Kungani i-openssl rand ingakwazi ukwenza ukhiye odingwa yi-tls-crypt

I-OpenSSL isivele ifakiwe, umhambi unayo i-entropy, futhi ukukhiqiza ukhiye nayo kubonakala kuyindlela emfushane esobala. Umphumela uzoba ngowangokungahleliwe futhi uyimfihlo futhi awusebenzi nhlobo, futhi ukwehluleka kuzofika njengephutha lesiteshi sokulawula esikhundleni sento ekhuluma ngefomethi yokhiye. Lokho kuphambukisa yikho okuyingxenye ebizayo, ngoba kuthumela abantu ukuba bahlole ama-cipher abo. Lokho i-VPN ekufundayo kuyisakhiwo sefayela esithile, hhayi ibhlokhi yamabhayithi engahleliwe, futhi enye yezinhlobo zalesi sici ayikwazi nhlobo ukukhiqizwa ngaphandle kweseva.

Ifayela elikusidiskhu kumele libe yini ngempela

Ifayela lokhiye elisimile le-OpenVPN liwumbhalo. Liqala ngomugqa wokuphawula okumemezela ukuthi liyini, lithwala idatha ye-hex emigqeni enobubanzi obungaguquki, futhi lilinganiselwa ku-256 byte yezinto zokhiye. I-OpenVPN ilifunda njengesifihlo esabiwe sesiteshi sokulawula, hhayi njengesitifiketi, hhayi njengebinzana lokhiye lokungena futhi hhayi njengento umtapo wezincwadi we-TLS ongayibona.

Uhlobo olufanayo lwento lusebenza kuzo zombili izici zesiteshi sokulawula. Nge-tls-auth, i-peer ngayinye idinga futhi isiqondiso ukuze amaphakethe ohlangothi olulodwa angakwazi ukubuyiselwa kulo. Nge-tls-crypt, isifihlo esisodwa esabiwe sibhala futhi siqinisekisa isiteshi sokulawula kuzo zombili iziqondiso, okufihla ukuxhawulana kanye nokukuvikela.

Akukho kulokho okuwulwazi oluyimfihlo, futhi ifomethi akuyona iphuzu. Iphuzu ukuthi ifayela kumele lihambisane ncamashi nalokho okulindelwe umfundi: isihloko, ububanzi bomugqa, umugqa omusha wokugcina kanye nobude obuphelele. Ifayela eliphambuke ngomugqa elilodwa lilayishwa njengodoti noma lihluleke ngokuphelele. Ngakho-ke ukuqhathanisa ama-peer amabili ngebhayithi ngebhayithi kuyisivivinyo sokuqala esifanele, futhi kuyashesha kunokufunda noma yiliphi kulawa mafayela amabili wokuhlela.

Indlela esekelwayo yokwenza elilodwa

Khiqiza ukhiye ojwayelekile osimile ngethuluzi elizowusebenzisa, bese ukhomba kuwo kusuka kuzo zombili iziphetho:

openvpn --genkey secret /etc/openvpn/tc-shared.key
tls-crypt /etc/openvpn/tc-shared.key

Isipelingi senketho sashintsha ngokuhamba kwesikhathi: ukufakwa kwakudala kwesikhathi sika-2.4 kwakusebenzisa isimo esinefulegi ehlukile ngaphambi kwegama lefayela, kuyilapho ukwakhiwa kwamanje kwamukela okufushane. Noma kunjalo, ifayela eliphumayo liwuhlobo olufanayo lwento, ngakho-ke ukuhlolwa ukuthi ama-peer amabili anamabhayithi afanayo yini.

Isizukulwane sesibili sengeza isakhiwo okungekho mhiqizaji wangaphandle ongasungula. Ukhiye weseva wenziwa kanye, futhi iklayenti ngayinye ithola ukhiye osongelwe osuselwe kuwo:

openvpn --genkey tls-crypt-v2-server /etc/openvpn/tc-v2-server.key
openvpn --genkey tls-crypt-v2-client /etc/openvpn/laptop1.key --tls-crypt-v2 /etc/openvpn/tc-v2-server.key

Lokho iklayenti ekutholayo akulona ikhophi yokhiye weseva uqobo. Kuyinto esongelwe ethwala imethadatha okwazi ukuyivula kuphela iseva, futhi lokho kusongwa yikho okuyisizathu sokuthi ifayela ledivayisi elilodwa lingachithwa ngaphandle kokuthinta enye idivayisi. Gcina ukhiye weseva kuseva futhi uwuthathe njengomsuka walokho kuthembela kwidivayisi ngayinye.

Lapho amabhayithi enziwe ngesandla ephuka khona

Ukuphrinta amabhayithi angu-256 angahleliwe njenge-hex ngaphansi kwesihloko esifanele ngokwethiyori kungaveza ifayela lokhiye elisimile elilayishwayo. Kuseyisiphakamiso esibi. Yonke imininingwane yefomethi iba yithuba lokukhiqiza izinto ehlulekayo ekulayisheni noma, okubi kakhulu, zishiye ama-peer amabili anamanani ahlukene abonakala kuphela njengokwehluleka kokuqinisekisa.

Akukho okulinganayo okungenzeka ngohlobo lwe-v2. Ukhiye weklayenti osongelwe ukhona kuphela njengomphumela wenqubo yokhiye weseva, futhi iseva igcina izinto ezidingekayo ukuze iwuvule. Ibhlokhi engahleliwe izonqatshwa noma yehluleke ngokuphelele ukubethela, futhi akukho kule mishwana emibili ekhuluma ngokungahleliwe.

Ukuhambisana kwenguqulo kusezingeni eliphezulu kukho konke lokhu. Isizukulwane sokuqala sidinga ukukhishwa okusisekelayo kuzo zombili iziphetho, futhi esesibili sidinga futhi ukukhishwa okusha. Iklayenti eyakhiwe ngaphambi kokuba isici sibe khona ayikwazi ukuqeda ukuxhawulana neseva emukela kuphela izinto ezisongelwe, futhi ukwehluleka ekubikayo kukhombisa isiteshi sokulawula hhayi inguqulo.

Ukuzungezisa ngaphandle kokuvalela wonke umuntu ngaphandle

Ukuzungezisa isifihlo esisodwa esabiwe kuwumsebenzi wokuxhumanisa, hhayi owezobuchwepheshe. Iklayenti ngayinye idinga ifayela lokushintsha esandleni ngaphambi kokuba iseva ihoxise eledlule, futhi noma yimuphi umshini osenalo inani elidala uyehluleka ngaso leso sikhathi. Ungaqali lokho kuzungezisa phakathi nosuku lokusebenza.

Ngohlelo lwe-v2, ukuzungezisa kungenzeka ngedivayisi: khipha ukhiye omusha osongelwe womshini owodwa futhi uhoxise owakudala walowo mshini kuphela. Leyo iyimpikiswano eyinhloko yokuthutha uma iklayenti ngayinye isekhishweni elikusekelayo.

Izimvume zefayela ziyingxenye yale ngxoxo efanayo. Ukhiye kufanele ufundaywe kuphela i-akhawunti eqhuba insiza, futhi akufanele uhlale endaweni yokugcina efanayo namaphrofayili ewavikelayo. Isandiso se-OpenVPN 2.6 sibhala izimo zokukhiqiza kanye nezigaba zezinto zokhiye, okuwumthombo ongcono kunomyalo okopishiwe kusuka kuthunyelwe kwinkundla.