Iyiphi i-PKCS#11 URI edingwa yi-OpenConnect yethokheni?

Ikhadi elihlakaniphile elivele linokhiye olulungile kusamele litshelwe ukuthi iyiphi into kulo okufanele isetshenziswe. Kuleso simo i-OpenConnect ayifuni ifayela le-.key elikopishiwe; ifuna i-PKCS#11 URI ebiza isitifiketi futhi, lapho ukusesha okuzenzakalelayo kungakwazi ukuqeda umsebenzi, nokhiye oyimfihlo oseduze kwaso. Ingxenye enzima ukuthi i-URI evumelekile ngokohlelo ayifakazi lutho. Kufanele ibize ukubhaliswa osekuvele kuthenjwa yisango, hhayi nje into ikhadi elikulungele ukuyivula.

Lokho iklayenti elikufunayo esikhundleni sokhiye okhishiwe

I-flag -c ngokuvamile ithatha indlela yefayela, kodwa lapho inani lihlaziywa njenge-PKCS#11 URI, i-OpenConnect ilibheka njengesikhombo sento engaphakathi kwethokheni hhayi ifayela elikudiski. I-flag -k yenza okufanayo kokhiye oyimfihlo. Akukho okukhishiwe, futhi ukhiye awukaze ushiye isivikelo esinikezwa ikhadi. Lokho iklayenti elikudingayo kuwe igama okuhambisana ngalo imojuli yethokheni, isitoreji samasitifiketi kanye nokubhaliswa kwesango.

Yilokhu kuvinjwa kokugcina lapho imizamo eminingi igcina khona. I-URI ingase yakheke ngokuphelele futhi nokho ikhethe isitifiketi isango elizosala ngaso, ngoba ukufaneleka nokuhambisana yimibuzo ehlukene. Ukuhlola okufanele kwenziwe ukuqhathanisa nerekhodi lokubhaliswa, hhayi ukusesha into yokuqala evuleka ngengozi.

Ama-URI amabili, imisebenzi emibili ehlukene

I-URI yesitifiketi iphendula ukuthi iwuphi ubunikazi obufunayo. Ikhomba entweni yesitifiketi okuhambisana nayo ukhiye womphakathi kanye nomugqa wesihloko neprofayela le-akhawunti noma ledivayisi elikhishwe umlawuli we-VPN. Lelo sitifiketi ngokuvamile siza nento yokhiye oyimfihlo egcinwe eceleni kwaso, futhi yilowo mbhangqwana okudingwa yi-TLS handshake ngempela.

I-URI yokhiye iphendula ukuthi kuphi okokusebenza okuyimfihlo okuhambisanayo lapho i-OpenConnect ingakwazi ukukuthola. Uma kusethwe i-flag -c kuphela, iklayenti lakha ukusesha kokhiye kusukela ezintweni zesitifiketi; ukunikeza i-flag -k kufaka esikhundleni sokuqagela isikhombo sento esicacile. I-PIN yethokheni ingenye yesithathu engahlobene: ivula ikhadi kulowo msebenzi, futhi ayikaze ikhombe into.

openconnect --protocol=anyconnect \
  -c 'pkcs11:model=PKCS%2315%20emulated;manufacturer=piv_II;serial=1a2b3c4d;id=%01' \
  vpn.example.net

Konke okukulelo chungechunge elicaphuniwe kuyidatha. Ama-semicolon ahlukanisa izimfanelo ze-URI futhi ama-percent escape akhoda izinhlamvu ezazingase zephule ukuhlaziya, ngakho yonke impikiswano kufanele iphume ku-shell ingonakalisiwe.

Ukuthola i-URI ehambisana nokubhaliswa kwakho

I-GnuTLS iletha i-p11tool, ebalisa lokho umsebenzisi wamanje angakufinyelela ngempela nge-p11-kit. Qala nge-p11tool --list-tokens, bese ubalisa izinto zesitifiketi ethokheni oyikhathazayo. Engeza --login uma izinto zivela ngemuva kwe-PIN kuphela, futhi uqhathanise isihloko nomkhiphi nerekhodi lokubhaliswa esikhundleni sokukhetha okokuqala okuvelayo.

Uma ithokheni lingaveli nhlobo, inkinga ingaphansi kwe-OpenConnect: i-p11-kit ayinayo imojuli ebhalisiwe yalelo middleware, noma imojuli ibhaliselwe enye i-akhawunti. Ukubhaliswa kwezinga lesistimu kungaphansi kwe-/etc/pkcs11/modules, futhi isiqondisi somsebenzisi ngamunye singagcina okufanayo ngaphandle kokuthinta ikhophi yesistimu. Hlola ukuthi indlela yomhlinzeki efayeleni lemojuli ikhomba emtatsheni wezincwadi owofakwe ngempela isofthiwe yomfundi.

Uma ukopisha i-URI ohlwini, gcina izicaphuno ezizungezile. Ama-semicolon angenazo izicaphuno anciphisa impikiswano emfanelweni wokuqala futhi iklayenti libika into engayitholi.

Lapho ukusesha kokhiye okuzenzakalelayo kunikeza

I-OpenConnect ingathola ukusesha kokhiye ku-URI yesitifiketi, kodwa ukufanisa okuqondile elikwenzayo kuncike kunguqulo, futhi ukuphathwa kohlobo lwento nelebula kushintshile ngokuhamba kwesikhathi. Iseluleko sokuthi unciphise i-URI ize isebenze sichaza indlela endala yokugwema, hhayi imfuneko. Uma ukusesha okutholiwe kwehluleka, biza ukhiye ngokucacile nge-flag -k esikhundleni sokuguqula i-URI yesitifiketi ibe yinto engacacile.

Qinisekisa ukuthi ukhiye ukhona futhi uyabonakala nge-p11tool --list-keys ngaphambi kokusola iklayenti. Bese uhlola ukuthi into imakwe njengokusetshenziswayo ekusayineni noma ekukhipheni, ngoba ukhiye owenziwe ngezimfanelo ezingalungile awukwazi ukuqeda i-handshake, kungakhathalekile ukuthi i-URI ilungile kangakanani. Ungadlulisi inani le-pkcs11-id elilandelanisiwe lisuka kuphrofayela ye-OpenVPN liya kukhwelelo ye-OpenConnect; amaklayenti womabili asebenzisa amafomethi ahlukene okukhomba ngisho lapho ekhuluma nekhadi elifanayo.

Uma i-URI ixazululeka futhi i-PIN yamukelwa kodwa ukuqinisekisa kusahluleka, yeka ukulungisa i-URI. Funda iphutha lesango uqobo, ngoba ukwehluleka okulandelayo kungaphezulu kwethokheni.

Ukwehluleka okubonakala njengezinkinga ze-URI kuphela

Isango elikhuluma enye iphrothokholi lizohluleka ngendlela efanayo noma i-URI yakho ilungile noma cha. I-OpenConnect yashintsha iklayenti le-vpnc elidala ngesizathu, futhi ukusekelwa kwamakhadi akwenzi iphrothokholi yesango engahambisani ibe ekhambisanayo. Qinisekisa iphrothokholi elindelekile yeseva kanye nokuhlelwa kokuqinisekisa ngaphambi kokuchitha elinye ihora ezimfanelweni zento.

Ukuqinisekiswa kobunikazi beseva nakho kuyisendlalelo esihlukile. Iklayenti liqinisekisa isitifiketi sesango ngokusebenzisa isitoreji salo sokuthemba, futhi lokho kuhlola kwenzeka ngemuva kokuba ikhadi selivele lenze ingxenye yalo. Izimvume zomfundi kanye nensizakalo ye-pcscd emile kukhiqiza uphawu olufanayo lwangaphandle, ithokheni engafundeki, ngokulungiswa okulula kakhulu.

Sebenza usuka entweni uye ngaphandle: ingabe i-p11tool iyabona ithokheni, iyabona isitifiketi nokhiye, ingabe i-OpenConnect iyamukela i-URI, bese kuthi kuphela ubuze ukuthi isango liyabamukela ubunikazi. Isinyathelo ngasinye sinomlayezo waso wephutha, futhi ngasinye silula ukusihlola kunesilandelayo.