Yadda za a cire tsohon takardar shaidar VPN daga ma'ajiyar amana

An cire abokin ciniki na VPN, bayanin martaba ya ɓace daga Saituna, kuma rami yana fitowa da tsoffin takaddun shaidar shiga. Ko ka share shi, ka sake yi, ka same shi a safiyar gobe. Babu ɗaya daga cikinsu da ya zama lalacewar maɓallin sharewa. Bayanin martaba shine tsari; takardar shaida ita ce kayan maɓalli tare da shawarar amana da aka rubuta a cikin ma'aji da bayanin martaba kawai yake nunawa. Wanne daga cikinsu kake riƙe shine zai ƙayyade abin da 'cirewa' zai nufa.

Bayanin martaba ba takardar shaida ba ce

Anaye kiran abubuwa uku daban-daban 'takardar shaidar' a cikin tsarin VPN. Ainihin abokin ciniki shine takardar shaidar ganye da ke da maɓalli na sirri, kuma ƙofa tana amfani da ita don yanke shawarar wanene kai. Ganyen uwar garken da kansa da na tsakiya sune abin da abokin cinikinka ke dubawa lokacin da ya haɗu. Anga na amana, yawanci tushe ko takardar shaidar CA ta sirri, ita ce ke sa sarkar ta zama mai iya tabbatarwa kwata-kwata. RFC 5280 yana kiran waɗannan anga na amana, na tsakiya da ƙarshen mahaluƙi, kuma sarkar tana inganta ne kawai muddin kowane mahaɗi yana rattaba hannu kan wanda ke ƙasa.

Share ainihi sai na'ura ɗaya ta rasa shiga. Share anga sai kowace aikace-aikacen da ke tabbatarwa da wannan ma'aji ta rasa ikon duba duk wani abu da aka bayar a ƙarƙashinsa, gami da haɗin kai da ba su da wata alaƙa da VPN. Wannan rashin daidaito shine duk haɗarin a nan: tushen da aka sanya don ƙofa ɗaya sau da yawa shine tushen da ke rattaba hannu kan tashar ciki, uwar garken wasiƙa ko madubin fakiti. Ka tuna wanne daga cikinsu kake riƙe.

Mallaka ce ke yanke shawarar ko sharewar za ta kasance a share. A kan kwamfutar tafi-da-gidanka da ka mallaka, kai kaɗai ne za ka iya mayar da takardar shaidar. A kan na'ura da ake sarrafawa, bayanin martabar tsari ko MDM na iya sake sanya shi a lokacin dubawa na gaba, wanda shine dalilin da yasa yake 'dawowa' kuma dalilin da yasa ƙara ƙarfi wajen sharewa ba ya taimakawa.

Nemo wanne ma'aji har yanzu yana riƙe da shi

Mutane suna farawa daga aikace-aikacen Saituna, wanda shine kawai wurin da ba a adana takardar shaida. Wuraren ainihi sune ma'ajiyar amana ta OS, ma'ajin mai bincike da kansa da ma'ajin sirri na aikace-aikacen.

Daidaita da lambar jerin ko sawun yatsa, ba da sunan nuni ba. Sunan nuni wanda ya bayar da takardar shaidar ne ke saita shi kuma ana sake amfani da su: 'Example VPN' na iya zama takaddun shaida uku da maɓallai uku daban-daban, ɗaya har yanzu ana amfani da shi kullum.

certutil -user -store My
certutil -store Root
openssl x509 -in vpn-client.pem -noout -subject -issuer -serial -fingerprint -sha256

A macOS kayan aikin security yana ba da gaskiya ɗaya, kuma find-identity yana nuna waɗanne takaddun shaida har yanzu suna da maɓalli na sirri a haɗe:

security find-certificate -a -c "Example VPN" -Z /Library/Keychains/System.keychain
security find-identity -v -p ssl-client

Share ƙaramin abu, ka riƙe mai bayarwa na tarayya

Fitar da shi kafin ka share. Ba tare da ajiya ba, hanyar dawo da ita kaɗai ita ce sake bayarwa, wanda a kan CA ta sirri yana nufin komawa wurin wanda ke tafiyar da PKI. PFX da aka fitar shi ma shine abin da kake miƙa idan cirewar ta zama shawara mara kyau.

certutil -user -exportPFX -p backup My <serial> C:\temp\vpn-id.pfx
certutil -user -delstore My <serial>
Remove-Item Cert:\CurrentUser\My<thumbprint>

Alamar -user ita ce mutane ke barin ta bisa kuskure. Idan babu ita certutil yana aiki a ma'ajin na'ura a maimakon haka, wanda ke nufin shell da aka ɗaukaka, wani rukunin takaddun shaida daban da kuma faɗin tasiri wanda yanzu ya ƙunshi kowane wani asusu a kan na'urar.

A macOS da Linux siffar ɗaya ce: gano, fitar da shi, sannan cire daga mafi ƙarancin ma'ajin da ke bayyana alamar. Cire fayil ɗin da ke ƙarƙashin /usr/local/share/ca-certificates da sake gudanar da update-ca-certificates ya isa; --fresh yana taimakawa ne kawai idan hanyoyin alama a cikin /etc/ssl/certs sun riga sun yi rashin daidaituwa. Tsarin dangin RHEL suna ajiye anga a cikin /etc/pki/ca-trust/source/anchors, inda trust anchor --remove ke yin aiki ɗaya.

sudo security delete-certificate -Z <sha1> /Library/Keychains/System.keychain
sudo rm /usr/local/share/ca-certificates/example-vpn.crt
sudo update-ca-certificates
sudo trust anchor --remove /etc/pki/ca-trust/source/anchors/example-vpn.crt

Kafin ka share takardar shaidar CA, duba abin da kuma ke sarƙaƙƙiya da ita. Jerin batutuwan da ke cikin tarin dubawa ne na layi biyu kuma yana amsa ko wannan angar tana yin wani aiki:

openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout | grep -i example

Share fayil ɗin ba soke ainihi ba ne

Sharewa na gida yana cire kwafi ɗaya. Maɓallin sirri na iya kasancewa a cikin p12 da ke haɗe da tsohon tikit, babban fayil ɗin ajiya ko kwamfutar tafi-da-gidanka ta biyu da aka saita lokaci ɗaya. Idan wannan ainihin abokin ciniki ne, ƙofar tana ci gaba da karɓar kowane kwafin wannan maɓalli har sai an ƙi ainihin a gefen uwar garke.

Don OpenVPN PKI, wannan yana nufin soke takardar shaidar da tabbatar da cewa CRL da crl-verify ke magana da ita ta kasance ta yanzu; easyrsa revoke sannan easyrsa gen-crl shine gajeren sigar. Don ƙofar da ke da alaƙa da mai bayar da ainihi, kashe mai amfani ko cire na'urar a can, domin takardar shaidar ɗaya ce kawai daga cikin takaddun shiga da ke cikin wasa. Share kwafin gida yayin da asusun ya kasance a kunne yana kama da tsaftacewa kuma ba haka ba ne.

Aikin abin da ya faru yana da wani tsari: fara adana takardar shaidar, lambar jerinta da rikodin sokewa, sannan share kuma ka soke. Waɗannan rikodin ba su kashe komai kuma ba sa buƙatar barin takardar shiga mai aiki a wurin.

Tabbatar da musayar hannu da aikace-aikace na biyu

Duba sarkar daga waje, ba daga jerin ma'ajin da ka gyara yanzu ba. Ma'ajin yana nuna gyaran ka; musayar hannu tana nuna sakamakon.

openssl s_client -connect vpn.example.com:443 -servername vpn.example.com \
  -CAfile /etc/ssl/certs/ca-certificates.crt -verify_return_error < /dev/null
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt vpn-gateway.pem

Lambar dawo da 0 tana nufin sauran anga har yanzu suna tabbatar da ƙofar. Kuskuren sarkar bayan cire anga shine sakamakon da ake tsammani, kuma yana tabbatar ka bugi angar da ake amfani da ita ba kwafin da ke cikin ma'ajin da abokin ciniki bai taɓa karantawa ba. Idan haɗin yana aiki har yanzu, nemi kwafi na biyu, ma'ajin da aka haɗa cikin aikace-aikacen ko takardar shaida da aka liƙa, duk sun zama ruwan dare a cikin abokan ciniki da ke kawo nasu jerin amana.

Sannan gwada wani abu mara alaƙa: shafi na ciki, abokin cinikin wasiƙa, madubin fakiti. Wannan yana auna faɗin tasiri cikin sauƙi kafin taga canjin ya rufe.

• An gano rawar a matsayin ainihi, na tsakiya ko anga na amana
• An rubuta lambar jerin da sawun yatsa, kuma an fitar da kwafin zuwa wurin da aka amince
• An yi sharewa a mafi ƙarancin iyaka da ke bayyana alamar
• An soke izini a gefen uwar garke lokacin da mutum ko na'ura ya tafi
• An bayyana musayar hannu, kuma an sake gwada aikace-aikace ɗaya mara alaƙa
• An sabunta MDM payload ko bayanin martabar gudanarwa, in ba haka ba takardar shaidar za ta dawo

Idan takardar shaidar ta dawo bayan sake yi, aikin bai ƙare ba: wani abu ya mallake ta kuma yana sake sanya ta. Nemo wannan mai shi kafin ka sake sharewa, domin sharewa ta uku za ta yi daidai kamar biyun farko.