OpenVPN tls-ciphersuites ngokumelene ne-tls-version-min: ngakunye kuphoqelela ini

Amaqiniso amathathu ahlukene ahlanganiswa abe umugqa owodwa ezingxoxweni eziningi ze-OpenVPN TLS: lokho okungenziwa ukwakhiwa kwekhasimende lakho, lokho okuvunyelwe iphrofayela kanye nalokho okwaxoxiswana ngakho ngempela yisikhathi. Uhlu olufushane lwamaseti e-TLS 1.3 luphendula ingxenye kuphela yombuzo ophakathi, futhi alusho lutho mayelana nomkhawulo ophansi wenguqulo yephrothokholi. Landela ukuhlola okungezansi ngokulandelana futhi ume kokokuqala okungagxili, ngoba ukuhlola ngakunye okulandelayo kucabanga ukuthi okwangaphambili sekuxazululiwe.

Hlola ukwakhiwa ngaphambi kokufunda noma yiluphi uhlu

Isiqondiso sokumiswa asikwazi ukwengeza ukusekelwa kwephrothokholi kufayela le-binary elingenakho. Qala ngebhana yenguqulo, ebalula ilabhulali ye-crypto ehlanganisiwe:

openvpn --version

Ukwakhiwa kwe-2.6 okuxhunywe ne-OpenSSL kwamukela kokubili tls-cipher kanye ne-tls-ciphersuites. Ukwakhiwa nge-mbed TLS akunakho nhlobo ukukhethwa kwamaseti e-TLS 1.3, futhi incwadi yokuhola ye-2.6 imaka i-tls-ciphersuites njengenketho ye-OpenSSL. Uma iseva yakhiwa kabusha nge-backend ehlukile, iphrofayela efanayo ingashintsha ukuziphatha kwayo ngaphandle kokushintsha ngisho umugqa owodwa wokumiswa.

Ngenkathi ukhona lapha, gijimisa openvpn --show-tls futhi ugcine okukhishiwe. Yiloyo uhlu lwezinto ozokuqhathanisa nalo kamuva, futhi kushibhile ukulubamba ngaphambi kokuba othile aqale ukuhlela amaphrofayela.

Bhala ibhana kanye nohlu kutikithi loshintsho, hhayi efasiteleni lengxoxo. Uma abantu ababili bexabana ngokuthi ikhasimende lingakwazi yini ukunikeza iseti emasontweni ayisithupha, okukhishiwe okubanjwe kuzonquma lokho emugqeni owodwa.

Gcina imikhawulo yenguqulo ihlukile kuhlu lwama-cipher

Encwadini yokuhola ye-2.6 lezi zinto zokulawula ezintathu, hhayi eyodwa:

• I-tls-cipher ibeka inqubomgomo ye-cipher ye-TLS 1.2 nangaphambilini, futhi idluliselwa ohlwini lwama-cipher e-OpenSSL;
• I-tls-ciphersuites ikhetha amaseti e-TLS 1.3;
• I-tls-version-min ne-tls-version-max zikhawulela izinguqulo zephrothokholi okungase kuzisebenzise ukuxhumana.

Ngakho-ke uhlu lwamaseti e-TLS 1.3 olusikwe ngokucophelela alufakazi lutho mayelana nokuthi inguqulo endala isavunyelwe. Uma imfuneko iwukuthi «i-TLS 1.3 kuphela», umkhawulo ophansi wenguqulo owuthwalayo, futhi uhlu lwamaseti lunciphisa kuphela izinketho ngaphakathi kwalowo mkhawulo:

tls-version-min 1.3
tls-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256

Lolo mbhangqwana wenza imisebenzi emibili. Ukususa omunye wemigqa kushiya omunye uphoqelela okuncane kunalokho ocabanga, futhi yilokho kanye ukwehluleka okwenzelwe ukubanjwa yilokhu kuhlola konke.

Isiteshi sedatha siyisilawuli sesine. I-data-ciphers ixoxisana nge-cipher elinganayo ngaphakathi komhubhe, futhi umphumela wayo awusho lutho mayelana nenguqulo ye-TLS yesiteshi sokulawula. Ukubona i-AES-256-GCM kusifinyezo sesikhathi akubona ubufakazi be-TLS 1.3 kunoma yiluphi uhlangothi.

Funda i-show-tls njengohlu lwendawo

I---show-tls ibalula amaseti asekelwa ilabhulali ye-crypto okuxhunywe kuyo leli fayela le-binary, ngokulandelana kokuncanyelwayo. Lona akulona umbiko ovela kusango. Incwadi yokuhola isho ngokucacile ukuthi uhlu luvela kulabhulali yendawo, okusho ukuthi ikhompyutha ephathekayo ene-OpenSSL 3.x kanye nomzila onokwakhiwa okudala bazophrinta amahlu ahlukene ngenkathi bekhuluma nesiseva esifanayo.

Ake sithi ikhasimende lisekela amaseti A, B no-C futhi isikhathi esisodwa sikhetha u-B. Lokho akukugcwalisi lutho mayelana nokuthi isiseva sivumela u-A noma u-C, noma ukuthi u-B ukuphela kwesinqumo esivunyelwe. Gcina imigqa emithathu ihlukile, futhi izihloko eziningi ze-TLS ezididayo zizozixazulula ngokwazo.

Uhlu lusafanele lugcinwe. Uma isikhathi sehluleka, ukuqhathanisa uhlu lwelabhulali nohlu lwephrofayela kukutshela ukuthi ikhasimende lalinethuba yini lokunikeza lokho okwakufunwa yisiseva. Kubuye kubonise ukuthi ushintsho lwe-backend lususe ngokuthula i-TLS_CHACHA20_POLY1305_SHA256 emthonjeni abathembele kuwo amakhasimende amadala — uhlobo lokuhlehla oluvela njengabambalwa abasebenzisi abahlulekayo ukuxhuma ngenkathi wonke umuntu engaboni lutho.

Buza isango into elingayiphendula

Uma uphatha insizakalo, hlola ukumiswa okusebenzayo kwesibonelo esisebenzayo esikhundleni sefayela elikudiski. I-OpenVPN kungenzeka yaqalwa ngomzila we---config ohlukile, idonsa okufakiwe, futhi kungenzeka ayizange iqalwe kabusha kusukela kuhlelo. Inqubomgomo ye-daemon esebenzayo yiyo amakhasimende ahlangana nayo.

Uma ungayiphathi, cela kumqhubi izidingo zekhasimende ezisekelwayo noma ukuhlolwa kokwamukela okulinganiselwe. Umzamo owenqatshiwe awusona iseti esinqatshiwe ngokuzenzakalela: umkhawulo ophansi wenguqulo, ukuhlolwa kobunikazi besitifiketi njenge-remote-cert-tls, noma ukungafani phakathi kwe-tls-auth ne-tls-crypt kungaqeda ukushintshana ngaphambi kokuba ukukhethwa kweseti kube nokubaluleka. Funda iphutha lesiseva ngaphambi kokushintsha uhlu lwekhasimende, ngoba i-«handshake failed» ihlanganisa izizathu ezine ezihlukene futhi eyodwa kuphela yazo ingukwehluka kwe-cipher.

Ukuqondisa i-openssl s_client embobeni ye-VPN nakho akukukhiqizi umbuzo. Isiteshi sokulawula sihamba ngaphakathi kohlaka lwe-OpenVPN uqobo, ngakho-ke uphenyo oluluhlaza lwe-TLS luhlola enye iphrothokholi embobeni elindele okunye. Noma yisiphi isiphetho esithathwe kulo simayelana nophenyo, hhayi umhubhe.

Qopha imiphumela emibili futhi uyigcine ihlukile

Isikhathi esisanda kuvunyelwa sikhiqiza umugqa wesiteshi sokulawula obalula inguqulo yephrothokholi kanye ne-cipher ekhethiwe, kanye nomugqa ohlukile wesiteshi sedatha obalula i-cipher yomhubhe. Bamba kokubili nenguqulo yekhasimende kanye negama lephrofayela, futhi qopha ukuthi yisiphi isibonelo sesiseva esiphendulile:

openvpn --config office.ovpn --verb 4 2>&1 | tee session.txt

Bese ufunda leyo migqa emibili kulelo fayela, hhayi enkumbulweni. Umbhangqwana uwubufakazi; igama leseti lodwa wukuncanyelwa, futhi umkhawulo wenguqulo isitatimende esihlukile mayelana nalokho isiseva esikwenqabayo.

Yenza ukuhlola ngokulandelana lokhu. Qinisekisa ukwakhiwa kanye ne-backend nge---version. Bamba i---show-tls ngaphambi kokushintsha noma yini. Shono umkhawulo ophansi wenguqulo odingekayo uhlukile ohlwini lwamaseti. Qinisekisa inqubomgomo esebenzayo yesibonelo esisebenzayo nomnikazi wayo. Buka isikhathi esisodwa esivunyelwe futhi, uma uhlelo luvuma, umzamo owodwa owenqatshiwe wenguqulo endala. Qopha imiphumela yesiteshi sokulawula nesiteshi sedatha njengokutholakele okuhlukile.

Uma ikhasimende elidingekayo lingakwazi ukuhlangabezana nomkhawulo omncane omusha, thatha leso sinqumo sokufuduka noma sokukhipha ngokusobala esikhundleni sokwehlisa ngokuthula umthetho wokwamukela ongahlobene ukuze ukuthunyelwa kubonakale kuqediwe.