I-OpenVPN ngaphandle kwesitifiketi sekhasimende: inqubomgomo yeseva, hhayi iphrofayela

Ususa imigqa yesitifiketi nokhiye, unikeza iphrofayela, futhi ukuxhumana kusahluleka ngephutha lesitifiketi. Iphrofayela yayingeyona into eyayiphoqelela leyo mfuneko. Yiseva enqumayo ukuthi isitifiketi sekhasimende siyisibopho yini, futhi akukho ukuhlela ohlangothini lwekhasimende okukuxoxisana nalokho. Ngakho-ke isixazululo inguquko yenqubomgomo yeseva, eyenziwe ngamabomu, nayo yonke into encike kuyo ibuyekezwa esigabeni esisodwa.

Iphrofayela ayiyona inqubomgomo

I-Community OpenVPN 2.6 iza nezitifiketi zekhasimende eziyisibopho, ngoba i-verify-client-cert ngokuzenzakalela iyi-require. Ukuyisetha ku-none yikho okumisa isidingo sesitifiketi futhi kunikeza ukuqinisekiswa kwekhasimende ohlelweni lwegama lomsebenzisi nephasiwedi iseva eselivele ilusebenzisa. Imihlahlandlela emidala ibamba i-client-cert-not-required, isipelingi esidala somqondo ofanayo, ngakho-ke sebenzisa umyalelo obhalwe uhlobo olufakiwe lwakho. Noma kunjalo ushintsho lwenzeka kuseva, futhi alikho iphrofayela lekhasimende elingakwenza lokho.

Isiqephu esingezansi siwukho konke ukushintsha ohlangothini lweseva, futhi sisodwa akusona isakhiwo sokuqinisekisa esisebenzayo. I-verify-client-cert none isusa imfuneko yesitifiketi, kuyilapho i-username-as-common-name yenza igama le-akhawunti libe wubunikazi obubonwa izingcingo zakamuva namafayela ekhasimende ngakunye. Akukho mugqa ohlola iphasiwedi, ngakho-ke umqinisekisi kumele abe khona namanje.

verify-client-cert none
username-as-common-name

Lowo mqinisekisi uyi-plugin noma iskripthi esiqhutshwa i-auth-user-pass-verify, futhi kumele abe sendaweni yawo ngaphambi kokuba noma yimuphi umugqa ongenhla ube nomqondo. Ukuhlanekezela ukulandelana kukunikeza iwindi lapho iseva ingafuni sitifiketi futhi ingahloli i-akhawunti.

Yini esaqinisekisa iseva

Ukushiya isitifiketi sekhasimende akusikho ukushiya i-TLS. Iseva igcina isitifiketi sayo nokhiye wayo, futhi ikhasimende ligcina ukuthembela kwe-CA nokuhlola kwegama lomsingathi okulivimbela ekukhulumeni nomkhohlisi. Ukususa i-remote-cert-tls server noma inqwaba ye-CA ngoba ikhasimende alinaso isitifiketi kuwukufunda okungalungile okuvamile futhi okubi kakhulu, futhi 2.6 umhlahlandlela uveza ngokusobala ukuthi izinhlangothi ezimbili zizimele. Eyodwa iqinisekisa iseva kukhasimende; enye iqinisekisa ikhasimende kuseva.

Iphrofayela ingase futhi iphathe ibhlokhi ye-tls-auth noma i-tls-crypt. Leyo ukhiye weshannel yokulawula owabiwe onesikhathi saso sokusabalalisa nokuzungezisa, ngakho-ke ifayela elingenayo imigqa yesitifiketi noma yokhiye aliphephile ngokuzenzakalela ukushicilelwa. Liphathe njengemfihlo uze ulifunde.

Ifayela lesitifiketi elikopishwe liphrofayela elisebenzayo alifakazi lutho ngokwalo; ukuba nakho kusho ukugcina ukhiye oyimfihlo ohambisana nalo, okuyinto ukusetshenziswa okuqinisekiswe ngesitifiketi okuhlola. Ifayela eliqukethe isitifiketi akulona ifayela umuntu angaziqinisekisa ngalo.

Umqinisekisi kumele enzeni

Lapho imfuneko yesitifiketi isusiwe, konke kuncike kumqinisekisi: i-plugin, noma iskripthi esiqhutshwa i-auth-user-pass-verify. Kumele lenqabe izifakazelo ezingavumelekile, lenqabe ama-akhawunti akhutshaziwe noma angafaneleki, futhi lihluleke livaliwe lapho lingakwazi ukufinyelela i-backend yalo. I-username-as-common-name ivame ukunikwa amandla eceleni, futhi ishintsha ubunikazi obubonwa izingcingo zakamuva namafayela wokuhlela ekhasimende ngakunye. Ayiqinisekisi iphasiwedi, futhi ayenzi i-akhawunti engafaneleki ifaneleke. Lezo yimisebenzi ehlukene, futhi ukuzihlanganisa yikho okwenza ukufuduka kudlule isivivinyo sendlela ejabulisayo futhi kuhluleke esigamekweni saso sokuqala sangempela.

Hlola izimo ezingezinhle ngokucophelela okufanayo nesimo esihle. Iphrofayela ekhombisa isicelo sephasiwedi ibonisa kuphela ukuthi ikhasimende lingadweba isicelo, kuyilapho iseva eyamukela iphasiwedi engalungile ibonisa into embi kakhulu. Engeza i-akhawunti ekhutshaziwe nezifakazelo eziphelelwe yisikhathi kusethi yokuhlola, hhayi kuphela iphasiwedi embi.

Shintsha inqubomgomo, iphrofayela nemephu ndawonye

Xhumanisa izinto ezintathu: umyalelo weseva, iphrofayela lekhasimende, kanye ne-mephu yobunikazi bekhasimende ngakunye. Zishintshe ngokwehlukana bese amakhasimende ehluleka ngaphambi kokuqinisekiswa, noma axhumane ngaphansi kwegama umlawuli ayengalilindele, okubi kakhulu ngoba kubonakala njengempumelelo. Ukuxhumana okuphumelelayo ngaphansi kobunikazi obungalungile kunzima ukukuqaphela kunalokho okuhlulekayo.

Gcina ama-akhawunti okuhlola amabili alo mzila, elilodwa elivumelekile nelilodwa elaziwa njengelibi, futhi usebenzise womabili ngemva kwanoma yiluphi ushintsho kumqinisekisi. I-akhawunti evumelekile ibonisa indlela ejabulisayo kanye nemephu yobunikazi; elibi libonisa ukuthi ukwenqaba kusasebenza. Akukho sivivinyo esikutshela lutho mayelana nemithetho yokufaneleka, ngakho-ke engeza i-akhawunti okufanele yenqatshwe ngenxa yezizathu zenqubomgomo uma ukusetshenziswa kunayo. Qalisa zontathu ngemva kwakho konke ukushintsha, ngoba umqinisekisi oqala ukwamukela konke ubonakala ufana ncamashí nokungena okusebenzayo.

Qopha ukuthi yiziphi izindlela zokuqinisekisa iseva elizamukela ngempela, hhayi lezo iphrofayela eliziphakamisayo. Lelo rekhodi liphendula umbuzo abantu abaqhubeka bewubuza, okungukuthi ubani ongaxhumana nale sevisi. Liphinde liphile isikhathi eside kunomlawuli olandelayo, obekuyofika lapho engakuthola kabusha kusuka ekubanjweni kwamaphakethe.