Gelitaanka VPN ee shahaadada Mac: aqoonsiga, isticmaalka fure ama kalsoonida albaabka?
Saddex go'aan ayaa ka dambeeya gelitaanka shahaadada: aqoonsiga la doorto, haddii qaybta VPN ay isticmaali karto furaheeda, iyo haddii albaabka la aamini karo.
Gelitaannada VPN ee shahaadada ku saleysan waxay Mac ka codsadaan wax ka cidhiidhi badan furaha sirta ah: isticmaal furahakan gaarka ah, isla duruufan fulinta, si aqoonsi loo caddeeyo albaabkaas. Marka uu guuldareysto, fariintu badanaa waxay sharraxdaa oo kaliya waxa ugu dambeeya ee qaldan, taasna naadir bay tahay inay sabab tahay. Mara tallaabooyinka saddexda go'aan sida nidaamku u qaato waxay daahfurka ka dhigtaa mid daacad ah, waxayna ka hortagtaa in dhibaatada fasaxa maxalliga ah loo arko guuldarada xaqiijinta silsiladda.
Raac gelitaanka sida Mac u sameeyo
Marka hore macmiilku wuxuu doortaa aqoonsi: shahaado lammaane la leh fure gaar ah oo la isticmaali karo, oo laga heli karo kaydka la taageeray ama bixiyaha aqoonsiga. Kadib qaybta VPN waxay codsataa in hawlgalkan sirta ah lagu sameeyo furahaas, qaabka fasaxa maxalliga ahna wuu jawaabaa. Kaliya marka labaduba guuleystaan ayay isku-dhacidda fog dhacdaa, halkaas oo Mac qiimeeyo albaabka iyo albaabku qiimeeyo caddaynta macmiilka.
| Decision | Typical symptom | Where to look |
|---|---|---|
| Identity selection | No valid identity, wrong certificate offered | Profile and which identity the client picked |
| Local key use | Signing or interaction error before any handshake | Execution context and key access rules |
| Remote authentication | Chain, name or client-admission rejection | Gateway identity and what it accepts |
Akhri shaxda kor ilaa hoos oo joog safka ugu horreeya ee guuldareysta. Wax kasta oo ka hooseeya guuldarada lama caddeyn, taasina waa sababta «shahaadada lama aamini karo» ay tahay gabagabo aad u caan ah oo aan la isku halayn karin.
Waxa fasaxa maxalliga ah dhab ahaan daboolo
Qaabka key-chain ee macOS, walxaha la ilaaliyay waxay qaadaan xeerar gelitaan oo hawlgalkan gaar u ah iyo liis barnaamijyo la aamini karo. Ku saxeexidda fure gaar ah waa mid ka mid ah hawlgalladaas, xeerrayna waxay khuseeyaan faylka fulinta ee sameeya, ma aha shahaadada oo dokument ah. Tixraaca xakamaynta gelitaanka Apple wuxuu kaloo xariiq u dhexeeya qaabkan iyo key-chain-ka iCloud iyo habaynta kooxaha gelitaanka, sidaas darteed talada mid loo qoray uma gudubto kan kale.
Waxaa ka soo baxa laba natiijo. Shahaado dadweyne oo liiska ku muuqata ma caddaynayso in qaybta dambe ee VPN ay gabi ahaanba gaari karto furahaas. Iyo fasaxa barnaamijka hore la siiyay wax kama sheegayo caawiye ama kordhinta shabakadeed oo gaar ah, sababtoo ah waa kood kale oo leh aqoonsiyo kale.
Aqoonso hirgelinta dhabta ah iyo habka wadaagga aqoonsiga ee la taageeray halkii aad ka koobi lahayd macmiil hore dariiqa faylka fulinta. Marka hore xaqiiji aqoonsiga nidaamku soo bandhigi doono:
security find-identity -v -p ssl-clientAkhriska errSecInteractionNotAllowed
Heerkaas wuxuu soo sheegaa is-dhexgal aan la ogolaan Security Server, waxna kama sheegayo silsiladaha shahaadada. Akhri isaga oo la socda hawlgalkii soo saaray: codsiga saxeexa ee laga soo diray duruuf aan bandhig gaari karin wuxuu ku guuldareystaa sidan xitaa marka furaha iyo shahaadada labaduba si buuxda u ansax yihiin. Meesha laga bilaabo waa hawlgalkii diiwaangeliyay, ma aha kaydka shahaadada. Wax kasta oo aad ka beddesho aaladaha kalsoonida ayaa khaladka ku reebi doona isla meeshii uu ahaa.
Sidaas darteed koodka u qaado sabab lagu baadho duruufaha fulinta iyo fasaxa. In loo qaato caddayn in CA-da albaabka aan la aamini karin ayaa kuu horseedda qaybta khaldan ee dhibaatada, beddelka aad halkaas ku sameysana wax saameyn ah kuma yeelan doono khaladka.
Ku hagaaji si cidhiidhi ah, ma aha si ballaaran
Ka bilow tilmaamaha diiwaangelinta ama soo dejinta ee milkiilaha xiriirka. Diiwaangeli nooca macmiilka, baaxadda profile-ka, aqoonsiga la doortay iyo khaladka maxalliga ah ee ugu horreeya ee khuseeya, sababtoo ah afarta xaqiiqo ayaa ah waxa wareejinta taageerada u baahan tahay oo isbarbardhigga dambe ku tiirsan yahay. Profile la maareeyo ama aqoonsi lagu taageeray qalab ayaa laga yaabaa inuu u baahdo maamulaha ama bixiyaha inuu hagaajiyo wareejinta, waxna kama beddeli karo tirada gujisyada maxalliga ah.
Halka badeecaddu ay ka filanayso oggolaanshaha isticmaalaha, xaqiiji qaybta codsanaysa oo ogolow kaliya gelitaankaas iyada oo loo marayo qulqulka la taageeray. Halka qaybta aanay haysan hab lagu kiciyo bandhig duruufaha ay ku shaqeyso, diyaarintu waa inay raacdaa dariiqa uu iibiyuhu diiwaangeliyay, ma aha wada-hadal laga soo jiiday daaqad kale oo terminal.
Laba beddel ayaa lagu ururiyay talooyin hore, labaduba waa aad u ballaaran. In barnaamij kastaa helo gelitaanka furaha gaarka ah waxay ballaarisaa isticmaalka furaha maxalliga ah wax ka badan baahida, iyo in shahaadada loo dhigto Always Trust waxay beddelaa qiimeynta shahaadada wax kasta oo mishiinka ku yaal. Midkoodna ma muujinayo «hirgelintan VPN ee la ansixiyay, iyada oo isticmaalaysa aqoonsigan loogu talagalay».
Xaqiiji gudaha ka hor intaadan akhrin albaabka
Hagaajin ka dib, xaqiiji in hawlgalka maxalliga ahi guuleysto ka hor intaadan fasirin jawaab kasta oo ka timid dhinaca kale. Haddii saxeexu hadda shaqeeyo, diidmada magac, silsilad ama gelitaanka macmiil oo dambe waa natiijo cusub oo ma aha soo noqnoqosho, waxayna ka tirsan tahay go'aan kale oo leh mas'uul kale.
Wareejin faa'iido leh waxay magacawdaa mid ka mid ah saddexda go'aan oo guuldareystay oo halkaas ku joogsata. Waligeed kuma daro furaha gaarka ah, waligeedna dib uma dhigto walxaha key-chain-ka ee aan la xiriirin iyada oo rajeynaysa in xaalad nadiif ah ay caawin doonto. Labadaas caado ka samee wixii ka horreeya dhacdada ee ma aha inta lagu jiro, marka tijaabinta wax walba hal mar ay ugu xoog badan tahay. Tikitka sheegaya «key-chain-ka dib ayaa loo dhisay» waxba kama sheegayo akhristaha xiga cilladda asalka ah.