tls-auth key-direction: 0 da 1 dole su bambanta, ba su dace ba
Da tls-auth ƙarshen biyu suna buƙatar alkibla daban-daban, 0 da 1, ko duka biyu su bar saitin. Wannan lambar ɗaya tana kasawa, kuma tls-crypt ba ya amfani da ita.
Wani gefen ramin yana sa hannu a tashar sarrafawa da ramin maɓalli da ɗayan gefen ba ya taɓa dubawa, kuma haɗin yana mutuwa da kuskuren tabbatarwa kafin a musanya ko takardar shaida ɗaya. Haka rashin daidaituwar alkibla a tls-auth yake kama, kuma tabbatacce ne: waɗannan fayiloli biyu ɗaya suna kasawa a kowane ƙoƙari, daga kowace cibiyar sadarwa. Babu abin da ke cikin rajista ya ambaci zaɓin da kuke nema, shi ya sa mutane suke sake gina maɓallai kuma suke sake fitar da takaddun shaida waɗanda ba su taɓa lalacewa ba. Maganin shi ne a mai da ƙarshen biyu masu cikawa, ko a bar duka biyu su kasance masu alkibla biyu, maimakon raunana tabbatarwa.
Kuskuren yana faruwa kafin takaddun shaida
Da tls-auth duka abokan haɗin gwiwa suna riƙe maɓallin da aka raba ɗaya kuma kowanne yana amfani da ɗaya daga cikin ramuka biyu da aka samo daga gare shi: rami ɗaya yana sa hannu a fakitin sarrafawa masu fita, ɗayan yana tabbatar da masu shiga. Alkibla 0 da alkibla 1 suna ba da waɗannan ayyuka a jere daban, don haka dole ma'auratan su kasance masu cikawa domin binciken HMAC su dace. Lokacin da aka juya rabon a gefe ɗaya, mai karɓa yana neman sa hannu a ramin da bai dace ba kuma ya ƙi fakitin. Zaman yana ƙare a nan, shi ya sa kuskuren ya shafi tabbatar da fakitin ba wani abu da ajiyar takardar shaida za ta haifar ba.
Tabbatacce yana da muhimmanci ga bincike, domin matsalar lokaci ko hanya tana barin alama daban: tsayawa lokaci-lokaci, alkibla ɗaya tana kasawa, ko zaman da ke mutuwa kawai a wata cibiyar sadarwa. Rashin daidaituwar alkibla yana kasawa a musafaha na farko kowane lokaci, kuma yana kasawa iri ɗaya a wata na'ura da ke ɗauke da waɗannan fayiloli biyu. Karanta rajistan a --verb 4 ka nemo fakitin farko da aka ƙi maimakon layin ƙarshe. Idan wannan ƙin ya faru kafin kowane musayar takardar shaida, maɓallin da aka raba da alkiblarsa su ne abubuwa biyu da suka cancanci dubawa.
| What you see | What it rules out | Next check |
|---|---|---|
| Authentication error before any certificate is sent | The data channel is irrelevant; the control channel never authenticated | Compare tls-auth and its direction on both ends |
| Certificate or handshake failure after the control channel authenticates | The shared key and its direction already agree | Check the CA, the certificate dates and the hostname |
| Session completes but throughput or cipher warnings appear | Direction was never the problem | Compare the data-channel cipher settings |
| Startup stops on an options error | The number itself is not the issue | Re-read the inline versus external directive syntax |
Inda lambar take
Jagorar OpenVPN 2.6 tana rubuta wurare biyu na alkibla: hujja ta biyu ta tls-auth idan maɓallin yana cikin fayil na kansa, da layin key-direction mai zaman kansa idan an saka maɓallin cikin bayanin martaba. Duka biyu suna saita ƙima ɗaya, don haka bayanin martaba ya kamata ya yi amfani da tsari ɗaya ko ɗayan, ba duka biyu ba. Barin shi ma zaɓi ne, kuma yana sanya duka abokan haɗin gwiwa cikin tsarin alkibla biyu wanda ke aiki idan babu gefen da ya ambaci alkibla. Abokan haɗin gwiwa biyu masu lambar ɗaya ba sa cikin wannan tsarin: kowanne yana tsammanin yin sa hannu a rami ɗaya da tabbatarwa a ɗayan, kuma duka biyu suna yin haka iri ɗaya.
# server.conf, external key tls-auth ta.key 0 # client.ovpn, external key tls-auth ta.key 1 # client.ovpn, inline key key-direction 1
Sigar da aka saka umarni ne a layinsa, ba sifa a kan alamar buɗe rumbun maɓalli ba, kuma ƙara hujja ga wannan alamar kuskure ne, ba canjin alkibla ba. Wurin ma yana da muhimmanci: umarnin yana wajen rumbun da yake nasa, don haka ƙimar da aka rubuta cikin rumbun ana karanta ta azaman kayan maɓalli. Kwafi tsarin da mai rarraba bayanin martaba ya yi niyya maimakon ƙirƙirar ma'aurata, domin bayanin martabar da ke aiki da uwar garken ɗaya wataƙila an riga an kwafa shi a ɗayan gefe.
Abin da zaɓin ya bar ba a taɓa ba
Ba ya ɓoye zirga-zirgar aikace-aikace. tls-auth yana sanya HMAC a kewayen fakitin tashar sarrafawa, yayin da tashar bayanai ke da kariya ta maɓallan zaman da aka tattauna yayin musafaha, don haka tambayar saurin wucewa ko sirri ba ta da alaƙa da lambar alkibla. Saitin kuma ba ya ƙara wani rufi na biyu, kuma wannan zato ne ke tura mutane neman dogon maɓalli.
Ba ya shafi tls-crypt ba, wata hanya ta tashar sarrafawa da take da zaɓuɗenta da sarrafa maɓalli nata, kuma ba ya faɗin komai game da asalin takardar shaidar kowane abokin haɗin gwiwa. Don haka daidaiton alkibla mai aiki yana tabbatar da cewa ƙarshen biyu sun yarda kan yadda za a tabbatar da tashar sarrafawa kawai, ba cewa an tabbatar da sarkar amincewa ba.
Daidaita ma'auratan, sannan sake haɗawa
Kwatanta tsarin biyu kafin canza ɗaya, domin gyaran gefen da ya riga ya yi daidai yana ninka aikin. Grep da ke ƙasa yana nuna wace hanya kowane fayil yake zaɓa; cikakken gudu yana nuna ko an tabbatar da tashar sarrafawa kwata-kwata. Ajiye duka fitarwa biyu, domin a iya kwatanta canji na gaba da yanayin da aka sani.
grep -n -E 'tls-auth|tls-crypt|key-direction' server.conf client.ovpn openvpn --config client.ovpn --verb 4 2>&1 | grep -i -E 'hmac|tls error|control channel'
Sake kunna duka abokan haɗin gwiwa bayan kowane canji, domin ana karanta waɗannan zaɓuɗin sau ɗaya a lokacin farawa kuma sake loda gefe ɗaya yana barin ma'auratan rashin daidaituwa har tsawon rayuwar tsohon zaman. Idan turawa a halin yanzu tana aiki ba tare da alkibla da aka saita ba, ƙara saitin a abokin haɗin gwiwa ɗaya yana sake haifar da kuskuren da kuka fara da shi; ko ku bar duka biyu ko ku saita duka biyu. Canza ƙarshe ɗaya a lokaci ɗaya kuma ajiye fayil ɗin da ya gabata, domin koma baya ya zama dawo da minti biyu ba sake ginawa ba.
Rubuta hanyar, fayil ɗin maɓalli da alkibla ga kowane ƙarshe a cikin bayanan turawa, domin in ba haka ba mutum na gaba zai karanta fayiloli biyu masu kama kuma ya ɗauka cewa lambobin ya kamata su dace da juna. Alkibla bayanin daidaitawa ne, ba haɓakar tsaro ba: tana raba alkiblolin tashar sarrafawa biyu kuma ba ta yin wani abu.