Ifayela le-DH noma ukhiye we-tls-auth? Ukuhlukanisa amafayela amabili e-OpenVPN

Amafayela amabili, imiyalo emibili, kanye nomkhuba wokuqamba womabili ngokwalokho akuhlelayo. Yileyo ndlela i-dh.pem efika ngayo emgqeni we-tls-auth futhi iklayenti lihluleke ngomlayezo mayelana nefomethi yokhiye engalindelekile. Isinqumo esiphambi kwakho akusikho ukuthi yiliphi ifayela elinamandla kakhulu. Ukuthi iyiphi indima okudingwa ngokusetshenziswa, futhi izimo ezintathu zinquma lokho: ukushintshana kokhiye okuzoxoxisana ngakho isitaki sakho se-TLS, ukuthi uyafuna yini ukuqinisekiswa kwesiteshi sokulawula, nokuthi ingabe into yokufihla kufanele ihlale iyimfihlo.

Ziphendule ngokulandelana futhi umbuzo wefayela uzoziphendula wona. Uma uzishiya, amagama emiyalo aqala ukubonakala eshintshana, futhi iphutha livela kanye kuleso simo.

Funda ilebula ngaphambi kwegama lefayela

Umgqa wokuqala wefayela usitshela okuningi kunegama lalo, ngoba igama liwumkhuba wabantu kuyilapho ilebula lenziwa yithuluzi. Amapharamitha e-Diffie-Hellman aphethe ilebula le-PEM elithi BEGIN DH PARAMETERS. Ukhiye ozinzile we-OpenVPN uyisakhiwo esihluke ngokuphelele, unekhanda lawo nomthwalo we-hex.

Ukuqamba kabusha akuguquli lutho. Ifayela lamapharamitha elibizwa nge-ta.key lisengamapharamitha, futhi ukhiye ozinzile obizwa nge-dh.pem usengukhiye ozinzile; umhlaziyi ufunda okuqukethwe futhi wenqaba ukungafani. Hlola ngaphambi kokuhlela iphrofayela:

head -n 1 dh.pem
head -n 1 ta.key

Izimo ezintathu ezinquma ukuthi udinga liphi ifayela

Isimo sokuqala ukushintshana. Ukuxhawulana kwe-Diffie-Hellman endaweni elinganiselwe kudinga iqembu, futhi umyalo we-dh iyindawo lapho iseva ibiza khona amapharamitha ayo. Ukuxhawulana kwijika eliyisiyingi akulidingi nhlobo lelo fayela, ngoba ijika liwuhlu lwamapharamitha ngokwalo. Uma iseva yakho ixoxisana kuphela ngamasethi e-ECDHE, ifayela le-DH lingumthwalo ofile hhayi amandla engeziwe.

Isimo sesibili ukuqinisekiswa kwesiteshi sokulawula, isici esihlukile esinempahla yaso. Ifayela le-tls-auth ungukhiye ozinzile owabiwe owenziwa yizinhlangothi zombili, osetshenziselwa ukusayina amaphakethe esiteshi sokulawula ukuze uhlangothi olungaqinisekisiwe lungakwazi ngisho ukuqeda ukuxhawulana. Ukhona noma ngabe usebenzisa i-DH yendawo elinganiselwe noma cha, futhi akanakho ukuxhumana namapharamitha eqembu.

Isimo sesithathu imfihlo nokusatshalaliswa. Amapharamitha e-DH angashicilelwa ngaphandle kokwenza isikhathi sibe buthaka, ngoba amanani ayimfihlo enziwa ukuxhawulana ngakunye futhi awasoze ashiye izinhlangothi. Ukhiye ozinzile akumele ushicilelwe: angamabhayithi afanayo emikhawulweni yomibili, awuzishintshi ngokwawo, futhi noma ngubani onabo angakhiqiza amasayini asemthethweni esiteshi sokulawula. Lezi zimpendulo zimbili zikhomba emthethweni wokusingatha ohluke ngokuphelele, yingakho ifayela elilodwa lingahlala endaweni yokugcina kuyilapho elinye lingakwazi.

Khiqiza impahla efanele yendima ngayinye

Sebenzisa ithuluzi elikhiqiza ifomethi elindelwe umyalo esikhundleni sokuguqula phakathi kwazo. Kukhiye owabiwe ku-OpenVPN 2.6, ifomu elinohlobo lwakwa-generator lisho ngokusobala inhloso.

openvpn --genkey tls-auth ta.key

Lowo myalo wenza impahla entsha eyimfihlo; awulungisi futhi awuhloli ukhiye okhona, futhi ukuwusebenzisa futhi kukunikeza ukhiye ohlukile ongenawo ezinye izinhlangothi. Kopisha ifayela elivelayo kuzinhlangothi ezilidingayo ngomsele ongawusebenzisa kunoma iyiphi imfihlo eyabiwe, futhi gcina umkhuba wesiqondiso unguqho: nge-tls-auth, uhlangothi olulodwa lusebenzisa i-key-direction 0 kanti olunye lusebenzisa i-key-direction 1.

Amapharamitha e-DH, lapho edingeka, avela ekwenziweni kwamapharamitha hhayi ku-generator yokhiye, futhi umsuka wawo ubalulekile ngisho nomphumela usobala. Iqembu elithathwe emthonjeni ongaziwa alibi lokwethenjwa ngokuba lisobala; kusafanele libe yiqembu izinhlangothi zakho ezivumelana ngalo futhi elingancishwa amandla ngobukhulu noma ngokwakhiwa kwalo.

I-dh none isho ukuthini futhi ayisho ukuthini

dh none uwumyalo wangempela onencazelo encane: alikho ifayela lamapharamitha endawo elinganiselwe elizolayishwa, ngoba ukuxhawulana kusebenzisa i-Diffie-Hellman yejika eliyisiyingi. Akusona isifinyezo sokuthi «weqa isinyathelo se-DH» ngomqondo wokwenza buthaka okuthile, futhi akusho neze ku-OpenVPN ukuthi yamukele elinye ifayela njengelithatha indawo.

Amaphutha amabili avela ekulifunda kabi. Elokuqala ukucabanga ukuthi i-dh none isusa isidingo se-tls-auth, kuyilapho kokubili kulawula izinto ezihlukene. Elesibili ukugcina umugqa we-dh ophelelwe yisikhathi eceleni kokuhlelwa kwejika kuphela bese uzibuza ukuthi iyiphi ifayela iseva eyisebenzisayo ngempela; uma umyalo ukhona, ifayela liyafundwa, futhi indlela ephukile lapho yenza ukuqala kuhluleke ngesizathu esingahlobene nokushintshana okuzoxoxiswana ngakho.

Uma ifayela elingalungile selivele litshalwe

Buyisela imfihlo ebiyelwe kumnikazi wephrofayela futhi ungathinti ukuqinisekiswa kwesitifiketi ngesikhathi wenza lokho. Ukwehluleka ukungafani kwefomethi, hhayi ukwehluleka kokwethemba, futhi ukuvala ukuqinisekiswa ukuze weqe iphutha kushintsha inkinga yokuqala ibe inkinga ethule.

Bese uhlukanisa izigameko ezimbili abantu abajwayele ukuzihlanganisa. Ukushicilela ifayela lamapharamitha e-DH cishe akunabungozi, ngoba amapharamitha abesesidlangalaleni ngokwakhiwa. Ukuveza ukhiye we-tls-auth kungenye into: ukhiye uqinisekisa amaphakethe esiteshi sokulawula kuzo zonke izinhlangothi ezinabo, ngakho ukushintshwa kufanele kuxhumaniswe kukho konke ukusetshenziswa hhayi kusetshenziswa kusibungu esisodwa.

Ukuhlola kwemizuzu emihlanu kunquma ukuthi usesimweni sini: funda umugqa wokuqala wafayela ngalinye, qinisekisa umyalo oyikhombayo, futhi uqinisekise ukuthi ukusatshalaliswa kwefayela kuhambisana nalokho okudingwa impahla. Lowo ngumsebenzi omncane kunokwakha kabusha i-PKI esebenzayo, futhi yilokho izimo ezintathu ebezikhomba kukho sonke isikhathi.