Ukwenqatshwa koxhumano akusiyo inkinga yesitifiketi: incwadi yokusebenza ye-VPN

Iklayenti lithi uxhumano lwenqatshiwe ngemuva nje kokuba uphinde wakhiqize i-CRL, ngakho i-CRL ibonakala inecala. Akunjalo. Ukwenqatsha kuyimpendulo yosongo lwezokuthutha, futhi ukuqinisekiswa kwesitifiketi kwenzeka kamuva, ngaphakathi kwe-handshake yomhubhe. Isikhathi esifanayo singumongo, akusona ubufakazi.

Ukuhlola okubili kwehlukanisa amacala esikhathini esingaphansi komzuzu, futhi akukho kukho okuthinta izilungiselelo zokuthembela.

Funda iphutha kusongo oluyidalile

I-ECONNREFUSED evela ku-connect isho ukuthi umzamo wezokuthutha wenqatshiwe: okuthile kuphendule nge-reset, noma isitaki sabika imbobo engafinyeleleki. Inkinga yesitifiketi ayikwazi ukukhiqiza lelo phutha, ngoba i-handshake ye-TLS ayiqali neze ngaphandle koxhumano lwezokuthutha. Uma ubona ukwenqatshwa, iklayenti alikaze lifinyelele ekukhipheni isitifiketi. Lelo qiniso elilodwa lisusa ukukhanselwa njengesizathu.

Okuphambene nakho kuyiqiniso. Isitifiketi esikhanseliwe sikhiqiza uxhumano lwe-TCP oluphelele kanye ne-handshake ehlulekile, okubhalwa kuseva njengephutha lokuqinisekisa.

Ukwenqatshwa kwe-TCP: akekho olalelayo

Nge-TCP, hlola ukuthi ingxenye ehlosiwe iyasebenza futhi ixhunywe ekhelini nembobo ekusiprofayili. ss -lntp ikhombisa abalaleli, futhi ukungabikho komunye yincazelo evamile. I-firewall enqabayo esikhundleni sokuphonsa iphansi ikhiqiza umyalezo ofanayo ohlangothini lweklayenti, yingakho uhlola kokubili.

Hlola nomndeni wamakheli. Isevisi eboshelwe ku-127.0.0.1 noma ku-IPv6 kuphela izonqaba iklayenti elixazululwa kwelinye.

Bese ufunda ilogi yesevisi esikhundleni sokuqagela. Ukuqala kabusha ngemva kokunakekelwa kwe-CA kungase kwehluleke kufayela elingafundeki noma elingekho futhi kungaze kufinyelele esimweni sokulalela, futhi ilogi isho ifayela. Lokho kuwukwehluleka kokuqala, iphutha elihlukile kunestifiketi esenqatshiwe.

I-UDP ayinayo i-handshake yokwenqaba

OpenVPN phezu kwe-UDP ayisunguli uxhumano ngomqondo we-TCP, ngakho akukho okungenqatshwa ngesikhathi se-connect. Ku-Linux, iphutha eliboniswa isokhethi ye-UDP lingavela ku-ICMP port-unreachable ekhiqizwe idathagramu yangaphambili. Ikhasi lencwadi ye-udp(7) lichaza lokho kuziphatha okungahambisani nesikhathi.

Yingakho iklayenti le-UDP lingaphrinta ukwenqatshwa ngenkathi inqubo yeseva isebenza kodwa ingaboshelwe ekhelini elilindelekile.

I-CRL ihlolwa kuphi ngempela

I-CRL ibuzwa ngesikhathi se-handshake ye-TLS, ngemva kokuba uhlangothi olunye lwethule isitifiketi salo, futhi kuphela uma ukucushwa kweseva kukuvumela. Inketho ye-OpenVPN crl-verify ikhomba kufayela, futhi ukwehluleka kuvela kulogi yeseva njengephutha lokuqinisekisa elisho isitifiketi.

Ngakho iklayenti elikhanseliwe lixhuma kusongo lwezokuthutha bese lehluleka ekuqinisekiseni ubunikazi. Iseva efanayo, imbobo efanayo, umyalezo ohluke ngokuphelele.

Hlola umkhiphi kanye nezinsuku zokusebenza ze-CRL uma ufika kuleso sigaba. I-CRL esayinwe i-CA engalungile, noma leyo ephelelwe yisikhathi ngaphambi kokuba iklayenti lixhumane, ikhiqiza amaphutha okuqinisekisa angenawo umphumela esitifiketini seklayenti uqobo.

Incwadi emfushane yokusebenza ngokuzayo

Qinisekisa ukuthutha kuqala: umlaleli ukhona, umndeni wamakheli ulungile, i-firewall ayinqabi. Bese uqinisekisa ukuthi isevisi yafinyelela esimweni sokulalela ngokufunda ilogi yokuqala. Futhi ngemva kwalokho kuphela bheka amaphutha e-handshake ngemiyalezo yokuqinisekisa. Gcina lokho kulandelana kuqinile, ngoba isinyathelo ngasinye sisusa isigaba esiphelele sezizathu.

Bhala phansi ukuthutha, indawo okwaxazululwa kuyo, imbobo kanye nombhalo oqondile wephutha. Ukufaka kabusha iklayenti kuconsa lobo bufakazi futhi ngokuvamile akushintshi lutho.