Isitifiketi se-VPN esikhanseliwe sisaxhuma? Hlola ukuphoqelelwa kwe-CRL

Ukhanselile isitifiketi, wakhiqiza uhlu olusha, futhi iphrofayela endala isakha ithumbu. Ukukhansela ngokwako akukona okuphukile: i-CRL iyisitatimende esisayiniwe sokuthi inombolo yochungechunge ayisavumelekile, futhi ishintsha ukufinyelela kuphela lapho ingxenye eqeda i-TLS iyilayisha, yomkhiphi ofanele, ngaphambi kokuthatha isinqumo sokwamukela. Yilapho iningi lalezi zigameko likhona, futhi yingakho ukukhansela nokwenqaba kungamazwi amabili ahlukene.

Dlula kulezi zivivinyo ezinhlanu ngezansi ngokulandelana, futhi ume kokokuqala okungasebenzi, ngoba isivivinyo ngasinye esilandelayo sicabanga ukuthi esedlule silungile.

Hlola ukuthi iyiphi ingxenye ethatha isinqumo sokwamukela

Shono inqubo eqinisekisa isitifiketi sekhasimende, ngoba yiyo kuphela enqubo engaphoqelela uhlu. Kusiphakeli se-OpenVPN yi-daemon uqobo, elungiselelwe nge-crl-verify. Ku-ocserv umugqa we-crl ku-ocserv.conf. Ku-strongSwan okokufaka yi-CRL elayishiwe kanye ne-strictcrlpolicy. I-proxy noma idivayisi eqeda i-TLS phambi kwe-VPN nayo ingaba umhloli wangempela, futhi uma kunjalo, i-daemon engemuva kwayo ayisiboni neze isitifiketi sekhasimende.

I-WireGuard isezigabeni ezinye. Ayinazo izitifiketi futhi ayinalo uhlu lokukhansela; i-peer yamukelwa ngokhiye wayo womphakathi kusimo, ngakho ukuqeda ukufinyelela kusho ukususa lowo khiye. Uma ufuna i-CRL ekusetshenzisweni kwe-WireGuard kuphela, lowo mshini awukho.

Qaphela nangesicu sokugcina ngasohlangothini lwekhasimende. Ikhasimende elenqaba ukuxhuma ngoba alisithandi isitifiketi sesiphakeli lisenza uchungechunge lwesiphakeli, alikukhanseli imininingwane yalo yokungena. Isitifiketi somsebenzisi sikhanselwa kuphela lapho siqinisekiswa khona, futhi lokho cishe njalo kuhlangothi lwesiphakeli.

Hlola ukuthi uhlu lusayinelwe umkhiphi muni

I-CRL ilinganiselwe ku-CA eyodwa ekhiphayo. Ngezimpande ne-CA ephakathi, izitifiketi zamaqabunga zivela kweyephakathi, ngakho uhlu olubalulekile i-CRL yeyephakathi; uhlu lwempande alusho lutho ngalawo maqabunga. Umhloli okhomba kufayela elingalungile uyihlaziya ngokujabula, akatholi okufanayo futhi amukele konke.

Qinisekisa ukubhanqa ngaphambi kokuthinta i-daemon. Umkhiphi kusitifiketi kufanele ahambisane ne-subject yohlu:

openssl x509 -in client.crt -noout -issuer -serial
openssl crl  -in intermediate.crl -noout -issuer -lastupdate -nextupdate

Lapho kokubili kuvela ku-CA eyodwa, inombolo yochungechunge ephrintiwe yesitifiketi iyona nani okufanele livele ohlwini. Uma zingavumelani, uphethe i-CRL engalungile noma ikhophi engalungile yayo.

Ukuvumeleka kungokwesivivinyo esifanayo. I-nextUpdate esikhathini esedlule yenza uhlu ludlule, futhi umhloli ohlulekayo ngokuvaliwe uzokwenqaba ikhasimende ngalinye esikhundleni salokho okukhanseliwe kuphela.

Hlola ukuthi inombolo yochungechunge isekhophini elayishwa yi-daemon

Ukukhansela kubhala okufakiwe kusizindalwazi se-CA, futhi ukukhiqiza kabusha kubhala ifayela elisha. Akukho kulokhu okubili okufinyelela i-daemon esebenzayo eyalayisha ikhophi endala ngesikhathi sokuqalisa. Khipha uhlu futhi ufune inombolo yochungechunge:

openssl crl -in intermediate.crl -noout -text | grep -i -A2 'Serial Number'
openssl ca -revoke client.crt
openssl ca -gencrl -out intermediate.crl

Bese uhlola ukuthi ukusetshenziswa kwakho kuyithatha kanjani ifayela. I-OpenVPN ifunda indlela enikezwe i-crl-verify kanye ngesikhathi sokuqalisa, ngakho uhlu olusha ludinga ukuqalisa kabusha noma isignali yokuqalisa kabusha; inketho efanayo eqondiswe kufolda ifundwa kabusha kuxhumano ngalunye, futhi yingakho imodi yefolda ikhona. I-strongSwan kufanele ilayishe kabusha imininingwane yayo yokungena, isibonelo nge-swanctl --load-creds. Ifayela elikudiski lilungile nokuthi umhloli uyalisebenzisa kungamazwi amabili ahlukene.

Hlola inqubomgomo yohlu olungekho noma oluphelelwe yisikhathi

Lesi yisinqumo izindawo eziningi zokusetshenziswa ezingakaze zisithathe ngokucacile, futhi sinquma ukuthi ukukhansela kuyakuvikela noma kukhiya wonke umuntu ngaphandle. I-Fail-closed isho ukuthi ngaphandle kolwazi lokukhansela olusebenzisekayo kwenzeka ukwenqaba; i-fail-open isho ukuthi umhloli uyaqhubeka ngaphandle kwalo. I-strongSwan iveza ukukhetha njenge-strictcrlpolicy. I-OpenVPN nge-crl-verify iyenqaba ukuqalisa kufayela engakwazi ukulifunda noma ukulihlaziya, futhi uhlu oluphelelwe yisikhathi luvela njengephutha lokuqinisekisa le-TLS mayelana ne-CRL ephelelwe yisikhathi esikhundleni sokwamukela buthule.

Noma yiluphi uhlangothi olukhethayo, ukuzenzakalela kubaluleke ngaphezu kokukhetha: umsebenzi okhiqiza kabusha i-CRL ngaphambi kwe-nextUpdate, nesixwayiso lapho ikhophi esetshenzisiwe iguga, kuvimbela imithetho yomibili ukuba ibe isigameko. Ukuhlola ku-inthanethi nge-OCSP kudlulisela ukusha kusiphenduli, kodwa kusebenza umthetho ofanayo, ngoba umhloli ongalungiselelwe ukuhlola impendulo akashintshi lutho.

Hlola iseshini esebenzayo, bese kuba amakhophi okhiye

Ukukhansela kuhlolwa ngesikhathi sokuqinisekisa isitifiketi, okwenzeka lapho kuxhunyanwa nasekuxoxisaneni kabusha. Iseshini esunguliwe iyaqhubeka ize ixoxisane kabusha, futhi okuzenzakalelayo kwe-OpenVPN kanye ngehora nge-reneg-sec 3600. Uma umuntu kufanele aphume manje kunethiwekhi, qeda iseshini kanye nokushicilela uhlu, bese uqinisekisa ukuthi ukuxhuma kabusha kuyenqatshwa.

Ihlukanise imininingwane yokungena namakhophi ayo. Ukususa iphrofayela kukhompyutha ephathekayo eyodwa akuvimbeli elinye ikhophi likakhiye ofanayo wangasese ukuba liqinisekise; ukukhansela yikho okwenza ikhophi ngalinye lingasizi, futhi kuphela lapho izivivinyo zedlule zisebenza. Nikeza idivayisi esikhundleni isitifiketi sayo ukuze elinye likwazi ukukhanselwa ngaphandle kokuthinta elinye.

Ngaphambi kokuthi ukubize ngokuthi kuphelile: ingxenye eqinisekisayo isitholiwe, umkhiphi wohlu uhambisana nomkhiphi weqabunga, inombolo yochungechunge ekhanseliwe isekhophini elayishwa ngempela yi-daemon, inqubomgomo yamahlu angekho noma aphelelwe yisikhathi inenjongo futhi iqashwe, futhi iseshini esebenzayo yaqedwa esikhundleni sokulindwa. Amafomethi angemuva kwakho konke lokhu achazwe ku-RFC 5280.