Igama elilodwa elivamile, izitifiketi ezimbili: uhlu lwemvume noma ukuhoxiswa?

Ukukhipha kabusha isitifiketi sekhompyutha ephathekayo ngaphansi kwegama elifanayo elivamile kubonakala njengokushintsha, futhi wonke umuntu ucabanga ukuthi esidala sifile. Akunjalo. Esandulelayo sihlala siyisitifiketi esivumelekile esisayinwe yisiphathimandla esifanayo, futhi noma yikuphi ukulawula okwamukela amaklayenti ngegama kuyoqhubeka nokuwamukela. Okuhlukanisa ukuhlolwa kobunikazi nokuhlolwa kobufakazi yinombolo yochungechunge, futhi yilapho ukulungiswa kufanele kube khona.

Qala ngomgomo wokuqamba amagama osethenziswa iseva

Izinhlobo ezimbili zokulawula zihlanganiswa: ukwamukela iklayenti ngenxa yalokho elizibiza ngakho, nokukhipha isitifiketi esisodwa esithile enkonzweni. Okokuqala ukuhlolwa kwegama, okwesibili ukuhlolwa kokuhoxiswa. Ziphendula imibuzo ehlukene, futhi ukusetshenziswa kungaba nakho okukodwa ngaphandle kokunye.

Funda ukumiswa kweseva futhi uphawule ukuthi yimuphi umthombo wobunikazi osetshenziswayo. username-as-common-name kwenza igama lomsebenzisi elifakazelwe libe yigama elisebenzayo lokusesha okuqondene neklayenti. Ngaphandle kwayo, kusetshenziswa igama elivamile lesihloko esisuka esitifiketini. Noma iyiphi impendulo, yibhale phansi ngaphambi kokuthinta noma yiluphi uhlu lwemvume.

Izindlela ezimbili zikhiqiza iqoqo elihlukile lamagama avunyelwe esitifiketini esifanayo. Ukuqagela lapha kusho ukuhlela ifayela elingalungile bese uphetha ngokuthi ukulawula akusebenzi.

Hlola ukuthi yini ngempela eyamukela iklayenti

Okuxhunywe nefayela elihambisanayo client-config-dir kunikeza izinketho eziqondene neklayenti; kukodwa akusona isimiso sokwamukela. Ukwamukela ngegama kudinga ccd-exclusive, okwenqaba amaklayenti angenalo ifayela elihambisanayo. Ukukuvula ekusetshenzisweni okusebenzayo kunqamula wonke umuntu ogama lakhe lingenalo ifayela, ngakho bala amafayela ngaphambi kokushintsha noma yini.

grep -nE 'ccd-exclusive|client-config-dir|username-as-common-name' /etc/openvpn/server/server.conf
ls -1 /etc/openvpn/ccd/

Isibalo siwukuhlola uqobo: qhathanisa uhlu lwedokhumenti nobunikazi obulindele ukuthi buxhume.

Bese uqinisekisa ukuthi igama ngalinye lefayela lihambisana ngqo nobunikazi obusebenzayo, kuhlanganise nobukhulu bezinhlamvu nezikhala. Ifayela le- office-laptop alwenzi lutho esitifiketini esihloko salo sifundwa ngokuthi Office-Laptop. Izikhala zokugcina nazo ziyacashela ohlwini olujwayelekile, futhi yilokho okwenza ifayela elibonakala likhona lihlale lingafundwanga.

Hlola i-CRL elayishwa yisango

I-CRL ibiza izitifiketi ezihoxisiwe ngomkhiphi nangenombolo yochungechunge, futhi lokho kuwukuningilizi okungenakho ekuhlolweni kwegama. Izitifiketi ezimbili zingabelana ngegama elivamile futhi zehluke ngenombolo yochungechunge, futhi uhlu lwezinga lwenombolo yochungechunge kuphela oluzihlukanisayo.

Qinisekisa indlela emisiwe, usuku lokukhipha nensimu yokubuyekezwa okulandelayo ngaphambi kokuthemba ifayela.

openssl crl -in /etc/openvpn/crl.pem -noout -lastupdate -nextupdate
openssl x509 -in office-laptop.crt -noout -serial -subject

Qhathanisa inombolo yochungechunge ekwi-CRL nenombolo yochungechunge esesitifiketini ohlose ukusigcina. Lokho kuqhathanisa kuwukuhlola konke, futhi ukukwenza kanye ngamehlo kungcono kunokuthemba umbhalo ongeke wafundwa muntu. Sabalalisa i-CRL ebuyekeziwe ngendlela isango elivele liyifunda. I-CRL esendaweni engalungile ayiqinisi lutho, futhi alukho ugogo lweklayenti oluyokhuluma ngayo.

Shintsha, bese ufakazela imiphumela yomibili

Khipha okushintshayo ngaphansi kwegama elifanayo elivamile, rekhoda zombili izinombolo zochungechunge, bese kuthi ngemva kwalokho hoxisa esidala. Lokho kuhleleka kugcina ubunikazi obusebenzayo butholakala ngesikhathi ulungiselela ushintsho.

Hlola okushintshayo kuqala: kufanele kufakazeleke futhi kufinyelele konke okunelungelo ngegama lako. Bese uhlola isitifiketi esidala futhi uqinisekise ukuthi senqatshwa, ngoba ukushintsha okuphumelelayo akusho lutho ngokuhoxiswa. Uma zombili zisaxhuma, okokufaka kokuhoxiswa akufundwa noma inombolo yochungechunge endala ayikaze ibhalwe ohlwini. Uma kungasekho okuxhumayo, uphule umthetho wokwamukela hhayi ubufakazi.

Izikhathi ezivele zisungulwe ziyindaba ehlukile, ngoba ukuhoxiswa kusebenza ekufakazelweni okusha ngaphandle uma isango nalo limiswe ukunqamula izixhumo eziphilayo. Nquma ukuthi ukususa ngokushesha kuyadingeka yini ngaphambi kokuthembisa umuntu.

Okungeke kwenzeke ekuhlolweni kwegama

Uhlu lwemvume luphendula ukuthi lobu bunikazi bungaxhuma yini. Alukwazi ukusho ukuthi buphi ubufakazi obusetshenziswe yibo bonu bunikazi, futhi luzokwamukela ubufakazi obudala uma nje ubufakazi buhlala busebenza futhi bungakahoxiswa. Leyo gebe ibonakala ngesikhathi sehlo, lapho okushintshayo kwakhishwa ezinyangeni ezedlule kanti esandulelayo sisasebenza.

Lapho kudingeka ukulawula ezingeni lesitifiketi, sebenzisa indlela ebiza isitifiketi: okufakiwe ku-CRL, noma i-hook yokuqinisekisa ehlola isigxivizo somunwe esigcinwa umqhubi. Zombili zidinga ukunakekela, futhi zombili zithembekile ngakho lokho ezikuhlolayo. incwadi ye-OpenVPN 2.6 ichaza crl-verify nokwamukelwa okuqondene neklayenti njengezinketho ezihlukene, ngenxa yaleso sizathu.

Bhala ukuthi yikuphi ukulawula okwenza muphi umsebenzi, bese uhlola isimo esiphikisayo. Ukuhoxiswa ongakaze ukubone kunqaba uxhumo kuwukumiswa okuthemba ukuthi kuzosebenza.