Kungani i-OpenVPN iyeke ukuxhumanisa ngemuva kokuthuthukiswa kwe-Ubuntu?

Amaphrofayela e-VPN ayesebenza ngesonto eledlule ayaphuka ngemuva kokuthuthukiswa kwenguqulo ye-Ubuntu, futhi ilogi ayivamisile ukusho ukuthuthukiswa. Okukushoyo yisendlalelo esihlulekile: ukuxhawulana kwe-TLS, isifo okwaxoxiswanwa ngaso ngesiteshi sedatha, iphakethe elafakiwe, noma ikhophi ye-OpenSSL evulwa yibhinari lapho iqala. Isendlalelo ngasinye sinesimo salo sephutha nokulungiswa kwakho, ngakho ukuhlukanisa kuwumsebenzi wokuqala nokuhlela kuwumsebenzi wesibili. Thatha iphrofayela njengengenacala kuze kuyisho ilogi.

Yisiphi isendlalelo esihlulekile: ukuxhawulana, isifo, iphakethe noma umtapo wezincwadi

Funda ilogi yeklayenti ngaphambi kokuthinta iphrofayela. iphutha lokuqala kakhulu kokuphumayo liyilo elikhomba isendlalelo; konke okunyatheliswa ngemuva kwalo ngokuvamile kuwumphumela walokho kwehluleka kokuqala. Uma iklayenti lingaqali nhlobo, ilogi ye-VPN iyifayela elingalungile okufanele livulwe.

Izikhalo mayelana nezitifiketi nemisayino, noma umyalezo mayelana nobude bokhiye, zivela esiteshini sokulawula kanye nenqubomgomo yomtapo wezincwadi ewulawulayo. Kepha isixwayiso esiqala nge-DEPRECATED OPTION singesokuxoxisana kwesiteshi sedatha.

Umugqa ofana no-Unrecognized option uyisigaba sesithathu: ibhinari entsha ayisayamukeli imiyalo okwakuyibekezelela endala, ngakho iphrofayela kufanele iphinde ibhalwe hhayi ukuthi umtapo wezincwadi ukhululeke. Ukwehluleka kwamaphakethe kubonakala ngendlela ehlukile ngoba kwenzeka ngaphambi kokuthi ikhodi yethuneli isebenze. Ibhinari engekho, ipulagi engalayishwayo, noma indawo yokugcina ekhomba igama lekhowudi elingalungile konke kunikeza leso simo. Izimpawu ezine, izindawo ezine zokubheka, futhi cishe akukho kuhlangana phakathi kokulungiswa.

Uma ukuxhawulana kwehluleka, inqubomgomo ye-TLS yenqaba isitifiketi

I-Ubuntu 22.04 yathuthukisa uhlelo lwaya ku-OpenSSL 3, futhi izinga lokuphepha elimisiwe kulelo gatsha liqinile mayelana nemisayino yezitifiketi nosayizi bokhiye kune-20.04. Isitifiketi se-CA esisayinwe nge-digest endala, noma ukhiye ongaphansi komkhawulo wamanje, manje kuyahluleka phakathi nokuxhawulana. Njengoba kungakafakazelwa lutho, iphutha lifundwa njengephasiwedi engalungile noma iseva efile.

Ukulungiswa okuncane kuxhuma umucu wesifo kulesi sixhumanisi kuphela. Kumhleli wedeskithophu vula iphrofayela, iya kuzilungiselelo ezithuthukile, bese ufaka DEFAULT:@SECLEVEL=0 emkhakheni wesifo se-TLS. Ifayela lokhiye le-NetworkManager lithatha inani elifanayo ngaphansi kwe-[vpn]:

[vpn]
tls-cipher=DEFAULT:@SECLEVEL=0

Qala kabusha i-NetworkManager bese uxhuma futhi, ngoba idaemon igcina amaphrofayela ahlaziyiwe futhi ngaphandle kwalokho izoqhubeka isebenzisa ikhophi enayo kakade. Yazi okwenzayo umugqa ngaphambi kokuwugcina: leso silungiselelo siwumkhawulo phezu kwezingxenye ezimbalwa zesitifiketi nokhiye, hhayi igama lesifo, ngakho ukwehlisa kwaso kwandisa lokho iphrofayela eyodwa ekwamukelayo. Bhala ukuthi iyiphi iseva ekufunile bese uyeka isilungiselelo uma umqhubi ephinde akhiphe izinto zamanje. Kepha ukushintsha /etc/ssl/openssl.cnf kufinyelela umkhawulo ofanayo kuhlelo ngalunye olufunda lelo fayela, okukude nge-VPN.

I-OpenVPN 2.6 idinga ukuthi isifo sifakwe ohlwini lokuxoxisana

I-Ubuntu 22.10 yaletha i-OpenVPN 2.6, futhi kulelo khisho --cipher iyeka ukuzikhethela isiteshi sedatha. Isifo kufanele futhi sibe ohlwini data-ciphers oluxoxisiwe, ngaphandle kwalokho iklayenti inyathelisa isixwayiso sokuphelelwa yisikhathi bese yehluleka ukuphakamisa ithuneli.

Ipulagi ye-NetworkManager yangaleso sikhathi yayisabhala umyalo omdala kuphela. Le mininingwane ihlukanisa ukuxilongwa, ngoba iphrofayela elungiswe ngesandla ingaxhuma kusuka ku-shell futhi isehluleke kusuka ku-applet yedeskithophu. Engeza uhlu kufayela lokuxhumana ngaphansi kwe-[vpn]:

data-ciphers=AES-256-CBC

Sebenzisa inani elimemezelwa yiseva, hhayi lelo olikhumbulayo; iseva enikeza i-AES-256-GCM ngeke ixoxisane nohlu lweklayenti olusho i-CBC kuphela. Qala kabusha umphathi bese uxhuma futhi, bese uphinda umzamo kusuka ku-shell ngokunikeza isifo ngokucacile kokubili ekuxoxisaneni nasekubuyeleni emuva:

sudo openvpn --config client.ovpn --data-ciphers AES-256-CBC --data-ciphers-fallback AES-256-CBC

Uma lowo myalo uphakamisa ithuneli, iseva, izitifiketi nezifakazelo konke kuhle, futhi ukukhubazeka okusele ukuphela ukukhetha okugciniwe komphathi. Isixwayiso mayelana nomyalo keysize singesokuhlanza okufanayo: kubeke njengamazwana bese ugcina ifayela lokuqala eduze kwephrofayela.

Ukukhubazeka kwamaphakethe neziphazamisi kubonakala njengokukhubazeka kwe-VPN

Akukona konke ukwehluleka ngemuva kokuthuthukiswa okuyimfihlo. Indawo yokugcina ye-OpenVPN engezwe ngaphansi kwegama lekhowudi inguqulo engayisebenzisi ikhiqiza iphakethe elingalokothi lifakwe, ngakho qhathanisa lokho lsb_release -a okubikayo nefayela lohlu olwengezile. Ingxenye universe engekho noma isikhwama sokuphepha kukhiqiza iphakethe elingatholakali nhlobo. Zombili izimo zishiya iphrofayela ingathintwanga futhi ithuneli lingenakwenzeka.

Funda iphutha lomphathi wamaphakethe ngaphambi kwelogi ye-VPN. Uma iklayenti lingakaze lifakwe, akukho nani lokuhlela iphrofayela elizokhiqiza ukuxhawulana.

Amaphrofayela anezici ezimbili ayeka ukubuza awuhlobo lwepulagi lwale ndaba. Inselelo ivela kupulagi yokuqinisekisa, futhi ukuthuthukiswa okwasusa noma kwashintsha kona kushiya iphrofayela iphelele ngenkathi isicelo sinyamalala. Faka kabusha ipulagi esekelwayo esikhundleni sokugcima isici sesibili ukuze isixhumanisi sisebenze.

Umtapo wezincwadi womhlinzeki ungacasha ngemuva kwephutha lenqubomgomo

Iphethini eyodwa ifanele ukwaziwa ngoba yehlula konke ukulungiswa kwenqubomgomo. Ithuluzi lokumisa likamhlinzeki wezingxenyekazi zekhompuyutha lingafaka imitapo yalo ye-OpenSSL bese iyibeka ngaphambi kwamakhophi ohlelo endleleni yokusesha yomlayishi. Iklayenti bese liqala ngokumelene nomtapo ongathuthukiswanga muntu, futhi ukwehluleka kokuqala kubonakala kufana ncamashi nesitifiketi esenqatshiwe.

Ukufaka kabusha iphakethe le-VPN akushintshi ukuthi yiwuphi umtapo otholakala kuqala, futhi ukwehlisa izinga le-TLS akufinyeleli emtapweni ongakaze uvele ohlelweni. Buza umlayishi ukuthi ibhinari ixazulula ziphi izinto zokufihla ezangempela:

ldd /usr/sbin/openvpn | grep -i -E 'ssl|crypto'

Susa noma uqondise kabusha ikhophi yomhlinzeki, bese ugijima futhi lokho kuhlola. Inguqulo elindelekile kufanele ibe yileyo esetshenziswayo ngaphambi kokubuyela kuphrofayela.

Ukuncinza iklayenti elidala kuthenga isikhathi, akusona isixazululo

Ukugcina inguqulo yeklayenti edlule kubuyisela ithuneli inqobo nje uma ukugcina kuqhubeka. Kubuye kumise izibuyekezo zokuphepha zalelo phakethe futhi kuhlele ukuphuka okufanayo ekuthuthukisweni okulandelayo, ngakho kuthatha njengesixazululo sesikhathi esithile hhayi njengesixazululo.

Uma noma kunjalo uyincinza, gcina iphakethe ngokucacile ukuze ukuthuthukiswa okungagadiwe kungakwazi ukuhoxisa ukuncinza, bhala isizathu nedethi yokubuyekeza, futhi ubeke isikhumbuzo sokukhishwa kwephrofayela okulandelayo komhlinzeki. Isimo okufanele silandelelwe iphrofayela yeseva exoxisana nesifo samanje; uma isivele ikhona, ukuncinza akusenasizathu. Ngakolunye uhlangothi, ukuncinza okungabhalwanga kuba ukuphazamiseka okungeke kuchazwe muntu ngemuva kwezinyanga eziyisithupha, ngoba umuntu owakusebenzisayo usuhambile futhi ifayela alibhali lutho.

Ngokuzayo uma i-VPN ifa ngemuva kokuthuthukiswa kwenguqulo, buza imibuzo emihlanu ngokulandelana: yisiphi isendlalelo esikhiqize iphutha lokuqala, ingabe inqubomgomo ye-TLS yenqabile isitifiketi, ingabe isifo siyaxoxisana nhlangothi zombili, ingabe iphakethe nepulagi yalo kwafakwa ngempela, futhi iyiphi imitapo yezincwadi elayishwa inqubo. Kuphela uma konke okuhlanu kubuya kuhlanzekile lapho ukwehlisa inguqulo kunengqondo.