Bayanan martaba da aka kulle da sabar yana gazawa a bayan wakili TLS: wace ƙarni?
Access Server 2.8 da 2.9 suna gina bayanan martaba da aka kulle da sabar ta hanyoyi daban-daban. Yanke shawara wace hanya wakilinka ke karya kafin ka canza gaban.
Wani mai amfani zai iya haɗawa wani kuma ba zai iya ba, ta hanyar tashar yanar gizo ɗaya, a rana ɗaya. Dukansu suna da bayanan martaba da aka kulle da sabar, dukansu suna kan ginin Access Server ɗaya, kuma bambanci ɗaya kawai shi ne lokacin da aka ƙirƙiri bayanansu. Wannan shi ne tsarin da ya kamata a gane, domin "an kulle da sabar" yana nomi manufa ce ba tsarin haɗawa ba. Access Server ya aika ƙarnoni biyu na wannan kayan aiki, kuma wakilin juye-juye na TLS yana gaban ɗaya daga hanyoyinsu kawai. Sharuɗɗa uku ne ke ƙayyade wace reshe kake ciki.
Ƙarnoni biyu, tsarin haɗawa biyu
A tsohuwar ƙira, wadda take aiki har zuwa 2.8, fayil ɗin da aka shigo da shi bayanin martaba ne na ƙarya. OpenVPN Connect yana amfani da shi don tabbatar da kansa a gaban API na yanar gizo na Access Server ta HTTPS, yana samun bayanin martaba na wucin gadi da aka kulle da mai amfani da alamar zama, sannan ya kafa VPN. Hanyoyin jigila biyu suna aiki a jere, kuma na farko buƙatar yanar gizo ce ta yau da kullum.
Tsarin da aka gabatar da 2.9 ba ya yin wannan farkon farawa ga kowace haɗawa. Bayanin martaba ne na asali wanda OpenVPN abokan ciniki masu dacewa za su iya amfani da shi, ba OpenVPN Connect kaɗai ba. Zazzage shi ko shigo da shi ta URL na iya har yanzu haɗa HTTPS — wannan matakin wallafawa ne, ba ɗebo bayanin martaba na wucin gadi ga kowace haɗawa ba.
| Older server-locked (≤2.8) | Newer server-locked (2.9+) | |
|---|---|---|
| Before the tunnel | Web API call with credentials | Nothing; the profile is already local |
| Client requirement | OpenVPN Connect | Any compatible client |
| What a TLS web proxy can break | The bootstrap, before any VPN attempt | Download only, not the connection |
| Expected HTTP log on connect | A request from the client | Often nothing at all |
Haɓakawa ba lalle ya sake rubuta bayanan martaban da aka riga aka bayar ba, don haka sigar sabar ta yanzu na iya har yanzu rarraba tsohon kayan aikin. Ginin sabar yana gaya maka abin da zai yiwu, ba abin da wannan mai amfani ya shigo da shi ba.
Sharuɗɗa uku da ke zaɓar reshenka
Sharaɗi na farko shi ne ƙarnin kayan aikin. Nemi fayil ɗin, duba yadda aka ƙirƙire shi, ka rubuta sigar abokin ciniki da ya shigo da shi. Idan ba za ka iya tabbatar da ƙarni daga fayil ɗin ba, sabon bayanin martaba da aka bayar ga asusun gwaji zai gaya maka abin da sabar ke samarwa a yau, wanda ya bambanta da abin da mai amfani da ke gazawa yake da shi.
Na biyu shi ne abin da gabanka ke ƙarewa da gaske. Wakilin juye-juye na HTTP na mataki na bakwai da ke sauke TLS ba shi ne abu ɗaya da mai tura TCP na mataki na huɗu ba, kuma mai tura UDP ma ba haka yake ba. Tsarin da Access Server ya saba a tashar 443 yana sa daemon na OpenVPN TCP ya gane zirga-zirgar burauza ya ba da ita ga ayyukan yanar gizo, don haka saka wani mai ƙarewa HTTPS mara alaƙa a gaba ba ya kiyaye sarrafa ka'idar wannan daemon. Raba lambar 443 ba ya mai da ƙira biyu daidai.
Na uku shi ne inda gazawar ke faɗuwa. Gazawar kafin VPN da gazawar tashar sarrafawa suna kama da juna a abokin ciniki da ke cewa "ana haɗawa" kawai, amma suna barin shaida a wurare daban-daban. Idan tsohon tsari yana aiki, farkon farawa ɗan takara ne. Idan sabon tsari yana aiki, log ɗin shiga yanar gizo mara komai abin tsammani ne kuma ba ya tabbatar da komai a kowane gefe.
Lokacin da kayan aikin ya tsufa: farkon farawa ne ke gazawa da farko
Karanta ainihin kuskuren abokin ciniki maimakon yanayinsa na ƙarshe. Filayen da suka fi muhimmanci su ne kuskuren HTTPS, asalin sabar da abokin ciniki ya yi tsammani, inda buƙatar ta je, da ko tabbatar da takardar shaidar ya kammala. Sannan ka kwatanta su da log ɗin ayyukan yanar gizo da wakili a gefen sabar.
Burauzan da ya isa shafin shiga ba shaida ba ne cewa tabbatar da API na wannan abokin ciniki ya yi nasara. Buƙatu daban-daban ne, da tsammanin takardar shaidar daban da kuma sunayen masauki daban. Idan ana ba da tashar daidai kuma abokin ciniki har yanzu yana gazawa, sabanin yana cikin hanyar farkon farawa, ba a cikin kalmar sirrin mai amfani ba.
Kada ka sa kwatancen ya wuce ta hanyar kashe tabbatar da TLS ko sassauta manufar tabbatarwa. Wannan yana mai da sabanin tsarin da za a iya gano shi zuwa hanya mai aiki amma ba a tabbatar da ita ba, kuma wannan canjin ne daidai yake mai da gwajin wucin gadi rami na dindindin. Takardun Access Server kan bayanan martabar haɗawa sun bayyana ƙarnoni biyun da tsarin bayanin martaba na wucin gadi, kuma ita ce hanyar da za a duba kafin a ɗauka cewa wakili ne ke da laifi.
Lokacin da kayan aikin sabo ne: karanta tashar sarrafawa maimakon
Da bayanin martaba irin na 2.9, abokin ciniki yana tafiya kai tsaye zuwa ƙarshen ƙarshen VPN na asali. Bincika ƙarshen ƙarshe a cikin bayanin martaba, jigilar da ake amfani da ita, da kuskuren tashar sarrafawa. Idan abokin ciniki bai taɓa fitar da buƙatar HTTP ba, wannan ya dace da ƙirar kuma ba alama ba ce.
A nan ma tambayar wakili ta canza siffa. Sauke HTTPS ba zai iya karya kwararar TCP kawai da ba ya taɓa gani ba, amma har yanzu zai iya karya zazzagewar da ke wallafa bayanin martaba, kuma mai tura TCP kawai ba zai ɗauki UDP kwata-kwata ba. Duba wace jigila bayanin martabar ke nema kafin ka yanke shawarar cewa gaban ba shi da mahimmanci.
Wucewar TLS ga kwarara ɗaya tsari ne mai kunkuntar. Ba ya samar da tura UDP, kuma ba ya sake haifar da halin tura ayyukan daemon da kansa a kan 443. Idan gabanka yana yin ɗaya daga waɗannan, faɗi wanne, domin maganin ya bambanta.
Magungunan da suka tsaya a kunkuntar
Bincike mafi ƙarancin tsoma baki shi ne ƙirƙirar sabon bayanin martaba mai goyan baya ga asusun gwaji da haɗawa ta ƙarshen ƙarshen asali da aka yi niyya da ma'auni ɗaya na tabbatarwa. Idan wannan ya yi aiki kuma tsohon bayanin martabar da aka ajiye bai yi aiki ba, ka raba kayan aikin daga sabar da daga wakili a mataki ɗaya.
Rarraba bayanin martaba da aka kulle da mai amfani yana kawar da dogaro da farkon farawa na gado gaba ɗaya, domin babu musayar bayanin martaba na wucin gadi da zai iya gazawa. Dole ne a bayar da shi ga mai amfanin da aka yi niyya, ba a taɓa kwafa shi daga mai gudanarwa ba, kuma yana canza abin da abokin ciniki ya sami izini ya yi, don haka ɗauke shi a matsayin shawarar manufa ba mafita ta wucin gadi ba.
Sannan gyara shimfidar wallafawa domin kowace hanya da ake buƙata ta kasance: hanyar yanar gizo don zazzagewa da amfani da tasha, da hanyar VPN ta asali a kan jigilar da bayanan martaba ke tsammani. Riƙe aikin wakili a mataki ɗaya. Ramin da ya yi aiki kuma aka kulle da mai amfani yana tabbatar da cewa wannan hanyar tana aiki; ba ya tabbatar da kowane tsarin wakili yana goyan bayan kowace ƙarni, kuma gazawar farkon farawa ta tsohuwa ba ta la'antar sabon tsarin ba.
- Gano ƙarnin kayan aikin kafin ka taɓa wakilin.
- Tabbatar ko gazawar tana faruwa kafin ramin ko a cikinsa.
- Tabbatar da abin da gaban ke ƙarewa: HTTP, kwararar TCP, ko UDP.
- Gwada sabon bayanin martaba da aka bayar a gaban ƙarshen ƙarshen asali ba tare da canza manufa ba.