Visual Studio yana jinkiri a VPN kawai? Duba CRL da OCSP

Visual Studio yana farawa da al'ada a gida, sannan kwamfutar tafi-da-gidanka ɗaya ta shiga ramin kamfanin kuma kowace ƙaddamarwa tana tsayawa rabin minti a allon farko. Cire manufar kuma jinkirin yana tafiya tare da ita; cire ramin kuma abu ɗaya ke faruwa. Duk abubuwan lura biyu daidai ne, shi ya sa sassan biyu suke zargin juna. Tambayar da za ta yanke hukunci ita ce ko tambayar soke takardar shaida tana jiran hanyar da rami kaɗai ke bayarwa, ko kuma ba ta samun wata kwata-kwata.

Auna ɗebo, ba ƙaddamarwa ba

Wata manufar WDAC, wadda aka tura a matsayin SiPolicy.p7b da aka sanya hannu, tana yanke shawara kan wane hoto ne zai iya gudana a na'urar. Ingantaccen lambar yana tabbatar da sarkar sa hannu ta hoto kafin aiwatarwa, kuma wannan tabbaci na iya haɗawa da tambaya kan sokewa. Amsar ta dogara ne da wurin rarraba CRL ko mai amsa OCSP da takardar shaidar ta ambata a cikinta.

Waɗannan buƙatun cibiyar sadarwa ne na yau da kullum, don haka kuɗinsu ya dogara da inda mai amsa yake. Lokacin da za a iya isa gare shi ta rami kaɗai, ko ana warware sunansa ta hanyar uwar garken DNS da ke bayan ramin kawai, tabbacin yana jira har ramin ya shirya. Visual Studio yana lodawa a lokacin farawa adadi mai yawa na manyan kundaye da kari da aka sanya hannu, kuma ɗan jinkiri a kowane hoto yana zama tsayawa da ake gani. Babu abin da ya lalace kuma manufar tana aiki daidai yadda aka daidaita ta, shi ya sa cire manufar yake kama da gyara matsalar.

Kowane hoto da aka sanya hannu na iya haifar da kiran cibiyar sadarwa

Fara da fayil ɗin binary da aka sanya hannu wanda yake riga a faifai kuma ka nemi dandamali ya tabbatar da shi da halin ɗebo ɗaya da ƙaddamarwa ke amfani da shi. Gudanar da umarnin sau ɗaya a ramin da sau ɗaya a wajensa, sannan ka kwatanta layukan ɗebo maimakon hukunci na ƙarshe.

certutil -verify -urlfetch C:\Tools\Contoso.Editor.dll
nslookup ocsp.contoso.example
Test-NetConnection ocsp.contoso.example -Port 80

Fitowar tana lissafa sarkar, adiresoshin CRL da OCSP da kuma ko kowane ɗebo ya yi nasara. Mai amsa da lokacinsa ya ƙare a ramin kuma ya amsa a wajensa shine shaidar da kake buƙata, kuma tana da nauyi fiye da tunanin jinkiri. Idan ɗebon ya yi nasara a hankali, rubuta adireshin domin mataki na gaba ya gwada wannan mai masaukin kai tsaye.

Warware sunan mai masaukin mai amsa ka gwada isarsa a wajen aikace-aikacen, domin sunan da ba ya warwarewa ba wani saitin abokin ciniki zai gyara shi. Rikodin aiki na CodeIntegrity yana bayar da rabin shaidar, yana haɗa abin da ya faru na tabbaci da tambarin lokacin jinkirin ƙaddamarwa.

Rage jinkirin ba tare da cire kulawa ba

Kashe manufar ko mayar da ita yanayin dubawa yana kawar da jinkirin kuma yana cire kulawar da ƙungiyar ta tura, don haka ɗauke shi a matsayin gyaran da bai dace ba. Ƙananan zaɓuɓɓuka sune canjin hanya domin a iya isa mai amsa ta ramin, keɓancewa a cikin rabon ramin ga masu masaukin mai amsa, gyaran DNS lokacin da sunan ya warware zuwa adireshin da ba za a iya isa ba, ko wakili mai adana bayanai da aka goyi bayan ga bayanan sokewa. Kowanne yana da mai shi daban: ƙungiyar PKI ce ke da isar mai amsa, ƙungiyar cibiyar sadarwa ce ke da rabon ramin, kuma ƙungiyar ƙarshen hanya ce ke da manufar.

Keɓe kowane mai masaukin sokewa daga ramin ba aminci ba ne kai tsaye, domin mai amsa na ciki na iya zama na ciki da gangan. Tabbatar da keɓancewar tare da ƙungiyar da ke tafiyar da PKI kafin ka rubuta ƙa'ida da ke aika binciken takardar shaida a hankali zuwa intanet na jama'a. Canjin da aka yi ba tare da wannan tabbaci ba shine irin wanda ake mayar da shi a sabunta manufa na gaba.

Tabbatar da farawa mai sanyi bayan canjin

Auna farawa mai sanyi a duka yanayi biyu ka adana lambobin, domin farawa mai dumi ba ya tabbatar da kusan komai da zarar an adana manyan kundaye a ajiya. Maimaita ƙaddamarwar daga sabon zama domin hanyar loda kari ta sake aiki.

Get-WinEvent -LogName Microsoft-Windows-CodeIntegrity/Operational -MaxEvents 40 |
  Where-Object { $_.TimeCreated -gt (Get-Date).AddMinutes(-10) }
Get-ChildItem C:\Windows\System32\CodeIntegrity\CiPolicies\Active
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

Daidaitaccen tsari da aka gyara yana ci gaba da tuntuɓar mai amsa, ko yana amfani da hanyar ajiya da ƙungiyar PKI ta amince da ita, kuma rikodin yana nuna tabbacin yana kammalawa maimakon lokacinsa ya ƙare. Tabbatar cewa aikace-aikacen da aka sanya hannu kwanan nan yana farawa har yanzu, domin manufar da ke ba da izini ga komai ba gyara mai nasara ba ce. Duba babban fayil ɗin manufar da ke aiki da yanayin aiwatarwa, domin a san cewa manufar da kake gyara ita ce ke gudana. Riƙe sarkar takardar shaida, adireshin mai amsa da tambarin lokacin ƙaddamarwa a cikin tikit ɗaya, domin sabuntawa yakan motsa mai amsa kuma ya bar ƙa'idar keɓancewa ko DNS ta tsufa.