strongSwan: nooca furaha, loader-ka iyo backend khaldan

PEM waa weel, ma aha nooc fure. Isbarbardhig furaha dadweynaha ee shahaadada iyo kan gaarka ah, ka dib ku rar backend-ka dhab ahaan akhriya.

Kordhinta faylalka ma aqoonsato algorithms-ka furaha, iyo galka .pem wuxuu ka koobnaan karaa wax RSA ama ECDSA. PEM wuxuu sharraxayaa sida bytes loo duubo, halka RSA iyo ECDSA ay magacaabaan algorithms kala duwan, iyo faylka PKCS12 waa shay saddexaad. strongSwan wuxuu ku rarayaa aqoonsiga iyada oo loo marayo plugins iyo backend qaabeynta, sidaas darteed shahaadadu waxay ku muuqan kartaa liis iyada oo furaha gaarka ah uusan waligiis noqon mid la isticmaali karo. Kala sooc lakabyadaas ka hor intaadan wax sir ah tafatirin.

Koodhaynta, algorithm-ka iyo baakadayntu waa saddex lakab

Faylka furaha wuxuu leeyahay koodhayn, algorithm iyo inta badan weel. PEM waa galka base64 ee la yaqaan; DER waa dhiggiisa binary; PKCS12 wuxuu isku darayaa shahaado furaheeda iyo silsiladeeda. Faylka silsiladda shahaadada waa weel kale, oo badanaa ma qabto wax fure gaar ah. Midkoodna calaamadahan ma sheegayo in waxa gudaha ku jira uu yahay RSA ama ECDSA.

Algorithm-ka ka akhri shayga laftiisa. Magaca suuqgeynta ee bixiyaha ama kordhinta faylku ma aha caddayn, maxaa yeelay isla soo-saaraha ayaa bixin kara noocyo fure oo kala duwan.

Isbarbardhig furaha dadweynaha ka hor intaadan loader-ka eedayn

Shahaadada rarta waxay caddaynaysaa in shahaadada la falanqeeyay, ma aha in furaheeda gaarku jiro ama la isticmaali karo. Ka soo saar furaha dadweynaha shahaadada iyo furaha gaarka ah ee la soo jeediyay, ka dib isbarbardhig labada digest. Haddii soo-saaris kasta fashilmo, halkaas ku joog, maxaa yeelay digest-ka wax-soo-saarka madhan waxba ma caddeeyo. Digest-yada iswaafaqsan waxay caddeeyaan in lammaanuhu wadaag yihiin, iyo wax kale ma jiro oo ku saabsan in shahaadadu ku habboon tahay shaqada.

openssl x509 -in server.crt -pubkey -noout |
    openssl pkey -pubin -outform DER |
    openssl dgst -sha256

openssl pkey -in server-key.pem -pubout -outform DER |
    openssl dgst -sha256

Amarka labaad wuxuu taabanayaa wax gaar ah oo ku yaal mashiinkaaga laakiin wuxuu soo saarayaa kaliya qaybta dadweynaha. Sidaas ku hay, oo marnaba ha ku dhejin fure gaar ah tikit. Haddii furahu sir ah yahay, u oggolow qalabka la taageeray inuu weydiiyo erayga sirta ah halkii aad ku dhigi lahayd khadka amarka halkaas oo liiska hababka uu ku muujin karo.

ipsec.secrets hore ama aqoonsiga swanctl

strongSwan wuxuu leeyahay laba waddo oo aqoonsi oo caadi ah. Stack-ga starter hore wuxuu ka akhriyaa gelitaannada nooca-gaar ah ipsec.secrets, oo gelitaan kastaa waa inuu sheegaa nooca saxda ah ee waxa. Stack-ga swanctl iyo vici wuxuu furaha ka rarayaa galkiisa aqoonsiga isaga oo adeegsanaya qaabeyntiisa. Tafatirka faylka uu backend-ka socda aanu akhrin waxba ma beddelo.

: ECDSA "/etc/ipsec.d/private/server-key.pem"

Ogow backend-ka dhab ahaan socda, ka dib furaha dhig meesha backend-kaas uu eego. buug-gacmeedka hore ee strongSwan 5.9 wuxuu qeexayaa gelitaannada sirta ah ee nooca-gaar ah, oo kani ma aha dukumeentiga swanctl. Isku-dhafka labada wuxuu abuuraa daemon oo iska indhatiraya fayl uu maamuluhu u arko mid awood leh. Dib-u-rarid aan khalad soo sheegin waxay kaliya ka dhigan tahay in qaabeynta la falanqeeyay.

Akhri dhacdada rarista iyo natiijada xaqiijinta

Ka dib dib-u-rarid la xakameeyay, akhri wax-soo-saarka rarista ee daemon-ka laftiisa ee furaha gaar ah. Shahaado ku taxan dump-ka xaaladda ma muujinayso in furaha gaarka ah lala waafajiyay.

Haddii macmiilku wali fashilmo, kala hay dhacdada server-ka iyo khaladka macmiilka. Xaqiijinta silsiladda, iswaafajinta aqoonsiga iyo waafaqsanaanta hababka waa su'aalo dambe oo leh caddayntooda. Natiijada ku qor waddada saxda ah ee furaha iyo digest-ka aad isbarbardhigtay, maxaa yeelay haddii kale wareegga xiga wuxuu ku celin doonaa isla dib-u-rarista. Beddelka CA maaha jawaabta ugu horreysa ee isku-dhac loader-ka.

Maqaallo la xiriira