SSTP ya karɓi tashar 443: me ya sa Apache ba ya tashi

Apache yana daina amsa a kan 443 a ranar da wani ya kunna hanyoyin haɗin VPN masu shigowa, kuma littafin kurakurai nasa yana zargin bind maimakon ajiyar da ke bayansa. Windows Routing and Remote Access yana kunna SSTP a wannan lokacin, kuma mai sauraren SSTP yana neman TCP 443 ta hanyar HTTP stack kafin kowane abokin ciniki ya tabbatar da kansa. Da’awar tana nan daram ko da takardar shaida ba ta nan, sunan ba daidai ba ne, ko kowace handshake an ƙi ta, don haka VPN da babu wanda zai iya shiga cikinsa har yanzu yana riƙe da tashar. Karanta teburin saurare da farko; PID da ya mallaki 443 shi ne ke yanke shawarar wanne daga cikin gyare-gyaren da ke ƙasa ya buɗe a gare ka.

Ajiyar tana rayuwa bayan takardar shaida ta lalace

SSTP yana naɗe PPP cikin zaman TLS, shi ya sa yake buƙatar 443 kuma shi ya sa yake wucewa ta proxies da ke watsar da sauran tunnels. Mai saurare ba socket ba ne da sabis ɗin VPN ke buɗewa wa kansa: SstpSvc yana yi masa rijista a wurin direban HTTP na kernel, don haka tashar tana zama ajiyayye muddin sabis ɗin yana gudana. Wannan rijistar ba ta taɓa tuntuɓar takardar shaida ba, wanda ke nufin sunan da ya ƙare, subject da bai dace ba, ko babu takardar shaida kwata-kwata suna barin 443 a mallake. Sai gazawa ta rabu biyu: handshakes da aka ƙi suna shiga littafin System ƙarƙashin RasSstp, yayin da uwar garken yanar gizo zai iya kawai ya ba da labarin cewa ya kasa yin bind.

netstat -aon | findstr :443
tasklist /svc /fi "PID eq <pid>"

Layi na farko yana mayar da PID mai mallaka; na biyu yana ambaton sabis ɗin da ke bayansa, kuma amsar yawanci sabis ɗin HTTP ne ko tarin RRAS. Lokacin da tasklist ya amsa da tsarin mai masaukin baki da aka raba, karanta ginshiƙin sabis maimakon yin hasashe daga sunan tsarin.

Gargaɗin RasSstp sun cancanci karatu bayan haka kawai, domin suna bayanin handshake da ya gaza kuma ba su ce komai game da ajiyar da ta haifar da karo ba. Ƙarshen VPN da ke ƙin kowane abokin ciniki har yanzu yana mallakar tashar. Ɗauki littafin a matsayin tambaya ta biyu, ba ta farko ba.

IIS yana raba direba, Apache yana buɗe socket

IIS yana miƙa bindings ɗinsa ga direban kernel ɗaya da SSTP ke amfani da shi, kuma wannan direban yana raba haɗin da ke shigowa bisa sunan mai masauki da prefix ɗin URL, don haka ana iya gaya wa duka sabis ɗin su so 443 ba tare da ɗayansu ya gaza ba. Apache da nginx suna yin akasin haka: suna kiran bind a kan socket ɗinsu, kuma tsarin aiki ya ƙi saboda an riga an mallaki adireshin. Babu abin da ba daidai ba a kowane ɗayan saitin; bambancin yana cikin wane API ne ke mallakar tashar. Shi ya sa kuma kunna VPN ke rushe shafi ɗaya a kan wani mai masauki kuma ya bar shafi makamancin haka a kan wani mai masauki ba tare da lalacewa ba.

Wannan rashin daidaito shi ne ke yanke fasalin gyaran. Idan IIS ya riga ya zama ƙofar gaba, karon ya zama tambaya game da prefixes, bindings da takardun shaida. Idan Apache ne ƙofar gaba, ko shi ya ƙaura daga 443 ko mai sauraren SSTP ya yi haka, kuma sashe na gaba ya ƙunshi duka matakan.

Zaɓi wane sabis ne zai riƙe 443

Tashar mai saurare tana rayuwa a cikin ƙima ɗaya ta rijista, DWORD na ƙididdigar goma ƙarƙashin maɓallin sigogin Sstpsvc. Canza ƙimar, sake kunna Routing and Remote Access, kuma tabbatar daga teburin saurare cewa tsohuwar tashar ta yi sako-sako.

reg query "HKLM\SYSTEM\CurrentControlSet\Services\Sstpsvc\Parameters" /v ListenerPort
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Sstpsvc\Parameters" /v ListenerPort /t REG_DWORD /d 4443 /f
Restart-Service RemoteAccess

Zaɓi tashar da babu wani abu a kan mai masaukin da yake so, kuma rubuta ta a ƙididdigar goma: reg add yana ajiye DWORD ɗin daidai yadda aka rubuta shi, don haka ƙimar da aka yi nufin hexadecimal ta sauka a matsayin wata tashar dabam. Idan tambayar ta ce ƙimar ba ta wanzu, layi na biyu yana ƙirƙirar ta. Restart-Service RemoteAccess yana fitar da duk wanda ke da alaƙa, abin da ya cancanci tsarawa. Sake gudanar da gwajin saurare bayan haka, domin wani tsohon shigarwa a kan 443 yana nufin sabis ɗin ya riƙe tsohuwar rijistarsa.

Matsar da mai saurare yana ɗauke da farashi da gyaran rijista ba ya nunawa. Talakawan abokan cinikin SSTP suna kira 443, don haka kowane bayanin martabar abokin ciniki yana buƙatar sabuwar tashar, kuma kwarara ta daina kama da buƙatar yanar gizo ga duk abin da ke duba hanyar. A kan hanyar sadarwa da ke jure wa zirga-zirgar da ke kama da HTTPS kawai, hakan yana kawar da mafi yawan dalilin da aka zaɓi SSTP. Ƙaramin yawan abokan ciniki da ake sarrafawa yana karɓar hakan; tushen masu amfani na jama’a ko BYOD ba ya karɓa.

Ɗayan matakin yana riƙe 443 tare da IIS kuma yana ɗaukar Apache a matsayin backend da proxy ke turawa zuwa gare shi. Yana kiyaye tsohuwar ƙimar SSTP kuma yana barin mai mallaka ɗaya ga tashar, a farashin kawunan da aka tura gaba, adireshin abokin ciniki da aikace-aikacen ba ya ganinsa kai tsaye kuma, da backend wanda dole ya yi magana da ka’idar da proxy ke aikawa da gaske.

Tabbatar da mai mallaka, takardar shaida da handshake bisa tsari

Haɗin TCP da aka kammala yana tabbatar da cewa akwai mai saurare kuma babu wani abu, shi ya sa binciken tashar zai iya kamanceceniya da lafiya yayin da tunnel ɗin har yanzu yana gaza. Matakan huɗu suna gazawa ta hanyoyi dabam, kuma gyaran da aka nufa ga matakin da ba ka karya ba yawanci yana zurfafa karon. Yi aiki da su bisa tsari kuma tsaya inda amsar ta rabu.

netstat -aon | findstr :443
certutil -store My
Get-WinEvent -LogName System -ProviderName RasSstp -MaxEvents 20

Layi na farko yana ambaton PID da ke riƙe 443, kuma ya kamata ya zama sabis ɗin da ka riga ka daidaita. Na biyu yana jera takardun shaidar na’ura tare da subjects ɗinsu, don haka sunan da bai dace da adireshin da ke cikin bayanin martabar abokin ciniki ba yana fitowa nan take. Tambayar abubuwan da suka faru tana mayar da sabbin rikodin SSTP, kuma handshake da ba ya taɓa kaiwa ga tabbatarwar PPP yana barin rikodi dabam da wanda aka tabbatar sannan aka ƙi. Mataki na ƙarshe ana iya gani ne kawai a wurin abokin ciniki, inda shigarwar ko ta ba da labarin an haɗa ko ta ambaci kuskuren PPP.

Lokacin da mai masauki ɗaya dole ya yi duka ayyukan biyu, zaɓi mai mallakar 443 da gangan kuma rubuta zaɓin, domin in ba haka ba mutumin da zai kunna wata fasali zai sake gano wannan karon. Raba ayyukan ya kasance amsa mafi tsabta: uwar garken yanar gizo na jama’a da ƙarshen hanyar shiga daga nesa suna ɗauke da dabam dabam na faci, takardar shaida da sake kunnawa, kuma waɗannan zagayowar suna haɗuwa bisa nasu jadawalin. Ko ta yaya, bar gwajin saurare, hanyar rijista da zaɓaɓɓiyar tashar a cikin takardar miƙa mulki.