Sabuntawar Ubuntu ta karya L2TP/IPsec? Kwatanta shawarwarin IKEv1

Haɗin yana aiki ranar Alhamis, sabuntawar ta gudana ranar Juma'a, kuma ranar Litinin abokin ciniki yana juyawa a “connecting” sannan ya daina. Kwamfuta ɗaya, uwar garke ɗaya, asusu ɗaya, maɓalli ɗaya da aka raba tun farko. Babu abin da aka gyara a cikin furofil, shi ya sa waɗanda ake zargi a fili, kalmar sirri da firewall, suke ɓata maka lokaci.

Abin da ya canza shi ne jerin sauye-sauyen da injinka ke shirye ya bayar. Duk manyan IPsec guda biyu da ake amfani da su a Ubuntu, strongSwan da Libreswan, suna cire algorithms da ba su ƙara ganin su lafiya ba, kuma plugin ɗin NetworkManager da ke gabansu yana da nasa jerin da ke motsawa bisa wani tsari daban. Uwar garke da aka ɗaure a kan 3DES, SHA1 da rukunin Diffie-Hellman na bit 1024 na iya ƙarshe rashin jin wani abu da take karɓa.

Abin da sabuntawar ta canza a zahiri

Yadudduka biyu ne ke ciyar da shawarar IKEv1. Daemon ɗin yana kawo saitin shawarwari na asali da aka haɗa a ciki, kuma plugin ɗin L2TP ko ya dogara da shi ko ya bayar da nasa jerin. Kafin NetworkManager-l2tp 1.2.16 plugin ɗin yana dogara da shi, don haka shawararka ita ce abin da daemon ɗin da aka girka ya ga ya dace. Daga 1.2.16 zuwa gaba plugin ɗin yana aika jerin da aka rubuta wanda aka tsara bisa abokan cinikin Windows da Apple, kuma wannan jerin ya fi tsohon asali faɗi amma ba ya ƙara ɗauke da kowane tsohon haɗi a gaban layi.

Wannan rabuwa yana bayanin yanayin gazawa da mutane ke ganin yana da ruɗani: injuna biyu a kan fitowar Ubuntu ɗaya na iya yin daban domin ɗaya yana da fakitin rarraba kuma ɗayan yana da backport, kuma sigar daemon ɗin a dukansu tana kama a cikin rahoton kuskure. Duba sigar plugin ɗin, ba sigar daemon ɗin kawai ba, kafin ka kammala cewa sabuntawar ba ta canza wani abu mai muhimmanci ba.

Akwai ƙaramin tarko a wannan yanki. Daemon ɗin biyu suna rubuta rukunin Diffie-Hellman na lanƙwan elliptical daban, ɗaya yana rubuta ecp384 ɗayan kuma ecp_384. Liƙa kuskuren rubutun a cikin maganganun Advanced kuma daemon ɗin zai ƙi saitin a matsayin wanda ba za a iya nazari ba, wanda ke bayyana a cikin log a matsayin matsalar tattaunawa maimakon kuskuren rubutu a cikin tsari.

Karanta gazawar kafin ka canza wani abu

Fara da wanne backend kake gudanarwa, domin amsar ita ce ke ƙayyade duka syntax da wurin log ɗin.

ipsec --version
nmcli connection show "Your VPN name" | grep -i ipsec

Sa'an nan karanta musayar da kanta. A strongSwan daemon ɗin yana rubuta zuwa journal a fitowar yanzu kuma zuwa /var/log/syslog a wacce ta tsufa, kuma abin sha'awa shi ne shawarar da yake aikawa, ba layin ƙarshe ba. Kana neman kalmomi game da babu shawarar da ta dace, wanda matsala ce ta algorithm; gazawar tabbatarwa, wanda ke nuna maɓalli ko asusu; ko lokacin jira kawai, wanda ke nuna isarwa.

Ana ɗaukar waɗannan sakamako uku a matsayin alama ɗaya sau da yawa. Lokacin jira tare da log daemon mara komai yana nufin fakitin ba sa isowa. Ƙin shawarar yana nufin sun iso kuma an ƙi su. Idan log ɗinka ya yi shiru, ɗaga matakin debug na plugin ɗin don gwaji ɗaya sannan ka saukar da shi bayan, domin fitarwar dalla-dalla tana cika journal da sauri.

Mataki na 1 da mataki na 2 jifa ne daban

IKEv1 yana yin shawarwari sau biyu. Babban yanayi yana gina haɗin tsaro na IKE daga algorithm ɗin ɓoyewa, algorithm ɗin cikakke, rukunin Diffie-Hellman da hanyar tabbatarwa. Yanayin sauri sai ya gina haɗin ESP wanda zai ɗauki L2TP. Uwar garke tana da 'yanci ta karɓi na farko kuma ta ƙi na biyu, don haka furofil ɗin da ya yi daidai rabi yana gazawa bayan da ka yi tsammani kuma yana kama da wani kuskure daban.

Phase 1: 3des-sha1-modp1024!
Phase 2: 3des-sha1!

Alamar mamaki ita ce syntax ɗin strongSwan don shigarwa mai tsauri: bayar da wannan haɗi ɗaya kuma babu wani abu. Ba tare da ita shigarwar tana shiga jerin ajiya, wanda yake da kyau idan abokin gaba na zamani ne kuma yana da illa idan na'ura ce da manufa ɗaya da aka ƙulla a code. Ɗauki biyun da ke sama a matsayin misalin siffa, ba shawara ba ga duk abin da kake ginawa yau.

Canza fili ɗaya, sannan sake gwajin

A kan plugin na yanzu, gwajin farko mafi sauri shi ne share duka filayen shawara gaba ɗaya sannan ka sake haɗawa, domin jerin asali da aka kawo ya riga ya haɗa da haɗin Windows da Apple na yau da kullum. A kan tsohon plugin, share su yana mayar da iko ga daemon wanda wataƙila ya watsar da algorithm ɗin da uwar garkenka ke nacewa da shi, kuma gazawar tana ƙara muni.

Idan sharewar ba ta taimaka ba, saita tsauraran biyun da uwar garkenka ya rubuta, mataki ɗaya a lokaci. Canza mataki na 1, sake haɗawa, ka karanta log ɗin kafin ka taɓa mataki na 2. Lokacin da haɗi ya yi aiki daga ƙarshe, rubuta shi kusa da samfurin uwar garke da sigar plugin ɗin, domin asalin zai sake motsawa kuma wannan rubutun ne ke mai da sabuntawa na gaba dubawa na minti biyar.