Uhlu lwe-IP oluvunyelwe ngokumelene ne-laptop egunyaziwe: izilawuli ezimbili ezihlukene

Izicelo zomthetho wokuthi i-laptop egunyaziwe kuphela engaxhuma zivame ukugcina ziyisicelo se-firewall sekheli lomphakathi lehhovisi. Lowo mthetho manje wamukela yonke idivayisi engemuva kwalelo kheli. Isidingo nokwenza akukona into eyodwa. Hlukanisa lokho umgomo okufunayo nalokho ikheli elingakufakazela.

Imibuzo emithathu esicelweni esisodwa somgomo

Hlukanisa isicelo ezingxenyeni ezintathu: ukuxhumana kuvela kuphi, iyiphi insizakalo engayifinyelela, nokuthi iyiphi ikhompyutha ethula ubufakazi. Umthetho wekheli lomsuka uphendula owokuqala, kanti umthetho wensizakalo yendawo ewuphendula owesibili. Akukho okukhomba umshini wangempela, ngoba zombili zisebenza emikhakheni yenethiwekhi eyabiwe amadivayisi amaningi. Owesithathu udinga ubufakazi obukhishwe kuleyo divayisi futhi obungeke busetshenziswe futhi ngokuthula.

Bhala izimpendulo ezintathu ngokwehlukana. Umugqa owodwa we-firewall awukwazi ukufeza isidingo esisho ezintathu.

Ikheli lomsuka lingakutshela ini

Ukuhumusha amakheli yisizathu esivamile sokuthi umthetho womsuka wenethiwekhi uvume ngokweqile. Konke okungemuva komnyango wokuphuma wehhovisi kubonakala njengekheli lomphakathi elifanayo, ngakho umthetho unikeza iqembu lonke imvume. Ikheli eligxilile ngaphakathi kwe-VPN linobuthaka obufanayo kwenye indawo: kuwukwabiwa okuboshelwe kuseshini, hhayi isici sehadiwe. Noma iyiphi idivayisi ephethe ubufakazi obamukelekile ingavula leso seshini. Thatha ikheli njengomkhawulo wenethiwekhi futhi ulichaze kanjalo.

Lokho kusewusizo ekukhawuleleni ukuchayeka, futhi akukona ukuqinisekisa idivayisi.

Bophela ukufinyelela kubufakazi obubhalisiwe

Uma isidingo siwumkhawulo wedivayisi, sebenzisa ukubhalisa kwedivayisi ngayinye okusekelwa yi-VPN futhi unikeze ikhompyutha ngayinye ubunikazi obuhlukile.

certutil -store My <thumbprint>
openssl verify -CAfile vpn-ca.pem device.pem

Uhlu lwesitoreji lubonisa isitifiketi nokuthi kukhona ukhiye oyimfihlo, futhi ukuqinisekisa kubonisa ukuthi uchungechunge luholela esisekelweni esihlosiwe. Isitifiketi sifakazela ukuba nokhiye oyimfihlo owamukelekile ngaphansi komgomo ohleliwe; asifakazeli ukuthi iyiphi imishini yangempela eyayinawo lapho lowo khiye ungasetshenziswa futhi ukopishwe. Ukuqamba iphrofayili nge-laptop kushiya imfihlo ithwaleka kalula njengakuqala. Lapho ipulatifomu isekela khona, okhiye abavikelwe yihediwe abanomgomo wokuqinisekisa banikeza ukubopha okuqinile, futhi ukubhalisa kusamele kunqume ukuthi ubani angathola ubufakazi.

Hlola umngcele, bese uhlela ukususa

Hlola izimo ezimbili: i-laptop egunyaziwe nomsebenzisi kufanele baxhume, futhi enye idivayisi ephethe i-akhawunti yomsebenzisi kuphela akufanele ixhume. Uma umklamo udinga ukuhlolwa komsebenzisi nokwedivayisi, qinisekisa ukuthi indlela ekhethiwe iphoqelela kokubili kuseshini elilodwa esikhundleni sokucabanga ukuthi izilungiselelo ezimbili ezizimele ziyahlanganiswa.

openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -cert device.pem -key device.key

Ukuhoxiswa kufanele kususe ubunikazi bedivayisi obamukelekile, futhi ukuphathwa kwamaseshini asebenzayo kufanele kube nokuhlolwa kwako. I-TPM noma ifulegi ledivayisi elawulwayo akusona isitifiketi esihlanzekile sezempilo sayo yonke inqubo emshinini.

Rekhoda umkhawulo wenethiwekhi, ubufakazi bedivayisi kanye nesinqumo sokubhalisa njengezilawuli ezintathu ezinabanikazi abathathu. Lokho kwenza umngcele uhlolwe, futhi yilokho ikheli lilodwa elingasoze likunikeze.