Hal khalad, saddex sir: kee baa VPN aqoonsiga ku guuldareystay?
Macaamiilku wuxuu muujinayaa hal khalad marxalad kasta. Akhri xiriirka, isdhaafsiga isticmaalaha iyo habka ka hor intaadan dib u dejinin password cidna aan hubin.
“Xaqiijintu waa guuldareystay” waxay tilmaami kartaa shahaadada server-ka, furaha hore loo wadaagay ee mishiinka ama password-ka isticmaalaha. Midkee uu tilmaamayo waxay ku xiran tahay borotokoolka, sababtoo ah borotokool kastaa wuxuu qeexayaa sir gooni ah. Haddii aad dib u dejiso kan qaldan, khaladku si isku mid ah ayuu u sii jiraa. Bixitaanku waa in la caddeeyo inta caddayn uu borotokoolku u baahan yahay ka hor intaadan wax wax ka beddelin.
Laba caddayn oo u jeeda jihooyin iska soo horjeeda
Tunnel-ku waa inuu ka jawaabo su'aasha ah inuu gaaray gateway-ga saxda ah, iyo si gooni ah cidda isticmaalaha. Caddaynta gateway-ga waa heer mishiin: shahaadada server-ka, furaha hore loo wadaagay ama furaha dadweynaha ee aan isbeddelin. Caddaynta isticmaalaha waa heer qof: password, token, shahaadada macaamiilka, ama waxba. Kuwaasi waa jihooyin kala duwan oo kalsooni ah waxayna isticmaalaan wax kala duwan.
IKEv2 waxay caddaynta gateway-ga ku sameysaa gudaha IKE_AUTH iyo, marka EAP la isticmaalo, waxay caddaynta isticmaalaha ku socodsiiyaa isdhaafsi gooni ah ka dib. sharaxaadda IKEv2 waxay ku haysaa qaybo gooni ah, taas oo tilmaan xoog leh ku tahay halka la eegayo marka fariin keliya ay daboolayso labada wareeg.
Akhri marxaladda, ma aha fariinta
Macaamiilku wuxuu muujinayaa isla xarafka khaladka, marxalad kasta oo guuldareysatay, marka xarafka laftiisu ku dhawaad wax macluumaad ah ma qaado. Waxa macluumaad qaata waa xaaladda aad ka eegi karto marxalad kasta: in xiriirku jiro, in isdhaafsiga isticmaalaha bilaabmay, iyo in macaamiilku soo bandhigay habka gateway-gu doonayay. Jadwalku wuxuu marxaladaha u kala hormariyaa sidaas, ee ma aha magaca borotokoolka.
| Stage that failed | Evidence you can inspect | What a password change cannot fix |
|---|---|---|
| The machine proof | no security association in the state list | a mismatched pre-shared key or an untrusted chain |
| The user proof | an association is up while PPP or EAP reports failure | an expired token, a locked account, a missing client key |
| The client's method support | the client offers no method the gateway accepts | a client without the required EAP or key material |
| The server's policy | the gateway rejects before any user exchange starts | a policy that requires a certificate the profile lacks |
Kaliya safka labaad ayaa ku saabsan aqoonsiga isticmaalahu dib u qori karo. Saddexda kale waa xaqiiqooyin habeyn, iyo ismaandhaafkaas ayaa sabab u ah in warbixinno badan ay ku dhammaadaan dib u dejinta password aan waxba beddelin. Akhri safka u dhigma caddayntaada ka hor intaadan taaban goob.
Borotokool laba sir leh ayaa gacantiisa muujiya
L2TP over IPsec waxay tiradu muuqato, sababtoo ah labada hubin waxay ku dhacaan habab kala duwan. Lakabka IPsec waa inuu marka hore soo baxaa furaha hore loo wadaagay ama shahaado, ka dibna kaliya PPP gudaha ku jira ayaa isku dayaa gelitaanka isticmaalaha.
Marka sirta mishiinku qaldan tahay, xiriir ma samaysmo oo aqoonsiga isticmaalaha weligiis lama isku dayo. Marka sirta mishiinku sax tahay oo sirta isticmaalahu qaldan tahay, xiriirku wuu jiraa oo PPP wuu diidayaa gelitaanka ka dib marka tunnel-ku hore u soo baxay. Labaduba waxay shaashadda ku muujiyaan isla fariin laga soo qaaday laba dhacdo oo kala duwan.
sudo swanctl --list-sas
sudo ip xfrm state list
sudo journalctl -u xl2tpd -n 50 --no-pagerLiiska xiriirka oo madhan wuxuu isla markiiba meesha ka saarayaa lakabka isticmaalaha, marka hubi ka hor password-ka. Xiriir la aasaasay oo leh guuldarro PPP soo noqnoqda wuxuu tilmaamayaa dhinaca kale, lakabka isticmaalaha ama borotokoolka xaqiijinta gudihiisa. Midkoodna gabagabo lagama heli karo qoraalka khaladka macaamiilka.
Password-kaliya runtii maxay ku xiran yahay
Gelitaan password-kaliya waa caadi L2TP, PPTP, SSTP iyo IKEv2 oo leh EAP. WireGuard wax xulasho ah ma laha haba yaraatee, sababtoo ah derisyadiisu waa furaha ee ma aha isticmaalayaal. OpenVPN jawaabtu waxay ka timaaddaa shuruudda server-ka ee shahaadada macaamiilka: gateway dalbaya shahaado iyo password labadaba wuxuu sii wadayaa diidmada macaamiil password-kaliya, wax kasta oo goobta lagu qoro.
Qaybtee aad u baahan tahay waxay ka timaaddaa isla jawaabtaas. Gelitaan password ah oo IKEv2 hoos yimaada wuxuu u baahan yahay macaamiil ku hadla EAP, halka gelitaan shahaado ah uu u baahan yahay furaha gaarka ah ee macaamiilka iyo silsiladda server-ka. Ku rakib kan qaldan oo guuldarraddu waxay u akhmi doontaa sida khalad aqoonsi, in kasta oo habka xaqiijinta laftiisu uu maqan yahay.
Beddel hal shay, ka dib dib u tijaabi
Marka hore caddey saddex xaqiiqo: borotokoolkee ayaa socda, imisa sir ayuu qeexayaa, iyo kee ka mid ah ay leeyihiin mishiinka ee ma aha isticmaalaha. Mishiinnada waxay ku guuldareystaan marxaladda koowaad dadkuna tan labaad, isku qasidda labadaasna waa dhammaan dhibaatadan.
Ka dib beddel si sax ah hal shay oo dib u tijaabi isla macaamiilkaas. Anshaxaas wuxuu guuldarro jahawareer leh u beddelaa hagaajin aad u sharxi karto qofka xiga, taas oo ka faa'iido badan xiriir shaqeeya oo aan cidna sharxi karin.