I-peer eyodwa endala iphoqa i-TLS 1.0: khawulela okuhlukile, hhayi i-host

Kuvela idivayisi eyodwa endala, yehluleka ukuxhuma, futhi ukulungiswa okubonakala kushesha kakhulu ukuwenza wonke ama-host abe buthakathaka kuze kuphumelele ukuxhumana. Lokho kushintshana akubonakali ngaleso sikhathi futhi kuhlala njalo empilweni, ngoba akekho osusa izinga eliphansi elisebenza ekugcineni. Ingcindezi yenziwa amaphutha amabili ahluke kakhulu, futhi elilodwa kuphela lawo liphathelene nama-cipher. Hlela iphutha kuqala, bese ubeka okuhlukile endaweni okungeke kusakazeke kuyo.

Hlukanisa ukwehluleka kabili ngaphambi kokushintsha umyalelo

Umugqa welogi leseva mayelana nokungabikho kwe-cipher eyabiwe, noma mayelana nenguqulo ye-protocol engasekelwe, uvela esiteshini sokulawula: iziphetho zombili azikwazanga ukuvumelana ngendlela yokuvikela ukuxoxisana ngokwako. Umugqa weklayenti othi ayikho indlela yokuqinisekisa isitifiketi seseva enikwe amandla uvela kwenye indawo ngokuphelele, ngoba lelo klayenti alihloli ngisho ukuthi ngubani ophendulile. Ukushintsha i-cipher yedatha akusizi lutho esimweni sesibili, futhi ukwengeza ukuhlolwa kwendima akusizi lutho kwesokuqala.

Thatha umugqa wokuqala ohlulekile ovela ohlangothini ngalunye, hhayi umugqa wokugcina ngaphambi kokunqamuka, ngoba owokugcina ngokuvamile umphumela kuphela. Bese uthola ukuthi iyiphi ifayela iklayenti eliyivulile ngempela: iphrofayela elethwe yengeziwe ivamise ukuba khona kabili ngaphansi kwamagama okubonisa ahlukene, futhi ukuhlela ikhophi okungekho muntu oyifundayo kwenza ukungabi khona koshintsho okukholisayo. Inqubo esebenzayo igcina izilungiselelo eyaqala ngazo, ngakho ifayela eligciniwe akulona ifayela elilayishiwe. Imiyalo engezansi ikhombisa ukuxoxisana kweklayenti eceleni kombono weseva ngomzamo ofanayo.

openvpn --config <profile>.ovpn --verb 4 2>&1 | head -n 40
journalctl -u [email protected] --since '-10 min' | grep -iE 'cipher|tls|verify'

Isilaleli sesibili iyindawo eqotho yezinga eliphansi elibuthakathaka

Uma idivayisi ima ku-TLS 1.0 ngesiteshi sedatha esingaphambi kuka-2.5, iseva kufanele inikeze izinga eliphansi eliphansi lesiteshi sokulawula kanye ne-cipher yedatha ekhonjwa yiklayenti elidala. Umyalelo wokubuyisela ukhona ngqo kulowo peer, kuyilapho uhlu lwama-cipher lugcina amaklayenti esimanjemanje kuma-suite esimanjemanje. Yomibili imiyalelo ingeyesilaleli hhayi eyomsebenzisi noma eyokuxhumana, futhi akukho ukukhetha kweklayenti ngakunye okubanciphisa kamuva. Yingakho idivayisi eyodwa endala esiteshini esiyinhloko iyisinqumo mayelana nayo yonke i-peer eyabelana ngaleso siteshi.

Lapho inkundla ivuma khona, sebenzisa isilaleli esidala njengesimo saso esiteshini esihlukile, vumela leso siteshi kuphela kusuka ekhelini ledivayisi, bese ushiya insizakalo eyinhloko. Bhala ukuthi kungani isilaleli sesibili sikhona, efayelini eliphethe ukucushwa kwaso, ngoba uma kungenjalo ukuhlanza kwesikhathi esizayo kuzokufunda njengensalela. Ukwehlukanisa kuba nenzuzo kuphela uma izinga eliphansi elibuthakathaka liphela lapho iphela khona idivayisi.

tls-version-min 1.0
data-ciphers AES-128-GCM:AES-256-GCM:AES-256-CBC
data-ciphers-fallback AES-256-CBC

Yini isitifiketi sakudala somhlinzeki esiyiphula ngempela

Iphutha lokuqinisekisa ukuntuleka kokubopha indima: ngaphandle kwako iklayenti lizokwamukela noma yisiphi isitifiketi esixhuma ku-CA ethembekile, kungakhathaliseki ukuthi sakhishwa sesiva noma cha. Qala ngokubopha isitifiketi endimeni yesiva, futhi uphathe ukubopha njengesidingo hhayi njengesilawuli sokulungisa. Iphrofayela kuphela esahluleka ngemva kwalelo nyathelo enenkinga yesitifiketi yangempela.

Isitifiketi sakudala somhlinzeki esinosayizi wokhiye noma i-algorithm yesiginesha engasahlangabezani nomgomo ozenzakalelayo we-OpenSSL yisimo sokushintsha izinga lokuphepha elikhawulelwe esiteshini sokulawula. Ukwehlisa izinga lapho akukucishi ukuqinisekisa, futhi akumele nanini kuhlangana ne-CA engenalutho, ukuqinisekisa okuvaliwe noma igama le-host elingahloliwe. Gcina umugqa ngaphakathi kwephrofayela eyodwa ewudingayo; ukuthumela ngaphandle ukucushwa kwe-OpenSSL okuxegisiwe emhlabeni wonke kuzonikeza lokho kuxega okufanayo kuhlelo ngalunye kumshini.

remote-cert-tls server
tls-cipher "DEFAULT:@SECLEVEL=0"

Funda amanani axoxiwe, hhayi ibhana

Ku-verbosity 4 iziphetho zombili ziphrinta inguqulo ye-TLS ne-cipher yesiteshi sokulawula abavumelane ngayo, kanye ne-cipher yedatha yesikhathi. Funda leyo migqa hhayi ibhana lokuqalisa, elibika impumelelo hhayi imibandela yayo. Bese uxhuma futhi iklayenti lesimanjemanje esilalelini esiyinhloko futhi uqinisekise ukuthi lisahamba kuyi-suite yesimanjemanje, ngoba okuhlukile okuthelekelele ekucushweni okwabiwe kubonakala lapha kuqala. Amanani owakopishayo aba yisisekelo sokubuyekezwa okulandelayo.

Hlola idivayisi endala iyodwa: kufanele ixhumeke, futhi kufanele ibe ukuphela kwesikhathi kumalogi okukhombisa amapharamitha abuthakathaka. Uma i-peer yesibili nayo ixoxisana nge-suite endala, okuhlukile kubanzi kunalokho obekuhlosiwe futhi ukwehlukaniswa kwesilaleli akwenzekanga ngempela. Rekhoda kokubili ukubona hhayi isiphetho kuphela.

Okuhlukile ngakunye kudinga umnikazi nosuku

Okuhlukile okungenasimo sokususwa kuba yisisekelo buthule, ngakho beka idivayisi, umnikazi, isizathu kanye nosuku elinyamalala ngalo eceleni kokucushwa elikuthethekelayo. Ngaphandle kwalowo mugqa izinga eliphansi elibuthakathaka liphila isikhathi eside kunenguxube yezinto eyayilidinga.

Ukushintsha iklayenti, noma ukucela iphrofayela yamanje kumhlinzeki, umphumela okufanele uhloswe; okuhlukile ukubambezeleka hhayi umklamo. Uma idivayisi ithatha umhlalaphansi, susa isilaleli nephrofayela kushintsho olulodwa ukuze kungabikho uhhafu oqhubeka nokusebenza. Akukho kulokhu okwenza amapharamitha amadala aphephe, kuvimbela kuphela ukuthi umkhawulo wedivayisi eyodwa ube yisisekelo sawo wonke umuntu.