I-IKEv2 inamasiginesha amabili: isitifiketi ne-IKE_AUTH
I-CA isayina isitifiketi, kanti uzakwabo usayina ukushintshana kwakhe kwe-IKE_AUTH ngohlelo lwakhe. Funda ngayinye emkhakheni wayo, bese ubhala kokubili.
Ithikithi lakho lithi isitifiketi siyi-SHA-256 kuyilapho ilogi yesango isho enye i-algorithm yamasiginesha, futhi othile usevele wabhala isicelo sokukhipha i-CA kabusha. Ngaphambi kokuba leso sicelo siye ndawo, hlukanisa amasiginesha amabili: elinye isigxivizo somkhiphi esihlwini esivamile, elinye ubufakazi bozakwabo bokuthi unalo ukhiye oyimfihlo ohambisanayo phakathi ne-IKE_AUTH. Izingxenye ezihlukene ziwakhetha, futhi kuvunyelwe ukuthi ahluke. Ukufunda ngakunye endaweni elihlala kuyo kudinga imiyalo emibili nethebula elilodwa.
Funda isiginesha somkhiphi esitifiketini
I-CA ibeka isiginesha yayo ekubosheni phakathi kobunikazi nokhiye. Leyo siginesha ibhala lokho i-CA ekwenzile ngesikhathi sokukhipha, hhayi lokho umuntu ozokwenza lapho exhumanisa, ngakho i-algorithm yayo ichaza ukukhetha kwayo i-hash nokhiye kwe-CA. Ukhiye womuntu wohlobo olulodwa ungaba ngaphansi kokhiye we-CA wohlobo olunye ngaphandle kokuphikisana, futhi ukushintshwa kokhiye we-CA kuvamile hhayi iphutha. Funda izinkambu ezimbili futhi unengxenye yohlu:
openssl x509 -in peer.pem -noout -text | grep -E "Signature Algorithm|Public Key Algorithm"Bhala zombili izilebula njengezinto ezihlukene. Eyokuqala ichaza i-CA, eyesibili ichaza ukhiye womuntu, futhi akukho okubikezela isiginesha esiku-inthanethi.
Funda isiginesha esiku-inthanethi ekushintsheni kwe-IKE
Ngesikhathi sokuqinisekisa uzakwabo ngamunye usayina idatha yokushintshana ngokhiye wakhe oyimfihlo, futhi uhlangothi olunye luqinisekisa lobo bufakazi ngokobunikazi besitifiketi, uchungechunge lokwethemba kanye nenqubomgomo. Ku-RSA ukugcwalisa ne-hash kungokwalolu hlelo lweku-inthanethi, ngakho ukhiye omude noma isitifiketi esisha se-SHA-256 akukwazi ukuzikhethela i-RSA-PSS yesiginesha yokuqinisekisa. Indlela okwavunyelwana ngayo ibonakala kulogi ye-daemon noma ohlwini lwayo lokuxhumana, hhayi nasemstifiketini. Buza uhlangothi ngalunye ukuthi kuvunyelwene ngani, ngoba izinhlangothi ezimbili zingahluka.
ipsec statusall | grep -i "auth\|proposal"Lapho uhlangothi olulodwa lusho uhlelo uhlangothi olunye olungenakukwenza, uthole ukungahambisani okwakukhulunywa ngakho ethikithini. Ukukhipha i-CA kabusha kuwukulungisa okungalungile, ngoba isitifiketi kwakungeyona into eyahluleka.
Yini i-RFC 7427 eyishintshayo, nengayishintshi
Izindlela zokuqala zibalwa ngokwenhlanganisela ye-algorithm ku-RFC 7296. Isandiso sesiginesha se-RFC 7427 sakamuva senezela indlela ejwayelekile ye-Digital Signature enophawu lokusekelwa kwe-hash yesiginesha, ngakho i-hash entsha ayisadingi inombolo yayo yendlela. Lokhu kuyavunyelwana, akucatshangwa: uzakwabo akalusitholi isandiso ngenxa yokuthi umtapo wakhe wezincwadi unakho ukuhlaziya isitifiketi esifanayo, futhi uzakwabo osebenzisa izindlela zokuqala kuphela uphoqelela isango ukuthi ligcine enye yazo. Lokho kuwukuhweba ngenqubomgomo okunezindleko zokuhambisana, hhayi iphutha.
Ukusekelwa kungokwengxenye nangokokuxhumana ngakunye, ngakho hlola ukwakhiwa okukubhekile kunokuthembela esimweni sokuqokwa kosekuqala. Imatrix yamandla eyabhalwa eminyakeni emithathu edlule ichaza ukwakhiwa kweminyaka emithathu.
Faka imigqa emine ohlwini
Irekhodi eliqeda impikiswano linemigqa emine, ngayinye ifundwe endaweni ehlukile futhi ngayinye ishintshwe umuntu ohlukile. Yigcwalise ngaphambi kokuthatha noma isiphi isinqumo, ngoba umugqa ongakalungi yiwo okhetha ukulungiswa.
| Into | Kufundwa kuphi | Ubani oyishintshayo |
|---|---|---|
| isiginesha somkhiphi wesitifiketi | inkambu ye-Signature Algorithm yesitifiketi | umqhubi we-CA, ngesikhathi sokukhipha |
| ukhiye ovamile womuntu | inkambu ye-Public Key Algorithm yesitifiketi | noma ubani odala ukhiye womuntu |
| uhlelo lokuqinisekisa lwe-IKE | ilogi ye-daemon noma uhlu lokuxhumana, isaziso se-auth ne-signature-hash | iprofayela ye-IKE kubo bobabili ozakwabo |
| ama-algorithm okuvikelwa kwe-IKE ne-ESP | uhlu lweziphakamiso zokuxhumana | iprofayela ye-IPsec, ngengxenye |
Umugqa ngamunye uthwala umphumela wawo wokuhambisana. Ukushintshwa kwe-cipher ye-ESP akukhethi isiginesha somkhiphi, futhi ukuxegisa ukuqinisekiswa kwe-CA akwenezi indlela yeku-inthanethi ozakwabo abangakaze bavumelane ngayo. Lapho ithikithi lithi kukhona ukungahambisani kwesiginesha, umugqa oyiphutha ngempela cishe awusoze waba ngowokuqala.
Xazulula icala lakudala ngaphandle kokwenza i-PKI buthaka
Uzakwabo omdala angase anikeze kuphela uhlelo inqubomgomo yakho engasalivumeli. Izinketho iyisikhathi esiklanyelwe ukuxolelwa kokuhambisana, ukubuyekezwa kwekhasimende, noma elinye ilungiselelo lokuqinisekisa lalowo zakwabo kuphela. Ukwakha kabusha i-PKI ngokusizungulira isiginesha yesitifiketi ebuthakathaka akukulungisi ukulinganiselwa ekushintsheni kweku-inthanethi futhi kwenza buthaka yonke enye insizakalo ethemba i-CA efanayo. Bhala ukuthi yiwuphi umugqa oyishintshile nokuthi ukuxolelwa kuphela nini.
Bese uphinda ugijime ukufunda kokubili kusukela phezulu, ngoba ushintsho kumugqa owodwa lungasusa lokho okuvunyelwana ngakho komunye. Uhlu lonke luyimiyalo emibili nethebula elilodwa, futhi umsebenzi uyafana noma uzakwabo ungumzila, ikhompyutha ephathekayo noma ithuluzi.