I-IKEv2 ayiwukuxhawulana okukodwa: IKE SA, ukuqinisekisa, bese kuba yi-CHILD SA
Impendulo yesango ifakazela ukufinyeleleka, hhayi ubunikazi. Landela i-IKE_SA_INIT, i-IKE_AUTH ne-CHILD SA yokuqala, bese uhlola ukuthi yini okufanele ibe yiqiniso ngaphambi kokuba uhambo lwezimoto lweqe.
Ungase ucabange ukuthi uxhumano lwe-IKEv2 luwukushintshana okukodwa okuphela ngokubethelwa kohambo lwakho. Kukhona okungenani okubili, futhi okokuqala akufakazeli muntu ubunikazi. Izinhlangothi ziqala ngemiyalezo yokulawula, zivumelana ngamapharamitha e-cryptographic, zifakazela ubunikazi, bese kuba lapho zixoxa khona ngesimo esithwala amaphakethe ohlelo lokusebenza. Lokho kuhleleka kuchaza ukungafani abantu abakubika njalo: isango liyaphendula, iklayenti lithi lixhunyiwe, kepha uhlelo oluyimfihlo lusaphelelwa isikhathi. Nakhu okwenziwa yisigaba ngasinye ngempela, nokuthi yini okufanele ibe yiqiniso ngemva kwaso.
Inganekwane: uma isango liphendula, uxhunyiwe
Impendulo kumyalezo wokuqala ifakazela ukuthi indawo yokugcina iyafinyeleleka futhi ikulungele ukukhuluma. Ayifakazeli ukuthi i-akhawunti yamukelwe, ukuthi uchungechunge lwesitifiketi luqinisekisiwe, noma ukuthi kunomyalo wokugcina wemininingwane ofakiwe.
Lezo zihluleka zenzeka kamuva, futhi zinikeza izimpawu ezihlukile. Ukwenqatshwa kwesitifiketi noma ukuhluleka kwe-EAP kufika ngemva kokuba ukushintshana kokuqala sekuphumelele, yingakho i-ping eya ku-UDP 500 nesithonjana esiluhlaza kuklayenti kusho okuncane kangaka.
IKE_SA_INIT: vumelana ngamapharamitha, hhayi ubunikazi
Ukushintshana kokuqala kuthwala iziphakamiso ze-IKE security association: ama-algorithm okubethela nokuphelela, umsebenzi ozenzakalelayo we-pseudo, neqembu le-Diffie-Hellman. Izinhlangothi ziphinde zishintshane ama-nonce, futhi uhlangothi ngalunye luthola impahla yokhiye ye-IKE SA kumfihlo owabiwe okhiqizwa yilawa mavelu. Akukho lutho kulokhu kushintshana okuthola ukuthi ngubani ohlangothini olunye. Kuthola kuphela ukuthi izinhlangothi zombili zingabala okhiye abafanayo nokuthi ziyavumelana ngesiphakamiso esisodwa. Umphinduli ongathandi noma isiphi isiphakamiso wenqaba ukushintshana lapha, yingakho ukungafani kwenguqulo noma kwe-algorithm kubonakala sengathi iseva iwile.
I-IKE SA eyakhiwe kuleli phuzu ivikela konke ukushintshana kokuphatha okulandelayo. Lowo umsebenzi wayo, futhi ungumsebenzi ohlukile kunokuvikela amaphakethe akho.
IKE_AUTH: fakazela ubunikazi, bese wakha i-CHILD SA yokuqala
Ukushintshana kwesibili kuthwala ubunikazi. Ngezitifiketi, uhlangothi ngalunye lusayina ngokhiye walo oyimfihlo futhi lwethula uchungechunge okufanele olunye luqinisekise; nge-EAP, umphinduli ubiza umqalisi ngendlela ekhethiwe. Nakhu lapho igama leseva elingalungile, isitifiketi esiphelelwe yisikhathi noma iphasiwedi enqatshiwe kubonakala khona ekugcineni.
Ngokuvamile i-IKE_AUTH ixoxa ne-CHILD SA yokuqala, ngakho ukuvikelwa kwedatha kuvunyelwana ngakho ohambweni olulodwa. Umqalisi uphakamisa izikhethi zohambo, umphinduli uyazinciphisa noma uyazenqaba, futhi okhiye bendlela yedatha batholakala ku-IKE SA. Lokho kusho ukuthi ukushintshana okukodwa kungahluleka ezindaweni ezimbili ezihluke kakhulu: ubunikazi noma umgomo. Funda i-notification payload noma iphutha esikhundleni sokuhluleka kokuxhawulana okujwayelekile, ngoba ikhambi lakho okukodwa isitifiketi kanti kwelinye ukungafani kwesubnet.
Ama-SA amabili, imisebenzi emibili
| Inhlangano | Ivikelayo | Indlela yokuphila |
|---|---|---|
| IKE SA | Ukushintshana kokuphatha: ukuvuselela okhiye, ukususa, ama-payload okumisa | Kuvuselelwa ngohlelo lwakho; indlela yedatha ingasinda ushintsho |
| CHILD SA | Uhambo lohlelo oluhambisana nezikhethi zohambo | Kuvuselelwa ngokuzimela, ngokuvamile kaningi |
Ukuzihlukanisa kuchaza izindlela ezimbili ezibonakala njengeziphutha. Ithinelu lingabonakala limisiwe ngenkathi ukuvuselela okhiye kuhluleka ngemuva, futhi i-CHILD SA ingashintshwa ngaphandle kokuba iklayenti lilahlekelwe uxhumano.
Ku-strongSwan, ireferensi yokumisa ye-IKEv2 kanye swanctl --list-sas kukhombisa womabili amazinga, futhi ip xfrm state kanye ip xfrm policy kukhombisa lokho okufakwe ngempela yi-kernel. Ukuqhathanisa le mibono emibili iyona ndlela eshesha kakhulu yokubona ukuthi ukuxoxa kuphelile noma kubonakale kuphela. Uma i-daemon ibala i-CHILD SA i-kernel engenaso isimo yayo, ukufakwa kuhluleke buthule. Uma i-kernel iphethe isimo i-daemon engasazi, ubheka insalela yomzamo wangaphambili.
Yini okusafanele ibe yiqiniso ngemva kokuba ithinelu likhuphile
Izikhethi zohambo zichaza ukuthi yimaphi amakheli amboziwe. Uma iklayenti lihlongoza isubnet eyodwa kanti iseva ilindele enye, i-CHILD SA iyafakwa kodwa ayithwali lutho olusizo, futhi iphutha livela njengenkinga yomzila hhayi yokuxoxa. Bese kuba yizingxenye zendawo kufanele zibambisane: ukudlulisela kuvuliwe lapho umphathi womzila enza khona umzila, imizila eqonde ethinelwini, imithetho yomlilo evumela amaphakethe aqaqunuliwe, nesixazululi sangaphakathi uma amagama ayimfihlo efakiwe. Ngakunye kwalokhu kuhluleka ngokwahlukana futhi akukho okulungiswa ngokuqalisa kabusha i-daemon ye-IKE.
Gcina ilogi ibonakala ngenkathi uxilonga: ukushintshana kokuqala, bese ukuqinisekiswa kobunikazi, bese ukuqinisekiswa komsebenzisi lapho kusebenza khona, bese ukufakwa kwe-CHILD, futhi ekugcineni uhambo lohlelo. Isigaba esimayo yisona okufanele silungiswe, futhi ukuhluleka komzila kamuva akusoze kube yisizathu sokudekisa ukuhlolwa kobunikazi osekuvele kwadlula.