I-L2TP/IPsec iyahluleka: hlukanisa i-IPsec, ukuqinisekiswa komhubhe noma ukungena kwe-PPP

Izinto ezintathu ziqinisekiswa ngaphakathi koxhumano olulodwa lwe-L2TP/IPsec, futhi kube kukodwa kuphela kuzo okuhilela umuntu oshayayo. I-IPsec ifakazela iziphetho zomhubhe, uxhumano lokulawula lwe-L2TP lungase lifakazele kabusha ozakwabo ngemfihlo yalo, bese i-PPP ifakazela i-akhawunti yomsebenzisi ngaphakathi kwesikhathi. Ukwehluleka kwesigaba sanoma yisiphi sibonakala njengephutha elijwayelekile lokungena kudayalogi yeklayenti futhi sibonakala sihluke ngokuphelele kulogi yeseva. Dlula ezigabeni ngokulandelana futhi ma lapho esokuqala sihluleka khona, ngoba isigaba ngasinye esingaphansi kwesigaba esingakahlolwa naso asikahlolwa.

Izigaba ezintathu zokuqinisekisa, ubunikazi obuthathu obuhlukene

I-IPsec ifakazela ukuthi iziphetho zingezikabani, isebenzisa ukhiye owabiwe ngaphambili noma isitifiketi. Lobobunikazi bungezemishini noma amasango, akukaze kube ngokomuntu ophambi kwekhibhodi. Uma ozakwabo bengakwazi ukuvumelana kulesi sigaba, akukho iphakethe le-L2TP elishintshaniswayo.

Uxhumano lokulawula lwe-L2TP lungangeza ukushintshana kwesibili, okwehlukile, kokubhetelela nokuphendula, okuqhutshwa imfihlo eyabiwe okufanele ibe nayo yomibili imiphetho.

I-RFC 2661 yenza lokho kuqinisekiswa koxhumano lokulawula kube okuzikhethela, okuchaza ukuthi kungani iphutha elifanayo linikeza izimpawu ezihlukene kumaseva amabili. Ukusetshenziswa okungakaze kumise imfihlo yomhubhe kudlula ngokuphelele lesi sigaba; lokho okumise ohlangothini olulodwa kuphela kuyehluleka ngaphambi kokuthi i-PPP inikezwe. Bese i-PPP iqinisekisa umsebenzisi nge-PAP, i-CHAP noma i-MSCHAPv2 futhi inikeze igama esitolo sama-akhawunti okungenzeka sibe sendawo, ku-chap-secrets noma ku-RADIUS. Iphasiwedi engalungile ngaleso sikhathi isahamba nawe inika umhubhe osebenzayo kanye nesikhathi esihlulekile.

Funda indawo yokuma ngaphambi kokuhlela ukucushwa

Qala nge-ipsec --version ukuze wazi ukuthi umphumela wesimo ungowakwa-strongSwan noma Libreswan. Bese ufunda ilogi yeseva, hhayi idayalogi yeklayenti, ngoba iseva irekhoda ukuthi yisiphi isigaba esenqabile.

Umugqa owodwa uvamise ukuxazulula ithikithi: isikhalazo se-IKE noma iziphakamiso yisigaba sokuqala, umyalezo woxhumano lokulawula yisigaba sesibili, futhi ukunqatshwa kwendlela ye-PPP noma kwe-akhawunti yisigaba sesithathu. Kopisha lowo mugqa ethikithini kanye nesigxivizo sesikhathi. Ukuqagela ohlangothini lweklayenti kuchitha ubufakazi obukodwa osuvele unabo.

Gcina impahla yokhiye namaphasiwedi ngaphandle kwalokho okunamathisiwe; igama lesigaba liqondisa umsebenzi, futhi ukhiye owabiwe ngaphambili ophuzile uvula ithikithi kabusha ngemiphumela emibi kakhulu.

Isigaba sokuqala: ingabe i-IPsec inokuhlangana?

Gijimisa i-ipsec statusall ku-strongSwan noma i-ipsec whack --status ku-Libreswan futhi ufune ukuhlangana kwengane okusunguliwe okunezibali ezingezona uziro. I-ip xfrm state ibonisa umbono wekhoneli kukho kokubili. Ipheya ye-SA efakiwe enezibali ezikhuphukayo isho ukuthi isigaba sokuqala sesiphelile futhi ungaqhubeka.

Ukungabikho ngokuphelele kokuhlangana kukhomba ikheli lozakwabo, isethi yeziphakamiso noma ukhiye owabiwe ngaphambili, futhi ngezinye izikhathi kukhomba idivayisi ebhala kabusha i-UDP 500 kodwa ilahle i-UDP 4500. Ukuhlangana okusungulwayo bese kunyamalala ngemva kwemizuzwana embalwa ngokuvamile ukungafani kwesikhathi sokuphila phakathi kwemiphetho emibili, hhayi inkinga yobufakazi bokungena. Hlola ukuthi izinhlangothi zombili zibala iziphakamiso ezifanayo zokubethela neze-hash ngaphambi kokuthayipha noma yini kabusha. Uma kungenjalo, awekho ukhiye ozosebenza.

Ma ngesikhathi ukuhlangana kungakho. Ukuhlela izinketho ze-PPP ngaleso sikhathi akushintshi lutho futhi kufihla iphutha langempela kumuntu olandelayo.

Isigaba sesibili: ingabe uxhumano lokulawula lwe-L2TP luziqinisekisile?

Lapho i-IPsec isimi kahle, qaphela idemoni le-L2TP ukuze uthole uxhumano lokulawula olufinyelela isimo esisunguliwe, ngoba i-PPP ayikwazi ukuqala ngaphambi kwalokho. Ukunqatshwa koxhumano lokulawula kusho ukuthi imfihlo yomhubhe iyahluka phakathi kwemiphetho, noma umphetho owodwa ufuna imfihlo enye engayithumeli neze. Amaklayenti avamise ukubonisa insimu eyodwa enelebula elithi shared secret, futhi ngokuvamile ingeyakwa-IPsec hhayi eye-L2TP. Ukuyigcwalisa akumisi imfihlo yomhubhe, futhi ukuyisusa akuyikhubazi.

Uma kungekho hlange olumise imfihlo yomhubhe, yeqa lesi sigaba futhi uthatha ukwehluleka koxhumano lokulawula njengenkinga yokufinyeleleka esikhundleni salokho. Qinisekisa ukuthi i-UDP 1701 ifinyelela idemoni nokuthi imiphetho yomibili iyavumelana ngokufakwa okufanayo. Umthetho wodonga lomlilo obhalwe kwesinye salezi zimo ezimbili uyimbangela evamile yoxhumano oluvuleka uhhafu.

Yisikhathi kuphela esiqala ukuxoxa nge-PPP esidlule ngempela isigaba somhubhe.

Isigaba sesithathu: ingabe i-PPP inqaba i-akhawunti?

Ukwehluleka kwe-PPP kubonakala ngendlela ehlukile ngaphandle: umhubhe usunguliwe, isikhathi siqala, futhi idemoni irekhoda ukwehluleka kwendlela yokuqinisekisa noma ukunqatshwa kwe-akhawunti. Funda indlela eshiwo kulo myalezo. I-PAP ne-CHAP yehluleka ngezizathu ezihlukene, futhi iseva enqaba eyodwa izonqaba iklayenti elinikeza leyo kuphela.

Kuseva ye-Linux, hlola ifayela lezinketho idemoni elinikeza i-PPP, ngokuvamile i-/etc/ppp/options.xl2tpd, futhi qinisekisa ukuthi iziphi izindlela zamukelwayo nokuthi ama-akhawunti axazululwa kuphi. Igama elikhona ku-RADIUS kodwa lingekho efayeleni lemfihlo yendawo liyehluleka ngokuhlanzekile futhi libonakala njengephasiwedi engalungile. Bese uhlola ukuthi iklayenti linikeza indlela eyamukelwa yiseva, hhayi eyona enamandla evinjiwe yiseva ekuxoxisaneni ngayo. Ukushintsha ukhiye owabiwe ngaphambili ukuze kulungiswe lesi sigaba kuchitha ntambama futhi akushintshi lutho.

Lapho isikhathi ekugcineni siphakama, ukwabiwa kwekheli, i-DNS nemizila akukahlolwa, futhi ngakunye kuhluleka buthule ngendlela yaso. Gcina izingqimba ezintathu zihlukene kumanothi akho: ukhiye olungile ne-akhawunti engalungile kuhluleka njalo, futhi ukulungisa ingqimba eyodwa akulungisi enye neze.