Ukuqinisekisa kwe-HTTPS Basic kuqhathaniswa ne-IPsec: yini evikelwa yilowo nalowo

Vula amathuluzi onjiniyela, layisha uhlelo lwangaphakathi, bese ubuka indlela isicelo esisodwa esidlula ngayo ezindaweni zokuhlola ezine ngaphambi kokuba ikhasi likhiqizwe. Kuqala igama liyaxazululwa, bese kuvulwa ukuxhumana kwe-TCP, bese ukuxhawulana kwe-TLS kuqinisekisa ukuthi iseva ingubani, futhi ngemva kwalokho uhlelo lubuza ukuthi ungubani. Thatha lezi njengezehlakalo ezihlukene, ngoba ngayinye yehluleka ngobufakazi obuhlukene futhi ngayinye ingeyethimba elihlukile. Ukudideka okuningi ezehlakalweni kuvela ekufundeni i-401 njengenkinga yethaneli, noma inkinga yethaneli njengephasiwedi engalungile.

Indawo yokuhlola yokuqala: ingabe le iyiseva obuhlosile ukukhuluma nayo

Ukuxhawulana kwe-TLS kuphendula lowo mbuzo ngaphambi kokuba noma yiluphi ubufakazi bokungena buhanjiswe. Iklayenti lakho liqinisekisa uchungechunge lwesitifiketi ngokumelene nesitoreji sokwethemba futhi lihlola ukuthi igama elisestifiketini liyafana noma cha nesikhululo osifakile. Uma lokho kwehluleka, isiphequluli sibonisa iphutha lesitifiketi futhi asilokothi lithumele isihloko se-Authorization. Ngakho isicelo sephasiwedi akusona ubufakazi bokuthi iseva ingeyangempela; ubufakazi bokuthi uhlelo luphendule.

Nansi lapho umngcele wokuqala uvela khona. I-TLS ivikela ukuxhumana kuze kufike endaweni yako yokuphela. Uma isilinganisi somthwalo siphelelisa i-TLS bese sidlulisela i-HTTP engenalutho ohlotsheni, ingxenye eshicilelwe iphelela kwisilinganisi, futhi ubufakazi bokungena buvikelekile esigabeni sokuqala kuphela.

Indawo yokuhlola yesibili: yini empeleni ehambayo ekushintshaneni kwe-401

Ukuqinisekisa kwe-HTTP Basic kuthumela isihlonzi somsebenzisi nephasiwedi esihlokweni esisodwa, okubhalwe nge-Base64 njengoba kuchaziwe ku-RFC 7617. Authorization: Basic dXNlcjpwYXNz iyisimo sako; noma ubani ongakwazi ukufunda isicelo angakwazi ukuhlehlisa ukubhala, ngakho konke ukufihlakala kuvela ekuthuthweni okungaphansi. curl -v kukhombisa kokubili inselelo ye-WWW-Authenticate: Basic nesihloko osithumelayo emuva.

Leso sihloko sitshela uhlelo ukuthi ubani obuzayo. Asitsheli inethiwekhi ukuthi ubani angaxhumana, futhi asibhali lutho ngokwaso. Uhlelo kusamele luqinisekise ubufakazi bokungena ngokumelene nesitoreji futhi lunqume ukuthi leyo akhawunti ingenzani, lokho kungukugunyaza futhi kwenzeka ngemva kokuqinisekisa.

Ithaneli le-IPsec lihlala kuphi kuleyo ndlela

Manje hamba uye ngaphandle usuka esipheqululini. Ithaneli le-IPsec phakathi kwamasango livikela ukuthutha okukhethiwe phakathi kwamasango amabili okuphepha, hhayi phakathi kwekhompyutha yakho ephathekayo nenqubo yohlelo. I-ESP kwimodi yethaneli isonga iphakethe lokuqala, amasango ayibhala futhi ayiqinisekise, futhi amakheli angaphakathi ahlala ekhona ukuze uhlangothi olukude lukwazi ukuqondisa isicelo ohlotsheni.

Ukukhetha yingxenye ekhuphisa abantu. Amathaneli asekelwe kumgomo asebenzisa izikhethi zokuthutha, ezivame ukubhalwa njengohlu lokulawula ukufinyelela, ukunquma ukuthi yimaphi amaphakethe angena ethanelini. Amathaneli asekelwe emzileni asebenzisa isixhumi esibonakalayo esingokoqobo kanye nethebula yomzila esikhundleni salokho. Ku-Linux, ip xfrm policy ikhombisa izikhethi futhi ip xfrm state ikhombisa ubudlelwano bokuphepha obusunguliwe; kudivayisi yomlilo wendlela, okulingana nakho ithebula le-SA lethaneli kanye nomkhondo wamaphakethe.

Umphumela kufanele ushiwo ngokucacile. Iphakethe lingahlala ngaphakathi kwethaneli elinempilo ephelele futhi lisathwala isicelo se-HTTPS uhlelo olusilahayo, futhi ubufakazi bokungena obuvumelekile bungafika ngendlela engenalo nhlobo ithaneli uma umzila uvuma.

Funda ukwehluleka kusigaba esikubikile

I-401 isho ukuthi uhlelo aluzange lwamukele ubufakazi bokungena. I-403 isho ukuthi lwamukele ubunikazi futhi lwenqaba umsebenzi. Iphutha le-TLS lisho ukuthi iklayenti alizange lamukele iseva. Ukungabi khona komzila noma ukungafani komgomo kusho ukuthi iphakethe alizange lifike esangweni elikude. Ukwehluleka okune okuhlukene, abanikazi abane abahlukene, futhi akukho nokukodwa okuxilongwa ngokugqolozela ifomu lokungena.

Sebenzisa ubufakazi obukhiqizwa yisigaba ngasinye: iphaneli yenethiwekhi yesiphequluli yesimo nezihloko, openssl s_client -connect host:443 yochungechunge lwesitifiketi, izibali ze-SA kanye namalogi esango okuthutha kwethaneli, kanye nelogi yohlelo lesinqumo se-akhawunti. Uma izigaba ezimbili zibika amaphutha ngesikhathi esisodwa, lungisa esiphansi kuqala, ngoba ithaneli elifile lingafihla kalula ukwehluleka kokuqinisekisa futhi kube njalo nangokuphambene.

Dweba imephu yensizakalo eyodwa kusukela ekuqaleni kuze kube sekupheleni

Bhala imigqa emihlanu yensizakalo oyilungisayo: ithaneli lixhuma iziphi izinhlangothi, izikhethi zivumela amaphi ama-subnet namachweba, i-TLS iphelela kuphi futhi isitifiketi siveza buphi ubunikazi, iyiphi i-akhawunti yohlelo nendima esetshenziswayo, futhi isigaba ngasinye sibhala kuphi. Zigcine ekhasini elilodwa, ngoba inhloso yemephu ukukhombisa lapho umthwalo wesigaba esisodwa uphela khona bese kuthi esilandelayo siqale khona.

Bese uhlola icala elilodwa elingalungile ngesigaba ngasinye. Sebenzisa iphasiwedi engalungile bese uqinisekisa ukuthi uthola i-401, hhayi ukuphelelwa yisikhathi. Xhumana usuka ku-subnet engaphandle kwezikhethi bese uqinisekisa ukuthi iphakethe alidluliswa ethanelini. Veza isitifiketi segama elingalungile bese uqinisekisa ukuthi iklayenti liyenqaba ngaphambi kokuthumela ubufakazi bokungena. Leyo miphumela emithathu ikutshela okuningi ngomklamo kunanoma yimuphi umdwebo wamabhokisi.

Ekugcineni, nquma ngamabomu ukuthi ubuphi ukuvikelwa obudingwa ubudlelwano ngabunye. Ukuqinisekisa kwe-Basic phezu kwe-TLS kufaneleka kuthuluzi langaphakathi elincane elingemva kwesango; akusona isikhundla sokugunyaza umsebenzisi ngamunye noma sokuvikela ukuthutha okungale kwesiphetho se-TLS. Ithaneli livikela indlela, isitifiketi sivikela isigaba, futhi i-401 ivikela i-akhawunti, futhi iyona yokugcina kuphela kulezo eyaziyo ukuthi ungubani.