remote-cert-tls server: yini eyo eyihlola kuphrofayela ye-OpenVPN
Lo myalelo uhlola indima ebhalwe kusitifiketi sozakwethu, hhayi igama laso. Qhathanisa indima, isisekelo sokuthembela nokuhlolwa kwegama lomphathi ngaphambi kokukhubaza noma yini.
Imibuzo emithathu ehlukene iphendulwa izingxenye ezintathu ehlukene zephrofayela ye-OpenVPN, futhi ukuzihlanganisa kuyindlela abantu abagcina ngayo bacisha ukuhlolwa obekusebenza. Ngabe isitifiketi sozakwethu sisayinwe yisiphathimandla engisithembayo? Ngabe leso sitifiketi simemezela indima yeseva ye-TLS? Ngabe iyona seva engangifuna ukuyifinyelela? remote-cert-tls server iphendula umbuzo ophakathi kuphela, futhi ikwenza lokho ngokufunda izandiso ezingaphakathi kwesitifiketi.
Ukuhlolwa okuthathu okulula ukukuhlanganisa ekhanda
Isisekelo sokuthembela sitholakala kumyalelo ca. Ukuhlolwa kwendima kungokomyalelo remote-cert-tls. Ukuhlolwa kobunikazi kungokomyalelo verify-x509-name, lapho iphrofayela iwusebenzisa, noma kungokwanoma yikuphi ukuhlolwa kwegama okwengezwa ukusatshalaliswa.
Zihlanganisa ukwehluleka okuhlukene:
| Question | Directive | Failure it catches |
|---|---|---|
| Who signed this? | ca | Certificate from an unrelated authority |
| Is this a server? | remote-cert-tls | Client certificate presented by a peer |
| Is this my server? | verify-x509-name | Another valid server from the same CA |
Iphrofayela ingaba nakho kokuthathu futhi isaba buthaka uma i-CA yabiwe kabanzi kakhulu, okuwumbuzo wokuphathwa kokhiye hhayi umbuzo womyalelo.
Ukuhlolwa kwendima kufunda ini
Lo myalelo uyi-macro. Unwetshwa ube yisidingo sokusetshenziswa kokhiye kanye nesidingo sokusetshenziswa kokhiye okunwetshiwe esibiza indima ye-TLS Web Server, ngakho isitifiketi sozakwethu kufanele sikhulume ngempela leyo njongo. Isitifiketi esikhishwe ukuze kuqinisekiswe iklayenti asiyifezi, ngisho noma isiphathimandla esifanayo sasayina kokubili.
Lokho kubalulekile ngoba i-CA eyabiwe ivamile ekusatshalalisweni okuncane. Isiphathimandla esisodwa sisayina iklayenti ngalinye neseva, futhi ngaphandle kokuhlolwa kwendima noma yisiphi salezi zitifiketi sasingaqedela uhlangothi lweseva lokuxhawulana. Ukuhlolwa akwenzi leso simo singenakwenzeka, kodwa kususa inguqulo yaso elula.
Lo myalelo awulingani ngokwakhiwa: amaklayenti aphethe remote-cert-tls server, futhi amaseva aphethe remote-cert-tls client. Wahushintshanisa futhi konke ukuxhumana kuzohluleka ngephutha lendima elibukeka njengesitifiketi esiphukile.
Amaphrofayela amadala kwesinye isikhathi asebenzisa ns-cert-type ngenjongo efanayo. Amakhasi omhlahlandlela amanje abheka leyo nketho njengengasasebenzi, ngakho iphrofayela esathembele kuyo ifanele ukudluliselwa kunokuxazululwa.
Kungani ukukhubaza kuzwakala njengokulungisa
Lapho ukuhlolwa kwendima kwehluleka, ukuxhumana kuma nephutha lokuqinisekisa futhi isinyathelo esisobala ukususa lowo mugqa. Ukuxhumana bese kuphakama, okuzwakala njengenqubekela phambili futhi empeleni kuyisimo sokwehluleka umyalelo okhona ukuze usivimbele. Manje usuvuma ozakwethu okwakungaklanyelwe isitifiketi sakhe leyo ndima.
Funda iphutha esikhundleni salokho. Lisho ukuhlolwa okwehlulekile, futhi isitifiketi esingaphesheya singahlolwa ukuze kubonakale ukuthi sinezandiso ziphi ngempela. Imizuzu emibili yokufunda inquma ukuthi iphutha likwezokukhishwa noma likwezokulungiselela. Ukuqagela kuthatha intambama futhi ngokuvamile kuphetha ngephrofayela ebuthakathaka. Isitifiketi seseva esivuselelwe esalahlekelwa ukusetshenziswa kokhiye okunwetshiwe iyiphutha langempela ekuvuseleleni, hhayi isizathu sokuxegisa iklayenti.
Ukuhlolwa kwegama kuwumyalelo ohlukile
Ukwanelisa ukuhlolwa kwendima kusho ukuthi ozakwethu uyiseva ethile esayinwe isiphathimandla sakho. Akusho lutho ngokuthi iyiphi, okubalulekile lapho i-CA efanayo ikhipha izitifiketi zamageyithi amaningana futhi elinye lawo lihlaselwe noma lishintshwe injongo.
verify-x509-name iqhathanisa isihloko sesitifiketi nenani olisethayo, ngemodi zokufanisa zesihloko esiqondile, isiqalo noma inkambu eyodwa. Sebenzisa inkambu eyona ikhomba igeyithi, futhi ulindele ukuyibuyekeza ngamabomu lapho igama lishintsha.
Awukho umyalelo kulezi ezimbili othatha indawo yokuphathwa kahle kokhiye. Uma ifayela lokhiye leklayenti likopishwa lizungeza neprofayela, ubunikazi bozakwethu buqinile kuphela njengohlu lokusabalalisa.
Hlola isitifiketi ngaphambi kokuhlela iphrofayela
Funda isitifiketi sozakwethu kanye nelogi yeklayenti, ngaleyo ndlela. Isitifiketi sitshela ukuthi simemezela ziphi izindima; ilogi itshela ukuthi yikuphi ukuhlolwa okulilenqabile.
Le mishini ikhipha izandiso zokusetshenziswa kanye nemigqa yokuqinisekisa ekuxhumaneni okunemininingwane:
openssl x509 -in server.crt -noout -text | grep -A1 -E "Key Usage|Extended Key Usage"
sudo openvpn --config client.ovpn --verb 4 2>&1 | grep -i verifyUma izandiso zikhombisa indima yeseva futhi ilogi isabika ukwehluleka kwendima, iphrofayela cishe ikhomba ifayela lesitifiketi elingalungile hhayi isitifiketi esibi. Uma izandiso zikhombisa kuphela ukuqinisekiswa kweklayenti, yeka ukubheka iklayenti futhi ulungise ukukhishwa. Kunoma yikuphi, buyisela ukuhlolwa ngaphambi kokuthi uthi ukuxhumana kunempilo, ngoba ukuxhawulana okuphumelelayo ngemva kokususa ukuqinisekisa kufakazela okuncane kunephutha elikuthathe indawo.