Iphrofayili ye-IKEv2 ku-Mac: setha izichazamazwi zombili ze-SA, bese uhlola
Amapharamitha e-IKE azuzwa njengefa yi-Child SA uma leso sichazamazwi sikhona. Gcwalisa zombili, humusha amagama, bese uhlola ukuthi ababambiqhaza baxoxe ngani ngempela.
Ukuxhumana okuphumelelayo kufakazela kuphela ukuthi iziphetho zombili zithole isethi yamanani ezizamukelayo. Iphrofayili ye-IKEv2 ku-Mac elawulwayo ithwala izichazamazwi ezimbili zobudlelwano bokuphepha, isango linohlu lwalo lwezigaba, futhi ukuxhumana kuphumelela kunoma yikuphi ukuhlangana okuvunyelwe yizinhlangothi zombili. Yenza izivivinyo ezingezansi ngokulandelana, futhi ma ekhona lapho iziphetho ezimbili zingavumelani khona yima khona esikhundleni sokwengeza enye imfihlo ukubona ukuthi iyasiza yini. Isinyathelo ngasinye sikhipha ungqimba oluhlukile lwephrofayili.
Hlola izichazamazwi zombili ngaphambi kokuhlela inani
Ngaphakathi kwezilungiselelo ze-IKEv2 zomthwalo we-VPN, IKESecurityAssociationParameters ichaza ubudlelwano be-IKE futhi ChildSecurityAssociationParameters ichaza i-Child SA. Isikimu se-Apple sithi amapharamitha e-IKE nawo asebenza ku-Child SA uma isichazamazwi sesibili singekho. Lokho kuzuzwa njengefa kulula, futhi yileyo ndlela iphrofayili egcina ngayo amanani okungekho muntu owawakhetha ngokuqonda.
<key>IKESecurityAssociationParameters</key>
<dict>
<key>EncryptionAlgorithm</key><string>AES-256</string>
<key>IntegrityAlgorithm</key><string>SHA-256</string>
<key>DiffieHellmanGroup</key><integer>14</integer>
<key>LifeTimeInMinutes</key><integer>1440</integer>
</dict>Bhala imigqa emibili kurekhodi lokusatshalaliswa ngisho noma amanani efana. Lapho umhloli angabona ukuthi i-Child SA yacutshungulwa hhayi ukuthi yazuzwa njengefa ngengozi, futhi ushintsho lwakamuva kumugqa owodwa alushintshi omunye ngokuthula.
Hlola ukuthi isihluthulelo ngasinye sisho ukuthini ngaphambi kokukopisha uchungechunge
Izihluthulelo ezine azikwazi ukushintshwa ngochungechunge lwesiphakamiso esivela komunye umkhiqizo. Amagama e-algorithm ancike ekusetshenzisweni, ngakho humusha isethi ekhethiwe ngokusebenzisa isintaksi ebhaliwe yohlangothi ngalunye esikhundleni sokunamathisela isiphakamiso se-strongSwan emkhakheni we-Apple.
| Key | Holds | Common mistake |
|---|---|---|
| EncryptionAlgorithm | Cipher for that association | Assuming an AEAD name also sets integrity |
| IntegrityAlgorithm | Integrity for the chosen suite | Leaving it set for an AEAD suite that does not use one |
| DiffieHellmanGroup | Numeric group identifier | Reading the number as key size in bits |
| LifeTimeInMinutes | Association lifetime | Setting it shorter than the gateway's renewal margin |
«Sebenzisa inombolo enkulu kakhulu yeqembu» akulona indlela yokukhetha. Izihlonzi zeqembu zisho izakhiwo ezahlukene, futhi inombolo enkulu ayisho nje inguqulo enamandla kakhulu yento efanayo. Vumela umnikazi wesango ukuthi agunyaze inhlanganisela ephelele, ngoba isethi iyasebenza noma ayisebenzi njengengqikithi. Imfihlo egunyaziwe eneqembu elingagunyaziwe isiphakamiso esingagunyaziwe, futhi izohluleka noma ibuyele ngokuthula entweni okungekho uhlangothi oluyibhalile.
Hlola imikhawulo yenguqulo ekhipha ama-algorithm amadala
Isikimu somthwalo we-Apple sikhawulela i-DES, i-3DES, i-SHA1-96, i-SHA1-160 namaqembu e-Diffie-Hellman 1, 2 no-5 ezingugulweni ze-macOS ngaphambi kuka-26. Iphrofayili elethwe kusuka ekusatshalalisweni okudala ingase ibe namanani lawo futhi isaxhuma esangweni elidala, futhi leso yisimo lapho ukulungiselelwa okusebenzayo kufihla usuku lokuhoxiswa.
Thola izinguqulo ze-Mac ezisekelwayo kanye nenqubomgomo yeziphakamiso egcinwa isango ngaphambi kokwakha iphrofayili. Bese ukhetha ukuhlangana futhi ubhale ukuthi kungani ezinye izinketho zakhishwa. Inothi elithi «isango lisahlinzeka ngeqembu 2 kumakhasimende amadala» libaluleke ngaphezu kohlu lwezimfihlo olungenamlando. Ngaphandle kwalelo nothi, umhloli olandelayo akakwazi ukuhlukanisa ukukhishwa okwenziwe ngamabomu nobudedengu.
Hlola ukuqinisekisa kwangempela emgqeni walo
Ukuvumelana ngesiphakamiso akukulungisi ukuthi ubunikazi besiphakamiso beseva. Ubunikazi besango, ukwethemba isitifiketi kanye nezimpawu zomsebenzisi noma zedivayisi kuyizinqumo ezihlukene, futhi ngayinye ingahluleka ngenkathi ama-algorithm ehambisana ngokuphelele. Ukushintsha i-algorithm yesiginesha yesitifiketi akusona isenzo esifanayo nokukhetha i-algorithm yokubethela ye-IKE, nakuba zombili zivela ekubuyekezweni okukodwa.
Gcina ubunikazi besiphakamiso obulindelekile eceleni kwesiphakamiso kurekhodi. Uma ukuxhumana kuhluleka ngemuva koshintsho lwesitifiketi, leyo mbhangqwana itshela umuntu olandelayo ukuthi ukuxoxisana noma isinqumo sokwethemba kuhambile kuqala.
Satshalalisa inguqulo eyodwa futhi uhlole ukuthi kwaxoxwanani
Sebenzisa uhlelo lokusatshalaliswa olusekelwa inhlangano futhi urekhode isihlonzi sephrofayili, inguqulo, izinguqulo ze-Mac eziqondiwe kanye nenqubomgomo yesango ehambisanayo. Nika amadivayisi angakwazi ukuxhuma indlela yokululama ebhaliwe, futhi gwema ukwakha iphrofayili yesibili enegama elifanayo okungekho muntu ongakwazi ukusungula ubunikazi bayo.
Ngesikhathi sokwamukela, hlola ukulungiselelwa okufakiwe kanye nobudlelwano be-IKE ne-Child obuxoxiwe ngokusebenzisa ukuxilongwa okuvunyelwe. Bese uphoqa ukuvuselelwa okulawulwayo, ngoba ukuxhumana kokuqala kufakazela kuphela ukuthi ukuxoxisana kokuqala kwasebenza; ukungafani kwesikhathi sokuphila kuvame ukuvela ekushintsheni kokuqala kokhiye, isikhathi eside ngemuva kokugunyazwa kokusatshalaliswa.
Gcina isethi eyamukelwe kanye nerekhodi lenguqulo. Lapho khona ukuvuselelwa kwe-macOS okulandelayo noma ushintsho lwesango kuzoba nomugqa wesisekelo wokuqhathanisa nawo esikhundleni sephrofayili evele ixhuma namuhla ngengozi.