Ukulungiselelwa kwe-VPN yomphakathi kuyekile ukusebenza? Funda isigaba sokuhluleka

Iphrofayela yayisebenza ngoLwesibili, kwathi ngoLwesihlanu iklayenti liyazungeza imizuzwana engamashumi amathathu bese liyayeka. Akukho okwashintsha emshinini wakho. Yilokho kanye iphuzu: ukulungiselelwa okulandiwe kuchaza isibungu esisodwa ngomzuzu owodwa, futhi umqhubi ngaphesheya akanaso isibopho sokugcina lencazelo iyiqiniso. Isilingo siwukuqala ukuhlela izilungiselelo zokuphepha kuze kubuya umhubhe. Yiyo kanye le mizwa ebangela ukuthi abantu bagcine beqalisa iphrofayela evale ukuqinisekiswa kwesitifiketi, okuyinto embi kunokungabi nawo nhlobo umhubhe.

Ifayela lichaza umzuzu, hhayi isivumelwano

Ifayela lokulungiselela liqoqo lezitatimende: leli gama lesibungu lilalela kule phothi ngalolu hlelo, lethula isitifiketi esihambisana naleli gama, futhi lamukela lezi ziqinisekiso. Uma noma yisiphi sazo siyeka ukuba yiqiniso, ifayela seliphelelwe yisikhathi futhi ukulungiswa kungokwaseceleni komqhubi emngceleni, hhayi kuzilungiselelo zakho.

Uhlu lwamaphoyinti omphakathi kukwenza kucace ngemvelo yawo. Amaphoyinti aphethwe ngamavolontiya, ayavela futhi anyamalale, amakheli ayasetshenziswa kabusha futhi amaphothi ayavinjwa inethiwekhi akuyo ngemuva kwayo. Uhlu luyisithombe sesikhashana esakhiwa kabusha, futhi ikhophi kudiski lakho isithombe sesithombe sesikhathi esidlule.

Izinsizakalo zezohwebo zishintsha kancane, kodwa hhayi neze. Iziphathimandla zesitifiketi ziyashintshana, isilaleli sisuka ekhelini elabiwe siye kwelikhethekile, uhlelo oludala luyahoxiswa futhi uhlu olusha lwezinhlamvu luyafika. Ngakunye kwalokhu akubonakali kuze kube yilapho iklayenti lakho lizama ukuxhuma futhi lithola impendulo ehlukile kunaleyo ifayela eliyilindele.

Funda isigaba sokuhluleka ngaphambi kokuthinta isilungiselelo

Umlayezo wephutha usho ukuthi yisiphi isitatimende esaphuka, futhi isitatimende ngasinye sinokulungiswa okuhluke ngokuphelele. Ukuhlela izinhlamvu lapho igama lesibungu lingasaxazululwa kuchitha intambama futhi akufundisi muntu lutho.

dig +short vpn.example.net
curl -sS -o /dev/null -w 'connect=%{time_connect} tls=%{time_appconnect}\n' --max-time 8 https://vpn.example.net:443/
openssl s_client -connect vpn.example.net:443 -servername vpn.example.net -brief </dev/null

Umugqa ophakathi uhlukanisa indlela evinjiwe nokuxhawulana kwezandla okugqekeziwe, futhi owesithathu ukhombisa umkhiphi kanye nezinsuku zokusebenza zesitifiketi esethulwa ngempela. Uma lowo mkhiphi kungeyena lowo iphrofayela eyayimkhombele, isitifiketi sishintshile, futhi akukho ukukhetha ohlangothini lweklayenti okuzokwenza ukukhomba kwakudala kube ngcono futhi.

Izinguquko zesitifiketi nobuwena yizona ezithulile

Izingxaki eziningi ziyazimemezela. Izinguquko zobuwena azenzi njalo, ngoba iklayenti elikhonkhela igama lesitifiketi lizokwenqaba isitifiketi esisha esihle ngokuphelele ngomlayezo abaningi abawufunda njengephutha lehlelo. Umhubhe ukhona kahle. Ukukhomba kuphelelwe yisikhathi.

Funa izinketho zobuwena ngaphambi kokuphetha noma yini:

grep -nE '^(remote|proto|auth|verify-x509-name|tls-crypt|key-direction|ca) ' profile.ovpn
openssl x509 -in profile-ca.crt -noout -subject -dates

Uma iphrofayela iphethe i-CA efakiwe futhi umqhubi usethuthele kwisiphathimandla esisha, ifayela elidala alikwazi ukuqinisekisa isiphakamiso esisha. Ukushintsha ingxenye ye-CA ngale eyakhishwa umqhubi kuwukulungiswa okusemthethweni. Ukususa umyalo wokuqinisekisa akunjalo, futhi kungukucindezelwa okufanayo kwamakhi futhi umphumela uhluke ngokuphelele.

Ukuthuthukiswa kweklayenti kungaveza uphawu olufanayo ngaphandle kwanoma yiluphi ushintsho oluvela kumqhubi. Izinketho ebezibekezelelwa buthule manje ziyanqatshwa, noma uhlelo oludala luyasuswa. Lona umkhawulo wokuhambisana kuhlelo lwakho, futhi kufanele uzame iphrofayela yesibili ngeklayenti elifanayo ngaphambi kokusola isiphakamiso.

Umqhubi kuphela ongashicilela okunye okusemthethweni

Uma iphoyinti linyamalala, okunye kufanele kuvele emthonjeni ofanayo owasicilela okwangempela. Iphrofayela efika kumlayezo oqondile ngenxa yokuthi «isebenzisa igama lesiphakamiso elifanayo» iwukulungiselelwa okungaqinisekisiwe okuvela ohlangothini olungaziwa, futhi ukuyingenisa kunika lolo hlangothi ukulawula ukuhamba kwezindaba kwakho.

Ukuhlola akubizi. Thatha ifayela lamanje endaweni eshicilelwe, qhathanisa indawo yokugcina nohlelo nohlu, futhi qinisekisa umnyakazo womunwe wezinto ze-CA esikhundleni sokwethemba igama lefayela:

curl -sS -o current.ovpn https://example.org/nodes/current.ovpn
sha256sum current.ovpn profile.ovpn
grep -nE '^(remote|proto) ' current.ovpn

Uma ama-hashi amabili ehluka ngezikhala nje, unoshintsho lwefomethi. Uma ehluka ezindaweni zokugcina, umqhubi ushintshile okuthile futhi ifayela elishicilelwe liyigunya. Uma ifayela elishicilelwe lidala kunelakho, mhlawumbe ubheka isigcinambumbulu, futhi impendulo ephelelwe yisikhathi izokuthuma endleleni engalungile.

Khipha umugqa wokufaka omdala futhi urekhode okwenzekile

Uma sekufakazelwe okunye okusebenzayo, sula iphrofayela elidala esikhundleni sokuligcina njengebamba. Umugqa wokufaka omdala oxhumayo ngengxenye uyingozi: uzokhethwa ngesikhathi sokuphazamiseka, uzohluleka kancane, futhi olungisa iphutha uzochitha imizuzu eyishumi yokuqala kufayela elingalungile.

Gcina irekhodi elifushane ngaphandle kokulungiselelwa: usuku, indawo yokugcina endala, isigaba sokuhluleka kanye nokuyishintshile. Amaphoyinti omphakathi ayashintshana, futhi emasontweni ayisithupha umbuzo ofanayo ufika nomunye umuntu. Umugqa owodwa efayeleni lamazwana uyiphendula ngemizuzwana.

Uma kusuka kunethiwekhi eyodwa wonke amaphoyinti ehluleka ngendlela efanayo kanti kwelinye akekho ohlulekayo, yeka ukuhlela amaphrofayela bese ubheka indlela yasendaweni. Isango lokubamba, ibanga lamaphothi elihlungiwe noma i-proxy ebamba phakathi kuzoveza amaphutha afanayo kubanikeli abangahlobene, futhi lowo mkhuba uwukuphela kwesibonakaliso sokuthi inkinga yayingakaze ibe yifayela.