I-SECLEVEL=0 ilapha uphawu, hhayi isitifiketi

Ukuxhumana kwe-OpenVPN kuyahluleka, othile uthola isilungiso somugqa owodwa esengeza i-SECLEVEL=0, futhi umhubhe uyaphakama. Okwashintshayo kwakuyisitifiketi hhayi isethi yezinhlamvu zokubethela; umkhawulo wokwamukela kulo lonke umtapo wolwazi washintsha, futhi konke okwenziwa inqubo ngemuva kwalokho kuzuza umkhawulo omusha. Lokho kufanele kuqondwe ngaphambi kokuthi umugqa ofanayo ukopishwe kuyo yonke iphrofayili endaweni.

Thola ukuthi yimuphi umtapo wolwazi nokuthi yimuphi umgomo osebenzayo

I-SECLEVEL iwumqondo we-OpenSSL, ngakho umbuzo wokuqala ukuthi ukwakha kwakho kuyisebenzisa yini i-OpenSSL. I-OpenVPN ingaxhunyaniswa nemitapo yolwazi yezokubethela engaphezu kweyodwa, futhi isimo esisebenza komunye wabo asinamsebenzi kwabanye. Buza ifayela lebinari ukuthi lakhiwe ngani, bese ubuza umtapo wolwazi ukuthi yiluphi uhlobo nokuhlelwa olukulayishile:

openvpn --version | head -3
openssl version -a

Funda umphumela wohlobo ngokucophelela, ngoba izisabalalisi zishintsha izindinganiso eziyisisekelo. Ezinye ziletha ukuhlelwa kwesistimu okukhuphula izinga elincane ngaphezu kwesisekelo se-upstream, yingakho iphrofayili efanayo iziphatha ngendlela ehlukile emishinini emibili enamaphakethe e-OpenVPN afanayo. Umgomo osebenzayo yilowo olayishwe inqubo esebenzayo, hhayi lowo osencwadini ye-upstream.

Bese uhlukanisa izingqimba ezimbili abantu abazihlanganisayo. I-OpenVPN inezilawuli zayo ze-TLS, kuhlanganise nesimo sephrofayili yesitifiketi nohlu olucacile lwezinhlamvu zokubethela, futhi lezo zimi ngaphezu kwakho konke okugcizelelwa umtapo wolwazi. Ukwehlisa izinga lomtapo wolwazi akushintshi ukuthi yiziphi izinhlamvu zokubethela ezibalulwa ukuhlelwa kwakho kwe-OpenVPN, futhi ukunciphisa uhlu lwe-OpenVPN akukhuphuli umkhawulo womtapo wolwazi. Ukwazi ukuthi yiliphi igqimba elikwenqabile yikho okuvimbela isilungiso ekubeni umcabango nje.

Hlukanisa izinto ezintathu ezingase zenqatshwe

Ikhandidethi yokuqala yizinto zobunikazi: isitifiketi okukuncane kakhulu ukhiye waso noma i-algorithm yesiginesha umgomo ongayamukeli. Eyesibili ipharamitha yokushintshana kokhiye, njengeqembu umgomo olibona libuthaka kakhulu. Eyesithathu isethi yezinhlamvu zokubethela umgomo oyikhiphayo. Zontathu zingabangela ukwehluleka kokuxhawulana, futhi umbhalo wephutha nesigaba sezingxoxo kuphela okuzahlukanisayo.

Akukho kulezo zintathu okuyisinhlamvu sokubethela somzila wedatha. I-OpenVPN ixoxisana ngokubethela komhubhe wayo ngokwehlukile ekuxhawulaneni kwe-TLS, ngakho ukuxhumana okuphumelelayo ngemva koshintsho lwezinga lokuphepha akusho lutho mayelana nokuthi iyiphi isinhlamvu sokubethela evikela idatha yakho. Uma umbuzo owubuzayo empeleni umayelana nokufihlwa kwedatha, ubheke isibambo esingalungile ngokuphelele.

Ukwehlisa izinga kwandisa ukwamukelwa kwazo zontathu izinto zokufaka ngesikhathi esisodwa. Leyi yingxenye abantu abayiphuthelwayo: isilungiso esamukela isitifiketi esidala siphinde samukele iqembu elibuthaka nesethi okungenzeka ukuthi wawungahlosile ukuyivumela. Iphutha elilodwa lishukumise ushintsho, futhi ushintsho lubanzi kunephutha. Lokho kungalingani yikho okwenza umbandela onomkhawulo ube ngcono kunesisekelo sendawo yonke.

Shintsha okokufaka, hhayi umkhawulo

Gcina iphutha eliqondile ngaphambi kokuthinta ukuhlelwa, kuhlanganise nesigaba esikubikile kanye nento eyayiqambe. Inkinga yesitifiketi ixazululwa ngokufaka esikhundleni sesitifiketi into eyamukelwa umgomo wamanje, okuvamise ukusho ukukhipha kabusha kusiphathimandla esikhundleni sokufaka kabusha ifayela elifanayo.

Uma okokufaka okwenqatshiwe kungokozakwethu ongayilawuli, ingxoxo inoMNikazi wayo mayelana nezinto zokushintsha ezisekelwayo. Ukwehlisa umkhawulo wakho ukuze uhlalise isistimu okungekho ozinakekelayo kudlulisela izindleko kusuka kubo kuyo yonke into exhumayo ngemuva kwabo.

Lapho iseva igcizelela umgomo, hlola ukuthi isimo sezinga le-OpenVPN yisona sizathu sangempela ngaphambi kokusola umtapo wolwazi. Iphrofayili yesitifiketi efuna isigaba esiqinile kunalokho isitifiketi esisetshenzisiwe esingakufeza izohluleka kungakhathaliseki izinga lokuphepha, futhi ukususa leyo phrofayili ushintsho oluncane kunokucisha ukuhlolwa komtapo wolwazi.

Uma kufanele uyehlise, khawulela futhi urekhode

Ngezinye izikhathi umbandela wokuhambisana ogunyaziwe uyimpendulo efanele, ikakhulukazi kozakwethu wakudala onohlelo lokuthatha umhlalaphansi olunosuku. Kuwukhawulelele kusevisi ekudingayo esikhundleni saso sonke isiphathi: ifayela lokuhlelwa lwesisevisi ngalunye noma ukuhlelwa kwe-OpenSSL okukhethekile kunomthelela omncane kunokuthumela ngaphandle kuphrofayili yomhlaba wonke.

Bhala izinto ezine kanye nombandela: isimo esiqondile, umnikazi owugunyazile, amaklayenti athintekayo, nesimo lapho uzosulwa khona. Umbundela ongenasimo sokuthatha umhlalaphansi ukuwohloka okungapheli okunencazelo yesikhashana enamathiselwe.

Ukubuyisela emuva kufanele kube yisinyathelo esisodwa osekwazama sona. Gcina ukuhlelwa kwangaphambilini, sebenzisa ushintsho, qinisekisa ukuthi isevisi iyaqala, futhi wazi kahle ukuthi yiliphi ifayela okufanele ulibuyisele uma ukuxhumana okulandelayo kuziphatha ngendlela ehlukile kunalokho obekulindelekile.

Bese uqinisekisa ubunikazi nokuvikela

Ukuxhumana okuphumelelayo kufakazela kuphela ukuthi izimo ezibuyekeziwe zikuvumile. Qinisekisa ukuthi ukuqinisekiswa kwegama lesiphathi nozakwethu kusasebenza, ukuthi isitifiketi esisetshenziswayo yisona obekuhlose ukusisebenzisa, nokuthi umzila wedatha oxoxiwe uhambisana nomgomo ocabanga ukuthi unawo.

openssl x509 -in /etc/openvpn/client.crt -noout -subject -dates -text | grep -E 'Signature Algorithm|Public-Key'
openvpn --show-tls | head -20

Isichibiyelo samazinga okuphepha e-OpenSSL sisho ngokucacile ukuthi uhlaka lufaka imikhawulo kokhiye, amasiginesha, amaqembu namasethi ndawonye, nokuthi izinga likaziro livumela konke okuhlolwa i-callback. Lelo yilo bubanzi balokho okushintshile, futhi lowo umusho okufanele uwucaphune uma othile ebuza ukuthi isilungiso sasincane yini.

Ukudluliswa okudlula ukuhlolwa kusho ukuthi umuphi umgomo owenqabe okokufaka okukuphi, yini eshintshile, nokuthi yini esahlala yamukelwa njengomphumela. „Isebenza ne-SECLEVEL=0“ iwukubona mayelana nokuxhumana okukodwa, hhayi ukuhlolwa kokuphepha kokusetshenziswa.