Ukuvuselela iseva ye-VPN ngaphandle kokuphindaphinda ubunikazi

Ubuselele ikhophi yokugcina, insizakalo yaqala, futhi iklayenti laxhumana ngomzamo wokuqala. Leyo mpumelelo iwugibe. Ukuvuselela kubuyisa amafayela iseva eyayinawo ngesikhathi sesithombe, hhayi isimo sokufinyelela esishintshile kusukela lapho, futhi uma iphoyinti lokugcina elidala lisafinyeleleka manje unemishini emibili ephendula ubunikazi obubodwa. Isixazululo akuyona ikhophi engcono; isixazululo ukunquma ukuthi umsingathi ovuselelwe angaba yini ngaphambi kokuba aphendule ukuxhawulana okukodwa.

Ikhophi yokugcina ibuyisa amafayela, hhayi igunya

Isithombe siqukethe ukulungiselelwa kweseva, okhiye abayimfihlo, isiphathimandla sesitifiketi, uhlu losingani kanye nemithetho yodonga lomlilo njengoba yayikhona ngenkathi ikhophi igijima. Ayikwazi ukuqukatha okwashintsha ngemuva kwalokho: idivayisi oyihoxisile, ukhiye oyikhiphe kabusha, usingani omususile ngenkathi kudayiswa ikhompyutha ephathwayo, inethiwekhi encane oyihambisile. Ukuvuselela kubuyisela amafayela kuwo lowo mzuzu. Akubuyiseli izinqumo abantu abazithathile kusukela lapho.

Umonakalo uvela kulelo gebe. Ikhompyutha ephathwayo eyebiwe eyahoxiswa emasontweni amabili ngemuva kwekhophi inikeza isitifiketi esisaqinisekiswa ngokumelene ne-CRL endala esihlahleni esivuselelwe, futhi iseva yamukela idivayisi oyiyekile. I-WireGuard iqondile kakhulu: usingani ugunyazwa ngokuba kuhlu, ngakho usingani osusiwe ngemuva kwesithombe uvele abe khona futhi. Akekho ophinde wagunyaza lokho kufinyelela. Yikho okwenziwe yifayela elidala.

Ubunikazi beseva nobunikazi beklayenti buhluleka ngezindlela ezihlukene

Ku-WireGuard ubunikazi beseva ukhiye oyimfihlo ku-wg0.conf, ngakho ukukopisha lelo fayela kuya kumsingathi wesibili ofinyelelekayo kudala amaseva amabili anobunikazi obufanayo futhi angazani. Ngamunye ugcina uhlu lwakhe losingani. Susa usingani kumsingathi omusha kanti elidala lisamwamukela; hlola i-wg show kwelinye futhi ubona ingxenye yeqiniso. Amaklayenti nawo awashintshi ngokwawo: iphrofayela ithwala i-Endpoint eyodwa, ngakho idivayisi iqhubeka ikhuluma nekheli eyayilungiselelwe lona, okungenzeka kube umsingathi obufuna ukuwuyeka.

OpenVPN iphindaphindwa esigabeni esifanayo ngesitifiketi seseva, ukhiye wayo oyimfihlo kanye nokhiye oqinile we-tls-auth noma we-tls-crypt. Kopisha yomithathu futhi iklayenti alikwazi ukuhlukanisa izimo; uma zombili zifinyeleleka, ukuxhumana kabusha kungase kwehlele kunoma yikuphi, futhi ifayela ngalinye lokubhalisa likhuluma ingxenye yendaba. Isiphathimandla sesitifiketi iyikhophi ejulile. Isihlahla se-easy-rsa esivuselelwe singumthombo wesibili weqiniso ongakhipha isitifiketi esivumelekile kunoma yiliphi igama olipha lona.

Amaklayenti nawo ayaphindaphindwa, ngokuvamile ngesikhathi sokufuduka uqobo. Ukukopisha iphrofayela kudivayisi eyisigele «ukuhlola kuphela» kudala idivayisi yesibili enokhiye ofanayo negama elivamile elifanayo. Nge-duplicate-cn izikhathi zombili zingahlala zivulekile ngesikhathi esisodwa, futhi ukwabiwa kwekheli okuqinile ku-ccd noma ku-ifconfig-pool-persist kungashayisana nedivayisi yokuqala. Lezi imishini emibili egqoke ubunikazi obubodwa, futhi akukho lutho ekulungiselelweni kweseva okuzihlukanisayo.

Khetha esisodwa sezimo ezintathu sephoyinti lokugcina elidala

Ukuvuselela kuphephile kuphela uma isiphetho sephoyinti lokugcina elidala sesinqunyiwe. Yeka: insizakalo endala kufanele iyeke ukwamukela imbobo ye-VPN ngaphambi kokuba umsingathi omusha uqale, futhi uma ungakwazi ukufinyelela umshini, vimba leyo mbobo emkhawulweni wenethiwekhi kukho konke ngaphandle komthombo wakho wokuphatha. Lungisa umsingathi ofanayo: ukuphinda usebenzise ubunikazi kulungile ngoba umshini owodwa ububamba, kodwa ngemuva kwalokho chitha ikhophi yediski noma isithombe se-VM sokhiye omdala ukuze ungabuyi. Yakha ibhangqa lokutholakala: imisingathi emibili idinga ubunikazi bomsingathi obuhlukene kanye nephoyinti lokugcina elabiwe, njengekheli elintantayo, isilinganisi somthwalo noma i-DNS ongayihambisa. Ukukopisha ukhiye oyimfihlo akusona isakhiwo se-failover; amaseva amabili afuna igama elilodwa.

Qinisekisa ukuthi usesimweni sini ngempela ngaphambi kokuthinta amaklayenti. Umsingathi omdala ophendula embotsheni ye-VPN yiwona ozokwamukela idivayisi ehoxisiwe, ngisho noma i-DNS isihambile. Hlola izilaleli nokhiye womphakathi:

ss -lunp | grep -E ':51820|:1194'
wg show wg0
wg pubkey < /etc/wireguard/server.key

Qala ngokuhlanganisa osingani, ukuhoxiswa namakheli

Bhala phansi lokho ukuvuselela okukushoyo uma kuqhathaniswa nalokho okugunyaziwe manje. Ku-WireGuard i-wg show wg0 inikeza ukhiye, iphoyinti lokugcina, ukuxhawulana kokugcina kanye nezibali zokudlulisa zosingani ngamunye, okwanele ukubona idivayisi ongasanayo. Yisuse ngokuqondile nge-wg set wg0 peer <key> remove, bese uhlela nokulungiselelwa, ngaphandle kwalokho usingani uzobuya ekuqaleni okulandelayo. I-wg show wg0 allowed-ips iveza inkinga yesibili: osingani ababili ekhelini elilodwa, noma ikheli osuvele walabela kabusha.

Ku-OpenVPN uhlu lokuhoxiswa iyifayela elinedethi, futhi ukuvuselela kungabuyisa elidala. Hlola ngaphambi kokuxhumana kwamaklayenti:

openssl crl -in /etc/openvpn/crl.pem -noout -lastupdate -nextupdate
grep -E 'crl-verify|reneg-sec' /etc/openvpn/server.conf

Uma isibuyekezo sokugcina sandulela ukuhoxiswa, iseva isahlonipha isitifiketi osihoxisile. I-OpenVPN 2.4 nangemuva ifunda kabusha ifayela le-CRL kukho konke ukuxhumana okusha, ngakho ukufaka elinye ifayela kumisa izikhathi ezintsha, kodwa amathunjana asunguliwe ahlala kuze kube ukuxoxisana kabusha; okuzenzakalelayo kwe-reneg-sec ngamasekhondi angu-3600, futhi ukwehlisa kwayo noma ukuqalisa kabusha insizakalo yikho okukunikeza ushintsho manje. Izakhiwo ezindala kungenzeka zingalifundi ifayela ngokuthembeka okufanayo, ngakho qalisa kabusha uma ungakwazi ukuqinisekisa ukuziphatha kwenguqulo. Incwadi ye-wg(8) ihlanganisa ukususa usingani kanye ne-syntax ye-allowed-ips esetshenziswe ngenhla.

Hlanza nokwabiwa okuqinile kwezinto ezingasekho. Ukuphinda usebenzise ikheli ledivayisi eyekisiwe kwelisha ngenkathi iphrofayela endala isafakiwe kudala ngqo leyo khophi oyizamayo ukugwema.

Qinisekisa ngeklayenti olihoxisile

Gijimisa izivivinyo ngokulandelana, kusukela kunethiwekhi engaphandle komhubhe. Okokuqala idivayisi egunyaziwe iyaxhumana, ixazulula i-DNS ngokusebenzisa isixazululi esiphushelwe futhi ifinyelela insiza yangasese. Bese idivayisi ehoxisiwe kufanele yehluleke, isebenzisa iphrofayela yayo ekhona hhayi entsha. Bese uzama iphoyinti lokugcina elidala ngaphandle: uma imbobo ye-VPN isaqedela ukuxhawulana, umsingathi omdala usaphila futhi ukuphindaphinda kungokoqobo, hhayi okwethiyori.

Qalisa kabusha umsingathi ovuselelwe futhi uphindaphinde izivivinyo zokugunyaziwe nokuhoxisiwe, ngoba yilapho ifayela lokulungiselelwa linqoba lokho okukushintshile ngesikhathi sokusebenza. Qhathanisa ukhiye womphakathi noma umzwenselo wesitifiketi somsingathi nowasetshenziswa umshini oyekisiwe. Imizwenselo efanayo emishinini emibili ephilayo isho ukuthi ukuvuselela kuklone ubunikazi; imizwenselo efanayo emshinini oyedwa kujwayelekile. Bhala amavesti avuselelwe, imizwenselo yokhiye kanye nenombolo yochungechunge noma ukhiye wosingani ohoxisiwe, bese uthatha ikhophi elandelayo ngemuva kwalokhu kuhlanganisa, ukuze imele insizakalo njengoba injalo manje. Isivivinyo esisebenzayo akukona ukuthi iklayenti liyaxhumana. Kukho ukuthi iklayenti olisusile lihlala ngaphandle ngenkathi iphoyinti lokugcina elidala lihlala livaliwe.