Rashin daidaiton takardar SSTP: sunan da ya kamata uwar garkenka ya gabatar

SSTP abokin ciniki na SSTP yana karɓar uwar garke ne kawai bayan tabbatarwar TLS ta yi nasara, kuma wannan duba na kwatanta suna, sarka da manufa. Sunan yana fitowa daga bayanin martabar haɗi, ba daga adireshin da ka sami damar yin ping ba kwatsam. Idan ɗaya daga cikin ukun bai daidaita ba, abokin ciniki yana ba da rahoton matsalar takarda kuma bai taɓa kaiwa ga neman shiga ba.

Sunan bayanin martaba ne ke ƙayyade abin da ake dubawa

SSTP yana gudanar da TLS a kan TCP 443, don haka abokin ciniki yana ɗabi'a kamar kowane abokin ciniki na TLS: yana ɗaukar sunan mai masaukai daga bayanin martaba, yana neman wannan sunan kuma yana kwatanta takardar da shi. Idan ka rubuta adireshin IP cikin bayanin martaba, kwatancen ya zama kwatancen adireshin IP, wanda yawancin takardun uwar garke ba sa cika shi.

Saboda haka gwajin burauza na iya yin nasara yayin da VPN ke kasawa, domin burauzar ta yi amfani da wani suna daban da na bayanin martaba. Irin wannan rarrabuwa tana bayyana sa'ad da DNS mai ɓangarorin biyu ya warware sunan mai masaukai na VPN zuwa adireshi na ciki yayin da burauzar ta isa wani na jama'a. Da farko ka daidaita bayanin martaba da sunan mai masaukai da aka rubuta, sannan ka kwatanta takardu. Duk wani abu da ka canza kafin haka hasashe ne.

Abin da takardar uwar garke dole ta ɗauka

Abokan ciniki na zamani suna kwatantawa da ƙarin sunayen madadin batun, don haka sunan mai masaukai dole ya kasance a can a matsayin shigarwar DNS. Sunan gama gari shi kaɗai bai isa ba ga tarin tabbatarwa na yau, kuma alamar wildcard tana rufe lakabi ɗaya maimakon kowace ƙaramin yanki da ka ƙirƙira. Takardu uku suna nuna iyakar: sunan daidai tare da manufa mara kyau yana tabbatar da asali sannan ya kasa gwajin manufa, sunan da manufa daidai tare da takardar tsaka-tsaki da ta ɓace sun kasa sarkar, kuma sunan da ya bayyana kawai a cikin sunan gama gari yana kasawa kafin ko ɗaya daga cikin waɗannan biyun ya zama da muhimmanci.

Takardar kuma tana buƙatar manufar tabbatar da uwar garke, ƙimar amfani da maɓalli mai faɗaɗawa da aka ambata a cikin ƙayyadaddun SSTP na Microsoft, wato serverAuth tare da mai gano abu 1.3.6.1.5.5.7.3.1. Amfani da maɓalli da sarka mai inganci suna cika saitin. Takardar da ke kan uwar garke, da aka bayar don sunan daidai amma don tabbatar da abokin ciniki kawai, har yanzu tana kasawa.

Duba sarkar da agogo kafin bayanan shiga

Kasawar lokaci da amincewa suna haifar da sakamakon gani ɗaya da rashin daidaiton suna, kuma duka biyun sun fi arha a gano su fiye da matsalar kalmar sirri. Duba agogon uwar garke da agogon abokin ciniki, sannan ka karanta sarkar kamar yadda abokin ciniki yake gani:

# from the client, or any host that runs openssl
openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts </dev/null 2>/dev/null | openssl x509 -noout -subject -dates -ext subjectAltName
openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -verify_return_error </dev/null
# on the Windows server that holds the SSTP listener
w32tm /query /status

Umarni na farko yana buga sunan, tagar inganci da sunayen madadin da abokin ciniki zai kwatanta da su. Na biyu yana ba da rahoton kurakuran tabbatarwa tare da sarkar kamar yadda aka gabatar, kuma a nan ne takardar tsaka-tsaki da ta ɓace ke bayyana. A Windows, tambayar sabis ɗin lokaci tana gaya maka ko ana gyara agogon ko kuwa ya karkata kawai.

CA na ciki yana ƙara wata sharaɗi: abokin ciniki dole ya amince da wannan CA. Sanya tushen ƙungiyar ta hanyar rarraba da aka amince da ita, ba daga shafin da ke ba da maye gurbin takarda ba, domin wannan shawarar ita ce dukan tsarin amincewa a ƙarami.

Tabbatar da uwar garke da tabbatar da mai amfani matakai ne jere da kasawa daban-daban. Kuskuren takarda yana nufin abokin ciniki bai taɓa amincewa da uwar garke ba, yayin da kalmar sirri da aka ƙi tana nufin ya amince da uwar garke kuma bayanan sun yi kuskure. Kashe tabbatar da takarda don kaiwa ga neman kalmar sirri yana cire tabbacin maimakon gyara shi. Domin tabbatar da sauran hanyar tana aiki, gwada sunan mai masaukai da tashar jiragen ruwa ɗaya daga abokin ciniki da ya riga ya amince da sarkar, kuma ka bar bayanin martabar da aka tura kamar yadda yake.

Gyara sunan ko takardar sannan a sake gwadawa

Sharaɗɗi uku ne ke ƙayyade gyaran. Idan sunan bayanin martaba ba daidai ba ne, gyara bayanin martaba ko ƙara sunan da ya ɓace cikin takardar. Idan sarkar ba ta cika ba, sanya takardar tsaka-tsaki kan uwar garke. Idan manufar ba daidai ba ce, sake bayarwa maimakon liƙa faci a kanta.

Bayan canjin, sake haɗawa da abokin cinikin da aka tallafa kuma tabbatar da neman shiga ya bayyana, sannan tashar ta tashi. Rubuta sunan mai masaukai da aka yi amfani da shi, mai bayarwa da ranar ƙarewa cikin tikitin. Wannan rikodin ne ke mai da sabuntawa ta gaba aikin da aka tsara maimakon wata katsewa, kuma yana nuna wa mutum na gaba wanne daga cikin sharaɗɗin ukun da ya karye da gaske.