Isicelo sokhiye we-OpenVPN ngemva kwe-OpenSSL 3: hlola umhlinzeki
Isicelo esingazelelwe sokhiye wangasese ngokuvamile silandela ushintsho lomhlinzeki, hhayi iphasiwedi entsha. Hlola ukhiye, hlola womabili amasethi abahlinzeki, futhi gcina umusho oyimfihlo.
Akekho othinte iphrofayela, nokho iklayenti elifanayo manje licela umusho oyimfihlo wokhiye wangasese njalo lapho liqala. Lapho lolo shintsho lwenzeka ezinsukwini ezimbalwa ngemva kokuthuthukiswa kokusabalalisa, ukuthuthukiswa kungumbangela onokwenzeka: i-OpenSSL 3 ihlele kabusha ukusekelwa kwayo kwe-algorithm, futhi ukhiye owayefundwa kalula yilabhulali endala ungaba ongafundeki ngaphandle kokushintsha ngisho ibhayithi elilodwa. Yenza izihlolo ngokulandelana, ngoba ezimbili zazo zibukeka zifana uma ubheka isicelo kuphela.
Umbuzo wokuqala ukuthi ukhiye ufikile yini, nowesibili ukuthi lesi sakhiwo singakwazi yini ukumvula. Izinguquko zokulungiselelwa ziba nengqondo kuphela uma zombili izimpendulo zaziwa.
Hlola ukuthi ukhiye ufikile yini
Funda umugqa wokuqala wefayela bese uvumela ilabhulali ukuba ihlaziye, ngoba igama lefayela alifakazi lutho. Ibhlokhi le-PEM elinelebula ENCRYPTED PRIVATE KEY iyi-PKCS#8 efihliwe, futhi ibhlokhi RSA PRIVATE KEY endala ethwala Proc-Type: 4,ENCRYPTED iyisimo sendabuko, futhi zombili zilindele umusho oyimfihlo. Ibhlokhi PRIVATE KEY engafihliwe akufanele ngisho iwucela. Sebenzisa ukuhlaziya nge-akhawunti engumnikazi wefayela, ngoba inkinga yemvume inikeza iphutha elihlukile nelingathandeki kakhulu.
Uma ukhiye ungafihliwe ngempela futhi iklayenti lisabuza, yeka ukubheka i-cryptography bese uhlola ukuthi iphrofayela isho yini ifayela le-askpass isevisi esengalifunda.
Hlola ukuthi lesi sakhiwo singakwazi yini ukumvula
I-OpenSSL 3 yahlukanisa ukusekelwa kwayo kwe-algorithm ngabahlinzeki, futhi iqoqo lamakhodi afihla amadala manje lisekuhlinzekeni lwe-legacy esikhundleni sokwezokuzenzakalela. Ukhiye ofihlwe ngelinye lalawo makhodi uhlala uvumelekile, kodwa ilabhulali elayishwa ngaphandle komhlinzeki we-legacy ayikwazi ukuwuvula. Kwamanye amaklayenti lokho kubonakala njengesicelo esiphindayo, kwezinye njengokwehluleka okuqinile ngemva nje komusho oyimfihlo.
Hlaziya ukhiye ofanayo kabili ngebhinari efanayo: okokuqala ngomhlinzeki wokuzenzakalela kuphela, bese kuthi nge-legacy nokwezenzakalela kokubili kucelwe emugqeni womyalo. Uma umzamo wesibili uphumelela lapho owokuqala wehluleka khona, ukuxilongwa kusekelwe ebufakazini hhayi esikhathini sokuthuthukiswa. Uma womabili ehluleka ngendlela efanayo, umusho oyimfihlo awulungile noma ifayela lonakele, futhi asikho isilungiselelo somhlinzeki esilungisa noma yikuphi.
Hlola isixazululo esincane kunazo zonke esitholakalayo
Khetha ushintsho olugcina kuklayenti kunololo oluphathelene nayo yonke isistimu. Amanye amasakhiwo e-2.6 amukela inketho yephrofayela elayisha bobabili abahlinzeki senqubo yalelo daemon, ngakho qinisekisa umyalo encwadini yezandla yenguqulo yakho eqondile ngaphambi kokuncika kuwo; ukuhlela openssl.cnf kwesistimu esikhundleni salokho kuthinta yonke ihlelo le-OpenSSL kumsingathi. Isilungiselelo esincane futhi kulula kakhulu ukusihlehlisa ngemva kokuba ukhiye usubhalwe kabusha.
Ungasusi umusho oyimfihlo ukuze isicelo sinyamalale. Lokho kuguqula ubufakazi obuvikelwe bube ifayela lombhalo ocacile futhi kushintsha buthule ingozi yakho konke ukulondolozwa, ikhophi nephakethe lokusekela lapho kuvela khona. Umehluko obalulekile uphakathi kokhiye odinga umusho wawo oyimfihlo nokhiye ilabhulali engakwazi ukuwuvula.
Hlola umongo wesevisi, bese ubhala kabusha
Uma ukhiye usungavulwa, fihla kabusha nge-algorithm yamanje ukuze ukuncika kunyamalale. Bhala ifayela elisha ngokufihla kwesimanje, qinisekisa ukuthi liyahlaziywa, buyekeza iphrofayela, futhi gcina ikhophi endala kuphela kuze kuphumelele ukuxhumana. Ungalokothi ubeke umusho oyimfihlo emugqeni womyalo, lapho noma yimuphi umsebenzisi wasekhaya angawufunda khona ohlwini lwezinqubo. Susa ifayela endala ngemva kokuba elisha lixhumeke lisuka ku-akhawunti yesevisi, hhayi kuphela ku-shell yakho.
Bese uhlola iyunithi eqhuba iklayenti ngempela. Ukhiye ofundeka ku-shell yakho kungenzeka ungafundeki kusevisi esebenza ngaphansi kwe-akhawunti ehlukile noma ngokulungiselelwa okuqinisiwe kwefolda yasekhaya.
Bhala isilungiselelo somhlinzeki eduze kwephrofayela futhi gcina ukuhlolwa kwemiyalo emibili nayo. Uma ukuthuthukiswa kwakamuva kususa umhlinzeki we-legacy, phinda wenze lokho kuhlolwa ukuze ubone ukuthi ukhiye usawudinga yini noma iphrofayela ingakhishwa kulesi sixazululo sesikhashana.
Isicelo wuphawu olunezimbangela ezintathu okungenani, futhi eyodwa yazo kuphela umusho oyimfihlo ongekho.