Indlela yokuchitha idivayisi ye-VPN elahlekile: ukhiye, isitifiketi noma i-akhawunti

I-laptop yakho ilahlekile, futhi i-VPN isayifaka ohlwini njengekhasimende. Umbuzo ophuthumayo awuwona wokuthi ususa kanjani iphrofayela kumshini ongasanayo, kodwa ukuthi yibuphi ubunikazi iseva esabamukelayo. I-WireGuard ihlola ukhiye womphakathi, ukuhlelwa OpenVPN okusekelwe ku-PKI kuhlola isitifiketi sekhasimende, futhi i-VPN ene-SSO ihlola i-akhawunti kanye nethokheni yesikhathi sayo. Lezi zinto ezintathu zichithwa ezindaweni ezahlukene ngesivinini esihlukile, futhi ukulungisa okukodwa ngokunganaki okunye yikho okwenza idivayisi elahlekile ihlale ixhunyiwe.

Ubunikazi obuthathu nokuthi ngamunye ulawula ini

Indlela ngayinye iphendula umbuzo ohlukile. Ukhiye wozakwethu uphendula ukuthi lo umshini oyibhalisile yini. Isitifiketi siphendula ukuthi sisayinwe yi-CA yakho futhi asizange sichithwe yini. I-akhawunti iphendula ukuthi lo muntu uziqinisekisile maduzane ngokwanele yini. Ukusetshenziswa okugxuma izendlalelo ezimbili, isibonelo isitifiketi kanye nokungena kuhlu, kuvala umnyango kuphela lapho zonke izendlalelo ezinikeze idivayisi okuthile zitshelwa ukuthi ziyeke ukukwamukela.

Isicupho esisebenzayo ukuthi umshini olahlekile uphethe ingxenye eyimfihlo yobufakazi ngabunye, ngakho-ke akukho okwenzayo endaweni efinyelela iseva.

I-WireGuard: susa uzakwethu, ngoba alukho uhlu lokuchitha

I-WireGuard ayigcini luhlu lokwenqatshwa. Isixhumanisi samukela ngqo izinkinobho zomphakathi ezihlelwe njengozakwethu, ngakho-ke ukuchitha ukususa: sebenzisa wg set wg0 peer <public-key> remove, ifomu elibhalwe ku- wg(8), bese ususa ibhlokhi ye-[Peer] ehambisanayo ku-wg0.conf. Yenza kokubili. Ukususa ngesikhathi sokusebenza kuphela kuhlala kuze kube ukuqalisa kabusha noma ukulayisha kabusha ukuhlelwa okulandelayo, lapho ifayela libuyisela ukhiye.

Izikhathi ezikhona azidingi isikhathi ukufa. Ukususa uzakwethu kulahla ukuxhawulana kanye nezinto zokhiye, ngakho-ke ithrafikhi iyama ngokushesha lapho kudingeka futhi ipheya yokhiye evumelekile. Hlola wg show wg0 latest-handshakes kuseva: umugqa wokhiye olahlekile kufanele unyamalale futhi uhlale unyamalele, kuyilapho abanye ozakwethu bayaqhubeka babika izikhathi zakamuva.

Isixwayiso esisodwa sibaluleke kakhulu kunalokho esibonakala. Uma idivayisi elahlekile yabelana ngokhiye nezinye izinto ngenxa yokuthi othile ukopishe ifayela elilodwa lokuhlelwa, ukususa lowo khiye kuxhumanisa konke; lokho kuseyisinyathelo esifanele, futhi ngemuva kwalokho ukhipha izinkinobho zedivayisi ngayinye esikhundleni sokubuyisela okwabiwe.

Izitifiketi: i-CRL ibalwa kuphela uma i-daemon iyifunda

Ukufinyelela okusekelwe kusitifiketi kunezela isinyathelo abantu abasidlulayo. easyrsa revoke laptop-01 maka isitifiketi njengesichithiwe emgqeni wemininingwane we-CA, kodwa i-VPN ayifundi lutho kulo mgqo. Bese usebenzisa easyrsa gen-crl ukubhala crl.pem, uyikopisha endaweni ekhonjwe kukhetho lwe-crl-verify lweseva, futhi uqinisekisa ukuthi i-daemon esebenzayo isebenzisa ifayela elisha. Ukuchitha ngaphandle kokukhiqiza kabusha nokusabalalisa i-CRL akunamphumela.

Isikhathi siyingxenye yesibili. I-CRL ibuzwa lapho ikhasimende lixhuma noma lixoxa kabusha, ngakho-ke umhubhe osukiwe ungaqhubeka udlulisa kuze kube yileso sikhathi. Uma idivayisi kufanele inqanyulwe ngokushesha, qeda leso sikhathi ngokusobala ngesixhumanisi sokuphatha se-OpenVPN esikhundleni sokulinda ukuxhawulana okulandelayo. Ukulayisha kabusha noma ukuqalisa kabusha isevisi, kuye ngokuthi ukusetshenziswa kulayisha kanjani i-CRL, kuyingxenye yoshintsho hhayi isengezo ozikhethela sona.

Kufanelekile ukuqinisekisa kusuka komunye umshini: ethula isitifiketi esichithiwe futhi ulindele ukwehluleka kokuxhawulana, ngokuvamile VERIFY ERROR: depth=0, error=certificate revoked. Uma ukuxhumana kusaphumelela, ikhasimende lifunda i-CRL ehlukile kunaleya oyibuyekeze.

Ama-akhawunti nezikhathi: ukukhubaza akufani nokuxosha

Ukungena kuhlu noma nge-SSO kuhlolwa ngesikhathi sokuqinisekisa. Ukukhubaza i-akhawunti kuvimbela ukungena okulandelayo, kodwa ithokheni yokuvuselela kanye nomhubhe osukiwe kungaqhubeka kusebenza kuze kuphele isikhathi. Chitha izikhathi namathokheni alowo msebenzisi, noma nyusa inguqulo yesikhathi uma umhlinzeki wobunikazi ekusekela. Susa futhi idivayisi elahlekile ekubhalisweni kwe-MFA, ngoba isiqinisekisi esibhalisiwe siyindlela yokufinyelela ngokwaso.

Ama-VPN asekelwe ku-RADIUS angathumela umyalezo wokunqamuka noma ushintsho lwemvume ukuze awehlise isikhathi esisebenzayo, kodwa akuzona zonke izeva zokufinyelela kwenethiwekhi ezihlonipha lokho. Uma ungaqiniseki, qeda isikhathi somsebenzisi ohlangothini lweseva futhi uqinisekise kumarekhodi ukuthi isikhathi esidala savalwa.

Ukulandelana kwezenzo ngehora elizayo

Qala kusukela kuhlu lwempahla, hhayi kukhasimende: bhala yonke into ehlobene nedivayisi, kungaba ukhiye wozakwethu, inombolo yochungechunge lwesitifiketi noma i-akhawunti. Chitha kuhlelo ngalunye olukhiphayo ngokulandelana okwakhiwa ngakho ukuxhumana, okungukuthi i-akhawunti kuqala, bese isitifiketi, bese uzakwethu. Bese ufakazela ukwenqatshwa kusuka kumshini owulawulayo.

Izenzo ezimbili zokulandelela kulula ukuzikhohlwa. Okokuqala, shintsha konke okunye idivayisi ebinakho, ikakhulukazi izinkinobho ze-SSH, ubufakazi bekhonsoli yefu kanye nokhiye we-WireGuard owabiwe ngaphambilini. Okwesibili, hlola ukuthi ukuphathwa kokuhlelwa, izithombe zesikhashana noma izithombe zegolide azikwazi ukubuyisela ikhasimende elisusiwe ekwakhiweni okulandelayo.

Isixazululo esihlala njalo ubunikazi obubodwa bedivayisi ngayinye. Lapho i-laptop ngayinye iphethe ukhiye wayo wozakwethu noma isitifiketi sayo, ukulahleka kubiza umyalo owodwa wokuchitha nokukhishwa kabusha esikhundleni sokwakha kabusha lonke ibutho.