Ingabe i-handshake ye-VPN ehlulekile iwukuhlasela kwe-downgrade ngempela?

I-handshake ephetha ngephutha izwakala njengokuhlasela kuze kube yilapho ubheka umlayezo, futhi ngokuvamile iwukubala: asikho isiphakamiso esabiwe, isitifiketi esiphelelwe yisikhathi, noma iphakethe elingakafiki neze. Ukuhlasela kwe-downgrade kuyinto ethile: isitha esicindezela iziphetho zombili ekuziphatheni okubuthakathaka kunalokho obekuzokukhetha, futhi sishiya ubufakazi obuhlukile. Ukuthatha konke ukwehluleka njengobubi kukuthumela ukufuna isisulu okungenzeka singekho, kuyilapho ukuthatha i-downgrade yangempela njengephutha lokumisa kushiya umphumela obuthakathaka endaweni yawo. Lawa maphutha amabili abiza ngendlela ehlukile, futhi yilodwa kuphela elilungiseka kalula.

Ukuhlasela kwe-downgrade kushintsha ini ngempela

Inhloso akuyona ukuphula i-cipher futhi akuyona ukuqagela ukhiye. Inhloso ukuthonya izingxoxo ukuze izinhlangothi zombili zime esimweni esidala noma i-algorithm ebuthakathaka abahlaseli abangayiphatha, noma ukwenza uhlangothi olulodwa lukhole ukuthi olunye lusekela lokho kuphela.

Okushintshayo isivumelwano, hhayi ukuqinisekiswa. Uma umhlaseli ekwazi ukushintsha isiphakamiso ngaphandle kokubonwa, izinhlangothi zisengaqeda i-handshake futhi zisaqinisekisana, kodwa ngamapharamitha akhethwa umhlaseli. Yingakho umbuzo othakazelisayo uwukuthi ingabe izingxoxo ngokwazo zihlanganisiwe ekuvikelweni kobuqotho.

Kungani izingxoxo ngokwazo kufanele ziqinisekiswe

I-TLS 1.3 yenza lokho kuvikelwa kube sobala. Iklayenti elinikeze inguqulo entsha iyakwazi ukuthola iseva ehlehlela emuva ngokuthula, ngoba inani elingahleliwe leseva liphethe iphethini eqinile uma lixoxisana nge-1.2 noma ngaphansi, futhi iklayenti kufanele lime uma libona lokho. Umbhalo wokuxoxa uphelele nawo uhlanganiswe nemilayezo yokugcina, ngakho ukushintsha noma kuphi ezingxoxweni kwehluleka kamuva esikhundleni sokudlula ngokuthula.

Izinguqulo ezindala zeprotocol zazinezinganekwane ezibuthakathaka, futhi yikho kanye okwenza imithetho yokubuyela emuva ibaluleke. Iphuzu le-TLS 1.0 kusimo esifanayo akulona ukuhlasela kwe-downgrade; kuwumphumela ovunyelwe owakhetha ukuwuvumela. Umehluko uwukuthi umphumela obuthakathaka uvela esinqumeni esivikelwe noma endleleni engavikelwe umxhumanisi ayengayithonya. Uma usho kanjalo, izehlakalo eziningi ziphenduka umbuzo wokumisa.

I-IKEv2 iziphatha ngendlela ehlukile kodwa incike embonweni ofanayo. Isiphakamiso sithwalwa ekushintshisaneni okugcina kuqinisekisa izinhlangothi zombili, ngakho ibhokisi eliphakathi elibhala kabusha ama-algorithm liphula ukuqinisekiswa esikhundleni kokukuqondisa. Isiteshi sokulawula se-OpenVPN sivikela izingxoxo zaso nge-TLS bese sisebenzisa leso siteshi ukuvumelana ngama-cipher esiteshi sedatha, yingakho umugqa welogi wesiteshi sokulawula uyinto ethakazelisayo.

Ukuhambisana okumisiwe akulona ukuhlasela

Umlawuli angavumela ngamabomu izinketho ezindala ukuze asekele iklayenti elibhalisiwe, futhi leso sinqumo siyabonakala ekumiseni. Umhlaseli akanakho ukwakha lokho kumisa; angasebenzisa kuphela indlela emvumela ukuthonya isiphakamiso.

Ukulungisa okuyingozi yilokho okususa ubufakazi bomehluko. Ukuvula zonke izinketho zakudala, ukuvala ukuqinisekiswa kwesitifiketi noma ukwamukela noma iyiphi i-cipher ukuze iphutha linyamalale kwandisa lokho iphuzu lokugcina elizokwamukela, futhi kususa izikhathi zokuhlola obekuzobika umphumela obuthakathaka.

Uma kufanele ugcine inketho eyodwa endala, shono isizathu neklayenti kumazwana wokumisa, bese ukhawulela inketho kuphrofayili eyidingayo. Ukuxolelwa kokuhambisana okukhawulelwe kumsilaleli oyedwa kuyacwaningwa; lokho okusetshenziswe emhlabeni wonke kumane kuyizingenelo ezibuthakathaka okungekho okhumbulayo ukuthi wazikhetha.

Funda ukwehluleka ngaphambi kokusho isizathu

Gcina intambo yephutha eqondile, izinguqulo zeklayenti neseva kanye nesikhathi ngaphambi kwanoma yiluphi ushintsho. Bese uhlunga: izingxenye bezingavumelani ngesiphakamiso, indlela yamaphakethe yehlulekile, noma uhlangothi olulodwa lwenqaba ipharamitha eyayikwamukela ngaphambili?

Ukungafani kwesiphakamiso ngokuvamile kubiza izinguqulo noma ama-algorithm anecala futhi kwehluleka endaweni efanayo njalo. Inkinga yomzila noma ye-MTU iyama noma iphelelwa isikhathi, futhi ivamise ukuhluka ngokwenethiwekhi. Isitifiketi esiphelelwe yisikhathi siveza iphutha lokuqinisekisa hhayi lokuxoxisana.

Akukho kwalokhu okuwubufakazi bomhlaseli. Ukunikeza isizathu sobubi ekuphutheni kokuqala yilona iphutha, ngoba kufihla ibug eqinile elizophinda lehluleke kusasa.

Qinisekisa ukuthi kwakhethwani ngempela

Ngemuva kwanoma yisiphi isilungiso, funda umphumela okwaxoxwaniswana ngawo esikhundleni sokukholelwa ukuthi uxhumano lwenyukile. Uxhumano oluyimpumelelo ngenxa yokuthi ukuqinisekisa kususiwe yiwona mphumela obufuna ukuwugwema. Imiyalo emibili elandelayo ibonisa inguqulo ne-cipher ekhethiwe yephuzu lokugcina eline-TLS ngaphambili, kanye nomugqa wesiteshi sokulawula ovela kulogi yeseva OpenVPN.

openssl s_client -connect 198.51.100.30:443 -servername vpn.example.net -brief </dev/null
grep -iE 'Control Channel|Data Channel' /var/log/openvpn.log | tail -5

Qhathanisa umphumela nokumisa obekuhlosiwe, hhayi nalokho okuxhuma manje. Uma inguqulo ekhethiwe indala kunobuncane obuvunyelwe, iphrofayili noma uhlu lokubuyela emuva yindawo okufanele ibhekwe, futhi impendulo ukulungisa lolo hlu, hhayi ukumemezela ukuhlasela nokwakha kabusha konke okuzungezile.