Ukuthunyelwa kwe-VPN ku-Android: yini ngempela edlulela efonini entsha
Ukuthunyelwa kwe-VPN ku-Android kuthumela izilungiselelo futhi ngezinye izikhathi ukhiye, kodwa akukaze kuthumele imvume yedivayisi. Hlola okudlulelayo ngempela ngaphambi kokusula ifoni endala.
Ukuthumela iphrofayela ye-VPN kusuka ku-Android kuzwakala njengesinyathelo sekhophi yokuphepha, futhi imenyu ekunikezayo ayenzi lutho ukuze ilungise lowo mqondo. Okusalayo kuwe ingokufaka kwe-parser, ukhiye okungenzeka ukuthi uhlelo lokusebenza lungakubuyiseli, kanye nemvume ekhishwe kuleyo foni ngqo. Hlukanisa lezi zintathu futhi umbuzo owusizo uyavela: iyiphi ingxenye esashodayo kudivayisi entsha?
Ifayela ingxenye elula. Ezinye ezimbili zinquma ukuthi ukufuduka kuzosebenza yini.
Iphrofayela ethunyelwe iqukethe ini ngempela
Vula ifayela kusihleli sombhalo ngaphambi kokulithemba. Iphrofayela ye-OpenVPN iwulimi oluncane lokucushwa: remote, proto, data-ciphers, futhi kaningi amabhulokhi angaphakathi <ca>, <cert>, <key> noma <tls-crypt> anikezwa iklayenti ku-TLS stack yalo. Ukucushwa kwe-WireGuard kuyisicaba: [Interface] iqukethe PrivateKey ne-Address, bese kuba yi-[Peer] eyodwa ngekhulampomthombo ngayinye ethwala PublicKey, AllowedIPs ne-Endpoint. I-IKEv2 ifika njenge-.mobileconfig enezichazamazwi zomthwalo esikhundleni samabhulokhi okhiye.
Akukho kule mibhalo okuyisikhombisi ngokwako. Isikhombisi ukhiye wangasese, futhi ifomethi ngayinye iyinamathisela ngaphakathi noma ikhomba kugama-mbumbulu elixazululwa ngaphakathi kweklayenti eliye lalidala.
Ukhiye uhlala kuphi ngempela ku-Android
I-Android igcina idatha yohlelo ngaphansi kwe-/data/data/<package>, efundwa kuphela i-UID yalolo hlelo. Ayikho indlela esekwayo yokukopisha umkhombandlela wangasese wohlelo olunye kusuka efonini engasebenzi nge-root, futhi adb backup iyeke ukuba yimpendulo evamile ngemva kokuba i-Android 12 iyekile futhi amaklayenti aqala ukumemezela allowBackup="false". Ngakho ukuthunyelwa kusuka kuklayenti le-Android kusho lokho iklayenti elikwenzayo, hhayi ikhophi yohlelo lwamafayela.
Isendlalelo sobunikazi singaphansi kohlelo. Uma iklayenti lingenise ukhiye wakho ku-Android Keystore, impahla ikhiqizwa noma isongwa lapho, futhi ukuthunyelwa kwakamuva kungathwala isikhombisi kugama-mbumbulu le-Keystore esikhundleni samabhayithi. Okhiye abasekelwa yi-hardware bakhiwe ukuze ngisho uhlelo olungumnikazi lungakwazi ukubafunda, njengoba Keystore documentation ichaza, ngakho iphrofayela ekhomba kulelo gama-mbumbulu ingeniseka kahle efonini efanayo futhi yehluleke kwenye indawo yonke.
Lokho akukona ukuthunyelwa okuphukile. Yilolo impawu eyacelwa ipulatifomu.
Iphrofayela ayikwazi ukuthwala ini
Qhathanisa izinto nalokho indawo ekuyo ezokwamukela:
| Into | Iya ngaphesheya? | Kungani |
|---|---|---|
| Iphrothokholi nekhulampomthombo | Yebo, uma iklayenti lendawo likuqonda | Umbhalo osobala kuphrofayela |
| Isitifiketi se-CA nokuhlolwa kwegama lomsingathi | Ngokuvamile | Impahla yomphakathi, kodwa igama lomsingathi kumele lihambisane nesitifiketi |
| Isitifiketi seklayenti | Yebo, ngaphandle uma siboshelwe kudivayisi ngayinye | Izitifiketi ziyathwaleka; umkhiphi unquma ukuthi zingaki izinto ezingasebenzisa esisodwa |
| Ukhiye wangasese | Kuphela uma ukhiqizwe ngaphandle kwe-Keystore | Okhiye abasekelwa yi-hardware abakwazi ukuthunyelwa, bangashintshwa kuphela |
| I-akhawunti, i-MFA, isikhathi se-SSO | Cha | Amathokheni ayaphela futhi ahlala eboshelwe kudivayisi eyawatholayo |
| Imizila, i-DNS kanye nobubanzi bohlelo | Kuphela njengombhalo wokucushwa | I-Android iwasebenzisa lapho ixhuma nge-VpnService.Builder |
| Uhlu lwezinhlelo ze-tunnel ehlukanisiwe | Ngezikhathi ezimbalwa | Amagama amaphakheji ahluka phakathi kwezinto, futhi uhlu luyisimo seklayenti |
Imigqa emibili ibangela ukudideka okukhulu. Ukhiye okhiqizwe kudivayisi futhi omakwe njengongakwazi ukuthunyelwa uyanyamalala ngempela nedatha yohlelo, ngakho okubuyiselayo ukhiye omusha kanye nesitifiketi esikhishwe wona. Ithokheni yesikhathi ekopishwe efonini entsha ivamise ukufa ekuhlaziyweni kokuqala, lokho okubonakala njengokungeniswa okwehlulekile.
Ukungeniswa kungukuhlaziya, bese kuba isicelo semvume
Ohlangothini olwamukelayo, ukungeniswa kungukuhlaziya okulandelwa ukubhaliswa. Iklayenti lifunda ukucushwa, lihlola ukuthi yonke ibhulokhi ekhonjiwe ikhona, bese libhala incazelo ye-tunnel ku-sandbox yalo, yingakho ifayela olikhethe kusuka Kwezilandiwe kungelona elixhumayo kamuva.
Bese kufika isinyathelo semvume okungekho fayela elingasidlulayo. I-Android idinga ukuthi uhlelo lushayele VpnService.prepare() futhi luthole imvume yakho ngaphambi kokuba lusungule i-tunnel, ngakho iphrofayela esanda kungeniswa isabonisa ingxoxo yohlelo kanye. Bese i-tunnel yakhiwa ngokusobala nge-addAddress, addRoute, addDnsServer kanye ne-addAllowedApplication noma addDisallowedApplication yokuhambisa ngehlelo ngalinye. Akukho kwalokhu okushiwo yikhulampomthombo, ngakho iphrofayela efanayo ingaveza isethi ehlukile yemizila esebenzayo kumaklayenti amabili.
Ukucushwa okusekelwe kusitifiketi kwengeza elinye igatsha. Lapho iseva ikhiphela idivayisi ethile isitifiketi, njengoba i-MDM nokubhaliswa kwe-SCEP kwenza, ukusisebenzisa futhi efonini yesibili kusebenza kuze kube yilapho iseva iphoqa isikhathi esisodwa ngobunikazi ngalunye, noma kwehluleka ekuxhumaneni kwe-TLS. Hlola inqubomgomo yomkhiphi ngaphambi kokuhlela ukusebenzisa futhi.
Qinisekisa idivayisi entsha ngaphambi kokuthatha umhlalaphansi kwendala
Gcina ifoni endala ixhunyiwe kuze kube yilapho entsha idlula okuthile okungcono kunesithonjana esiluhlaza. Qinisekisa ikheli lokuphuma kudivayisi entsha kanye nesixazululi se-DNS eyasebenzisa ngempela. Uma split tunneling ibalulekile, qalisa uhlelo okufanele ludlule i-tunnel kanye nolunye okungafanele, bese ubona ukuthi yikuphi okufinyelela kumhlinzeki wakho.
Ukuhlolwa okukodwa kunquma ikheli lokuphuma. Vula https://ifconfig.me kusiphequluli sefoni, bese ugijima curl -s https://ifconfig.me kusuka kubhuku lwesandla kwi-Wi-Fi efanayo futhi uqhathanise izimpendulo zombili nekheli elinikezwe umhlinzeki wakho.
Ngaleso sikhathi kuphela thatha umhlalaphansi kobunikazi obudala, futhi kwenze ngomkhiphi: hoxisa isitifiketi noma susa idivayisi ku-akhawunti. Ukusula ifayela kusuka Kwezilandiwe akuphethi lutho, ngoba izinto ezimbili eziphethe isitifiketi esifanayo zibonakala zifana kukholi yeseva.
Uma ukuthunyelwa kuvela kungathwaleki, isisombululo ukubhalisa okusha hhayi isiqephu sokucushwa esidlangalaleni. Cela iphrofayela yedivayisi yesibili, noma khiqiza ipheya lokhiye efonini entsha bese uthumela i-CSR; kuhamba kancane, futhi yiyo indlela esekelwa umkhiphi.
Gijima uhlu lokuhlola ngaphambi kokusula noma yini: idivayisi entsha iyaxhuma, ikheli lokuphuma ne-DNS ziyafana, ububanzi bohlelo ngalunye buyilokho obukuhlosile, ubunikazi obudala buhoxisiwe, futhi noma yiliphi ifayela lokucushwa oliligcinile likusiphetho esibethelwe.