Sida looga saaro shahaadada VPN ee duugoobay kaydka kalsoonida

Macaamiilkaaga VPN waa la tirtiray, profile-ka wuu ka lumay Dejinta, haddana tunnel-ku wuu soo baxaa isagoo wata aqoonsiga hore. Ama waad tirtirtaa, dib ayaad u kicisaa, oo subaxda xigta waad helaysaa. Midkoodna ma aha badhan tirtirid oo xun. Profile waa habayn; shahaadadu waa maaddada fureed iyo go'aan kalsooni oo lagu diiwaangeliyay kayd uu profile-ku kaliya tilmaamayo. Midka aad gacanta ku haysaa ayaa go'aaminaya waxa 'saar' ay tahay inuu macne yeesho.

Profile ma aha shahaado

Habaynta VPN, saddex shay oo kala duwan ayaa loo yaqaan 'shahaadada'. Aqoonsiga macaamiilku waa shahaado caleen oo fure gaar ah leh, oo gateway-gu wuxuu ku go'aamiyaa cidda aad tahay. Shahaadada caleen ee server-ka laftiisa iyo dhexdhexaadiyeeda waa waxa macaamiilkaagu hubiyo marka uu isku xiro. Bar-tilmaameedka kalsoonida, badanaa xidid ama shahaado CA gaar ah, waa waxa silsiladda gebi ahaanba la xaqiijin karo ka dhigaya. RFC 5280 wuxuu u yaqaannaa kuwan bar-tilmaameedka kalsoonida, dhexdhexaadiyaha iyo hay'adda ugu dambeysa, silsiladduna waxay ansax tahay kaliya inta xiriir kastaa uu saxeexo kan ka hooseeya.

Tirtir aqoonsiga oo qalab keliya wuu lumiyaa gelitaanka. Tirtir bar-tilmaameedka oo app kasta oo ku xaqiijisa kaydkaas wuxuu lumiyaa awoodda uu ku hubiyo wax kasta oo hoostiisa lagu soo saaray, oo ay ku jiraan xiriiro aan waxba la qabin VPN-ka. Isku-dheellitirnaantaas ayaa ah khatarta oo dhan halkan: xidid loo rakibay hal gateway ayaa badanaa isla xididka saxeexa portal gudaha, server email ama muraayadda xirmooyinka. Xusuuso midka labada aad gacanta ku haysaa.

Lahaanshaha ayaa go'aaminaya in tirtiridda ay tirtiran tahay. Laptop-kaaga adiga leh, adigaa kaliya dib u dhigi kara shahaadada. Qalab la maareeyo, profile habayn ama payload MDM ayaa dib u rakibi kara isku-xirka xiga, taas ayaa sababta 'dib u soo noqoto' iyo sababta tirtirid adag aanay wax tarin.

Ogow kaydka kee ayaa weli haysta

Dadku waxay ka bilaabaan app-ka Dejinta, taas oo ah goobta kaliya ee shahaado aan lagu kaydin. Goobaha dhabta ah waa kaydka kalsoonida nidaamka, kaydka browser-ka laftiisa iyo kaydka gaarka ah ee app-ka.

Ku barbardhig lambarka taxanaha ama faraha, marnaba magaca la soo bandhigay. Magacyada la soo bandhigay waxaa dhigaa cidda shahaadada soo saartay oo dib ayaa loo isticmaalaa: 'Example VPN' waxay noqon kartaa saddex shahaado oo saddex fure oo kala duwan leh, midi weli maalin kasta la isticmaalo.

certutil -user -store My
certutil -store Root
openssl x509 -in vpn-client.pem -noout -subject -issuer -serial -fingerprint -sha256

macOS, qalabka security wuxuu bixiyaa isla xaqiiqooyinka, oo find-identity waxay tusaysaa shahaadooyinka weli fure gaar ah ku xiran yahay:

security find-certificate -a -c "Example VPN" -Z /Library/Keychains/System.keychain
security find-identity -v -p ssl-client

Tirtir shayga cidhiidhi ah, hayso soo-saaraha la wadaago

Dhoofi ka hor inta aanad tirtirin. Kayd la'aan, soo-kabidda kaliya waa dib u soo saarid, taas oo CA gaar ah macnaheedu yahay dib ugu noqoshada cidda maamusha PKI. PFX la dhoofiyay ayaa sidoo kale ah waxa aad gudbiso haddii saaridda ay noqoto go'aan khaldan.

certutil -user -exportPFX -p backup My <serial> C:\temp\vpn-id.pfx
certutil -user -delstore My <serial>
Remove-Item Cert:\CurrentUser\My<thumbprint>

Calamka -user waa kan dadku si shil ah uga tagaan. La'aantiis, certutil wuxuu ka shaqeeyaa kaydka mishiinka, taas oo macnaheedu yahay shell sare, shahaadooyin kale iyo gacan-ka-fog oo hadda ay ku jiraan dhammaan akoonnada kale ee mishiinka.

macOS iyo Linux qaabku waa isku mid: aqoonsado, dhoofi, kadibna ka saar kaydka ugu cidhiidhiga ah ee calaamadda sharraxaya. Faylka ku yaal /usr/local/share/ca-certificates ka saar oo dib u update-ca-certificates socodsii waa ku filan; --fresh waxay caawisaa kaliya marka isku-xirka calaamadeed ee /etc/ssl/certs horeba aan isku jirin. Nidaamyada qoyska RHEL waxay bar-tilmaameedyada ku hayaan /etc/pki/ca-trust/source/anchors, halkaas oo trust anchor --remove isla shaqadaas qabato.

sudo security delete-certificate -Z <sha1> /Library/Keychains/System.keychain
sudo rm /usr/local/share/ca-certificates/example-vpn.crt
sudo update-ca-certificates
sudo trust anchor --remove /etc/pki/ca-trust/source/anchors/example-vpn.crt

Ka hor inta aanad tirtirin shahaado CA, hubi waxa kale oo silsilad ku xiran. Liis ku qoridda mawduucyada xirmada waa hubin laba sadar ah oo ka jawaabta haddii bar-tilmaameedkaas shaqo kale qabanayo:

openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout | grep -i example

Tirtiridda faylku ma aha burinta aqoonsiga

Tirtirid maxalli ah waxay qaaddaa hal nuqul. Furaha gaarka ah wali wuxuu ku jiri karaa p12 ku xiran tikit hore, gal fayl kayd ah, ama laptop-ka labaad ee isla waqtigaas la diyaariyay. Haddii tani ay ahayd aqoonsi macaamiil, gateway-gu wuxuu sii aqbalayaa nuqul kasta oo furahaas ah ilaa aqoonsiga laga diido dhinaca server-ka.

Hal OpenVPN PKI, taas macnaheedu waa in shahaadada la buriyo oo la hubiyo in CRL-da crl-verify tilmaamayso ay cusub tahay; easyrsa revoke kadibna easyrsa gen-crl waa nooca gaaban. Gateway ku xiran bixiye aqoonsi, halkaas ka jooji isticmaalaha ama ka saar qalabka, sababtoo ah shahaadadu waa hal aqoonsi oo ciyaarta ku jira. Tirtiridda nuqulka maxalliga ah inta akoonku firfircoon yahay waxay u ekaanaysaa nadiifin, mana aha.

Shaqada dhacdadu waxay leedahay nidaam kale: marka hore kaydi shahaadada, lambarkeeda taxanaha iyo diiwaanka burinta, kadibna tirtir oo buri. Diiwaannadaas waxba kuma kacaan oo uma baahna in aqoonsi shaqaynaya meesha laga tago.

Ku xaqiiji gacan-qabad iyo app labaad

Silsiladda dibadda ka hubi, ma aha liiska kaydka aad hadda tafatirtay. Kaydku wuxuu tusayaa tafatirkaaga; gacan-qabku wuxuu tusayaa natiijada.

openssl s_client -connect vpn.example.com:443 -servername vpn.example.com \
  -CAfile /etc/ssl/certs/ca-certificates.crt -verify_return_error < /dev/null
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt vpn-gateway.pem

Koodhka soo-noqodka 0 macneheedu waa bar-tilmaameedyada hadhay wali gateway-ga xaqiijinayaan. Khalad silsiladeed ka dib marka bar-tilmaameedka la saaro waa natiijada la filayay, oo waxay xaqiijinaysaa inaad ku dhacday bar-tilmaameedka la isticmaalayo ee aan ahayn nuqul ku jira kayd uusan macaamiilku waligiis akhrin. Haddii xiriirku wali shaqeeyo, raadi nuqul labaad, kayd app-ka dhexdiisa ah ama shahaado la dhejiyay, dhammaantood caadi u ah macaamiisha keena liiskooda kalsoonida.

Kadib tijaabi wax aan la xiriirin: site gudaha ah, macaamiil email, muraayad xirmooyin. Taas waxay si jaban u cabbirtaa gacan-ka-fog, ka hor inta aysan daaqadda isbeddelku xirmin.

• Doorka loo aqoonsaday aqoonsi, dhexdhexaadiye ama bar-tilmaameed kalsooni
• Lambarka taxanaha iyo faraha la diiwaangeliyay, nuqulkaana loo dhoofiyay goobta la ansixiyay
• Tirtiridda lagu sameeyay baaxadda ugu cidhiidhiga ah ee calaamadda sharraxda
• Oggolaanshaha dhinaca server-ka la buriyay markii qof ama qalab baxay
• Gacan-qabka la sharraxay, hal app oo aan la xiriirin dib loo tijaabiyay
• Payload MDM ama profile maamul la cusboonaysiiyay, haddii kale shahaadadu way soo noqonaysaa

Haddii shahaadadu dib u soo noqotay ka dib dib-u-kicis, shaqadu ma dhammaan: wax baa leh oo dib u rakibay. Hel milkiilahaas ka hor inta aanad mar kale tirtirin, sababtoo ah tirtiridda saddexaad waxay u dhaqmi doontaa sida labada hore.