L2TP: isignali ebulalayo 15, NO_PROPOSAL_CHOSEN kanye ne-modp1024 elahlekile

Ukuxhumana kwakho kuyama, iklayenti liyaphuma, futhi umugqa wokugcina esikrinini yi-death_handler: Fatal signal 15 received. Lowo mugqa ubika ukunqanyulwa, hhayi imbangela. Umugqa owodwa phezulu kuloji ye-IPsec cishe njalo unabakho NO_PROPOSAL_CHOSEN, futhi lezi zinto ezimbili zikhomba esigabeni 2 sokushintshana, lapho izinhlangothi ziqhathanisa ukukhetha kokubethela ne-hash futhi ziyeke uma zingahlanganyeli lutho. Imininingwane yokungena ayikathunyelwa kuleso sigaba, ngakho ukubhala kabusha iphasiwedi ngeke kushintshe umphumela.

Kuvamile ukuthi izinto ezimbili zikhiphe leyo ndawo ehlangene kuklayenti le-Linux. I-daemon yendawo kungenzeka ayisasebenzisi iqembu le-Diffie-Hellman elicelwa iphrofayili, noma iphrofayili iphethe isiphakamiso sesigaba 1 ekheleni lesigaba 2. Kokubili kushiya umkhondo kuloji, futhi akukho okungukuthi inkinga ye-akhawunti.

Imibiko emibili ithini ngempela

I-IKE ixoxisana ngezigaba. Isigaba 1 sakha umzila ovikelwe futhi sikhetha ama-algorithm aso; isigaba 2, i-SA yengane, sithwala ithrafikhi ngaphansi kwesethi ehlukile. I-NO_PROPOSAL_CHOSEN iyisaziso esibuyiselwa umphenduli lapho kungekho nxenye yezinhlanganisela ezinikeziwe eyamukelekayo, futhi ivela njenge-[ HASH N(NO_PROP) ] ngaphakathi kokushintshana kwe-INFORMATIONAL.

Isignali 15 ingenye into: okuthile kwatshela inqubo yendawo ukuthi ime futhi umphathi wakubhala phansi. Uma imigqa yomibili ivela ndawonye, ukulandelana kuyimbangela, ukwenqatshwa kuqala bese kuba ukuvalwa.

Funda ukuxoxisana ngaphambi kokuthinta imininingwane yokungena

Khuphula izinga loji lapho i-daemon ibhala khona, bese uxhuma futhi ugadile okukhiphayo. Kumakhi we-NetworkManager, ingezo ye-L2TP idlulisela lelo zinga ku-backend, futhi imibiko ingena ku-journal noma efayelini le-syslog lendabuko kuye ngokuthi ukusatshalaliswa. Okukodwa kulokhu kuzobonisa ukushintshana: journalctl -f -u NetworkManager | grep -Ei 'pluto|charon|no_prop|proposal' noma tail -f /var/log/syslog | grep -Ei 'pluto|charon|ike'.

Umugqa osho i-pluto uvela ku-libreswan, i-charon ivela ku-strongSwan, futhi kokubili kuchaza isimo esifanayo ngamagama ahlukile. Isimo okufanele sifunwe yileso esisho iqembu elilahlekile, isibonelo i-algorithm 'modp1024' is not supported, ngoba siguqula ukwehluleka okungacacile kube okucacile.

I-modp1024 yaya kuphi

Iqembu 2 le-Diffie-Hellman libuthakathaka ngendlela yokuthi abasabalalisi abaningi bayeka ukulihlanganisa ku-libreswan kusukela ku-3.30. Lapho-ke iphrofayili eyabhalwa eminyakeni edlule, noma eyathathwa encwadini yesango elibala kuphela i-aes128-sha1-modp1024, icela i-daemon yendawo into engakwazi ukuyenza nhlobo. Izakhiwo ezintsha ze-NetworkManager-l2tp zenza lowo mphumela ube nokwenzeka kakhulu: kusukela ku-1.2.16 zishintsha isethi ngeziphakamiso zesitayela se-Windows 10 ne-iOS futhi zilahla i-modp1024 ngokushesha uma kutholakala i-libreswan. Uhlangothi olubhekene nalo ngokuvamile alunacala futhi lusaqhubeka linikeza iqembu elilungile olilungiselele.

Yikho ukungalingani okwenza ukwehluleka kubonakale kungahleliwe. Iklayenti elidala liyaxhuma, iphrofayili efanayo kukhompyutha ephathekayo ebuyekeziwe ayixhumi, futhi ukulungiselelwa kweseva akukaze kunyakaze. Umonakalo wenziwa ukwehluka kwezinguqulo.

Izilungiso ezimbili ezinomthelela ohlukile

Isilungiso esishibhile ukuyeka ukubhala ama-algorithm ngamandla. Sula izinkambu zombili zeziphakamiso kusihleli bese uvumela ingezo ikhethe isethi eyamukelwa uhlangothi olukude; uma isango lisekela amaqembu esimanje, ukuxoxisana kuphela ngaphandle komsebenzi owengeziwe.

Isilungiso sesibili sigcina isango elidala lifinyeleleka ngokufaka i-strongSwan, okuyizingxenye zayo ezisaqhubeka zisebenzisa iqembu 2 ezabalazweni eziningi. Lokho ukushintshwa kwe-daemon, ngakho kunenani: qinisekisa ukuthi amanye amathuluzi kumakhi ancike ekulungiselelweni kwe-libreswan ngaphambi kokuyisusa, futhi ulindele ukwenqatshwa kwe-SELinux phakathi kwe-NetworkManager nengezo ye-strongSwan ku-Fedora. Lokho kwenqatshwa kubonakala kulogi yokuhlola hhayi emkhondweni we-IKE, yikho umhubhe ungabonakala uphukile ngokushesha ngemuva kokufaka okuphumelelayo. Ukulandelana okusebenzayo ukuthi kuqala i-dnf install strongswan, bese kuba i-rpm -e libreswan.

Imisho yeziphakamiso evumelanayo, kanye nezingibe ezizungezile

Lapho izinkambu kufanele zigcwaliswe ngesandla, isigaba 1 nesigaba 2 sithatha amanani ahlukile. Ipheya elaziwa ngokusebenza ngokumelene nohlangothi lwesitayela se-Meraki linikeza i-aes128-sha1-modp1024 esigabeni 1 kanye ne-3des-sha1-modp1024 ngemuva kwayo, kokubili kuvalwe uphawu lwesibabazo olwenza isethi ibe nzima, ngakho kuthunyelwa lezo ziphakamiso kuphela.

Isigaba 2 bese sincipha sibe yi-aes128-sha1 ne-3des-sha1 ngophawu olunzima olufanayo futhi ngaphandle kwesijobelelo se-Diffie-Hellman nhlobo. Umugqa wesigaba 2 ophethe i--modp1024 iyinani lesigaba 1 ekheleni elingalungile, futhi umphenduli uyenqaba kuwo wonke umzamo. Kopisha lowo mugqa kwiphrofayili yesibili futhi iphrofayili yesibili yehluleka ngendlela efanayo, futhi yileyo ndlela iphutha elilodwa lokuthayipha eliba isigameko kulo lonke ithimba.

Amanye amaphutha agqoka iwindi elifanayo lokuhlahla ngaphandle kokuba ukungafani kweziphakamiso. Ku-KDE uhlobo lwe-L2TP lungabhaliswa ngengezo efakiwe kuyilapho ukuxhumana ngakunye kufa ngokushesha, ngoba isihleli sokuxhumana kanye nabasizi besikhathi sokusebenza kulethwa njengezingxenye ezihlukile. Amakhi angenaso isikrini angaphinda asebenzise iphrofayili evela kudesktop esebenzayo: kopisha kusukela ku-/etc/NetworkManager/system-connections/, setha imodi ibe ngu-600, bese usebenzisa i-nmcli con reload. Yenyusa nge-nmcli con up id work-l2tp, ngoba ifomu elinqunu lidinga i-UUID, futhi ususe noma yikuphi ukufakwa okudala kwe-ifname, ngaphandle kwalokho umphathi uphendula nge-Could not find source connection kuyilapho konke okunye kulungile.

Ukhiye owabiwe ngaphambilini ungagcinwa njengombhalo osobala noma njenge-0s elandelwa i-base64; zombili izimo ziyasebenza, kodwa inani kufanele lihambisane nesango ngobhayithi ngobhayithi, kufaka phakathi izikhala zokugcina ozikopishe kanye nawo.