Engeza iklayenti le-VPN ngaphandle kokwakha kabusha i-CA

Udinga esinye isitifiketi selinye ikhompyutha ephathekayo, kodwa isifundo sokuqala emiphumeleni yokusesha siqala ngomyalo osusa uxwebu lwe-PKI. Lowo myalo ungowokuhlelwa kokuqala, hhayi owokubhalisa, futhi ukuwusebenzisa kukulahlekisela i-CA, umlando wokukhipha kanye nawo wonke amaphrofayili amaklayenti ayethemba umkhiphi wakudala. Isinqumo sincane: ingabe umkhiphi usenesimo esisebenzisekayo, futhi ingabe idivayisi entsha ihambisana nenqubomgomo yakho yokubhalisa? Izimo ezintathu zinquma, futhi eyodwa kuphela ihlonipha ukwakha kabusha.

Ukuhlonza okwenzeka ekwakheni kabusha

Ukuqalisa kabusha i-PKI kushintsha uxwebu ngolwakhiwo olungenalutho: ukhiye nesitifiketi se-CA okusha, isizindalwazi sokukhipha esingenalutho kanye nesibali semigqa emisha. Amaklayenti awalandeli ngokwawo; amaphrofayili awo abambelela ku-CA endala, ngakho yonke idivayisi kufanele ibhalise futhi, kanti ezingafinyeleleki kufanele zenziwe ngesandla.

Ukulahlekelwa okuthule kakhulu ukubalwa kwemali. Ukuhoxiswa kuncike ekwazini ukuthi yiziphi izinombolo zomugqa oye wazikhipha nokuthi wazikhiphela ubani. Sula inkomba futhi usengasayina, kodwa awusakwazi ukusho ngokuqiniseka ukuthi yiziphi izitifiketi ezazikhishiwe obuzimisele ukuzihoxisa. Uxwebu lwe-CA olunezitifiketi ngaphandle kwesimo somkhiphi esihambisanayo luyisipele esibuyisela ingxenye engalungile yohlelo.

Ukukopisha ukhiye oyimfihlo we-CA eceleni kwesiphakeli esisebenzayo kungenye indlela emfushane okufanele uyinqabe: iguqula igunya lokusayina okufanele libe ngaphandle kwenethiwekhi libe enye ifayela kumsingathi onokuhamba okungathembekile.

Isimo sokuqala: ingabe isimo somkhiphi sisafinyeleleka

Ngaphambi kokunquma, thola uxwebu isiphakeli esilithemba ngempela. Qhathanisa isitifiketi isiphakeli esisethula ngaso njenge-CA naleso esikuxwebu lwe-PKI ngophawu lomunwe, hhayi ngokwegama lefayela:

openssl x509 -in ca.crt -noout -fingerprint -sha256
openssl x509 -in /etc/openvpn/ca.crt -noout -fingerprint -sha256

Uma izimpawu zifana, ukubhalisa kuyengezeka futhi akukho okumele ukwakhe kabusha. Uma zihlukile, usayina nge-CA isiphakeli esingayithembi: isitifiketi sifakwa kahle kodwa sihluleka ekuxhawulaneni ngesandla, futhi lelo phutha lihlolwa ngokungalungile njengephutha leklayenti amahora amaningi.

Bese ufuna isimo sokukhipha: ifayela lenkomba, isibali semigqa kanye nefayela lenombolo ye-CRL. Uma inkomba ingekho kodwa ukhiye ukhona, ungakhipha, kodwa uzuza inkinga yokuqopha ukuhoxiswa. Bhala lokho encwadini yezinguquko, ngoba isicelo sokuhoxisa esilandelayo sizokwembula.

Isimo sesibili: ubani ophethe ukhiye oyimfihlo omusha

Lesi yisinqumo esizwiwa abasebenzisi, ngakho sinqume ngokusobala. Ukhiye owenziwe eklayentini futhi othunyelwe njengesicelo ugcina ingxenye eyimfihlo kudivayisi kusukela kumyalo wokuqala, futhi umlawuli akawuthinti neze. Ukhiye owenziwe kusiphakeli ulula kumadivayisi angenazo izinsiza, kodwa wenza umlawuli abe umgcini wakho wonke ukhiye futhi kwandise umphumela wokugqekeza isiphakeli.

Nge-Easy-RSA 3 ebheke i-CA ekhona, ukungenisa nokusayina isicelo kuyimiyalo emibili:

./easyrsa import-req /tmp/alice.req alice
./easyrsa sign-req client alice

Khetha uhlobo lwesitifiketi ngamabomu. Isicelo esisayinwe njengesitifiketi sesiphakeli esikhundleni seklayenti sinikeza ifayela elibukeka kahle kodwa elinqatshwa ngumlingani, futhi umlayezo wephutha awuvamisile ukusho ukuthi kungani. Nge-openssl ca, ukukhetha okufanayo kusemithanjeni oyidlulisayo, hhayi esigabeni esimisiwe.

Isimo sesithathu: ingabe isiphakeli sidinga okungaphezu kwesitifiketi

Kwi-OpenVPN evamile enokuqinisekiswa ngesitifiketi, isitifiketi siwukubhalisa uqobo: igama elijwayelekile liba ubunikazi beklayenti, futhi noma yiluphi uxwebu, umzila ophushwayo noma ikheli elimile kuncike kulelo gama. Engeza isitifiketi ukhohlwe ukucushwa, umhubhe uyaxhumanisa kodwa imizila edingekayo ayivelanga.

Amapulatifomu ashintsha lokhu. I-OpenVPN Access Server inesizindalwazi sayo sabasebenzisi, ngakho isitifiketi esisayinwe akuyona i-akhawunti; i-akhawunti kufanele ibekhona futhi ivunyelwe. Amanye amasango ahlobanisa intambo yobunikazi neqembu. Ukubhalisa idivayisi eyodwa ngokuvamile kuthinta amasistimu amabili, futhi isitifiketi siwukuqala kuphela.

Inqubo yokwengeza nokuthi ukwakha kabusha kulungile nini

Ukulandelana okwengeza idivayisi ngaphandle komonakalo: qinisekisa umkhiphi ngophawu lomunwe, thatha isipele esisha soxwebu lwe-PKI, ngenisa futhi usayine isicelo sendima yeklayenti, delela isitifiketi kanye nochungechunge lwaso ngomzila ovunyiwe, bese uqinisekisa ngaphambi kokuthi umsebenzisi axhumane:

openssl verify -CAfile ca.crt alice.crt
openssl x509 -in alice.crt -noout -subject -issuer -dates -purpose

Umugqa wenhloso kufanele ukhombise i-SSL client. Qeda ngokubuyekeza isipele se-CA ngemva kokukhipha, ngoba isipele esithathwe ngaphambi kokuba inombolo yomugqa emisha iqoshwe sibuyisela isimo esingenayo idivayisi osanda kuyengeza.

Ukwakha kabusha kulungile ezimeni ezintathu: ukhiye we-CA uphazamisiwe, isimo sokukhipha silahlekile ngendlela engalungiseki, noma ushintsha ngamabomu i-algorithm yokhiye noma inqubomgomo yesitifiketi. Zontathu zingamaphrojekthi adinga uhlelo lokubhalisa kabusha iklayenti ngalinye, hhayi izinyathelo esicelweni sedivayisi eyodwa. Uma kungekho okusebenzayo, bhalisa ngokwengeza bese ushiya umkhiphi.