Kurakurai na TLS a kan VPN na kamfani kawai: gyara ma’ajiyar amana daidai

Ginin Go, shigar Composer da abokin ciniki na Python duk suna aiki a gida kuma duk suna gazawa a cikin VPN na kamfanin. Wannan tsari yana gaya muku game da hanyar, ba game da manhajar ba. Wani abu a kan ramin ya canza sarkar takardar shaida da tsarinku ke gani, ko ya sake saita musafaha kafin wata sarka ta iso kwata-kwata. Lalacewar biyu suna kama da juna a tashar kuma suna bukatar amsoshi daban-daban.

Saƙonni uku, hanyoyi uku

Kuskuren x509 certificate signed by unknown authority yana nufin an gina sarka kuma tushenta ya ɓace daga ma’ajiyar amana da wannan tsari ke amfani da ita. Kuskuren self-signed certificate in certificate chain yawanci yana nufin wakili na bincike ya amsa da takardar shaidarsa, wadda ita ce sarkar da muhallin tafiyarku ba ya gane ta. SSL EOF yayin musafaha yana nufin an rufe haɗin kafin a aika kowace takardar shaida mai amfani, kuma hakan na’urar tsaka-tsaki ce da ke ƙin ClientHello, ba matsalar amana ba kwata-kwata.

Ƙara tutar rashin tsaro yana sa duka saƙonni uku su ɓace yayin da satar ke nan a wurinta, kuma yana cire binciken da zai kama ainihin mai hari.

Nemo rukunin da tsarin ke karantawa da gaske

Tushen kamfanin da aka shigar a ma’ajiyar Windows yana gyara masu bincike da manhajojin .NET da ke duba ma’ajiyar tsarin. Ba ya yin komai ga gini da ke gudana a cikin kwano, wanda ke ɗauke da rukunin CA nasa, kuma ba ya yin komai ga tsarin Python da ke amfani da certifi ko tsarin Node da ke amfani da jerin nasa da aka haɗa. Go yana karanta tarin tsarin muhallin da babban fayil ɗin ke gudana a ciki, wato kwanon, ba kwamfutar tafi-da-gida ba. Don haka na’ura ɗaya tana samar da mai bincike mai aiki da kayan aikin gini da ke gazawa a lokaci guda.

Tambayi kayan aikin maimakon ɗauka. python3 -c "import ssl; print(ssl.get_default_verify_paths())" yana buga fayilolin da Python zai duba, kuma node -e "console.log(process.env.NODE_EXTRA_CA_CERTS)" yana nuna ko an riga an saita wani maye gurbi. Don kwano, gudanar da wannan binciken a cikin hoton, domin shi ne muhallin da ginin ke amfani da shi da gaske.

Shigar da tushe ɗaya a inda ginin ke gudana

Sami tushen bincike daga sashin IT a matsayin fayil ɗin PEM kuma tabbatar da sawun yatsansa ta wata hanya dabam kafin ka amince da shi. A kan hotunan da suka fito daga Debian, kwafa shi cikin /usr/local/share/ca-certificates/ ka gudanar da update-ca-certificates; hotunan iyalin RHEL suna amfani da update-ca-trust bayan an ajiye fayil ɗin cikin /etc/pki/ca-trust/source/anchors/. A cikin ginin kwano, ƙara waɗannan matakan kafin umarnin da ke gazawa domin a adana Layer ɗin a kan shigar da dogaro.

Don devcontainer na gida, haɗa PEM ɗin kuma gudanar da wannan umarnin sabuntawa a farkon maimakon toya shi cikin hoton sirri wanda babu wanda zai iya sake haifarwa. Kayan aikin da ke ɗauke da rukuninsu suna bukatar nasu maye gurbin da aka rubuta: pip yana da saitunan takardar shaida, npm yana da saitunan cafile, kuma yawancin sauran suna karɓar masu canza muhalli na yau da kullum.

Wannan ba daidai yake da karɓar kowace takardar shaida ba. Kana ƙara wani tushe na musamman, wanda ka samu daga ɓangaren da ke yin binciken, zuwa wani muhalli, kuma tabbatarwa tana nan a kunne ga kowace sarkar. Rubuta wane fayil aka ƙara da kuma lokacin da zai ƙare, domin ana sabunta tushen bincike kamar kowace CA.

Lokacin da musafaha ya mutu kafin takardar shaida

Idan ba a gabatar da komai ba, wani canji a ma’ajiyar amana ba zai taimaka ba. Kwatanta wannan buƙatar da ramin a buɗe da a rufe, sannan duba sarkar kai tsaye da openssl s_client -connect host:443 -servername host -showcerts. Haɗin da ya cika a wajen VPN kuma ya sake saitawa a ciki shawara ce ta manufa daga na’urar tsaka-tsaki, kuma maganin ita ce keɓancewa ga wannan mai masaukin ba wata takardar shaida ba. Nemi a bar rijistar fakiti ko ƙarshen API ya wuce ba tare da canji ba.

Raba ramin domin kayan aikin ya tsallake VPN yana guje wa bincike ga wannan zirga-zirga, wanda zai iya saba wa manufa kuma ba ya sa kayan aikin amintacce.

Rubuta sakamakon ga kowane kayan aiki

Takaitaccen rubutu da ke lissafin babban fayil ɗin, fayil ɗin amana da yake karantawa, mai canza muhallin da ke cikin wasa da keɓancewar da aka amince da ita yana ceton mutum na gaba duk binciken. Riƙe rubutun ga kowane kayan aiki maimakon kowace kwamfutar tafi-da-gida, domin kwamfutar ba safai take zama abin da ya canza ba.

Kuma riƙe jimloli biyu daban a cikin tikitin: mun shigar da wani tushen kamfani na musamman, kuma mun kashe tabbatarwa. Ɗaya ne kawai daga cikinsu aikin tallafi.