I-OpenConnect iguqula kanjani ikhukhi yokungena ibe umhubhe?

I-OpenConnect ihlanganisa ukushintshana okubili okwehlukene ngenani elilodwa lesikhathi esifushane: ukungena kuwebhu kanye nomhubhe we-VPN. Ukushintshana kokuqala yi-HTTPS evamile: imininingwane yokuqinisekisa, uhambo lwe-SAML noma ithokheni kuye kusigaba, futhi impendulo ithwala ikhukhi yokuqinisekisa. Ukushintshana kwesibili kwethula leyo khukhi kusona leso sigaba njengobufakazi bokuthi isigaba sewebhu sesenzekile, futhi yilapho kuphela umhubhe ukhuphuka khona.

Phakathi nokungena akukho okuxoxwayo mayelana nomhubhe. Lesi yisigaba okufanele sasiqonde, ngoba iningi lamaphutha e-script licabanga ukuthi ikhukhi iyiphasiwedi okufanele igcinwe, noma ukhiye ovikela ukuhamba, kuyilapho empeleni kuyithikithi elithwalayo leseshini ethile yesigaba.

Yini iklayenti nesigaba abayishintshayo, ngokulandelana

Isigaba sokuqinisekisa sibukeka njengewebhusayithi evamile evikelekile. I-OpenConnect ithumela imininingwane yomsebenzisi, noma ilandela ukuqondiswa kabusha kwesigaba kuya kumhlinzeki wobunikazi, futhi isigaba siphendula ngombhalo ofaka ikhukhi yokuqinisekisa. Kuphrothokholi ye-AnyConnect lelo nani lihamba kusihloko sekhukhi ezicelweni ezilandelayo, ngokuvamile ngaphansi kwegama elifana ne-webvpn, futhi incwadi yokuhola iyibheka njengemininingwane eqhubekisela phambili iseshini.

Isigaba sesibili isicelo se-CONNECT esiya endaweni yokugcina ye-VPN yesigaba ngale khukhi enamathiselwe. Isigaba siyayihlola, sinikeza ikheli, futhi iklayenti liqala i-CSTP phezu kwe-TLS, kanti i-DTLS iyindlela yedatha eshesha kakhulu engakhethwa uma iseshini isivele ikhona. Kungalesi sikhathi kuphela lapho kusungulwa khona amapharamitha omhubhe, imizila, izilungiselelo ze-DNS kanye nokhiye bokuhamba beseshini. Ikhukhi yadlulisa iklayenti emnyango; ayizange ibethela lutho ngemfihlo.

Lokhu kulandelana kuchaza ukuthi kungani i-openconnect --authenticate ikhona. Yisebenzise, futhi yenza isigaba sewebhu, iphrinta ibhlokhi elincane leziguquguquki ze-shell ezifana ne-COOKIE, HOST, CONNECT_URL ne-FINGERPRINT, bese iyaphuma ngaphambi kokuthi kwakhiwe noma yimuphi umhubhe. I-script yokugoqa ingabe isiqalisa ukuxhumana kwangempela ngaleyo nani, futhi yikho kanye ukuhlukaniswa okudingwa ukusetshenziswa okungenakhanda noma okwamakhonteyina amabili.

Ikhukhi iyisithwali sesheshini, hhayi ukhiye

Phatha lelo nani ngendlela obungaphatha ngayo isihlonzi sesheshini kuhlelo lwewebhu. Noma ubani onalo phakathi nokuphila kwaso angacela kusigaba umhubhe okufanele iseshini leyo, ngakho ukufihleka kwaso kubalulekile. Kodwa ukukopisha akudaluli ukuhamba, ngoba ukufihleka komhubhe kuvela ekuxhumaneni kwe-TLS nakukhiye abasuselwe kukho, hhayi ochungechungeni lwekhukhi.

Futhi akusona isigunyazo esingapheli. Isigaba nomhlinzeki wobunikazi banquma ukuthi iseshini iphila isikhathi esingakanani, futhi isiphequluli esisabonisa ikhasi lokungena asisho lutho mayelana nokuthi iseshini yomhubhe isasebenza yini. Ukuxhuma kabusha ngemva kokuphelelwa yisikhathi kusho ukuphinda isigaba sewebhu nokwakha ikhukhi entsha, futhi lokho kuyinjongo yokuqinisekisa kabusha, hhayi inkinga okufanele igwenywe ngobunjiniyela.

Ungayithathi ikhukhi njengokufaka esikhundleni okujwayelekile kweminye imininingwane yokuqinisekisa. Isimemezelo se-SAML, iphasiwedi yesiphequluli nekhukhi ekhishwe enye insizakalo kuyizinto ezihlukene ezinababukeli abehlukene, futhi ukunamathisela enye enkundleni yenye kuvame ukwehluleka kusigaba noma, okubi kakhulu, kuphumelele ngokumelene nomngcele wokwethemba ongafanele.

Ukudlulisa ikhukhi ngaphandle kokushiya amakhophi

Ukunikezwa komshini okuphephe kakhulu ku-Linux ukufakwa okujwayelekile. I---cookie-on-stdin ifunda inani ku-stdin, ngakho ikhukhi ayiveli ohlwini lwezimpikiswano zenqubo, lapho noma yimuphi umsebenzisi wasendaweni angayifunda khona nge-ps. Ipayipi eliqinisekisa kwenye inqubo futhi londle umhubhe kwenye ligcina inani epayipini hhayi efayelini noma kokuguquguqukayo kwemvelo.

Izimpikiswano nokuguquguqukayo kwemvelo kubuthaka ngezizathu ezihlukene. Impikiswano ibonakala kuthebula lezinqubo ngaso sonke isikhathi sokuphila kweklayenti futhi ivame ukugcina emlandweni we-shell. Ukuguquguqukayo kwemvelo kuzuzwa njengefa yizinqubo ezingane, futhi iyunithi ye-systemd eyisetha efayelini leyunithi igcina imfihlo ekumisweni okufundekayo. Uma ifayela lidingeka ngempela, likhawulele ku-akhawunti yensizakalo futhi ulisuse uma iseshini iphela.

Gcina futhi umngcele wamalungelo ngamabomu. Inqubo ekhuluma nomhlinzeki wobunikazi futhi mhlawumbe ivula isiphequluli kufanele isebenze njengomsebenzisi ongumnikazi walokho kungena. Inqubo ehlela imizila, i-DNS kanye nedivayisi yomhubhe ingase idinge amalungelo engeziwe. Ukusebenzisa sonke isiphequluli njenge-root ukuze ikhukhi yaso itholakale kumhubhe ophethwe yi-root ukushintshana okungalungile, futhi ukuhlelwa kwesimanjemanje kwe-OpenConnect kungadlulisa inani ngale kwalowo mngcele ngokusobala.

Ukuloga nakho kufanelwe ukungabaza okufanayo. Ukuphuma kweklayenti okunemininingwane, ama-script okusiza kanye nokuxilongwa kwesigaba konke kungaphinda izinto zesicelo, futhi akuzona zonke izigaba zelogi ezifihla ikhukhi. Thatha irekhodi lephutha elincane kakhulu olidingayo, ligcine ngaphandle kweziteshi ezabiwe, futhi uhlole isampula efihliwe ngaphambi kokuyinamathisela kuthikithi.

Ukuqinisekisa nokuphelelwa yisikhathi esigabeni sesibili

Isigaba sesibili kusamele siqinisekise iseva. I-FINGERPRINT ephrintwa yi---authenticate iwukuphina kwesitifiketi ngendlela engu-pin-sha256:, futhi ukuyidlulisela ocingweni lomhubhe nge---servercert kugcina ukuhlola kugxilile kusigaba oqinisekise kuso. Ukucisha ukuhlola kwesitifiketi ukuze kube lula iscript kususa ubufakazi obulodwa bokuthi ikhukhi inikezwa isibungu esihlosiwe.

Uma isigaba senqaba ikhukhi, isisombululo umjikelezo omusha wokuqinisekisa, hhayi inqolobane ende. Gcina ikhukhi kuphela isikhathi sokuphila kokuxhumana, susa amafayela esikhashana uma uphuma, futhi usebenzise inqubo yokususa iseshini yomhlinzeki wobunikazi noma yesigaba uma iseshini ivezwa noma idivayisi ilahleka. Ikhukhi egciniwe ayisikhululi ku-MFA.

Ngaphambi kokwenza lokhu kuzenzakale, qinisekisa izinto ezine: umhubhe usebenza ngaphansi kwe-akhawunti efanele, ikhukhi ifika nge-stdin, umnyakazo womunwe wesitifiketi uphiniwe, futhi iseshini iyalahlwa uma umhubhe uvalwa. Uma kukhona okushodayo, ukuzenzakalisa kwandisa ukwethemba kwekhukhi esikhundleni sokuphinda ukuhamba kwesandla.