Ingabe ukhiye womphakathi we-VPN ungabelwa? Hlola izinto ezintathu

Unganikeza ukhiye wakho womphakathi we-VPN kumlingani, kumhlinzeki noma kufórumu, futhi umhubhe uyaqhubeka usebenza. Kodwa ukhiye oyimfihlo awukwazi ukuwunikeza, ngisho kubasebenzi bosekelo, ngaphandle kokunikeza ubunikazi okufakazelwa yilowo khiye. Isinqumo asivamisile ukuhlala sicacile kangako, ngoba abantu badideka ngokuthi yiluphi uhhafu wepheya abalubukayo, nangoba ezinye izindawo zokusetshenziswa zithatha inani lomphakathi njengegama. Izivivinyo ezintathu ziyakuxazulula lokho: yiluphi uhhafu onalo, yini okuxhunywa yindawo yokusetshenziswa, nokuthi ukushintsha kubiza malini.

Isivivinyo sokuqala: yiluphi uhhafu wepheya osemgcini wakho wokunamathisela

Okhiye abalinganisiwe bafika ngamapheya, futhi indlela yokukhipha iyona nto yonke. Ku-WireGuard ukhiye oyimfihlo ungamabhayithi angu-32 angahleliwe futhi ukhiye womphakathi ubalwa kusukela kuwo; ngakolunye uhlangothi akunakwenzeka. wg genkey kubhala inani eliyimfihlo, wg pubkey likhipha elomphakathi, futhi eyesibili kuphela efanele emlayezweni oya kumlingani.

wg genkey | tee private.key | wg pubkey > public.key
chmod 600 private.key
openssl x509 -noout -pubkey -in server.crt

Umhlaba wezitifiketi usebenzisa lokho kwahlukanisa okufanayo ngezingxenye eziningi ezinyakazayo. Isitifiketi seseva sithwala ukhiye womphakathi kanye namagama, futhi sisayinwa ngukhiye oyimfihlo we-CA ongakaze ushiye i-CA. Iklayenti eliqinisekisa leyo seva lidinga isitifiketi se-CA, esisemphakathini, futhi asinanzuzo ngokhiye wokushicilela oyimfihlo we-CA.

Uma ungaqiniseki ukuthi yiluphi inani oluphethe, funa uphawu hhayi igama lefayela. Ibhloko le-PEM eliqala nge------BEGIN PRIVATE KEY-----, noma ifomu elidala BEGIN RSA PRIVATE KEY, ingxenye eyimfihlo. Inani ongakwazi ukulinamathisela ngaphandle kwalolo phawu lingumgadli wokwabelana, kuncike ezivivinyweni ezimbili ezilandelayo.

Isivivinyo sesibili: yini okuxhunywa yindawo yokusetshenziswa kulelo nani lomphakathi

Ukuphepha kwe-cryptographic nokungaziwa kuyizici ezihlukene. Ukhiye womphakathi womlingani we-WireGuard uyisihlonzi esizinzile ngaphakathi kwendawo yokusetshenziswa: ukucushwa kweseva kuyawubala, ukubambana kwesandla kuyawubiza ngegama, futhi umlawuli ofunda izingongolo ubona uchungechunge olufanayo njalo lapho lowo mlingani exhumanisa. Uma uthumela ukhiye eduze kombuzo mayelana nokuhlelwa kwakho, usuxhumanise lolo chungechunge nakho konke okunye okusembhalweni.

Izitifiketi ziveza ubunikazi ngomklamo wazo. I-Subject ne-subject alternative name ziyafundeka, futhi ezitifiketini ze-TLS ezithenjwa umphakathi isitifiketi ngokwaso siyashicilelwa emibhalweni ye-Certificate Transparency, esingaseshwa. Akukho kulokho okuveza ukhiye oyimfihlo, futhi konke kulokho kuveza ubudlelwano.

Yilapho izindawo zokusetshenziswa zihluka khona, futhi yikho okunquma impendulo. Umlingani wokuhlolwa wesikhathi esisodwa kuseva yaselabhorethri uyinto ehlukile kukhiye okhomba indawo yokugcina yendawo ngendawo yenkampani, nakuba amabhayithi ebukeka efana.

Isivivinyo sesithathu: yini ongayihoxisa, futhi ngokushesha okungakanani

Isivivinyo sesithathu sehlukanisa izingxenye ezimbili ngokuphelele. Ukhiye womphakathi oshicilelwe ungashintshwa ngokuhlela kwakho. Ukhiye oyimfihlo oshicilelwe awukwazi ukubuyiswa: ukususa ikhophi yakho akuthinti amakhophi asevele athathiwe, futhi wonke umlingani owawuthemba manje uthemba into ephethwe ngumuntu wangaphandle.

Ukuhoxisa kuyisenzo sokucushwa, hhayi se-cryptographic. I-WireGuard ayinikezi uhlu lokuhoxisa, ngakho ususa umlingani:

wg set wg0 peer <peer-public-key> remove
# then delete the [Peer] block from the config so it does not return on restart

OpenVPN izindawo zokusetshenziswa ezakhiwe ezitifiketini zihoxisa isitifiketi futhi zishicilele i-CRL eseva eyihlola ngempela nge-crl-verify. Ngaphandle kwalowo myalelo uhlu lokuhoxisa luwumhlobiso nje. Kuzo zombili izimo ukulandelana kuyafana: khipha okungena esikhundleni, kusabalalise ngomzila osekelwayo, bese uthatha umhlalaphansi kobunikazi bakudala.

Amaphutha avela ekuhlanganiseni izivivinyo ezintathu ndawonye

Iningi lokuvuza kwangempela akusona isinqumo somuntu sokushicilela ukhiye oyimfihlo. Kuwukufakwa kwephrofayela yonke kufórumu: .conf ifayela le-WireGuard elinalo PrivateKey umugqa, .ovpn iphakethe elinebhloko lokhiye elingaphakathi, noma isithombe sesihloko sekliyenti esiveza ngengozi inkambu yokhiye. Inani lomphakathi cishe lalilungile; lahamba nengxenye eyayingelona.

Izinhlelo zokusebenza zosekelo ziwumthombo wesibili. Akukho sinyathelo sokuqinisekisa esisemthethweni esidinga ukhiye wakho oyimfihlo, ngoba uhlangothi olunye lukhipha okudingayo engxenyeni yomphakathi. Uma ifomu noma umuntu ecela inani eliyimfihlo, impendulo efanele iyinani lomphakathi kanye nomyalelo wasekhaya owukhiqizayo.

Izingongolo nezithombe zesikrini zisekholoni efanayo. Okukhishwayo kokuxilonga kungathwala into yokhiye, izihlonzi zesikhathi kanye namakheli angaphakathi, futhi ukushicilela konke lokho ukuze uthole impendulo yombuzo owodwa kushintsha ukunethezeka okuncane ngokuchayeka okukhulu.

Ngemva kokuvuza kwenani eliyimfihlo, thatha umhlalaphansi kobunikazi

Uma inani eliyimfihlo liphumile ngempela, thatha lobo bunikazi njengobuthathiwe umhlalaphansi. Khiqiza ipheya elisha, faka ingxenye yomphakathi lapho abalingani bayilindele khona, susa umlingani wakudala noma hoxisa isitifiketi sakudala, futhi uhlole izindawo owashicilela kuzo. Awukwazi ukususa amakhophi ongalawuli, ngakho ukususwa kumayelana nekusasa, hhayi okwedlule.

Bese ubhala phansi ukusatshalaliswa: yiluphi ukhiye okwesiphi isisetshenziswa, ubani ophethe ikhophi, okungena esikhundleni kulethwa kanjani, futhi ubani osusa umlingani othathe umhlalaphansi. Lezo yizo izingxenye abantu abazikhohlwayo, futhi zinquma ukuthi ukuvuza kuhlala kuwusizo isikhathi esingakanani.