0x noma 0s? Ukuqonda ifomethi ye-PSK ku-ipsec.secrets

Iklayenti elilodwa liqinisekisa ngesikhathi esabiwe kanti elinye liyenqaba, nakuba izinhlamvu ozinamathisile zibukeka zifana nhlangothi zombili. Cishe ziyizinhlamvu ezifanayo; umehluko ukuthi iyiphi imithetho yokuhumusha ifayela eliyisebenzisayo kuzo. Intambo phakathi kwezimpawu zokucaphuna ithathwa njengoba injalo, ithokheni eqala nge-0x ifundwa njenge-hexadecimal, kanti ithokheni eqala nge-0s ifundwa njenge-Base64. Kulezi zindlela ezintathu zokubhala kunesimo esisodwa kuphela esisho lokho obukuhlosile, ngakho ukulungisa ngokuvamile ukuguqulwa hhayi iphasiwedi engcono.

Uphawu lukhomba ekubhalweni kwekhodi, hhayi kumacipher

Lapho iziphetho zombili ziphethe amabhayithi ahlukene, izingxoxo ziyaphumelela noma kunjalo futhi ubufakazi behluleka ngemva kwalokho. Khona-ke ilogi ibika ukwehluleka kobuqotho noma kwe-HMAC esikhundleni sokungafani kwe-algorithm, ngoba isiphakamiso sikhethiwe futhi isinyathelo sokuqinisekisa asizange sivumelane. Lowo mugqa awukaze ukhulume ngokuma kwemfihlo.

Isigaba siwumkhondo. Ukwehluleka okufika ngemva kwesiphakamiso esikhethiwe kusho ukuthi izinhlangothi zombili zavumelana ngakho konke ngaphandle kwempahla yokhiye, kuyilapho «asikho isiphakamiso esikhethiwe» kungokwenqubomgomo noma amasethi e-cipher. Ukuhlola ubuqotho okwehluleka kuyilapho iphasiwedi ibukeka ilungile yikhona okubonakalayo kokungafani kokubhalwa kwekhodi.

Imfihlo eyodwa, izindlela ezintathu ifayela elingayifunda ngazo

Ngenani lamabhayithi amane key1, i-hexadecimal ne-Base64 ziyizindlela ezimbili zokubhala kabusha amabhayithi afanayo, futhi izinhlamvu zokuqala kuphela ezitshela umhlaziyi ukuthi iphi ayiphethe. Izifakazelo ze-swanctl zilandela umkhuba ofanayo, ngakho inani elidluliswa phakathi kwezindawo ezimbili zokuxhumana ligcina incazelo yalo kuphela lapho isiqalo salo sihamba nalo.

10.20.0.5 %any : PSK "key1"
10.20.0.5 %any : PSK 0x6b657931
10.20.0.5 %any : PSK 0sa2V5MQ==

Imininingwane emibili kulelo blokhi ithatha isikhathi esiningi. Izinhlamvu ze-hexadecimal zamukela izimo zombili, ngakho 0x6b657931 kanye no-0x6B657931 inani elifanayo, kodwa inani elingalingani lezinhlamvu lifundwa ngokungalungile buthule esikhundleni sokunqatshwa, okususa yonke ibhayithi ngemva kokusikwa. Ukugcwaliswa kwe-Base64 kuyingxenye yanani, ngakho intambo enamathiselwe ngaphandle kwezimpawu zayo = zokugcina ihumushwa ibe amabhayithi ahlukene esikhundleni sokwehluleka ngomsindo.

Iphrofayela esihumushe kakade inani isiliguqule, ngakho ukuhumusha futhi kuveza amabhayithi ahlukene nokwehluleka kokuqinisekisa okufundeka njengephasiwedi engalungile. Izimpawu zokucaphuna ziyindlela ephephile kukho konke okungacacile, ngoba okuqukethwe kungokwangempela ngisho nalapho kuqala ngophawu lokubhala kwekhodi.

Umbhalo we-Base64 uvelaphi

Ukukhishwa kwamaphrofayela kanye nezingosi zabathengisi kuvamise ukunikeza ukhiye usubhalwe kwekhodi, ngokuvamile emkhakheni wedatha owawungakaze uhloselwe ukuthayipha ngesandla. Kungaba yikho ukuvula lelo nani bese ugcina umbhalo ohumushiwe phakathi kwezimpawu zokucaphuna, noma ukuyeka kubhalwe kwekhodi ngophawu phambi kwalo. Ukwenza uhhafu wakho kokubili yikho okukwephulayo. Zombili izindlela zisebenza kuphela uma lonke inani lisinda ekukopisheni.

Izikhombisi-ndlela zombili ziwumyalo owodwa lilinye, futhi kufanelekile ukuzigcina kwithikithi njengomsebenzi oqondile owakha inani eligciniwe. Ziqhube ngalolu hlelo:

printf '%s' 'a2V5MQ==' | base64 -d
printf '%s' 'key1' | base64

Ukunamathisela umbhalo obhalwe kwekhodi njengombhalo ovamile iyiphutha elibizayo. Ifayela lenza i-hash yezinhlamvu njengoba zibhaliwe, ukhiye otholiwe uphuma cishe ingxenye eyodwa kwezintathu ube mude kunalowo obalwe ngumlingani, futhi wonke umzamo wehluleka ngendlela efanayo ngaphandle sesexwayiso, ngoba umhlaziyi ulandele umthetho awunikeziwe.

Qinisekisa ukuthi yimaphi amabhayithi asetshenziswa ngumlingani ngamunye ngempela

Funda kuqala umbono we-daemon ngoxhumano bese kuba umphumela wokuqinisekisa, esikhundleni sokuqagela imbangela kusukela kuyintambo yephutha. Ukuqhathanisa ubude obugciniwe ukuhlola okusheshayo kokunengqondo, ngoba umbhalo obhalwe kwekhodi mude kunamabhayithi akuwumelelayo. Bese uqinisekisa ukuthi yimuphi umugqa wobunikazi ohambisanayo, ngoba imfihlo elungile ebekwe ngaphansi komlingani ongalungile yehluleka ngendlela efanayo neyengalungile. Ukulandelana kwemigqa yikho okunqumayo: ukuhambisana kokuqala kuyanqoba, ngakho umugqa %any obanzi eduze phezulu ushintsha buthule umugqa othile osanda kuwuhlela.

Layisha kabusha esikhundleni sokuqalisa kabusha uma ifayela selilungile. ipsec rereadsecrets ivuselela ikhophi ye-daemon ye-IKE, futhi ukusethwa kwe-swanctl kulayisha izifakazelo ngomyalo wakho. Ukuqalisa kabusha kulahla zonke izinhlangano ezisunguliwe futhi kuchithe ukuqhathanisa obukuzama ukukwenza.

Akukho kulokhu kuhlola okudinga ukuveza imfihlo. Ubude, isikhethi sobunikazi kanye nendawo yomugqa kuchaza iningi lokwehluleka kwalolu hlobo ngaphambi kokuba othile adinge i-hex dump.

Shintsha ifayela ngaphandle kokufihla umphumela

Khawulela ifayela ku-akhawunti ye-daemon, futhi gcina izimfihlo eziphilayo zingekho kumathikithi, engxoxweni nasezithombeni zesikrini, ngoba ukhiye onamathiselwe ukuvuza hhayi ukuxilonga. Futhi uphila isikhathi eside kunesigameko esiwukhiqizile.

Hlola kusukela kuklayenti olawula ukumiswa kwayo, qinisekisa ukuthi ukuqinisekisa kuyaphumelela, bese uqinisekisa ukuthi umhubhe uthwala ithrafikhi. Ukulayisha kabusha okulungisa ukuxhawulana kuyilapho umzila usaqhekekile kwenye inkinga, futhi kubonakala ngokushesha lapho imfihlo iyeka ukunyakaza.