I-OpenVPN ngaphandle kwe-CA: indlela i-peer-fingerprint eqinisekisa ngayo ontanga
I-fingerprint ibopha isitifiketi esisodwa, hhayi imfihlo eyabiwe. Landela okumbozwa yisifinyezo, indlela uhlangothi ngalunye olwakha ngayo uhlu lwezimvume kanye nezindleko zokuvuselela.
Ukusatshalaliswa okuncane kuphendukela kuma-fingerprint ngoba isiphathimandla sesitifiketi sibonakala siyizingqalasizinda okungekho muntu onesikhathi sokuzilawula. Umuzwa uyavumelana, kodwa indlela emfushane abantu abayithathayo esikhundleni—ukukopisha imfihlo eyodwa yesiteshi sedatha kuzo zombili iziphetho—ayiyona. Ukuhlelwa kwe-peer-fingerprint kugcina isakhiwo se-TLS siphelele: uhlangothi ngalunye lusaphethe ukhiye walo oyimfihlo kanye nesitifiketi salo, futhi uhlangothi ngalunye lusaqinisekisa olunye. Okushintshayo ukuthi ukuqinisekisa kugxilwe kuphi: kusuka kumkhiphi othembekile kuya ohlwini olufushane lwezifinyezo eziboshiwe. Njengoba isifinyezo simboza isitifiketi sonke hhayi igama, ukuvuselela kuba umsebenzi odla isikhathi sangempela.
Okushiwo ngempela i-fingerprint
I-fingerprint yesitifiketi iyisifinyezo sesitifiketi sonke esifakwe nge-DER, hhayi ukhiye waso womphakathi futhi hhayi igama lesihloko saso. Ngakho-ke izitifiketi ezimbili ezinamagama afanayo nokhiye ofanayo kodwa izinsuku zokusebenza ezihlukile zinezigxivizo zeminwe ezihlukile. Yilokho okwenza ukubopha kube nokunemba, futhi yilokho futhi okwenza ukuvuselela kuphazamise. Ukubopha akukwazi ukusho ukwethemba ukhiye ngokujwayelekile, ngoba ibiza into eyodwa ngomzuzu owodwa wempilo yayo. Noma ubani angakwazi ukwazi isifinyezo, futhi ukusazi akufakazeli lutho ngokwako.
openssl x509 -in server.crt -noout -fingerprint -sha256
openssl x509 -in client-07.crt -noout -fingerprint -sha256Ukuba nokhiye oyimfihlo ohambisanayo yikho okuqinisekisa ukuthi ontanga unaso leso sitifiketi, futhi isifinyezo iyindlela uhlangothi olunye olunquma ngayo ukuthi ngempela yayilindele leso sitifiketi noma cha. Lokhu kwehlukana yikho okwenza lo mklamo ungeyona indlela yakudala yemfihlo eyabiwe: ukhiye owabiwe uqinisekisa noma ubani owazi amabhayithi afanayo, kuyilapho ukubopha kuqinisekisa isitifiketi esisodwa. Idivayisi ehlukile ithola ukufakwa kwayo hhayi ikhophi yaleyo mfihlo, okuyimehluko encane kumafayela futhi enkulu ebangeni lomonakalo.
Imephu ihlangothi zombili, ayilingani
Iphoyinti ngalinye lokugcina lidinga izinto ezimbili: ukhiye walo oyimfihlo nesitifiketi, kanye nesitatimende sokuthi yiziphi izitifiketi zontanga ezizozamukela. Kuklayenti leso sitatimende yisifinyezo sesitifiketi seseva; kuseva uhlu lwezifinyezo zamaklayenti abhalisiwe. Isibonelo esisemthethweni sokuhlelwa okuncane se-Community 2.6 sikhombisa ukuhlelwa nge-peer-fingerprint, futhi kufanele kufundwe ngaphambi kokukhetha le modeli yokuthemba ekusatshalalisweni kwangempela. Lezi zindlela ezimbili akulona uhlu olulodwa oluhlanekezelwe, futhi azihluleki ngasikhathi sinye.
| Verification direction | What is pinned | What never leaves that endpoint | How a wrong pin shows up |
|---|---|---|---|
| Client checks the server | One digest, for the server certificate | The server private key | The client aborts during the TLS handshake |
| Server checks the client | A digest per enrolled client | Each client private key | The server rejects the peer before a tunnel exists |
Ukufaka idivayisi kuhlela uhlu lwezimvume kuseva, ngaphandle kokukopisha impahla eyimfihlo yeklayenti ekhona nangaphandle kokuhambisa ukhiye weseva noma kuphi. Lezi zindlela ezimbili zihluleka ngokuzimela futhi, okusiza ekuxilongeni: uhlangothi oluvale ukuxhawula yilona olwalungafinyelelanga okulindelekile. Uma iklayenti lenqaba iseva, isifinyezo asihambisani nesitifiketi esethulwe. Uma iseva inqaba iklayenti, isifinyezo salelo klayenti asikho ohlwini, noma iklayenti lethula esinye isitifiketi hhayi leso esabhaliswa.
Ukubhalisa: idivayisi entsha ihlanganyela kanjani
Khiqiza ukhiye nesitifiketi sedivayisi entsha endaweni lapho ukhiye oyimfihlo uzohlala khona, bese uhambisa kuphela into yomphakathi ohlangothini oludinga ukuyibopha. Dlulisa isifinyezo esilindelekile ngesiteshi osuke wathemba sona, futhi qhathanisa isitifiketi sonke esikhundleni segama elibonakala lijwayelekile. Isifinyezo esikopishwe ekulandeni okungaqinisekisiwe okufanayo nesitifiketi sifakazela kuphela ukuthi amafayela amabili ayavumelana. Lokhu ukuhlola kokuvumelana hhayi ukuhlola kobuwena, futhi yiyo indlela ethule kakhulu lo mklamo oba buthakathaka ngayo.
Kuseva, ukwengeza isifinyezo ukushintsha kokuhlelwa okudlula kumphathi ojwayelekile futhi kulandelwa ukuxhuma kabusha. Qinisekisa ukuthi idivayisi entsha iyaxhuma nokuthi idivayisi esuswe isifinyezo sayo ayisaxhumi. Ukuhlolwa okumboza isimo esihle kuphela kushiya uhlu lwezimvume lungaqinisekisiwe, futhi yiso leso simo ozoba kuso ezinyangeni eziyisithupha.
Ukuvuselela yisikhathi esibizayo
Siyaphela isikhathi sazo zonke izitifiketi, futhi isitifiketi esisha sinesifinyezo esisha ngisho noma ukhiye namagama kuhlala kufana. Ngaphansi komkhiphi, ukuvuselela kusobala kontanga abathemba lowo mkhiphi; ngaphansi kokubopha, kuwumcimbi wokubhalisa kuwo wonke ontanga obopha isitifiketi.
Hlela ukulandelana ngaphambi kosuku lokuphelelwa isikhathi hhayi ngemuva kwaso. Sabalalisa isifinyezo esisha ezinhlangothini ezisiqinisekisayo, sebenzisa ushintsho, bese ushintsha isitifiketi endaweni yokugcina. Lokho kulandelana akushiyi iwindi lapho izinhlangothi ezimbili zingavumelani khona ukuthi yisiphi isitifiketi esikhona manje. Gcina futhi uhlu ngokwalo ngaphansi kokubuyekezwa, ngoba uhlu oluboshiwe luqongelela ukufakwa kwemishini eyahoxiswa ezinyangeni ezedlule. Ukufakwa ngakunye okudala kuwubuwena obusaqinisekisa uma ukhiye wakho usaphila, ngakho-ke ukususa okukodwa kuyisenzo sokuphepha hhayi ukuhlanza.
Okungakunqumi imephu yokuthemba
Ukuqinisekisa kuyingqimba eyodwa, futhi imephu eboshiwe ayisho lutho mayelana nechibi lamakheli, imizila eqhutshwayo, i-MTU yendlela noma inqubomgomo yodonga lomlilo. Lezo zihlala ziwukuhlelwa okwehlukile okunezindlela zokuhluleka ezihlukile. Ithumbu eliqinisekisayo futhi elingadlulisi thrafikhi liwuphenyo oluhlukile kunalelo elingalokothi likhuphuke.
Imephu futhi ayikhuli ngokungenamkhawulo, futhi i-PKI esekelwe kumkhiphi yilapho ukusatshalaliswa okukhulu kuphela khona. Lokho kukhetha kumayelana nokusebenza hhayi nokubhala kwemfihlo, ngoba ukwengeza nokuhoxisa ubuzwe ngokusebenzisa ugunyaziwe oyedwa kushibhe kunokuhlela uhlu kuwo wonke ontanga njengoba iqembu likhula. Lapho ukusetshenziswa kweklayenti kungayisekeli le nketho, impendulo iyimodeli yokuthemba ehambisanayo okubhalwa yilelo klayenti, noma isikhundla esisekelwayo. Ukucindezela isexwayiso sokuqinisekisa akwengezi lokho kusekelwa, futhi lonke inani lomklamo ukuthi ukuqinisekisa kusenzeka namanje.