Ukuqeda i-PPTP/MS-CHAPv2: incwadi yokusebenza ye-VPN endala

Amaphasiwedi anezinhlamvu ezingamashumi amabili, ashintshwa nyanga zonke futhi agcinwa esigcawini, awakwenzi iseva ye-PPTP esebenza nge-MS-CHAPv2 ibe i-VPN yesimanje. Iphasiwedi iwukufaka kokushintshana okubuthakathaka kwako kukulokho kushintshana ngokwako. Le ncwadi yokusebenza yeyalowo othole leyo seva njengefa futhi okufanele asuse abasebenzisi kuyo ngaphandle kokunqamula isiza esincike kuyo. Landela izinyathelo ngokulandelana, ngoba ngayinye ishiya irekhodi ozolidinga lapho othile ebuza ukuthi kungani ukufinyelela kushintshe ngokuzumayo.

Bhala isiteki ngaphambi kokuthinta noma yini

Izendlalelo ezintathu zihlanganiswa egameni elithi PPTP, futhi ngayinye yehluleka ngendlela yayo. Umshini wokuhamba uyi-PPTP uqobo, i-GRE kanye ne-TCP 1723. Ukuqinisekisa ubuwena kuyindlela ye-PPP enikezwa iseva, lapha i-MS-CHAPv2. Ukuvikelwa komugqa i-MPPE, okuthi izikhiye zayo zithathwe kulokho kushintshana kokuqinisekisa. Ukusho zontathu kuvimbela ukuthi ukulungiswa kwakamuva kungawi endaweni engalungile.

Funda ukucushwa okusebenzayo esikhundleni sokuthemba ikhasi le-wiki, futhi bhala ifayela, isilaleli nemihlangano yokugcina eqinisekisiwe.

grep -RniE 'mschap|mppe|require-mppe' /etc/ppp/options.pptpd /etc/pptpd.conf
ss -lntp 'sport = :1723'
journalctl -u pptpd -n 40 --no-pager

Emsebenzini wokufinyelela kude we-Windows lokho kubala kufika ngemiyalo emibili, futhi owesibili ubalulekile ngoba umsebenzi ungamemezela izindlela eziningi ngasikhathi sinye kuyilapho amaklayenti asenkundleni evumelana kuphela nokubuthakathaka kakhulu.

Get-VpnAuthProtocol
netstat -ano | findstr :1723

Nquma ukuthi umhamba uthwala ini namuhla ngempela

Bhala abasebenzisi ngaphambi kokukhetha okunye esikhundleni salokhu: amakhompyutha aphathekayo ahambayo, i-routa yegatsha, itheminali yokukhokha, neqoqo lamathebulethi asenkundleni. Umsebenzisi odinga ukufinyelela kuphela isibungu esisodwa sangaphakathi kulula ukumsusa. Umsebenzisi ofakwe kuhadiwe ongakwazi ukuyiflashisha kabusha angadinga isango eliphakathi esikhundleni sokuthuthukisa iklayenti, futhi leso sinqumo singesohlelo, hhayi phakathi nokushintsha.

Bese ubuza ukuthi umhlaseli ongabuka noma ongathonya ukushintshana kokungena uzothola ini. Nge-MS-CHAPv2 impendulo ihlanganisa into evumela ukubuyisa iphasiwedi yomsebenzisi ngaphandle kwenethiwekhi, futhi yikho kanye okwenza ubude nokushintshwa kungayilungisi idizayini: imfihlo ebuyisiwe isebenza kuzo zonke izinhlelo lapho umsebenzisi wayisebenzisa khona futhi.

I-MPPE izuza lobu buthakathaka, ngoba izikhiye zayo zivela kulokho kushintshana, futhi ayikuniki ubuqotho bephakethe ngalinye noma indlela yokudlala futhi yesibhalo se-AEAD sesimanje. Umhlangano oqinisekiswe ngokuhlanzekile ufakazele kuphela ukuhambisana nokuhlolwa okucushwe, hhayi okunye.

Noma ikhefu elifushane lesidlo sasemini noma isibalo esincane sabasebenzisi akukushintshi isici se-cryptographic sibe isici senqubomgomo.

Yenza ukufuduka ngaphakathi kwewindi elilodwa lokunakekela

Misa okunye esikhundleni, kufakazele ngeqembu elilodwa lokuhlola, bese umisa isilaleli esidala esikhundleni sokushiya sibe yindawo yokubuyela ethule. Indawo yokubuyela wonke umuntu asengakwazi ukufinyelela kuyo akuwona ukufuduka, futhi igcina ukushintshana okubuthakathaka kuvulekele yebo labo basebenzisi abangazami nhlobo ukushintsha.

sudo systemctl disable --now pptpd
sudo ss -lntp | grep -E ':(1723|1194|51820)\b'
sudo nft list ruleset | grep -i gre

Vala indlela yodonga lomlilo kulelo windi. I-GRE ayinalo iphothi okufanele likhunjulwe, ngakho umthetho ovumela iphrothokholi 47 ngenombolo ubalekela kalula futhi ushiya insizakalo ifinyeleleka ngisho ngemuva kokuba i-daemon ihambile. Bhala umthetho owususile, indawo yawo yangaphambilini nesizathu, ukuze ukubuyekezwa kwezinguquko kwakamuva kungayibuyiseli ngengozi.

Phatha ubufakazi ngokwehlukile ekucushweni. Ukususa iphrofayela yeklayenti akukona ukuhoxisa, futhi i-akhawunti esaqinisekisa kwenye indawo ayikahoxiswa.

Qinisekisa ukuthi okunye esikhundleni kwenza imisebenzi eyayenziwa yi-PPTP

Uhlu lokuhlola akulona elithi “ingabe iyaxhumana”. Ingabe ukuqinisekisa ubuwena, ukwabiwa kwekheli, ukuxazululwa kwe-DNS, ukukhethwa komzila, ukuziphatha kokuxhumana kabusha kanye nokuqinisekiswa kozakwethu kusaqhubeka ngaphansi kokunye esikhundleni. Hlola ngakunye kudivayisi yokuhlola, ngalolo landelano, futhi bhala umphumela obonwe eceleni kwalokho okulindelekile.

ip -4 addr show tun0
ip route get 198.51.100.23
resolvectl query intranet.example.net

Ikheli kusikhombisi-lwa lifakazela ukuthi izingxoxo ziqedile. Alifakazeli ukuthi uhlangothi olukude lugunyaze umzila owulindele, futhi umbuzo ongenhla uphendula kuphela kule sibungu, hhayi i-LAN edlulisiwe. Impendulo yesixazululi ifakazela ukufinyeleleka kwesixazululi, hhayi ukuthi inqubomgomo ye-DNS ehlukanisiwe ithumela amagama afanele lapho.

Hlola ukuxhumana kabusha ekugcineni, ngoba yilapho iningi lalokho okunye esikhundleni lihlehlela khona: lalisa ikhompyutha ephathekayo, shintsha amanethiwekhi, futhi uqinisekise ukuthi umhamba uphinde wakheke ngaphandle kokushiya imizila endala.

Ukubuyisela emuva, ukuhoxisa kanye nerekhodi olushiyayo

Ukubuyisela emuva kubuyisela insizakalo; akubuyiseli ukuvikeleka, futhi umehluko lowo kufanele ushiwo ngokuzwakalayo ngaphambi kokuba iwindi livulwe. Uma indlela entsha ihluleka, buyisela abasebenzisi ngokusebenzisa enye indawo yokuphela yesimanje noma isango lesikhashana, hhayi ngokuvula i-PPTP futhi kubo bonke. Ukugcina indlela eyodwa yezimo eziphuthumayo kuphrothokholi endala kwandisa ukuchayeka okusanda kubhalwa phansi.

Ngemuva kokushintsha, hoxisa ama-akhawunti aqinisekiswe nge-PPTP, vumela amaphrofayela awo agciniwe aphele, futhi uqinisekise ukuthi umthetho we-GRE awusekho kudivayisi ngayinye yomkhawulo, kufaka nekhophi yokubuyisela enhlekeleleni okungekho muntu oyikhumbulayo.

Shiya irekhodi elifushane: amaphrothokholi owatholile, usuku isilaleli ngasinye esama ngalo, izinguqulo zeklayenti ezisekelwa okunye esikhundleni, kanye nomnikazi ongavula isinqumo futhi. Inhlanzeko yephasiwedi isabalulekile ngemuva kwalokho, kodwa njengenhlanzeko kuphrothokholi efanelekile, hhayi njengesizathu sokugcina endala iphila.