Isikhathi se-TLS samasekhondi angamashumi ayisithupha: yiluphi uhlangothi olwama ngempela?

Iklayenti liyeka ngemva kwamasekhondi angamashumi ayisithupha ngomlayezo mayelana nokuxoxisana ngokhiye, futhi ikhompyutha ephathekayo ayinikezi umbono wokuthi kungani. Lowo mugqa uchaza ukubekezela kweklayenti, hhayi ukuziphatha kweseva. Izimo ezintathu ezihluke ngokuphelele zikukhiqiza: iphakethe alizange lifinyelele isevisi efanele, isevisi yalilahla ngaphambi kokurekhoda noma yini, noma isevisi yalinqaba futhi yakusho endaweni iklayenti elingakwazi ukuyibona. Ukuhlanganisa umzamo owodwa kuzinhlangothi zombili yikho okuhlukanisa lezi zimo.

Nikeza umzamo owodwa ubunikazi ongabufuna

Bhala isikhathi sokuqala kanye nesifunda saso sesikhathi, igama lephrofayela, indawo iklayenti eliyixazulule ngempela, imbobo, nokuthi ukuxhumana kungu-UDP noma i-TCP. Uma iphrofayela inokufaka okuningi kude, qopha ukuthi yikuphi umzamo owukhethile, ngoba umzamo omusha kungenzeka usudlulele kokunye ukufaka ngaphandle kokushintsha ifayela olifundayo.

Thatha iphoyinti lokugcina kusuka kulogi esebenzayo, hhayi kusuka kokulandwayo okukhumbulayo. Iphrofayela ekhomba kukheli eliyimfihlo ivumelekile ngokuphelele futhi ayisebenziseki ngokuphelele kusuka kunethiwekhi engakwazi ukuhamba ngomzila iye lapho, futhi leso simo sibukeka sifana neseva evaliwe.

Bese ucela umphathi wehadiwe iwindi elifanayo kusibonelo esihlosiwe. Ukwehluka kwewashi kuvamile ngokwanele ukuthi umehluko wamaminithi ambalwa ungenza isehlakalo esihambisanayo sibonakale singekho, ngakho qopha umehluko esikhundleni sokuphetha ngokuthi asikho isehlakalo.

Ukubona okune, izinyathelo ezine ezahlukene ezilandelayo

Lokho iseva ekurekhodayo kuqoka igatsha. Ukungabi khona kwanoma yimuphi umzamo kukhombisa ukukhethwa kwekheli, ukuthutha noma indlela eya kusevisi. Amaphakethe angenayo anyamalala ngaphambi kokushintshana okuvamile akhombisa izidingo zeshanneli yokulawula yesevisi yangempela. Ukwenqaba okushiwo ngegama kukhombisa into eyiqanjayo. Izimpendulo ezishiya iseva kodwa ezingafinyeleli neze kuklayenti zikhombisa indlela yokubuya.

Ilogi yohlelo lokusebenza engenalutho iwubufakazi obuthaka kunalokho ebukeka. Ukuloga kuqala endaweni ethile yokushintshana, futhi amaphakethe alahliwe ngaphambi kwaleyo ndawo awashiyi mkhondo efayeleni olifundayo. Lapho kuvunyelwe khona, umphathi angasebenzisa ukubonwa kwesevisi nenethiwekhi ukuze abone ukuthi kukhona okufikile yini.

Gcina imiphumela emine ihlukene ezincwadini zakho. Isilingo siwukuyihlanganisa ibe «iseva ayiphenduli», futhi yiwona mugqa othumela abantu ukuba bashintshe indlela yokubhala ekhodiwe lapho inkinga yangempela ingumthetho wothango lomlilo. Inothi eliqopha kuphela igama isikhathi asilahlile ukwehluka osanda kukukhokhela.

Lungisa isigaba esishiwo ubufakazi

Ukuxhumana kwe-TCP okuqedile kufakazela kuphela ukuthi kukhona okwamukele isokhethi. Akufakazeli ukuthi umlaleli yisevisi ye-OpenVPN oyilungisile, futhi iseva yewebhu egameni elifanayo lomsingathi iphendula isiphequluli ngokuphelele kuyilapho ingahlobene nomhubhe.

Uma iseva ibika uhlu lokuhoxiswa oluphelelwe yisikhathi, lokho kuyiqiniso elicacile kakhulu kunisikhathi sokugcina seklayenti, futhi isilungiso singesiphathimandla sezitifiketi hhayi esenethiwekhi. Uma izinhlangothi ezimbili zingavumelani ngokuvikelwa kweshanneli yokulawula noma impahla eyabiwe, ukusetha kabusha iphasiwedi akushintshi lutho, ngoba ukulahlwa kwenzeka ngaphambi kokuba noma yiluphi ubufakazi buhlolwe.

Shintsha into eyodwa ubufakazi obuyisekelayo ngempela, bese uphinda iphrofayela efanayo kuyo leyondawo yokugcina. Gcina isehlakalo esisha sokuqala uma ukuxhumana kudlulela phambili, ngoba leso sehlakalo akusona inkinga entsha, yisigaba esilandelayo sophenyo.

grep -nE 'TLS Error|VERIFY ERROR|CRL|handshake failed' /var/log/openvpn/server.log
date -u; timedatectl | head -3

Yini ukwandiswa kwewindi okushintshayo ngempela

Amasekhondi angamashumi ayisithupha iwindi lokuxhawula lesandla liklayenti, futhi ireferensi yeklayenti yomphakathi ibhala inketho eyilungisa. Ukuyenyusa kwenza iklayenti lilinde isikhathi eside ngaphambi kokuyeka. Akwenzi isevisi engekho ivele futhi akwenzi iphakethe elenqatshiwe lamukeleke.

Iwindi elide linokusetshenziswa okusemthethweni kuxhumano oluhamba kancane noma kuseva enomthwalo osindayo, futhi kufanelekile ukuzama uma unobufakazi bokuthi ukushintshana kuqhubeka kancane hhayi ukuthi akwenzeki neze. Ukuzama kuqala kumane kubambezela lokho kuxilongwa okufanayo ngomzuzu owengeziwe futhi kwenza umugqa wesikhathi ube nzima ukufunda. Uma umugqa wesikhathi ukhombisa ukushintshana okuqhubekayo bese kuma, iwindi liwuphawu lomthwalo hhayi lokufinyeleleka.