OpenVPN tls-crypt-v2: okwenziwa ukhiye weklayenti kanye ne-blob esongelwe
Iphrofayela ye-tls-crypt-v2 iqukethe ukhiye wokulawula weklayenti kanye nekhophi esongelwe okuyiseva kuphela engayivula. Gcina into ngayinye kanye nesinyathelo ngasinye sokuhoxiswa ngokwehlukile.
Ukunamathisela iphrofayela ye-tls-crypt-v2 kuthikithi kubonakala kungenangozi kuze kube yilapho ubala okukufayela. Ukhiye wesiteshi sokulawula weklayenti uhlezi eduze kwekhophi ebhalwe ngokufihlekile yalowo khiye, futhi into yesithathu, ukhiye wokusonga, awuyi neze kwiseva eyamukelayo. Lezi zintathu ziphendula imibuzo ehlukene mayelana nokugcinwa, ukwabelana nokuhoxiswa. Ukuzihlukanisa kuqeda izingxabano eziningi zenqubomgomo ngaphambi kokuba ziqale.
Iphrofayela iqukethe ini ngempela
Ingxenye yeklayenti ye-tls-crypt-v2 iwukhiye kanye nekhophi yawo esongelwe. Iklayenti lisebenzisa ukhiye ocacile ukuvikela isiteshi sokulawula futhi linikeza iseva ikhophi esongelwe ngesikhathi sokusetha, ngakho iseva ibuyisela ukhiye ofanayo ngaphandle kokugcina ikhophi yombhalo ocacile yeklayenti ngalinye. Ukhiye wokusonga wenza lokho kubuyiselwa kwenzeke futhi ungowohlangothi olwamukelayo kuphela. Konke okungezansi kuvela lapho lezo zinto zintathu zihlala khona.
| Object | Where it lives | What can open it | What a leak costs |
|---|---|---|---|
| Server wrapping key | accepting servers only | the unwrap step inside the server | every wrapped copy issued to that group becomes readable |
| Wrapped client key | inside the client profile | the server wrapping key | it names a client and exposes its metadata, but not the key inside |
| Client control key | inside the client profile, usable as-is | the client that owns it | someone can open handshakes as that client until the server refuses the key |
Funda ithebula ngokugcinwa, hhayi ngegama, futhi imiphumela iziveza ngokwayo. Ukulahlekelwa ukhiye wokusonga isehlakalo esibizayo, ngoba akukho lutho kuphrofayela olungayakha kabusha futhi ukubuyiselwa okuqotho ukuphinda kukhishwe iqembu. Iphrofayela evuzile ishibhile kodwa ivamile kakhulu, ngoba abantu banamathisela amaphrofayela kumathikithi bekholelwa ukuthi ikhophi esongelwe yenza ifayela liphephe ukwabelana ngalo. Lokhu kwehluleka okubili kudinga izimpendulo ezihlukene, yingakho izinto zigcinwa zehlukene.
Kungani ikhophi esongelwe kuyona yonke indaba
Iphrofayela ithwala izinto zeklayenti ezisebenzisekayo kanye nomlingani wayo osongelwe, ngakho ukuvikela ikhophi yeseva akusho lutho mayelana nokuvikela ifayela. I-blob iphephe ukudluliswa futhi ayiphephile ukushicilelwa. I-metadata engaphakathi kuyo ibonakala kunoma ubani othola i-blob, kuhlanganise nanoma ubani ofunda kamuva ithikithi eyananyathiselwa kulo.
Thatha iphrofayela njengobufakazi bokuphuma, hhayi njengesibonelo sokulungiselela. Ifayela elivuzile linikeza umnikazi walo ubunikazi beklayenti obusebenzayo kuze kube yilapho iseva iyeka ukwamukela lobo bunjikazi, futhi ukusonga akwenzi lutho ngaleso sikhathi. Khipha iphrofayela eyodwa ngeklayenti ngalinye ukuze ukuhoxiswa kuhlale kuyisinqumo sefayela elilodwa, futhi gcina ikhophi yokhiye wokusonga yehlukile kusilungiselelo seseva esikwenza kube nokwenzeka. Akukho kwemikhuba yomibili okulungisa iphrofayela ekhubazekile, kodwa kokubili kunquma ukuthi okulandelayo kuzobanjwa ngokushesha kangakanani.
Ingxenye yokuqinisekisa ihlala kuphi ekuxhawuleni ngezandla
Ingxenye yokuqinisekisa isebenza ngaphambi kokuba isitaki se-TLS sivezwe, futhi umsebenzi wayo ukuhlola i-metadata ethwalwa ku-blob esongelwe. Ithola leyo metadata kanye nendawo encane ebhaliwe, futhi inezinto ezimbalwa zokusebenza ngazo kunengxenye yokuqinisekisa ubunikazi. Ukucabanga ukuthi ibona amagama abasebenzisi, isimo sesikhathi noma izinto eziguqukayo ze-plugin iyona ndlela evamile yokuthi le ngxenye ibhalwe kabi. Funda isigaba sayo sencwadi yengxenye esikhundleni sokuboleka okulindelekile kwengxenye enye.
Isimo sayo sokuphuma yisinqumo: umphumela ongewona uziro unqaba iklayenti futhi umphumela uziro uvumela ukuxhawula ngezandla kuqhubeke. Ngakho inqubomgomo kufanele isho okwenzeka lapho i-metadata ingekho, ingahlaziyeki noma ingalindelekile. Bhala kuqala indlela yokunqaba, bese unquma ukuthi yimaphi amanani amukelekayo.
tls-crypt-v2 /etc/openvpn/server/tcv2-server.key
tls-crypt-v2-verify /etc/openvpn/server/verify-client-metadata.shLeyo mithathu yemigqa iyindawo yenqubomgomo kwiseva: eyodwa ibiza ukhiye wokusonga, enye ibiza uhlelo olwahlulela iklayenti ngalinye. Konke okuthakazelisayo kuhlala kuskripthi, okufanele ukulawulwa kwenguqulo nokubuyekezwa okufanayo nanoma yimuphi omunye umthetho wokufinyelela.
I-akhawunti, isitifiketi nokhiye wokulawula kuhoxa ngokwehlukile
Ukwamukela kwangaphambi kwesiteshi sokulawula akulona ubuqiniso, ngoba kwenzeka ngaphambi kokuhlolwa kobunikazi be-TLS nangaphambi kwanoma yikuphi ukugunyazwa kwe-akhawunti. Ukukhubaza i-akhawunti, ukuhoxisa isitifiketi nokunqaba ukhiye wokulawula weklayenti kuyizinto ezintathu ezinemishini emithathu. Ukusetshenziswa okwenza okukodwa kuphela kuzo kunesikhala, hhayi inqubomgomo. Vumelanisa lezi zintathu ngamabomu, futhi qopha ukuthi isiphi isinyathelo esisebenzisa liphi igunya.
Isikhathi siwumehluko wesibili. Uhlu lokwamukela olushintshiwe lusebenza ekuxhawuleni ngezandla okusha, kuyilapho amasikhathi asevele asunguliwe eqhubeka kuze kube yilapho okuthile kuwagcina. Ukubala okufakiwe ohlwini olusha njengobufakazi bokuthi amasikhathi amadala aphelile yiyo indlela iklayenti elisusiwe elihlala lixhunyiwe amahora amaningi.
Amagunya angavumelanisiwe ashiya izimbobo ezimbili okulula ukuzithola emsebenzini. I-akhawunti ingakhubazwa kuyilapho ukhiye wayo wokulawula usavula ukuxhawula ngezandla, futhi isitifiketi singahoxiswa kuyilapho inqubomgomo ye-metadata isamukela iklayenti elifanayo. Kokubili kuyiphutha elifanayo ezindaweni ezihlukene, ngoba umqhubi uthatha uhlu olulodwa njengelona gunya lonke. Beka imihlu emithathu eceleni lapho kususwa khona futhi iphutha liyabonakala.
Ukukhipha nokuhoxisa iphrofayela
Ukukhipha kuyingxenye elula: dala ukhiye weklayenti ohlangothini olwamukelayo, nikeza iphrofayela kumnikazi oyedwa ngqo, gcina izinto zokusonga zilinganiselwe, futhi gijimisa uhlelo olufanayo lokuqinisekisa kuseva ngayinye eyamukelayo. Ukwamukela okushibhile kuyisici seqembu lonke, hhayi sehhosti elisha kakhulu. Iseva yesibili eneskripthi esidala noma esixegayo iba yindlela ebuthakathaka kakhulu ekusetshenzisweni ngaphandle komsindo.
Ukuhoxisa kudinga izinyathelo ezintathu ngokulandelana okuhlosiwe. Nqaba iklayenti engxenyeni yokuqinisekisa ukuze ukuxhawula ngezandla okusha kwehluleke, hoxisa isitifiketi sayo uma kusetshenziswa i-PKI, futhi ukhubaze i-akhawunti ukuze ukugunyazwa kwakamuva kungabi nakho ukukugunyaza. Bese ugcina amasikhathi okuvunyelwe ukwamukela kwakudala, ngoba ngeke abone nokukodwa kwalokhu kuthathu. Zijwayeze ukulandelana eklayentini ongakwazi ukulimaza.
I-metadata kuphrofayela iwukungena kwaleyo nqubomgomo, hhayi ubufakazi bokuthi ukulawulwa kokufinyelela sekukhona. Idokhumenti yokuklama ye-OpenVPN 2.6 ichaza izinto kanye nomngcele ezowudweba, kuyilapho ukuphoqelela kuhlala kumqhubi.