Ingabe leyo khiye ye-OpenVPN eshicilelwe iyi-CA, ukhiye kazakwabo noma i-tls-auth?

Othile ubika ukuthi ukhiye we-VPN usobala, futhi lowo musho ufihla izimo ezintathu ezihluke ngokuphelele. Kungaba isitifiketi se-CA okufanele sibe nakho wonke iklayenti, ukhiye wobunikazi obucashile obekungafanele uhlale ushiya umshini owodwa, noma imfihlo yomgudu wokulawula eyabiwe okufanele ibe nayo yomibili imikhawulo. Ukulungisa, ukuphuthuma kanye nobubanzi bomonakalo kuyahluka esimweni ngasinye, ngakho umsebenzi wokuqala ukuhlukanisa, hhayi isenzo. Uma uhlukanisa kabi, zonke izinyathelo ezilandelayo zingumsebenzi oyize.

Qala emyalweni, hhayi egameni lefayela

Funda ukulungiselelwa okusebenzayo futhi uthole ukuthi yimuphi umyalo okhomba kokubalulekile. Izinketho ze-TLS ze-OpenVPN zisebenzisa i-ca kokubalulekile kwesitifiketi okuthenjwayo, i-cert esitifiketini sikazakwabo wendawo kanye ne-key kukhiye ocashile ohambisana nakho.

Amagama amafayela awafakazi lutho. Ifayela elibizwa nge-key.pem lingaqukatha isitifiketi, futhi ibhlokhi efakwe kuphrofayela ingaqukatha into efanayo ncamashi nefayela elihlukile kudiski. Vula ifayela bese ubheka isihloko salo esikhundleni sokwethemba igama. Lokho kubhekwa okukodwa kususa iningi lokungacaci embikweni.

Uma iphrofayela iyiphakethe le-PKCS#12, livule endaweni elawulwayo ukuze ubone ukuthi liqukethe ini ngempela. Iphakethe elilodwa lingathwala isitifiketi, uchungechunge lwaso kanye nokhiye ocashile, okusho ukuthi ukuvuza kwephakethe ukuvuza kwakho kokuthathu.

Bhala ukuhlukanisa phansi ngaphambi kokuba othile ashintshe ifayela: into, umyalo, okhokho abakutholayo kanye nokuthi ubani angakufunda. Lowo musho yiwona impendulo yonke encike kuwo.

Isitifiketi se-CA senzelwe ukwabiwa

Isitifiketi se-CA esisobala siyinto yokuthembela. Amaklayenti ayadinga ukuze aqinisekise iseva, futhi ukusabalalisa kwaso yisimo esivamile hhayi isigameko. Ukusishicilela akusishicileli ukhiye wokusayina ocashile we-CA, futhi into leyo yiyo engavumela umhlaseli ukuthi akhe ubunikazi obusha.

Umehluko lowo kufanele ubhalwe ngokucacile kuthikithi, ngoba kokubili kuhlanganiswa njalo. Umbuzo okufanele uphendulwe ukuthi ifayela elivuzile liyisitifiketi noma ukhiye wokusayina, futhi ukubheka ngokushesha okuqukethwe yifayela kuyakuxazulula. Isitifiketi sithwala ukhiye osobala kanye nesiginesha; ukhiye wokusayina awubonakali kuso nhlobo.

Ukusabalalisa kusadinga ukunakekela. Amaklayenti kufanele athole isitifiketi ngomgudu ogunyaziwe wokulethwa kwephrofayela, hhayi kusayithi yokunamathisela, futhi isitifiketi esifika ngomgudu ongathenjwa singashintshwa endleleni.

Ukhiye kazakwabo kanye nemfihlo ye-tls-auth akukho okukodwa

Ukhiye ocashile kazakwabo uyinto yobunikazi. Uma usukhanyiwe, iseva ayisakwazi ukwehlukanisa idivayisi ehlosiwe kunoma ubani ophethe ikhophi, ngoba ubunikazi obukhethekile kwakuyisici esasiboniswa. Ukuqhubeka nokugunyaza nokushintsha kuyizinqumo zomnikazi we-VPN, hhayi zalowo othole ifayela.

Imfihlo ye-tls-auth iyinto yesithathu. Yengeza ukuqinisekiswa kwe-HMAC ezungeze amaphakethe omgudu wokulawula ukuze lawo angaqinisekiswanga kahle alahlwe ngaphambi kokushintshana kwe-TLS, futhi akuwona ukhiye ocashile kazakwabo noma ukhiye obethela idatha yohlelo.

Uma leyo mfihlo eyabiwe isobala, umgoqo eyayiwunikeza awusekho kubo bonke abanayo. Akusho ukuthi wonke umnikazi udlula izivivinyo zesitifiketi nomsebenzisi ezilandelayo, yingakho ukuhlukanisa kubaluleke ngaphezu kwezinga lesixwayiso. Ikhulume ukuthi wuphi umgoqo owile, futhi ikhulume ukuthi yimiphi esele.

Lungisa indima evuzile, hhayi eyomakhelwane

Imfihlo eyabiwe ayikwazi ukuba yimfihlo futhi ngokuqamba kabusha ifayela noma ngokufihla isixhumanisi sokulanda. Ukushintsha kusho ukukhiqiza inani elisha nokulisabalalisa kuwo wonke uzakwabo kushintsho oludidiyelwe, futhi ukushintsha uhlangothi olulodwa kuphela kwephula isivumelwano kubo bonke abasaphethe inani elidala.

Uma ubunikazi bukazakwabo buveziwe, sebenzisa inqubo yokuhoxiswa nokubhalisa kabusha yomqhubi yalobo bunikazi. Ukushintsha iphasiwedi ye-akhawunti engahlobene akusenzi isitifiketi esikhanyiwe singasebenzi, futhi nokushintsha ifayela le-tls-auth akusenzi njalo.

Qinisekisa ukuthi iseva esisetshenzisiwe empeleni iphoqelela ini ngaphambi kokuthembela kunoma yikuphi kwalokhu. Uhlu lokuhoxiswa olungavuselelwa, noma ukuhlolwa kwendima okwavalwa ngesikhathi sokuphazamiseka, kushintsha impendulo ngokuphelele. Funda ukulungiselelwa okusebenzayo hhayi ikhophi esegcini.

Hlola ithrafikhi edlule ngemibandela yayo

Ifayela eliveziwe alikusho ngokwalo ukuthi amaseshini abanjwe ngaphambili angasetshenziswa yini. Lokho kuncike endleleni yokusungula ukhiye, kokubalulekile okuveziwe kanye nokuthi yimaphi amarekhodi akhona, futhi kokubili ‘wonke umsebenzi wemithwalo ulahlekile’ kanye ‘akukho okwenzekile’ kuyizicabango ngaphandle kwalokho kweqiniso.

Ungathumeli enye ikhophi yemininingwane yokungena ngesikhathi ubuza ukuthi ingokwesiphi isigaba. Kunalokho yabelana ngamagama emiyalo kanye nemethadatha engeyona imfihlo ngomgudu wokusekelwa ogunyaziwe.

Isiphetho esiwusizo sisho into, indima yayo, ukuvikelwa okulahlekile kanye nesenzo esididiyelwe esidingekayo. Noma yini emfushane kunalokho iyisihloko, hhayi ukuhlola.