Hayso CA-da xididka VPN-kaaga offline oo wali soo saar shahaadooyin

VPN-kaagu wuxuu ka jawaabaa xiriirada 3-da habeenimo halka mashiinka saxeexa shahaadooyinkiisa uu ku xiran yahay dhaqan. Macmiilka hubiya shahaadada server-ka marnaba lama xiriiro CA-daada, misa CA uma baahna inuu heli karo xiriir kasta. Qaybta u baahan qorsheynu waa maalinta shahaadada lagu soo saarayo, cusboonaysiin ama la tirtirayo iyada oo furaha xididku xiran yahay.

Waxa xiriirku dhab ahaan hubiyo

Marka macmiilka OpenVPN uu xiriiro, wuxuu maraa silsiladda saxeexa ee shahaadada blaydhka server-ka ilaa shahaadada CA uu horey u aaminsanaa, hubiyaa waqtiga ansaxnimada oo, haddii profile-ku sidaas yiraahdo, eegaa liiska tirtirka. Marnaba ma raadiyo CA-daada xididka. Server-ku wuxuu u sameeyaa shahaadooyinka macmiilka sida muraayad. Waqtiga xiriirka waxaa jira oo kaliya blaydhka, dhexdhexaadka iyo xirmada kalsoonida aad horey u qaybisay.

Waxa dhab ahaan guuldarraysta waa mid ka mid ah saddex arrimood: furaha saxeexa lama heli karo waqtiga soo saarista, liis tirtirku wuu duugoobay, ama xirmada kalsoonida macmiilku way ka duugan tahay silsiladda uu server-ku soo bandhigo. Ta koowaad waa dhibaato habraac; labada kale waa dhibaatooyin qaybinta. Midna ma dalbanayo in furaha xididku online yahay, adeegga VPN la maareeyo oo u baahan shahaado gaar ah aqoonsiga tunnel-ka wuxuu kaliya u rarayaa awoodda saxeexa bixiyaha. Azure dhibic-ilaa-goob ayaa ka shaqeeya gegida: waxaad soo gelisaa shahaado xidid ah oo shahaadooyinka hoos laga saxeexay waa la aaminaa, marka weydii yaa saxeexa, yaa hubiya iyo sida shahaado loo laabo goor hore.

Ka dhis xididka martigeliyaha aan marnaba ciwaan helin

Xididka offline waa lagu arkaa marar yar: si loo saxeexo shahaadada CA dhexdhexaadka ah iyo markii dambe in la cusboonaysiiyo ama la tirtiro. Wax kasta oo kale waxay dhacaan hal heer hoose. Samee shaqada xididka mashiin ka fog shabakadda, haddii suurtogal ah nidaam nool, oo qor cidda qolka joogtay. Amarrada waxay u malaynayaan OpenSSL 1.1.1 ama ka cusub, sababtoo ah -addext kama jiro dhismayaasha hore.

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out root.key
openssl req -x509 -new -key root.key -sha256 -days 7300 \
  -subj "/CN=Example VPN Root CA" -out root.crt \
  -addext "basicConstraints=critical,CA:TRUE" \
  -addext "keyUsage=critical,keyCertSign,cRLSign"

Ka abuur dhexdhexaadka martigeliyaha saxeexa oo kaliya codsigiisa u qaad mashiinka offline. Xididku wuxuu saxeexaa codsigaas dhererka waddo eber ah, marka CA dhexdhexaadku waxay saxeexi kartaa shahaadooyinka dhammaadka laakiin ma abuuri karto CA kale hoostiisa. Taas oo hal fidin ah waxay ka hortagtaa martigeliyaha saxeexa ee la waxyeelleeyay inuu abuuro awood la mid ah xididka. Isticmaal ECDSA kaliya haddii macmiil kastaa uu ku shaqeeyo OpenVPN 2.4 ama ka cusub; haddii kale abuur furayaasha RSA oo socodka isku mid ka dhig.

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out intermediate.key
openssl req -new -key intermediate.key -subj "/CN=Example VPN Intermediate CA" -out intermediate.csr
openssl x509 -req -in intermediate.csr -CA root.crt -CAkey root.key \
  -CAcreateserial -days 3650 -sha256 -extfile intermediate.ext -out intermediate.crt

intermediate.ext waxay ka kooban tahay basicConstraints=critical,CA:TRUE,pathlen:0, keyUsage=critical,keyCertSign,cRLSign iyo authorityKeyIdentifier=keyid:always. Ku celi furaha xididka sanduuqiisa ka hor inta aan martigeliyaha saxeexa dib loo xiriirin. Haddii xididku tahay inuu tirtiri karo dhexdhexaadka, ku saxeex openssl ca -config root.cnf -extensions intermediate_ca oo ka soo horjeeda index.txt heerka xididka halkii openssl x509 -req, si lambarka taxanaha loo diiwaangeliyo; kadib u dir liiska xididka natiijada profile-ka macmiilka, halkaas oo crl-verify ku salaysan fayl uu akhriyo bilowga. U dir macmiilka xirmo leh labada shahaado CA; blaydh kaliya lama hubsado xididka.

Soo saar blaydhyada laga bilaabo dhexdhexaadka, iyada oo leh database

Saxeexista openssl x509 -req way shaqaysaa ilaa aad u baahato tirtirid, sababtoo ah waxba ma diiwaangeliyaan lambarka taxanaha. Isticmaal openssl ca laga bilaabo shahaadada koowaad si lambarka taxanaha, dhicidda iyo xaaladda tirtirka ay ku noolaadaan hal database. Abuur faylasha database-ka hal mar, kadib u jeedi habaynta xaggooda:

mkdir -p /etc/vpn-ca/intermediate/newcerts
touch /etc/vpn-ca/intermediate/index.txt
echo 1000 > /etc/vpn-ca/intermediate/serial
echo 1000 > /etc/vpn-ca/intermediate/crlnumber

[ ca ]
default_ca = CA_default
[ CA_default ]
dir = /etc/vpn-ca/intermediate
database = $dir/index.txt
new_certs_dir = $dir/newcerts
serial = $dir/serial
crlnumber = $dir/crlnumber
certificate = $dir/intermediate.crt
private_key = $dir/intermediate.key
default_md = sha256
default_days = 365
default_crl_days = 30
unique_subject = no
policy = policy_any
[ policy_any ]
commonName = supplied
[ server_cert ]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = serverAuth
subjectAltName = @server_names
[ client_cert ]
basicConstraints = CA:FALSE
keyUsage = critical, digitalSignature
extendedKeyUsage = clientAuth
[ server_names ]
DNS.1 = vpn.example.com

Sadarka isticmaalka furaha wuxuu u malaynayaa furaha ECDSA; ku dar keyEncipherment RSA. Si each macmiil magac guud u gaar ah, sababtoo ah OpenVPN wuxuu ku aqoonsadaa xiriirka goobtaas, laba laptop oo wadaaga CN=vpn-client lama kala sooci karo logyada, xeerarka client-config-dir ama push kasta oo isticmaale, oo waad lumisaa u-dirista taas oo go'aanka tirtirku difaacmi karo. Soo saar oo hubi blaydh sidaan:

openssl req -new -key alice.key -subj "/CN=alice-laptop" -out alice.csr
openssl ca -config intermediate.cnf -extensions client_cert -in alice.csr -out alice.crt -batch
openssl verify -CAfile ca-bundle.crt -untrusted intermediate.crt alice.crt

Ku hay furaha saxeexa gudaha xadka siyaasadda halkii aad ku koobi lahayd martigeliyaha VPN: adeeg yar oo xaqiijiya codsiga, hubiya magaca guud oo ka soo horjeeda liiska la oggol yahay oo kaliya soo celiya shahaadada. Diiwaangeli lambar kasta oo taxane ah; loggu waa isku xirka kaliya ee u dhexeeya shahaado iyo qofka codsaday.

Soo saar tirtirka adigoon xididka toosin

Shahaadooyinka macmiilka waxaa tirtira dhexdhexaadka, marnaba xididka. Liiska xididka wuxuu muhiim u yahay kaliya marka dhexdhexaad la gubto. U jeedi server-ka liiska dhexdhexaadka crl-verify. CRL ku salaysan fayl waa la rarayaa bilowga adeegga, marka dib u rar ka dib abuur kasta; qaabka galku wuxuu akhriyaa xaaladda waqtiga xiriirka oo wuxuu ku kacaa hal fayl lambar kasta oo taxane ah.

Tirtir oo dib u abuur laba amar oo ka imanaya isla database-ka:

openssl ca -config intermediate.cnf -revoke /etc/vpn-ca/intermediate/newcerts/1001.pem
openssl ca -config intermediate.cnf -gencrl -out /etc/openvpn/crl.pem

Kadib ilaali saacadda. CRL waxay qaadaysaa goobta cusboonaysiinta xigta, oo marka taariikhdaas dhaafto, lammaanaha hubiya wuu diidaa liiska halkii uu iska indhatiri lahaa. Dib u abuurka bishii default_crl_days = 30 wuxuu ka tagaa firaaqo; kan sanadlaha ah ma tago. Nolosha gaaban ee blaydhyada ayaa ah xakamaynta lagu kalsoonaan karo, sababtoo ah tirtirku wuxuu khuseeyaa kaliya halka liiska la eego.

Tijaabi silsiladda, kadib qor munaasabadda

Soo saar afar guuldarro ka hor inta aadan aaminin naqshadda. Hubi silsiladda openssl verify -CAfile ca-bundle.crt -untrusted intermediate.crt server.crt. Ku xiriir shahaado macmiil oo dhacday oo xaqiiji in server-ku diido. Tirtir macmiil tijaabo ah, dib u rar oo xaqiiji in liisku dhaqan galo. Horay u dhaqaaji saacadda martigeliyaha hal maalin, sababtoo ah saacad khaldan waxay soo saari kartaa oo diidi kartaa shahaadooyin meel kale ansax u eg.

Xididka offline waa xakamayn kaliya haddii waraaqaha jiraan: laba qof oo magac leh munaasabadda, diiwaan lambar kasta oo taxane ah oo la saxeexay, kayd sir ah oo lagu hayo meel ka duwan mashiinka, iyo tijaabo soo celin martigeliye go'doonsan. Saxeex dhexdhexaad kayd ah isla munaasabaddaas si martigeliyaha saxeexa ee dhintay uusan ku qasbin inaad xididka furto habeen badhka.

Ka hor inta aadan u yeedhin mid dhammaaday, xaqiiji shan arrimood: furaha xididku kama jiro martigeliye shabakadeed, furaha dhexdhexaadku wuxuu ku nool yahay kaliya martigeliyaha saxeexa, xirmada macmiilku waxay qaadaysaa labada shahaado CA, CRL waxay leedahay cusboonaysiin xigta mustaqbalka, oo qof baa leh gelitaan kalandar ah dhicid kasta oo silsiladda ah. Haddii mid maqan yahay, habaynta offline u eg waa kaliya mid aan la diiwaangelin.