Sabbin takardar shaidar VPN: wasu abokan ciniki har yanzu suna ƙin ta

Rabin cibiyar suna sake haɗawa bayan sabuntawar kuma na’urori uku sun ƙi, kowanne da gargaɗi game da asalin ƙofa. Sabuntawar kanta aikin yau da kullum ne. Abin da waɗannan na’urori uku ke riƙe pin ne ga tsohon abin, kuma pin ba jerin CA ba ne, ba duban suna ba, ba shigarwa cikin ajiyar amincewa ba. Kwatanta hanyoyin uku kafin taɓa kowane abokin ciniki.

Sabuntawa ɗaya, halaye biyu

Abokan cinikin da suka sake haɗawa suna da shawarar amincewa da har yanzu ta wuce, waɗanda suka ƙi kuma suna da buƙata da sabuwar takardar ba ta cika. Wannan bambanci bayani ne, ba hayaniya ba. Karanta saƙon abokin cinikin da ya kasa daidai. Rashin daidaiton suna, mawallafi da ba a sani ba da hoton yatsa da ya canza hukunci uku ne daban-daban, kuma na ƙarshe kaɗai ke nuni ga pin.

Har ila yau duba wane bayanin martaba abokin cinikin da ya kasa ya zaɓa. Kwafin da aka shigo da shi da ke zaune a cikin ajiyarsa ba ya canzawa lokacin da mai gudanarwa ya gyara ainihin fayil ɗin a wani wuri.

Sabuntawa tana maye gurbin abin, ba kwanan wata kaɗai ba

Hoton yatsa yana gano abin da ke cikin takardar da aka ɓoye. Sabuntawa tana samar da sabuwar takarda, don haka hoton yatsa yana canzawa ko da sunan batun da maɓallin jama’a sun kasance iri ɗaya. Wannan abin tsammani ne kuma mara lahani ga abokan cinikin da suka amince da CA kuma suka tabbatar da sunan. Yana da mutuwa ga abokin cinikin da aka saita don karɓar takarda ɗaya daidai, kuma yana da mutuwa ga abokin cinikin da ajiyar amincewarsa ba ta taɓa samun sabon mawallafi ba.

openssl x509 -in server.pem -noout -subject -issuer -dates -fingerprint -sha256
openssl x509 -in server.pem -noout -pubkey | openssl sha256

Layin na biyu yana amsa wata tambaya dabam: shin maɓallin ma’aurata ya tsira. Sabuntawar da ta sake amfani da maɓallin tana riƙe wannan darajar kuma tana canza takardar kawai, wanda shine daidai yanayin da mai gudanarwa ke jaraba ya ɗauka cewa babu abin da ya canza. Bincika takardar da aka tura, ba wadda ke kan kwamfutar ginin ba. Kwatanta fayil a cikin ajiya yana tabbatar da abin da aka ƙirƙira, ba abin da mai sauraro ke gabatarwa yanzu ba.

Karanta abin da abokin ciniki ke pin

Wasu abokan ciniki suna riƙe hoton yatsa a cikin bayanin martabarsu kuma suna kwatanta shi a kowace haɗi. Wasu suna ajiye shi a cikin ajiyar amincewar dandamali, wasu kuma suna dogara da CA kawai. Gyaran ya bambanta a kowane yanayi, don haka fara gano hanyar.

grep -n 'peer-fingerprint' /etc/openvpn/client/*.conf
openssl s_client -connect gw.lab.example.net:443 -servername gw.lab.example.net < /dev/null 2>&1 | openssl x509 -noout -fingerprint -sha256

Umarni na farko yana nuna pin a cikin bayanin martaba na al’ada; na biyu yana nuna hoton yatsan da ƙarshen ke bayarwa a haƙiƙa yanzu. Lokacin da waɗannan biyu suka bambanta, kun gano gazawar ba tare da yin hasashe ba. Kada ku liƙa sabuwar darajar a cikin kowane abokin ciniki da ke ƙorafi. Abokin cinikin da ya ƙi saboda mawallafi zai ci gaba da ƙi, kuma za ku koya wa kanku cewa hoton yatsa shine matsalar alhali ba haka ba.

Kwatanta takardar da kowanne backend ke bayarwa

Sakamakon lokaci-lokaci yawanci yana nufin fiye da ƙarshen ɗaya, kuma sabuntawar da aka yi wa node ɗaya tana barin sauran suna gabatar da tsohon abin. Kwatanta kowanne backend da adireshi maimakon sunan da aka raba.

for h in 10.30.0.11 10.30.0.12; do echo "$h"; openssl s_client -connect $h:443 -servername gw.lab.example.net < /dev/null 2>&1 | openssl x509 -noout -subject -dates -fingerprint -sha256; done

Tafki da node ɗaya ya koma baya yana bayanin abokin cinikin da ke haɗawa a ƙoƙari na biyu kuma ya kasa a na farko. Har ila yau yana bayanin duban sa ido da ke wucewa yayin da masu amfani ke ƙorafi. Fara gyara koma baya. Juya kan tsarin amincewa kafin kowanne node ya bayar da sabuwar takardar yana haifar da taga da babu abin da ke aiki a ciki, kuma juya bayan haka yana barin abokan ciniki suna kasa ba zato ba.

Canza amincewa ta hanyar da ake gudanarwa

Tabbatar da maye gurbin ta tashar gudanarwa da aka amince da ita tuni kafin karɓe shi a ko’ina. Kwanan ƙarewa mai yiwuwa ba hujjar mallaka ba ce. Sabunta tsarin da ake gudanarwa ta hanyar da ke mallake shi, tare da duk wani shiri na haɗuwar asali da aka yarda da su, kuma ka riƙe tabbatar da sunan da turawa ke buƙata. Pin ba tare da duban suna ba ƙarancin ƙira ne fiye da amincewar CA da ya maye gurbinsa.

Sannan tabbatar da kowane abokin ciniki: haɗa, tabbatar da asalin da ya karɓa, kuma lura da sigar takardar da yake amincewa da ita yanzu. Gargaɗin da aka watsar sau ɗaya yana da hanyar dawowa a sabuntawa ta gaba.