tls-auth ne-tls-crypt: yini evikelayo ngayinye ku-OpenVPN
I-tls-auth isayina amaphakethe okulawula, i-tls-crypt iwafihla futhi. Akukho okushintsha ukuqinisekiswa kwezitifiketi noma isifreyimu sedatha, futhi ukungafani kubonakala njengokuthula.
Zombili izinketho zisebenzisa ifayela elilodwa lokhiye okwabiwe futhi zombili zenza ukuxhumana kwesandla kube nzima ukukhohliswa, yingakho zithathwa njengamagama amabili esici esisodwa. Akunjalo. Enye isayina amaphakethe okulawula, enye iwafihla futhi, futhi akukho kuzo ezihlobene nesifreyimu evikela idatha yakho.
Lowo mehluko ubalulekile lapho iphrofayela ihluleka ukuxhuma, lapho ukubuyekezwa kokuphepha kubuza ukuthi ukhiye uvikelani, nalapho othile ecabanga ukuthi ifayela elengeziwe lenza umhubhe ufihliwe ngendlela engacacile.
Yini ukhiye owabiwe ayivikelayo ngempela
Ukhiye osetshenziswa yilezi zinketho ungowesiteshi sokulawula: ukushintshana okuxoxisana ngemingcele, okuqinisekisa ubunikazi futhi okukhipha okhiye bedatha. Lona kuyimfihlo eyabiwe kusengaphambili okufanele ibe nayo yomibili imikhawulo ngaphambi kokuba ukuxhumana kwesandla kuqhubeke. Njengoba isendaweni yokuqala ngaphambi kwezikhathi zokuqinisekisa ubunikazi, ukhiye ongafanele umisa ingxoxo ngaphambi kwesikhathi kunalokho obekungenziwa yiphasiwedi engafanele. Leyo ndlela yokuhlela ichaza ukuthi kungani indlela yokwehluleka ithule kangaka.
tls-auth isebenzisa leyo mfihlo ukubala i-HMAC kumaphakethe okulawula. Iphakethe elingenaso isiginesha esivumelekile liyalahlwa ngaphambi kokuba lifike ekucutshungulweni kwe-TLS okubiza kakhulu, yingakho le nketho ivame ukuchazwa njengesihlungi sokuqala hhayi njengokungena esikhundleni se-TLS.
tls-crypt iqhubeka phambili ngokufihla ukuxhumana okulawulwayo okuvikelwe ngaphezu kokukuqinisekisa. Okuqukethwe kwezitifiketi, amagama ezifreyimu okuvunyelwene ngawo kanye neminye imininingwane yokuxhumana kwesandla akusabonakali kunethiwekhi, futhi obhekele ngaphandle ongenakho ukhiye akakwazi ngisho nokubona ukuthi ikuphi inguqulo ye-TLS elingwayo. Ekusetshenzisweni kwesakhiwo esesaba ukuveza umkhondo we-VPN yaso, leso simo yisona sizathu esiyinhloko sokuyikhetha. Kuseyimfihlo yeqembu namanje, hhayi ubufakazi bomsebenzisi ngamunye.
Awekho amasu akhipha ubunikazi. Ukhiye owabiwe uyimfihlo yeqembu, futhi noma ubani onayo angahlangabezana nalolo ungqimba lokuhlola.
Zihluka kuphi lezi zinketho ezimbili
Umehluko obonakalayo yilokho okubonwa ngobhekele. Nge-tls-auth ukuxhumana kwesandla kuyabonakala kodwa akunakuqinisekiswa ngaphandle kukhiye. Nge-tls-crypt ukuxhumana kwesandla akucaci kunoma ubani ongenakho ukhiye.
Ukucushwa kwakhona kuyahluka. I-tls-auth isetshenziswa nenani lomkhombandlela, ngakho uhlangothi olulodwa lusebenzisa ingxenye eyodwa yempahla yokhiye, olunye lusebenzisa enye ingxenye. I-tls-crypt isebenzisa ukhiye owodwa kuzo zombili izikhombandlela, ngakho umyalo womkhombandlela awuyona ingxenye yokuhlelwa kwayo.
Ezinguqulweni zesimanje lezi zinketho ezimbili ziyaphikisana. Iphrofayela kufanele ibe nenye yazo, hhayi zombili, futhi iseva neklayenti kufanele kuvunyelwane ukuthi iyiphi, ngempahla yokhiye efanayo. Ukugcina umyalo wakudala eceleni komutsha kungumsele wokufuduka ojwayelekile. Susa ongasebenziyo ukuze umfundi olandelayo azi ukuthi yiluphi ungqimba olusebenzayo ngempela.
Uhlobo olusha, i-tls-crypt-v2, lubopha iklayenti ngalinye kukhiye walo osongelwe, ngakho ukuhoxiswa kweklayenti elilodwa akudingi ukuthi ukhiye weqembu ukhishwe kabusha. Kufanele kwaziwe, kodwa kungenye inketho hhayi igama elifanayo kunoma iyiphi yalezi ezimbili lapha.
Kungani ukungafani kubonakala sengathi akukho okwenzekayo
Lapho impahla eyabiwe ingahambisani, uhlangothi olulodwa luyawajikijela amaphakethe ngaphandle kokutshela umthumeli ukuthi kungani. Akukho phutha lokuqinisekisa okungafundwa, ngoba iphakethe alikaze lifinyelele ungqimba obekuzolikhiqiza.
Iklayenti liyazama futhi, iseva ayisho lutho, futhi uphawu lubonakala njengenkinga yenethiwekhi. Bese abantu beqalisa kabusha isevisi, baphinda babhale iphasiwedi ye-akhawunti, noma basusa umyalo wokuvikela ukuze «bahlole», okushintsha ukusetshenziswa esikhundleni sokukuxilonga.
Funda kungelog yesiseva isikhalazo sokuqala sasezingeni lamaphakethe hhayi umugqa wokugcina wokuzama futhi. Qinisekisa ukuthi izinhlangothi zombili zithwele inketho efanayo ngempahla yokhiye efanayo nokuthi ifayela lokhiye alikhiqizwanga kabusha ohlangothini olulodwa kuphela.
Ukususa umyalo akulona ukulungisa okuphephile. Kucisha ungqimba lokuvikela kukho konke iklayenti, futhi umhubhe osebenza ngemva kwalokho ubonisa kuphela ukuthi lolo ungqimba yilona olwalungafani.
Okusafanele kucushwe ngokwahlukile
Lezi zinketho aziqinisekisi ukuthi uhlangothi olulodwa ungubani. Ukuqinisekiswa kwezitifiketi, i-anchor yokuthembela kanye negama leseva elilindelekile kuhlala kuyizidingo ezahlukile, futhi akukho kuzo okuba yikukhethwa ngenxa yokuba khona kukhiye owabiwe.
Futhi azikhethi isifreyimu sedatha. Lokho kuyingxoxo ehlukile elawulwa izilungiselelo zesiteshi sedatha ezinhlangothini zombili, futhi umhubhe ovikelwe nge-tls-crypt usengasebenzisa isifreyimu obekungayona oyifunayo.
Ekugcineni, ukhiye owabiwe ngokwawo udinga ukunakekelwa. Wuthathe njengemfihlo, uwusabalalise ngesiteshi esigunyaziwe, futhi uwushintshe lapho kuhamba noma ubani obenaye. Njengoba wabiwe, ukuvezeka kwawo ukuvezeka kwalo lonke ikhona eliwusebenzisayo.