Inguqulo ye-TLS engavumelekile ku-AnyConnect ku-Linux: qala ngokukala ubukhulu bokulungisa

Leli phutha lifika ngaphambi kombuzo wephasiwedi, futhi leyo yingxenye ewusizo: akukho okusuke kwaqinisekiswa, ngakho izifakazelo akuzona inkinga. Ku-Linux lelo khasi lokukhuluma le-AnyConnect lingavela kunguqulo endala yephrothokholi, eqenjini lokushintshisana kokhiye lama-1024-bit, noma kusethi yokubhala ephindwayo enqatshwa inqubomgomo ye-crypto yohlelo. Ngilisebise izindlela ezintathu ezihlukene emishinini emithathu, futhi okuhlukanisa lezo zixazululo ubukhulu bomthelela, hhayi ubuhlakani. Ngayinye iyavikeleka endaweni efanele futhi iyisimo esingalungile sonke esinye isikhathi.

Funda umyalezo ngaphambi kokuthinta inqubomgomo

Gcina umucu oqondile ovela kukhasi lokukhuluma. Isikhalazo senguqulo sikhomba isendlalelo sephrothokholi, isikhalazo sesitifiketi sikhomba ukuthembana noma ukuqamba amagama, futhi ukungena okuhlulekile kukhombisa izifakazelo. Isango elinikeza i-TLS 1.0 neqembu le-DHE lama-1024-bit, i-AES-256-CBC kanye nesiginesha ye-SHA-1 lingaba nesitifiketi esivumelekile ngokuphelele futhi lisalikwe ngenqubomgomo yesimanje ngaphambi kokuthi imininingwane yakho ithunyelwe.

Hlola iphoyinti lokugcina nge-OpenSSL yohlelo, usebenzisa igama langempela lomaqondisi kanye nebhodi elisetshenziswa yiklayenti.

Uma u-openssl s_client -connect vpn.example.com:443 -servername vpn.example.com ehluleka kanti u--tls1 -cipher DEFAULT@SECLEVEL=0 uphumelela, umngcele inguqulo nosayizi wokhiye ndawonye. Uma umyalo wokuqala ubika ukhiye omncane we-DH esikhundleni sesixwayiso sephrothokholi, inguqulo ilungile futhi iqembu kuphela elidinga ukunakwa. Ungalokothi ufake ukhiye oyimfihlo noma iphasiwedi ekuhloleni.

Ukukhetha 1: khulula yonke iseva ngenqubomgomo ye-crypto

Ku-Fedora naku-RHEL 8 no-9, i-update-crypto-policies --set LEGACY yehlisa inqubomgomo yohlelo ye-OpenSSL, futhi i-update-crypto-policies --show iqinisekisa ukuthi yini esebenzayo. Lokhu kuvamise ukubuyisela umhubhe, kodwa inqubomgomo ifundwa lapho inqubo iqala, ngakho qalisa kabusha iklayenti nanoma yimuphi umsizi eliwudale ngaphambi kokuhlola futhi. Ivumela futhi amaphrothokholi amadala namaqembu abuthaka kuwo wonke amaklayenti e-TLS emshinini, kusukela kusiphequluli esefasiteleni eliseduze kuze kufike kumphathi wamaphakethe avuselela i-kernel.

Lokho kubanzi kuyiyo yonke injongo kanye nayo yonke inkinga. I-LEGACY isebenza kuyo yonke iseva, ihlala isikhathi eside futhi kulula ukuyikhohlwa, ngakho kufanele kube yisinyathelo sokuxilonga noma okuhlukile okubhaliwe ekwakhiweni okulawulwayo, hhayi isimo sokuphumula sesiteshi somsebenzi. Ngike ngabona eyodwa eyahlala ku-LEGACY iminyaka emibili ngoba ingosi eyodwa yangaphakathi yayiyidinga, futhi akekho owayengasho ukuthi yaqala nini.

I-Debian ne-Ubuntu azinayo inkinobho eyodwa yalokhu. Okulinganayo ukuhlelwa kwe-/etc/ssl/openssl.cnf okubeka i-MinProtocol ephansi kanye ne-CipherString = DEFAULT@SECLEVEL=0 esigabeni sokuhlala kohlelo. Ubukhulu obufanayo, ifayela elihlukile, kulula kancane ukulahleka emehlweni ngesikhathi sokuthuthukiswa kwenguqulo.

Ukukhetha 2: ifayela elilodwa lokucushwa kuklayenti elilodwa

Ukucushwa kwe-OpenSSL ngenqubo ngayinye kugcina ushintsho ngaphakathi kwesihlahla esisodwa senqubo, kodwa kuphela uma ifayela lixhunywe ngendlela umtapo wolwazi olindele ngayo. Ukuqamba isigaba se-ssl_conf akwanele: i-OpenSSL ifunda ukhiye wezinga eliphezulu openssl_conf, iwulandela iye esigabeni sokuqala, futhi yabe isifinyelela kokuhleliwe kwe-SSL.

openssl_conf = openssl_init

[openssl_init]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.0
CipherString = DEFAULT@SECLEVEL=0

Khombisa i-OPENSSL_CONF kulelo fayela bese uqalisa iklayenti le-VPN ngesembozo esilithumelayo. Konke okunye kuseva kugcina inqubomgomo ehlala njalo, futhi leso yisici esibalulekile lapho umbuzo wokuhambisana ufika. Qinisekisa ukuthi ifayela lisebenza ngempela ngaphambi kokusola isango: i-OPENSSL_CONF=/path/to/file openssl ciphers -s -tls1 kufanele ibale izinhlelo zokubhala ze-TLS 1.0, futhi umphumela ongenalutho usho ukuthi uchungechunge lwephukile futhi iklayenti ligcine buthule okuhleliwe kohlelo.

Ifayela lizwela enguqulweni. I-OpenSSL 1.1.1 ne-3.x zamukela amagama afanayo ezigaba, kodwa ukuphathwa kwemiyalo ezungeze abahlinzeki kwashintsha ku-3.x, ngakho qinisekisa ngelogi yeklayenti uqobo nangokuxhawulana kokuhlola esikhundleni sokucabanga ukuthi ifayela lifundiwe. Iphutha lokubhala egameni lesigaba lihluleka ngokuvulekile, futhi iklayenti lisebenzisa buthule okuhleliwe kohlelo.

Umkhawulo ukumboza. Noma yini exhunywe ku-GnuTLS noma ku-NSS ayinaki i-OPENSSL_CONF, kanjalo nanoma iyiphi inqubo yomsizi iklayenti eliyiqalisayo ngaphandle kokuthola imvelo njengefa. Hlola nge-ldd ukuthi i-binary ixhunywe kuwuphi umtapo we-TLS ngempela ngaphambi kokwakha isembozo, ngoba impendulo inquma ukuthi lolu khetho lukhona yini nhlobo.

Ukukhetha 3: i-VM noma isitsha esisetshenziswa kanye

Kumuntu wesivumelwano ohlasela isango elilodwa elidala amasonto amabili, i-VM ezinikezelwe enenqubomgomo ekhululiwe ingumngcele ohlanzekile ukwedlula isiteshi somsebenzi. Indawo endala nephrofayela yokusebenzisa isiphequluli yansuku zonke ziyeka ukwabelana ngenqubomgomo ye-kernel, futhi ukulahlwa ukususa, hhayi ukutholakala kokuhlolwa.

Isemashini esexhumene nenethiwekhi, ngakho khawulela ukufinyelela kwayo futhi uyigcine kude nokuphequlula okuvamile. Izindleko zokunakekela iwumbukiso omunye okufanele uqweqwe, okuyiqiniso kodwa okulinganiselwe futhi okubonakalayo, ngokungafani nefulegi ye-LEGACY ekhohliwe kukhompyutha ephathwayo.

Ukuqhathanisa kukushiya nani

Khetha ngemibuzo emithathu: ubani odinga iphrothokholi endala, isikhathi esingakanani, futhi ubani ozobona uma okuhlukile kuphila isikhathi eside ukwedlula isizathu sako. Uhlelo lokusebenza olulodwa, umuntu oyedwa, izinsuku ezimbalwa kukhombisa ukucushwa ngenqubo. Ithimba lonke ngemuva kwedivayisi eyodwa likhomba isango uqobo. Noma yini edinga inqubomgomo ye-LEGACY unomphela kuseva iyisinqumo sokuthenga esigqoke ingubo yezobuchwepheshe.

Ukulungisa okuhlala isikhathi eside kungokwedivayisi: i-TLS 1.2 noma entsha, iqembu elingaphansi kwe-2048 bit, ukubhala kwe-AEAD, kanye nesitifiketi esinesiginesha yesimanje. Cela umnikazi wedivayisi lolo shintsho, bese uqinisekisa inguqulo nokubhala okuxoxiwe ngakho kulogi yeklayenti. Bhala phansi okuhlukile kanye neseva, isango, iphrothokholi okuxoxiwe ngayo, umgunyazi kanye nosuku lokuphelelwa yisikhathi, ngoba leyo nothi iyona evimbela isixazululo sesikhashana ukuba sibe yisimo esihlala njalo.