Kungani i-OpenConnect inqaba igeyithi ngemuva kokushintshwa kwesitifiketi?
Ukwehluleka kokuqinisekisa ngemuva kokushintshwa kwesitifiketi segeyithi yisinqumo sokuthembela, hhayi umhubhe ophukile. Khetha phakathi kwe-CA ekhiphayo nokubopha ukhiye owodwa.
Ama-geyithi ashintsha izitifiketi, futhi iklayenti ebelixhuma izolo liqala ukuma ekushintshaneni kwe-TLS kokuqala. Umlayezo usho isizathu sokuqinisekisa hhayi ukwehluleka kwenethiwekhi, futhi umshini ngokwawo awukashintshi, yilokho okuyikhomba okusizayo. Okwaphukile ubudlelwano phakathi kwesitifiketi esethulwayo manje nezimpande iklayenti elizimisele ukuzicabangela. Ukukulungisa yisinqumo sokuthembela, ngakho thatha leso sinqumo ngaphambi kokuthayipha inketho.
Funda ukwehluleka ngaphambi kokushintsha noma yisiphi isilungiselelo sokuthembela
Iphutha lohlobo lokuntuleka komsayini lisho ukuthi uchungechunge luphelela entweni iklayenti engayamukeli. Kungaba isitifiketi esivuselelwe esivela kwisikhungo sangaphakathi, ukushintshwa esivela kwesikhungo esivamile, noma idivayisi ephakathi ethula isitifiketi sayo. Amagama kuphela awakwazi ukuhlukanisa lezo zimo, ngakho bheka umkhiphi ngaphambi kokunquma.
Gijimisa ukuxhumana kanye ngaphambili futhi kuvumele kuhluleke, ngoba okukhishwayo okusebenzisanayo kuthwala igama leseva, uchungechunge lomkhiphi kanye nomnyathelo weminwe okubalwe yiklayenti. Qhathanisa lowo mkhiphi nesikhungo esiqhutshwa ngempela yinhlangano yakho. Uma umnyathelo weminwe washintsha kanti umkhiphi akashintshanga, kuthatha njengokungabazekayo kuze kuqinisekiswe ukuvuselelwa ngesiteshi osuthemba kuso. Ukuqagela kuleli qophelo yindlela umuntu agcina ngayo ebopha ukhiye womgadli.
Bhala inguqulo yeklayenti kulo mlando ofanayo. Ingxenye enkulu yokwehluleka okubonakala njengezinkinga zokuthembela ivela kuklayenti elidala elihlangabezana nokushintshana kwegeyithi okusha.
Khetha phakathi kokwethemba umkhiphi nokubopha ukhiye owodwa
Zombili izinketho zenza ukuxhumana kuphumelele. Ziyaphuka kamuva ngezindlela eziphambene, ngakho ukukhetha kungokokwehluleka ongakubekezelela.
| Approach | Good fit | What breaks it |
|---|---|---|
Trust the issuing CA with --cafile | Internal PKI you can obtain over an already trusted channel | CA rotation, or a client that still falls back to public roots |
Pin one key with --servercert | No CA relationship, or exactly one key should ever be accepted | Any reissue that generates a new key pair |
Sebenzisa ifayela le-CA uma isitifiketi sivela esikhungweni ongasiqinisekisa ngokuzimela, ngoba ukuvuselelwa kuyaqhubeka kusebenza ngaphandle kokuthinta izimpikiswano zeklayenti. Kuxhumanise neswishi evala izimpande zohlelo, ngaphandle kwalokho isikhungo esivamile singagcwalisa ukuhlolwa esikhundleni sakho. Esikhundleni salokho bopha uma igeyithi ingenayo i-CA ongayithola noma uma inhloso iwukuhlukana okuncane kakhulu okungenzeka. Awekho amanzi ahluke ngokuphepha ngendlela engaqondakali: i-CA ikhula kukho konke ukuvuselelwa, ukubopha kulula ukuyihlola.
Noma yikuphi okukhethayo, inani elithembekile kufanele lifike ngomzila owawuthembekile ngaphambi kokuba ushintsho lwenzeke. Umphathi, isikhathi sekhonsoli kugeyithi noma ikhophi ethathwe kusengaphambili konke kuyafaneleka. Ukukopisha noma yimuphi umnyathelo weminwe okhonjiswa isicelo kulula futhi kuyikho kanye umgadli akulindele.
Beka inani emyalweni oyisebenzisayo ngempela
Ukubopha kuhamba enkethweni yesitifiketi seseva, futhi isiqalo sayo sinquma ukufaka ikhodi: ama-digest wokhiye womphakathi we-hexadecimal ngaphansi kwe-sha1 noma i-sha256, nokubopha kokhiye we-base64 ngaphansi kwe-pin-sha256. Ukuyinikeza futhi kuvala ukuthembela kohlelo kulokho kugijima, ngakho ukhiye oboshiwe uba yisinqumo sonke.
sudo openconnect --protocol=gp vpn.example.com --user alice \
--servercert pin-sha256:AbCdEf... # single key pin
sudo openconnect vpn.example.com --cafile /etc/ssl/internal-ca.pem --no-system-trustIklayenti lihambisana ne-digest enqanyuliwe, lamukele izinhlamvu ezine kuphela ngemuva kwesiqalo, lokho kuwugibe hhayi ukunethezeka. Inani elifushanisiwe lidlula endaweni futhi alikakhombisi igeyithi obuyihlosile. Kopisha uchungechunge oluphelele olwanyatheliswa yiklayenti emzamweni wokuqala esikhundleni sokuluthayipha kabusha kumlayezo. Bese uhambisa inketho eqediwe kusikripthi sokugoqa, ifayela leyunithi noma iphrofayela eqalisa ukuxhumana, ukuze isinqumo sokuthembela sibuyekezeke futhi izinguquko zakamuva zibe ngenhloso.
Izihambisi zedeskithophu kanye ne-plugin ye-NetworkManager zigcina ikhophi yazo yezimpikiswano zokuxhumana. Isikripthi esihlelwe kudiski asifinyeleli iphrofayela eyangeniswa ngaphambili, ngakho inani eligciniwe liyaqhubeka linqoba.
Bhekana nokushintshwa ngaphandle kokuzivalela ngaphandle
Inketho inganikezwa izikhathi ezingaphezu kokukodwa, ngakho ushintsho oluhleliwe lungamukela ukhiye ophumayo nongena ndawonye. Engeza ukubopha okusha ngaphambi kokuba igeyithi ishintshe, gcina kokubili kufakwe ohlwini ngenkathi amaseshini efuduka, futhi susa okuthathwe umhlalaphansi lapho ukhiye omdala unyamalala. Leyo windi idinga umnikazi, ngoba ukubopha okukabili okukhohliwe kushiya ukhiye kuthenjwa ngaphandle kokuthi kukhona okuqaphayo. Ukwakhiwa kabusha okukhiqiza ipheya elisha lokhiye kuphula ukubopha okumsulwa, futhi ukubuyisela kuyindlela efanayo ngakolunye uhlangothi.
Bhala idethi yoshintsho eceleni kokubopha. Ukubopha okungenayo idethi yokubuyekeza ukuhluleka kwesikhathi esizayo okuthwala umlayezo wephutha odidayo.
Khipha inguqulo yeklayenti ngaphambi kokuhlela ukuthembela
Iklayenti elidala lingehluleka ngenkathi lihlaziya impendulo yokuqinisekisa igeyithi eseyishintshile kusukela lapho, futhi umlayezo wangaphezulu usakhuluma ngokuxhumana hhayi ngomhlaziyi. Qhathanisa inguqulo efakiwe nalokho okubhalwe yigeyithi, futhi hlola iphakethe lamanje kuphrofayela esetshenziswa kanye ngaphambi kokushintsha noma yisiphi isilungiselelo sokuthembela.
openconnect --versionNgemuva kokulungisa, qinisekisa izinto ezimbili hhayi eyodwa: ingosi yewebhu ilayisha ngomhubhe, futhi ikheli langaphakathi elijwayelekile liyaphendula. Ukuxhawula okuqediwe kufakazela kuphela ukuthi isinqumo sokuthembela samukelwe.