Iphutha elilodwa, izimfihlo ezintathu: iyiphi imininingwane ye-VPN ehlulekile?
Iklayenti likhombisa iphutha elilodwa esigabeni ngasinye. Funda ukuxhumana, ukushintshana komsebenzisi kanye nendlela ngaphambi kokusetha kabusha iphasiwedi okungekho oyihlolile.
“Ukuqinisekiswa kwehlulekile” kungakhomba isitifiketi seseva, ukhiye owabiwe ngaphambili womshini noma iphasiwedi yomsebenzisi. Ukuthi iyiphi kuye ngeprotocol, ngoba iprotocol ngayinye ichaza isethi ehlukile yezimfihlo. Uma usetha kabusha okungalungile, iphutha lihlala linjalo. Indlela yokuphuma iwukuthola ukuthi iprotocol idinga ubufakazi obungaki ngaphambi kokuhlela noma yini.
Ubufakazi obubili obukhomba ezinhlangothini eziphambene
Ithube kufanele liphendule ukuthi lifinyelele yini isango elifanele, futhi ngokwehlukile ukuthi umsebenzisi ungubani. Ubufakazi besango bungobungako bomshini: isitifiketi seseva, ukhiye owabiwe ngaphambili noma ukhiye womphakathi ongashintshi. Ubufakazi bomsebenzisi bungobungako bomuntu: iphasiwedi, ithokheni, isitifiketi sekilayenti, noma lutho. Lezi ziyizindawo eziphambene zokuthembela futhi zisebenzisa izinto ezihlukile.
IKEv2 yenza ubufakazi besango ngaphakathi kwe-IKE_AUTH futhi, lapho kusetshenziswa i-EAP, isebenzisa ubufakazi bomsebenzisi ekushintshaneni okwahlukile ngemuva kwalokho. isicaciso se-IKEv2 sizigcina njengezigaba ezihlukile, okuyisikhombisi esinamandla sokuthi ubheka kuphi lapho umyalezo owodwa uhlanganisa imijikelezo yomibili.
Funda isigaba, hhayi umyalezo
Iklayenti likhombisa umugqa ofanayo wephutha kungakhathaliseki ukuthi yisiphi isigaba esihlulekile, ngakho umugqa ngokwawo awutholi lwazi nhlobo. Okuthola ulwazi yisimo ongasihlola esigabeni ngasinye: ukuthi ukuxhumana kukhona yini, ukuthi ukushintshana komsebenzisi kuqalile yini, nokuthi iklayenti linikeze indlela ebiyifunwa isango yini. Ithebula lihlela izigaba ngaleyo ndlela, hhayi ngegama leprotocol.
| Stage that failed | Evidence you can inspect | What a password change cannot fix |
|---|---|---|
| The machine proof | no security association in the state list | a mismatched pre-shared key or an untrusted chain |
| The user proof | an association is up while PPP or EAP reports failure | an expired token, a locked account, a missing client key |
| The client's method support | the client offers no method the gateway accepts | a client without the required EAP or key material |
| The server's policy | the gateway rejects before any user exchange starts | a policy that requires a certificate the profile lacks |
Umugqa wesibili kuphela ophathelene nemininingwane umsebenzisi angayibhala futhi. Eminye emithathu ingamaqiniso okusethwa, futhi ukungafani kwalokho yikho okwenza imibiko eminingi enjena igcine ngokusetha kabusha iphasiwedi okungashintshi lutho. Funda umugqa ohambisana nobufakazi bakho ngaphambi kokuthinta inkambu.
Iprotocol enezimfihlo ezimbili iveza amakhadi ayo
L2TP phezu kwe-IPsec yenza inani libonakale, ngoba ukuhlola okubili kwenzeka ezinqubweni ezihlukile. Ungqimba lwe-IPsec kufanele lukhuphuke kuqala nokhiye owabiwe ngaphambili noma isitifiketi, futhi ngemva kwalokho kuphela i-PPP engaphakathi kwayo izama ukungena komsebenzisi.
Lapho imfihlo yomshini ingalungile, akukho kuxhumana okwakheka futhi imininingwane yomsebenzisi ayizange izanywe. Lapho imfihlo yomshini ilungile kodwa eyomsebenzisi ingalungile, ukuxhumana kukhona futhi i-PPP inqaba ukungena ngemva kokuba ithube selikhuphukile. Kokubili kunikeza umyalezo ofanayo esikrinini ovela ezehlakalweni ezimbili ezihlukile.
sudo swanctl --list-sas
sudo ip xfrm state list
sudo journalctl -u xl2tpd -n 50 --no-pagerUhlu olungenalutho lokuxhumana lususa ngokushesha ungqimba lomsebenzisi, ngakho luhlole ngaphambi kwephasiwedi. Ukuxhumana okusunguliwe okunehluleka okuphindaphindiwe kwe-PPP kukhomba kolunye uhlangothi, kungqimba lomsebenzisi noma iprotocol yokuqinisekisa engaphakathi kwayo. Asikho isiphetho kulezi esitholakala embhalweni wephutha leklayenti.
Ukufinyelela ngephasiwedi kuphela kuncike ngempela kuni
Ukufinyelela ngephasiwedi kuphela kuvamile ku-L2TP, PPTP, SSTP kanye ne-IKEv2 ene-EAP. I-WireGuard ayinayo nhlobo leyo nketho, ngoba ozakwabo bangamakhiye hhayi abasebenzisi. Ku-OpenVPN impendulo ivela esidingweni seseva sesitifiketi sekilayenti: isango elifuna kokubili isitifiketi nephasiwedi lizoqhubeka lenqaba ikilayenti elinephasiwedi kuphela, noma yini ebhalwe enkambini.
Iyiphi ingxenye oyidingayo ilandela impendulo efanayo. Ukungena ngephasiwedi ngaphansi kwe-IKEv2 kudinga ikilayenti elikhuluma i-EAP, kuyilapho ukungena ngesitifiketi kudinga ukhiye oyimfihlo wekilayenti kanye nochunge lweseva. Faka okungalungile futhi ukwehluleka kufundwa njengephutha lemniningwane, nakuba indlela yokuqinisekisa ngokwayo iyona engekho.
Shintsha into eyodwa, bese uphinda uhlole
Qala ngokuqinisekisa amaqiniso amathathu: iyiphi iprotocol esebenzayo, ichaza izimfihlo ezingaki, futhi eziphi zazo ezingezomshini hhayi ezomsebenzisi. Imishini iyahluleka esigabeni sokuqala futhi abantu kwesesibili, futhi ukuhlanganisa lezi ezimbili yiyo yonke le nkinga.
Bese ushintsha into eyodwa ngqo futhi uphinde uhlole kusuka kukilayenti elifanayo. Leso siko siguqula ukwehluleka okudidayo kube ukulungisa ongakuchaza kumuntu olandelayo, okuwusizo ukwedlula uxhumano olusebenzayo okungekho ongaluchaza.