Amagama amabili e-DNS, imbobo eyodwa ye-OpenVPN: yini ekhethayo ngempela

Amarekhodi amabili e-A, ikheli elilodwa, i-daemon eyodwa: noma yiliphi igama umsebenzisi alibhalayo, iphakethe elifikayo liyafana, futhi inqubo eboshelwe embobeni 1194 ayinalutho lokuhlukanisa lezi zimbili. Lokhu akusona isethingi engalungile elinde ukulungiswa; kungumngcele walokho okungashiwo ukusesha kwegama. Noma yini ekhetha phakathi kwezimo ezimbili ze-OpenVPN kufanele ibe yinani elibekwa yiklayenti kuxhumano futhi elingafundwa kabusha yingxenye yangaphambili, futhi iklayenti le-OpenVPN elijwayelekile alibeki inani elinjalo obala. Okulandelayo yilapho lokhu kukushiya khona, nokuthi yiziphi izinhlelo ezihlukanisa ngempela ithrafikhi.

Qala ngalokho okubuyiswa yisixazululi

Iklayenti licela i-vpn-a.example futhi lithola ikheli; lelo kheli kanye nembobo konke elikushayayo. Igama lisetshenziswa endaweni, ngesikhathi sokusetsha, futhi alikaze libe inkambu ocingweni, ngakho umlaleli kwelinye icala akakwazi ukubona ukuthi yiluphi uphawu olusetshenzisiwe. Khomba i-vpn-a.example ne-vpn-b.example kumgcini oyedwa futhi kokubili ukusesha kunikeza indawo efanayo, yingakho i-daemon imunca kokubili ukuxhumana kusimo esisodwa ngaphandle kokubhala umehluko. Amaphrofayili asekelwe ekhelini aziphatha ngendlela efanayo nalawo asekelwe egameni, ngesizathu esifanayo.

Lokhu futhi kuvala umndeni wezindlela ezihehayo: amagama anyeziwe, ukukhetha isitifiketi segama ngalinye kusokhethi eyodwa, noma umthetho we-firewall oboshelwe egameni elibuziwe. Akukho kukho okungasebenza olwazini olwalusuke lwalahlwa ngaphambi kokuba iphakethe lokuqala lishiye iklayenti. Uma amaseva amabili kufanele ahlale ehlukene, ukwehlukanisa kufanele kuhamba nokuxhumana uqobo, okusho ikheli, imbobo, noma inkambu yomthwalo echazwa iphrothokholi.

Isikhethi esisodwa esibalwayo sihamba ngaphakathi kwephakethe

I-HTTP ikwenza lokhu ngesihloko se-Host, futhi i-TLS ngokunwetshwa kwegama leseva ku-ClientHello, futhi ngale ndlela ikheli elilodwa likhonza izingosi eziningi ngemuva komlaleli oyedwa. Kokubili kuyasebenza ngoba iphrothokholi yocingo ithwala isicelo sesevisi ethile. Iqiniso elibalulekile nge-OpenVPN ukuthi azikho kulezi zinkambu ezimbili ezikhona kusendlalelo esihlolwa ibhokisi eliphakathi nendawo.

Ekuhlelweni okujwayelekile ukuxhawulana kwe-TLS okuvikela itshaneli yokulawula kwenzeka ngemuva kokusungulwa kwesikhathi sangaphandle futhi kuthwalwa ngaphakathi kwaso, ngakho umlaleli ongakasiqedi leso sikhathi ubona ukugeleza okungacacile. Isengasho ukuthi lokhu yi-OpenVPN, ngoba i-opcode nokuhlanganisa kumabhayithi okuqala kuyabonakala, kodwa igama leseva, uma likhona, lihlala engxenyeni eshicilelwe. Idizayini elindele ukufunda umgcini mbumbulu ephethetini langaphandle ifunda inkambu iphrothokholi engayibhalanga lapho. Lokhu kuvela endleleni okwakhiwe ngayo umhubhe, hhayi emgodini ongavinjwa ukufaniswa kwephethini okuhlakaniphe kakhulu.

Lapho isihlukanisi sephrothokholi sima khona

Isihlanganisi sohlobo olubhalwa iphrojekthi ye-sslh silalela embobeni eyodwa, sihlola amabhayithi okuqala, futhi sinikela ukuxhumana kunoma iyiphi i-backend ekhuluma iphrothokholi eyaziwe. Lokho kuyinani langempela lapho imbobo eyodwa kufanele ikhonze i-SSH, i-HTTPS ne-OpenVPN ndawonye.

I-sslh igcina uphenyo oluhlukile lwephrothokholi ngayinye, futhi uphenyo lwayo lwe-TLS lungakhipha igama leseva noma inani le-ALPN ku-ClientHello yangempela. Ukubona i-OpenVPN yemvelo kuwukuhlukanisa okuhlukile ekufundeni ukunwetshwa kwe-TLS, futhi kokubili akuhlanganiswa, ngoba iklayenti elingalokothi lithumele i-ClientHello kusokhethi elalelayo lishiya uphenyo lungenawo into yokufunda. Ngakho umthetho ohambisana ne-OpenVPN uphendula “lona yiklayenti le-OpenVPN” futhi awudluleli phambili. Ama-backend amabili e-OpenVPN ngemuva kwalowo mthetho awahlukaniseki, ingxenye yangaphambili ayinasisekelo sokukhetha, futhi zonke izikhathi zihlala endaweni eyodwa. Ukuhlanganisa kuhlanganyela imbobo eyodwa phakathi kwezinsizakalo ezahlukene; akwenzi ukusingathwa mbumbulu ngaphakathi kwensizakalo eyodwa.

Izinhlelo ezihlukanisa ngempela amaseva amabili

Ukwehlukanisa okuqotho okushibhe kakhulu yikheli lesibili lomphakathi, elilodwa kusimo ngasinye, futhi amaphrofayili akhona asevele athwala okudingekayo ngoba akhomba emakhelini ahlukene. Okulandelayo yimbobo ehlukile ekhelini elifanayo, engabizi lutho ngaphandle kwenombolo kuphrofayili ngayinye. I-TCP ne-UDP zigcina amathebula emibobo ahlukene, ngakho i-1194/tcp ne-1194/udp kungamasokhethi angahlobene futhi eyodwa kuyo ngayinye ingaba khona kumgcini oyedwa; lokho ukwehlukaniswa kokuthutha hhayi ukuhlela ngokwamagama, futhi kuvame ukudidaniswa nakho. Zombili lezi zinketho zidlula ukubuyekezwa kwe-firewall, ngoba umthetho uhambisana nento iphakethe elinayo ngempela.

Uma umngcele owudingayo uhamba phakathi kwamaqembu abasebenzisi hhayi phakathi kwezindlela ezimbili zokusebenza, isimo esisodwa esinokuhlelwa kwamaklayenti ahlukene, ukuphatha kwaso isitifiketi kanye nenqubomgomo yokufinyelela ecacile kungakuhlanganisa. Lokho okuthengwayo inqubomgomo ngaphakathi kweseva, hhayi ukwehlukaniswa phakathi kwamaseva, futhi lezi ziyizidingo ezahlukene. Ukwehlukaniswa okufanele kume ngaphansi kokuhlaselwa kusadinga ikheli noma unqenqema lwe-firewall.

Isipheli se-TLS esibekwe phambi kwe-OpenVPN singadalula igama leseva langempela engxenyeni yangaphambili enekhono, kodwa kuphela lapho uhlangothi lweklayenti nalo luhlelwe kulelo sendlalelo esengeziwe. Amaphrofayili akhona awazitholi lezi ziphathi ngokukhonjiswa ekhelini elifanayo kuphela.

Fakazela isikhethi ngaphambi kokwakha

Shono inkambu ezobona i-backend, bese uqinisekisa ukuthi iklayenti iyithumela ngempela; uma impendulo iyikheli isu liyayima, futhi uma kuyigama leseva ngaphakathi kokuxhawulana okungafinyeleli kumlaleli, akukho msebenzi we-DNS ozokusindisa. Imiyalo emithathu inquma ngokushesha uhlangothi olalelayo.

ss -lntup | grep -E ':443|:1194'
openssl s_client -connect vpn-a.example:443 -servername vpn-a.example </dev/null | head -n 20
journalctl -u openvpn-server@server-a -n 20 --no-pager

Umgqa we-openssl unikeza isitifiketi kuphela lapho okuthile kulelo kheli kuqeda i-TLS; uma kubhekene nomlaleli we-OpenVPN wemvelo uyagxambukela noma wehluleka, futhi lokho uqobo kuyimpendulo yalokho okudalulwa isendlalelo sangaphandle. Umgqa we-journal, uma ufundwa kuyo yonke i-backend, ukhombisa ukuthi yisiphi isimo esamukele isikhathi. Amalogi engxenye yangaphambili abhala lokho okwahlukaniswa futhi awalokothi abhale lokho okwakuhlosiwe, ngakho i-backend ihlala iyisiphathimandla esisodwa ngokuthi umsebenzisi wahlala kuphi.

Qeda ngamaphrofayili amabili ahloselwe ukufinyelela amaseva ahlukene, wahlanganise ngawodwana futhi ubhale ilogi ye-backend kuwona ngamunye. Uma zombili izikhathi zivela ku-journal eyodwa, isikhethi asikho hhayi ukuthi silihlelwe kabi, futhi isixazululo yikheli noma imbobo iklayenti elingayiqonda. Ukuhlela umthetho wokuhlela akuzosiza, ngoba umthetho awukaze unikezwe into yokuhlela ngayo. Uma ukwehlukaniswa sekungokoqobo, kubhale eceleni kwamaphrofayili ukuze umuntu olandelayo angangezi elinye igama futhi alindele ukuthi lizowenza umsebenzi.