Ubunikazi obubili ekungeneni okukodwa kwe-IKEv2: umshini, bese kuba umsebenzisi

Isitifiketi sekhasimende siqinisekiswa, ukushintshana kokuqala kuqedwa, bese ukuxhumana kuma ngephutha elimayelana nomjikelezo owengeziwe wokuqinisekisa. Akukho okungalungile ochungechungeni lwezitifiketi futhi akukho okushintshile enetini. Ingwango ilungiselelwe ukufuna ubufakazi besibili ohlangothini oluxhumayo, futhi ikhasimende alikuthumeli neze. Ukunquma ukuthi ubani ufakazelani, ngakuphi ukulandelana, umsebenzi wonke, futhi kuqala ngokufunda inqubomgomo endaweni okulo. Ubufakazi obubili bezinhlobo ezahlukene, ngokulandelana okunqunyiwe, isinqumo somklamo hhayi ibhokisi lokuxhuma.

Uphawu: ukwehluleka ngemva kobufakazi bokuqala obuphumelele

Ukushintshana kokuqala kuqedwa futhi ilogi ibukeka inempilo, kuze kube yilapho ingwango icela ubunikazi bomsebenzisi nge-EAP. Ukuxhawulana bese kuma noma kubuyisela iphutha lephrothokholi elisho umjikelezo owengeziwe. Isitifiketi somshini esivumelekile ngokuphelele senqatshwa ngesizathu esingahlobene nokuvumeleka kwaso. Inqubomgomo yacela ubufakazi besibili, futhi impendulo yekhasimende ayifikanga neze.

Zombili izincazelo zalokho kwehluleka zilungile kuye ngokuthi umi kuphi. Ohlangothini lwekhasimende kubukeka njengesiphakeli esenqaba isitifiketi esivumelekile, kanti ohlangothini lwesiphakeli kubukeka njengekhasimende elingakwazi ukuqeda ukungena. Isigameko esisodwa sifundwa njengenkinga yokuthembana kwelogi elilodwa nenkinga yekhono kwelinye. Inqubomgomo elungisiwe iyona kuphela ekutshela ukuthi ikuphi.

Okwengezwa yisandiso, nokungakwengezwa

I-IKEv2 inesandiso sokuqhuba ukushintshana kokuqinisekisa okungaphezu kokukodwa ngaphakathi kwesikhathi esisodwa. I-RFC 4739 idweba, phakathi kwezinye izilandelo, ikhasimende elifakazela ubunikazi besitifiketi bese liqinisekisa umuntu nge-EAP. Idokhumenti ikuSivivinyo, okusho ukuthi akukho ukuqaliswa okukukweletayo leso sici. Ungacabangi lutho ngokusekelwa kuze kube yilapho uhlangothi lunye luxoxisana ngakho.

Zombili izinhlangothi kufanele zisekele isandiso futhi zivumelane ngaso phakathi nokushintshana. Ingwango elungiselelwe umjikelezo wesibili ayikwazi ukuphoqa ikhasimende ukuba wenze owodwa, futhi ikhasimende elisekelayo ngeke likusebenzise ngaphandle uma isiphakeli sicela. Yikho lokho kungalingani okwenza ukwehluleka ngokuvamile kuvele njengokuphelelwa yisikhathi noma iphutha lephrothokholi esikhundleni sesitatimende esicacile ngekhono. Ukufunda ukulungiselelwa kohlangothi olulodwa kukutshela uhhafu walokho okuzokwenzeka.

Ubufakazi obubodwa endaweni ngayinye yisimo esivamile, futhi akusona lesi siklanyo. Ingwango yethula isitifiketi sayo, umsebenzisi uphendula nge-EAP, futhi uhla lwezinhlangothi luqinisekise olunye ngqo kanye. Lobu bufakazi bubili buvela ezinhlangothini eziphambene, ngakho abukho obukodwa obusho okuthile okwehlukile ngomshini nangomuntu owusebenzisayo.

I-EAP-TLS iyisimo sesithathu, futhi nayo akusiyo le. Lapho, isitifiketi sekhasimende sethulwa ngaphakathi kwendlela ye-EAP, ngakho ikhasimende lisaphetha ukuqinisekisa okukodwa kwe-IKE. Imininingo yokufinyelela ingabukeka ifana necala lemijikelezo eminingi kuyilapho iphrothokholi ithwala umjikelezo owodwa esikhundleni semibili. Yikho ukuklanywa okukopishwe ekusetshenzisweni kwe-EAP-TLS kwehluleka khona lapho kulindelwe khona ubufakazi besibili.

Ifayela elilodwa lifundeka ngendlela ehlukile engwangweni

Ifayela le-swanctl elilodwa lifundeka ngendlela ehlukile kuye ngokuthi lisebenza kuphi, futhi yilokho okuphazamisa abantu. Kumakhalekhikhini yekhompyutha ingwango iwuhlangothi olunye, kanti engwangweni ikhompyutha yikho, ngakho bhala uhlangothi lwe-local njengokuthi ngingubani kanti uhlangothi lwe-remote njengalabo engizobamukela. Ibhloko le-local lichaza ukuthi le ndawo iziqinisekisa kanjani yona, futhi ibhloko le-remote lisho lokho elikudingayo kolunye uhlangothi. Ukukopisha ibhloko phakathi kwamafayela amabili kuguqula incazelo yalo ngaphandle kokushintsha ngisho uhlamvu olulodwa. Ukuqhathanisa amafayela amabili akukutsheli cishe lutho, ngoba amagama afanayo ashoyo okuphambene kwilinye ngalinye.

Indawo yesigaba inquma ukulandelana kwaso ngaphandle uma inombolo yomjikelezo ikudlula. Ngakho izigaba ze-local noma ze-remote ezengeziwe zichaza imijikelezo eyengeziwe hhayi ezinye izindlela, futhi isihloko sokubhekisela se-swanctl.conf sikhona ngqo ukuze senze lokho kulandelana kube ngamabomu. Ngaphandle kwaso, ukuhambisa ibhloko kushintsha indlela yokuziphatha. Yikho futhi okwenza ukulungiselelwa okubili okubukeka kulingana ephepheni kungaziphatha ngokulandelana okuphambene.

Lowo mthetho wokulandelana ukhiqiza indlela yokwehluleka efanele ukukhunjulwa. Ibhloko lesibili le-remote akusilo enye indlela eyamukelekayo; liyisicelo sesibili, yikho inqubomgomo efundeka njengokuthi noma/ngoma iziphatha njengokuthi futhi-bese. Inqubomgomo yengwango ingamukela isitifiketi somshini obhalisiwe bese ifuna ukushintshana kwe-EAP kwalowo msebenzisi, ngalokho kulandelana.

Hlukanisa imijikelezo kuzici ezizimele

Imijikelezo emibili ayizona ngokuzenzakalela izici ezimbili ezizimele. Ukuphinda ubufakazi, noma ukugcina imininingo emibili endaweni eyodwa yokugcina, akulethi amandla okwakufanele ukuklanywa kuwengeze. Ukuzimela kuyisici sendlela izimfihlo ezigcinwa ngayo nokuthi yini ezibeka engcupheni, hhayi inani lokushintshana okwenziwa iphrothokholi. Ukuklanywa okubala imijikelezo njengezici kweqisa lokho enakho. Lowo mehluko ubaluleka kakhulu lapho umbuzo wokuhambisana ubuza ukuthi ukungena kusebenzisa izici ezingaki ngempela.

Isitifiketi somshini sifakazela ukuba nakho kokhiye waso owamukelwe, futhi akukho okunye. Akusona isiqinisekiso sezingxenyekhathi futhi akusona umbiko wempilo yedivayisi, ngakho inqubomgomo edinga ulwazi lwesimo idinga enye indlela. Futhi inkambu ye-subject ayisona isigaxa sokuqoqwa ongayethemba, ngoba i-subject ikhethwa yilowo okhiphe noma obhalise isitifiketi. Uma ukuklanywa kudinga ubufakazi bokuthi umshini unempilo, lobo bufakazi kufanele buvela engxenyeni ekala umshini.

Bhala phansi ukuthi umjikelezo ngamunye ufakazelani ngempela ngaphambi kokuwengeza. Lapho imijikelezo emibili ifakazela into eyodwa kabili, owesibili wengeza ukubambezeleka namathikithi okusekelwa esikhundleni sokuqiniseka. Lelo nothi futhi yilona elivimba ingxabano yokuthi umjikelezo owengeziwe uyazifanelela yini izindleko zawo.

Bhala umthetho wokuhlananganisa futhi uhlole ukwenqatshwa

Nquma ukuthi yibuphi ubunikazi bomshini obungahlananganiswa nabaphi abantu, futhi bhala umthetho lapho ukuphoqelelwa kukhona. Imininingo emibili evumelekile eduze komunye ayifakazeli lutho ngokuhlananganisa, ngoba ukuhlananganisa yisinqumo sokugunyaza hhayi umphumela wokuqinisekisa. Amarekhodi okubhalisa noma ingemuva lokuqinisekisa kufanele kuphoqelele ubudlelwano obufunwa inhlangano.

Bese uhlola lokho okufanele kwehluleke: umsebenzisi owamukelwe kumshini ongagunyaziwe, umsebenzisi ongagunyaziwe ophethe ubufakazi bomshini, kanye nohlangothi olungakwazi ukwenza umjikelezo owengeziwe. Uma bobathathu bethola ngokuthula ukufinyelela okufanayo, inqubomgomo ichaza inhloso esikhundleni sokuyiphoqelela. Qhathanisa ukulungiselelwa okumenyezelwe nalokho okubikwa yi-daemon, ngoba ukuxhumana okungazange kufane kufana ncamashi nomthetho owedlulile:

swanctl --list-conns
swanctl --list-sas

Hlola imijikelezo okwaxoxiswanwa ngayo kanye nokugunyazwa okuwumphumela, hhayi ukungena okuphumelele kuphela. Futhi ungabheki izilungiselelo zakudala ze-XAuth ze-IKEv1 njengendlela emfushane: fanisa iphrothokholi, izindima, ukulandelana kanye nokuziphatha kwangempela kwekhasimende esikhundleni sokucisha umjikelezo odingekayo kuze kuphumelele ukuxhumana. Ukucisha umjikelezo ohlulekile yikho okwenza ukuklanywa okunobufakazi obubili kuphenduke ngokuthula kube ukuklanywa okunobufakazi obubodwa okungekho owayekubuyekeza. Gcina ukucishwa kumarekhodi okushintsha.