I-VPN ye-Mac ixhumanisa kanye, bese isikhathi siphela: hlanza i-IKE daemon

Ukuxhumana kokuqala ngemva kokuqalisa kabusha kuyasebenza. Wonke umzamo olandelayo uyakhangwa esigabeni sokuxhumana futhi ekugcineni isikhathi siphela, futhi ukulapha okuwukuphela okuthembekile ukokuqalisa kabusha okunye. Leli phethini akulona inkinga yephrofayela futhi akulona inkinga yemininingwane yokungena. Kukhona okuthile ngemuva okusabambe isimo somzamo odlule, futhi umzamo olandelayo ushayisana nakho.

Ku-macOS, lokho okuthile ngokuvamile i-IKE daemon.

Iphethini: ukuxhumana kanye, bese isikhathi siphela

Ukuxhumana okusebenza ngqo kanye ekubuyeni ngakunye kukhombisa isimo esidlula ukunqamuka kodwa esingadluli ukuqalisa kabusha. Amaphrofayela adlula kokubili, ngakho iphrofayela akulona ukuguquguqukayo. Imininingwane yokungena nayo idlula kokubili, ngaphandle uma iseva ikhiya i-akhawunti. Okushintshayo ekuqaliseni kabusha yiqoqo lama-daemon asebenzayo kanye namasokhethi eziwabambayo.

Lokhu kunciphisa uphenyo ngaphambi kokuthi uvule ngisho ilogi elilodwa. Umbuzo uba yikuphi inqubo ephethe imbobo ye-IKE nokuthi icabanga ukuthi yenzani.

Ama-daemon amabili, imbobo eyodwa

Isistimu isebenzisa racoon lapho ukuxhumana kukhuluma nge-IKE inguqulo 1. Izinguqulo zamanje ziletha futhi iked ze-IKEv2 kanye nesitaki se-IPsec esisha. Kokubili kungabamba i-UDP 500 ne-UDP 4500, futhi kokubili kungagcina ukuhlangana kokuphepha okuvuleke uhhafu ngemva kokuthi umzamo wokuxhumana ukhanselwe esicelweni sephasiwedi noma uphazanyiswe ukushintsha kwenethiwekhi.

Lapho lokho kwenzeka, umzamo olandelayo awuqali ngokuhlanzekile. Izama ukuxoxisana ngesikhathi ukuhlangana okudala kusabambe isimo sozakwethu, futhi ukushintshana kuyama esikhundleni sokuhluleka ngephutha elicacile. Umsebenzisi ubona isibonisi esijikelezayo, bese isikhathi siphela.

Thola umnikazi ngaphambi kokubulala noma yini, ngoba impendulo inquma ukuthi iyiphi isevisi oyqalisa kabusha kanye nokuthi iyiphi ilogi oyifunda ngokulandelayo.

sudo lsof -i :500 -i :4500
ps -ef | grep -E "racoon|iked"

Funda okukhiphayo njengamaqiniso amabili: iyiphi inqubo ebambe imbobo, nokuthi zingaphezu kukodwa yini. Ama-daemon amabili e-IKE ancintisanayo ngesokhethi elilodwa achaza ukuziphatha okuningi okuphakathi okubonakala njengeseva engazinzile.

Qalisa kabusha umsebenzi, hhayi inqubo

Ezinhlelweni ezindala, ukubulala inqubo nokuvumela ukuxhumana okulandelayo ukuthi iqalise kabusha kwanele. Ezinguqulweni zamanje i-daemon ilawulwa yi-launchd, futhi ukuthumela isignali enqubeni kuphela kungashiya umsebenzi esimweni lapho ungasebenzi futhi ungahlelelwanga ukuqala. Misa futhi uqalise umsebenzi esikhundleni salokho.

sudo launchctl stop com.apple.racoon
sudo launchctl start com.apple.racoon

Uma i-launchd ingenayo irekhodi yomsebenzi, ukubulala inqubo ngegama kusaphoqa ukuxoxisana okusha emzamweni olandelayo. Ukuhlola kuyafana kuzo zombili izimo: akukho nqubo okufanele ibambe imbobo lapho uzama ukuxhuma futhi. Qinisekisa lokho ngomyalo ofanayo lsof esikhundleni sokucabanga ukuthi ukuqalisa kabusha kusebenzile.

Bese uxhuma kanye futhi ufunde ilogi yeklayenti kusukela ekuqaleni. Ukuxoxisana okudlula isigaba 1 bese kubika ukwehluleka kokudlulisa kuphinda inkinga yesokhethi lendawo; ukuxoxisana okunqatshiwe uzakwethu yithikithi elihluke ngokuphelele.

Lapho iseva iyona enqabayo

Akukhona konke ukuxhumana kwesibili okwehluleka endaweni. Iseva inganqaba ukungena okusha isikhathi esinqunyiwe ngemva kokunqamuka, futhi ukuphela kwesikhathi kuklayenti kubonakala kufana ncamashi ne-daemon ebambekile. Umehluko ushibhile: uma ukuqalisa kabusha i-daemon kungasizi kodwa enye i-akhawunti ixhuma ngokushesha, iwindi liseceleni kweseva futhi i-Mac yayingakaze ibe yinkinga.

Inqubomgomo yethunge lwengxenye ikhiqiza isimo esifanayo ngakolunye uhlangothi. Iseva efuna wonke umthamo wethunge izolahla iklayenti elilungiselelwe ithunge lengxenye ngesikhathi sokuxoxisana, futhi iklayenti libika ukuphela kwesikhathi esikhundleni kokwenqatshwa kwengqubomgomo. Ukushintsha iphrofayela ukuze konke kudlule ethungeni kungase kuxhumise, kodwa leso yisinqumo senqubomgomo okufanele sithathwe nomnikazi wenethiwekhi, hhayi ukulungisa okufakwa buthule.

Funda ilogi kazakwethu ngaphambi kokushintsha iklayenti futhi. Ukunqatshwa, ukungavumelani kwengqubomgomo nokulahlwa buthule kuyizizathu ezintathu ezihlukene ezibonakala zingathi “kuyaxhumeka” esikrinini se-Mac.

Amaklayenti amadala kanye ne-kernel yama-64-bit

Iklayenti elidala le-Cisco IPSec lilayisha isandiso se-kernel esakhelwe amasistimu angama-32-bit ne-PowerPC. Ku-Mac eqaliswe nge-kernel yama-64-bit, leso sandiso asikwazi ukulayishwa, futhi iklayenti lihluleka kusenesikhathi ngephutha 51 ngoba alifinyeleli nhlobo uhlelo olungaphansi lwe-VPN. Noma ngabe uqalisa kabusha i-daemon kangaki, isandiso se-kernel esinokwakheka okungalungile asilungiswa.

Ukuphinda kulayishwe isandiso kungasebenza isikhashana bese kwehluleka futhi ekuqaliseni okulandelayo. Izimpendulo ezihlala njalo ukusebenzisa i-kernel endala lapho isasekelwa khona, noma ukudlulela kuklayenti elakhelwe ngaphakathi eliza nesistimu. Hlola ukwakheka ngaphambi kokuchitha ubusuku kuklayenti lenkampani yesithathu elingakwazi ukulayishwa.

• Phinda ukhiqize kanye, bese uhlola ukuthi iyiphi i-daemon ephethe i-UDP 500 ngaphambi kokuthinta iphrofayela.
• Funda ukwehluleka kokuqala ngemva kwesigaba 1: iphutha lokudlulisa likhomba isokhethi lendawo.
• Qalisa kabusha umsebenzi we-launchd, hhayi inqubo kuphela, futhi uqinisekise ukuthi imbobo ikhululekile.
• Zama enye i-akhawunti ukuze uhlukanise iwindi lokuqinisekisa kabusha oseceleni kweseva nokonakala kweklayenti.
• Bhala ukwakheka kwe-kernel ngaphambi kokusola iklayenti.

I-VPN esebenza kanye ngqo inkinga yesimo kuze kube kuqinisekiswa okuhlukile. Ukuhlanza i-daemon kushesha kunokuqalisa kabusha, futhi kugcina ubufakazi belogi obekungalahlwa ukuqalisa kabusha.