ne ya amsa ko ya isa ƙofar da ta dace, kuma a rabe, wanene mai amfani. Hujjar ƙofar tana kan matakin na’ura: takardar shaidar uwar garke, maɓallin da aka riga aka raba ko maɓallin jama’a na tsaye. Hujjar mai amfani tana kan matakin mutum: kalmar wucewa, alama, takardar shaidar abokin ciniki, ko babu komai. Waɗannan hanyoyi ne saɓani na amincewa kuma suna cinye kayan daban.
IKEv2 yana yin hujjar ƙofar a cikin IKE_AUTH kuma, idan an yi amfani da EAP, yana gudanar da hujjar mai amfani a wata musayar dabam daga baya. takardar ƙa’idar IKEv2 tana riƙe waɗannan a matsayin sashe dabam, wanda shine babban alama game da inda za a duba idan saƙo ɗaya ya rufe zagaye biyu.
Karanta matakin, ba saƙon ba
Abokin ciniki yana nuna zaren kuskure ɗaya ko wanene matakin da ya kasa, don haka zaren kansa ba ya ɗauke da kusan wani bayani. Abin da ke ɗauke da bayani shine yanayin da za ka iya bincika a kowane mataki: ko akwai haɗin kai, ko an fara musayar mai amfani, kuma ko abokin ciniki ya ba da hanyar da ƙofar ke so. Jadawalin yana tsara matakan haka maimakon da sunan ladabi.
| Stage that failed | Evidence you can inspect | What a password change cannot fix |
|---|---|---|
| The machine proof | no security association in the state list | a mismatched pre-shared key or an untrusted chain |
| The user proof | an association is up while PPP or EAP reports failure | an expired token, a locked account, a missing client key |
| The client's method support | the client offers no method the gateway accepts | a client without the required EAP or key material |
| The server's policy | the gateway rejects before any user exchange starts | a policy that requires a certificate the profile lacks |
Layi na biyu ne kawai ya shafi bayanin shiga da mai amfani zai iya sake bugawa. Sauran ukun abubuwan tsari ne, kuma wannan rashin daidaituwa shine dalilin da yasa yawancin irin waɗannan rahotannin ke ƙarewa da sake saita kalmar wucewa da ba ta canza komai. Karanta layin da ya dace da hujjarka kafin ka taɓa filin.
Ladabi mai sirri biyu yana nuna katunansa
L2TP a kan IPsec yana sa lissafin a bayyane, domin binciken biyu suna faruwa a tsare-tsare daban. Dole ne Layer IPsec ya fara tashi da maɓallin da aka riga aka raba ko takardar shaida, sannan PPP a cikinsa ya yi ƙoƙarin shiga mai amfani.
Idan sirrin na’urar ba daidai ba, babu haɗin kai da zai samu kuma ba a taɓa gwada bayanin shiga na mai amfani ba. Idan sirrin na’urar daidai ne kuma sirrin mai amfani ba daidai ba, haɗin kai yana nan kuma PPP na watsi da shiga bayan tunnel ya riga ya tashi. Dukansu suna fitar da saƙo ɗaya a kan allo daga al’amuran biyu daban.
sudo swanctl --list-sas
sudo ip xfrm state list
sudo journalctl -u xl2tpd -n 50 --no-pagerJerin haɗin kai mara komai yana cire matakin mai amfani nan take, don haka duba shi kafin kalmar wucewa. Haɗin kai da aka kafa tare da gazawar PPP mai maimaitawa yana nuni ga wancan gefen, ga matakin mai amfani ko ga ladabin tabbatarwa a cikinsa. Babu ɗaya daga cikin waɗannan kammaloli da ake samu daga rubutun kuskuren abokin ciniki.
Menene shiga da kalmar wucewa kawai ya dogara da shi a zahiri
Shiga da kalmar wucewa kawai abu ne na yau da kullum ga L2TP, PPTP, SSTP da IKEv2 tare da EAP. WireGuard ba shi da irin wannan zaɓi kwata-kwata, domin abokan haɗinsa maɓallai ne ba masu amfani ba. Ga OpenVPN amsar ta fito ne daga buƙatar takardar shaidar abokin ciniki na uwar garke: ƙofar da ke neman duka takardar shaida da kalmar wucewa za ta ci gaba da watsi da abokin ciniki mai kalmar wucewa kawai, komai abin da aka buga a filin.
Wane ɓangare kake buƙata ya biyo daga wannan amsa. Shiga da kalmar wucewa a ƙarƙashin IKEv2 yana buƙatar abokin ciniki da ke magana EAP, yayin da shiga da takardar shaida ke buƙatar maɓallin sirri na abokin ciniki da sarkar uwar garke. Saka wanda bai dace ba kuma gazawar tana karantawa kamar kuskuren bayanin shiga ko da kuwa hanyar tabbatar da ita ce ta ɓace.
Canza abu ɗaya, sannan sake gwadawa
Fara tabbatar da abubuwa uku: wane ladabi ke gudana, sirri nawa yake bayyanawa, kuma waɗanne ne na na’ura maimakon mai amfani. Na’urori suna kasa a mataki na farko kuma mutane suna kasa a na biyu, kuma rikita biyun shine duk wannan matsalar.
Sannan canza abu ɗaya daidai kuma sake gwadawa daga abokin ciniki ɗaya. Wannan horon yana mayar da gazawa mai ruɗani zuwa gyara da za ka iya bayyana wa mutum na gaba, wanda ya fi amfani fiye da haɗin da ke aiki wanda babu wanda zai iya bayyanawa.