I-PSK ye-L2TP/IPsec inqatshiwe: dlula idayalogi, bese kuba amafayela

Unamathisela ukhiye owabiwe ngaphambili ovela kumyalezo womlawuli kudayalogi ye-NetworkManager, ubeka uphawu ebhokisini ukuze uwubonise, futhi ufana ngohlamvu nolunye. Ukuxhumana kusaphetha ngokwehluleka kokuqinisekisa ngaphambi kokuba umhubhe ukhuphuke. Ngesikhathi ngikubona okokuqala ngacabanga ukuthi ukhiye awulungile; kwakungenjalo. Ezinye izinto ezimbili zinquma lokho idaemon ekufundayo ngempela: ifayela lezimfihlo elibhalwa yisengezo salokho kuxhumana, nokuthi ingabe inani ladlula kudayalogi lingashintshile.

Umzila ongezansi ulandela ukhiye kusukela enkambeni kuze kufike efayeleni, futhi ukulandelana kwako yikho okukutshela ukuthi walahleka kuphi. Kwenze emshinini ohlulekayo, hhayi kulelo osebenzayo, ngoba umehluko phakathi kwale mishini emibili ngokuvamile ukuhlelwa kwamafayela, hhayi ukhiye.

Qala kudayalogi, kodwa ungathembi inkambu

Vula ithebhu ye-IPsec yokuxhumana bese uphinda ubhale ukhiye esikhundleni sokuwunamathisela. Ukhiye okopishelwe kumyalezo wengxoxo, ku-PDF noma kusiphathi samagama okuvuma angafika nokunqanyulwa komugqa ekugcineni inkambu engakubonisi, futhi izinhlamvu ezibonakalayo zisabonakala zilungile.

Chofoza isilawuli sokubonisa igama lokuvuma bese ubheka ekugcineni komucu, hhayi phakathi. Uma isikhombisi sishiya umugqa ongenalutho ngaphansi kombhalo, uwususe bese uphinda ubhale uhlamvu lokugcina. Lokho kulungiswa okukodwa kuxazulula ingxenye emangazayo yale mibiko, futhi kushibhe kunezindleko zokufunda noma iyiphi ilogi.

Uma ukhiye uvela kusistimu yamathikithi egoba imigqa emide, wucele ngendlela engagobi. Qhathanisa ubude nomlawuli esikhundleni sokubheka imicu emibili eceleni komunye nomunye; uhlamvu olulahlekile endaweni yokugoba alubonakali kufonti elinganiselayo.

Landela ukhiye ngaphakathi ku-/etc/ipsec.d

Isengezo asikaze sinikeze i-PSK kudaemon ye-IPsec njenge-agumenti emugqeni womyalo. Esikhundleni salokho sigcina inani efayeleni lezimfihlo futhi sihlela ukuthi idaemon lifake lelo fayela, ngokwengeza umugqa we-include ku-/etc/ipsec.secrets uma ingekho. Lokho idayalogi elikubambayo kungukufakwa kwalelo fayela elenziwe, hhayi inani elisetshenziswayo.

Bhala uhlu lwalokho okukhona ngaphambi kokushintsha noma yini:

ipsec --version
sudo ls -l /etc/ipsec.d/*.secrets /etc/ipsec.d/ipsec.nm-l2tp.secrets 2>/dev/null
sudo grep -n "include" /etc/ipsec.secrets

Izinguqulo ezindala zesengezo zazibhala ifayela elilodwa kukho konke ukuxhumana, eliqanjwe nge-UUID yokuxhumana, isibonelo /etc/ipsec.d/nm-l2tp-ipsec-<uuid>.secrets. Ukususa iphrofayela kusibonisi akulisusi lelo fayela ngendlela ethembekile. Uma ifayela elidala elivela kuseva yangaphambilini lisekhona kudiski futhi lisafakiwe, idaemon ingakhetha imfihlo engeyephrofayela ongasayisebenzisi, futhi ukuxhumana kwehluleka nakuba inkambu ebonakalayo ilungile.

Qonda ukuthi ushintsho lwe-1.2.12 lwenze ukuthini ekuthuthukisweni

Inguqulo yesengezo engu-1.2.12 yashintsha amafayela ezimfihlo akhokho konke ukuxhumana yaba yifayela elilodwa elabiwe, /etc/ipsec.d/ipsec.nm-l2tp.secrets. Ukuthuthukisa akuhlanzi amafayela amadala ngokwe-UUID, futhi umugqa okhona we-include /etc/ipsec.d/*.secrets usawafaka. Inguqulo engu-1.2.16 yashintsha ukuphathwa kweziphakamiso ezizenzakalelayo, hhayi ukuhlelwa kwezimfihlo.

Lomlando uchaza ukuthi kungani imishini emibili enephrofayela ebonakala ifana iziphatha ngendlela ehlukile. Ukhiye uyafana; iqoqo lamafayela idaemon eliwafakayo alifani. Uma ususa ifayela eliyintandane, lisusa eceleni esikhundleni sokusilicisha, qinisekisa ukuxhumana, bese usulicisha ngemva kokuba isimo esisebenzayo sibhaliwe. Ukuqamba kabusha kugcina inani elidala likwazi ukubuyiswa uma kwenzeka ukuthi iphutha likwenye indawo.

Hlukanisa izinhlamvu ezingenakugcinwa yifomethi yokugcina

Imibhalo ye-strongSwan mayelana nomucu wemfihlo eyabiwe ithi inani angeke libe nokunqanyulwa komugqa noma uhlamvu lwamakhotheyishini amabili. Ukhiye onamathiselwe kudokhumenti ungathwala okunye kwalokho ngaphandle komehluko obonakalayo kudayalogi evamile.

Kusukela ku-1.2.12 inani eligciniwe alilona umbhalo ocacile. Isengezo sifaka i-PSK kusimo se-base64 ngaphambi kokuba ifinyelele efayeleni, futhi amanothi okukhishwa abonisa lokho kufaka njengesizathu sokuthi ukhotheyishini oyimbaxa wamukelwa manje kukhiye. Ngakho ukhotheyishini obhalwe enkambeni uyamelwa; lokho akulona iqiniso kuyo yonke inhlamvu yokulawula.

Ubude bunenye imikhawulo. Akukho ubuncane obujwayelekile kuyo yonke isoftware ye-L2TP/IPsec: amanye amaklayenti amukela okhiye abafushane kunezinhlamvu ezingamashumi amabili kanti amanye amasango aphoqa ubuncane. Uma ukhiye omfushane wenqatshwa, umthetho ungowenqubomgomo yeseva noma wokuqinisekisa kwalelo klayenti, futhi ukukhulisa okuthile endaweni ngeke kukushintshe.

Funda ukuthi yiluphi ungqimba lokuqinisekisa olwehlulekile

Qala ngokuqalisa i-ipsec --version, ngoba i-strongSwan ne-Libreswan zisebenzisa amagama amafayela kanye ne-syntax ehlukile, futhi iseluleko sokunye singalimaza okunye. Bese ufunda isigaba sokwehluleka kumyalezo weklayenti noma kwilogi yedaemon: isikhalazo mayelana nokhiye owabiwe ngaphambili siyisigameko esihlukile ekunqatshweni kwegama lomsebenzisi negama lokuvuma.

I-PSK iqinisekisa iziphetho zombhubhe. Igama lomsebenzisi negama lokuvuma kuqinisekisa umuntu ongaphakathi kwe-L2TP, futhi i-PPP ibhekana nakho ngemva kokuba inhlangano ye-IPsec ikhuphukile. I-PSK elungile ene-akhawunti engalungile isehluleka, futhi ukushintsha i-akhawunti ngeke kulungise ukhiye idaemon engakaze iwufunde kahle.

Uma uvale ithikithi, bhala konke okune: inguqulo yesengezo, ifayela lezimfihlo elisetshenziswayo, ukuthi ukhiye waphinda wabhalwa noma wanamathiselwa, kanye nongqimba oshiwo ephutheni. Lapho-ke noma ubani ophinda lo mzila kamuva angagxuma ngqo emehlukweni phakathi komshini osebenzayo nolohlulekayo.