Ngaphambi kokukuguqula: ukhiye we-SSH nesitifiketi se-OpenVPN

Ukungenisa kwehluleka ngephutha lesitifiketi, ngakho isinyathelo esisobala sibonakala siwukuguqula. Leso sizungu siholela abantu endleleni lapho isandiso sefayela sishintsha khona kepha ukwenqatshwa kuhlala kuyinto efanayo. Umugqa we-ssh-ed25519 ku-authorized_keys nesitifiketi somxhasi se-OpenVPN yizinto zobufakazi ezihlukene, ezinabakhiphi abahlukene, ukubhala amakhodi okuhlukene nezindlela zokuhoxisa ezihlukene. Ukudlula lezi zivivinyo ngokulandelana kukutshela ngaphakathi komzuzu owodwa ukuthi ukuguqula kungasiza nhlobo yini.

Isiphi isinto osiphethe ngempela?

Kunezinto ezinhlanu abantu abazibiza ngokuthi ukhiye, futhi kukuphela kwayo eyodwa ekuphela kwayo ileyo iphrofayela ye-TLS eyifunayo. Ukhiye womphakathi we-SSH wumugqa owodwa wombhalo oneqembu lohlobo kanye nomthwalo we-base64. Isitifiketi se-OpenSSH yilowo khiye kanye nesiginesha, principals nezinketho, okukhiqizwa yi-ssh-keygen esebenza njenge-CA yayo encane. Isitifiketi se-X.509 siyisakhiwo esihluke ngokuphelele, esithwala isihloko, isikhathi sokusebenza, izandiso kanye nesiginesha esivela esiphathimandla sezitifiketi. Ukhiye wangasese uyingxenye eyimfihlo, futhi inqwaba ekhishiwe ngokuvamile iyisitifiketi kanye nochunge lwaso kanye nokhiye wangasese kufayela elilodwa.

Isivivinyo sokuqala sidinga umyalo owodwa kuphela. Khomba i-openssl efayeleni futhi ucele ukuthi ihlaziye isakhiwo sesitifiketi:

openssl x509 -in client.crt -noout -subject -issuer

Uma lokho kwehluleka ngephutha lokungakwazi ukulayisha noma le-PEM, ifayela akulona isitifiketi se-X.509 noma ngabe ulibize ngani. Ukuqamba kabusha akubhali kabusha i-ASN.1 engaphakathi, futhi nokugoqa umugqa wokhiye womphakathi embhalweni wesihloko se-PEM akwenzi lokho.

Ingabe iphrofayela icela isitifiketi nhlobo?

Izitifiketi zamakhasimende ziyindlela eyodwa yokuqinisekisa phakathi kwezinye ezimbalwa, futhi amaphrofayela amaningi e-TLS asebenzayo awasoze acele eyodwa. Iseva ingaqinisekisa abasebenzisi ngophluksini, ngegama lomsebenzisi nephasiwedi, noma nge-backend yamathokheni, kuyilapho isadinga ukuthi ikhasimende liqinisekise ubunikazi baseseva. Uma iphrofayela ingenayo imiyalo yesitifiketi sekhasimende, akasoze kucelwe isitifiketi, futhi akukho kuguqula okuzokwenza isango licele esisodwa.

Ukulungiselelwa kwakudala kokhiye oqinile yisimo sesithathu. Kwandulela ukuxhawulana kwe-TLS futhi kulindele ifayela lemfihlo eyabiwe ngaphambili, yingakho nokunamathisela ukhiye womphakathi kuleyo nkambu nakho kungenzeki. Funda ukuthi iphrofayela icela ini ngempela ngaphambi kokunquma ukuthi ubufakazi abulungile.

Ukubhala kabusha amakhodi kungenza ini futhi akukwenzi ini

Okhiye bangasese banemigqomo ehlukile esemthethweni. Ukhiye ofanayo we-RSA noma we-EC ungabhalwa njenge-PEM yendabuko, njenge-PKCS#8, noma ngaphakathi kwenqwaba ye-PKCS#12, futhi amathuluzi ashintsha ngokukhululeka phakathi kwazo. Okhiye bomphakathi banendaba efanayo: i-ssh-keygen ingakhipha isimo se-RFC 4716 sokhiye we-SSH, futhi i-OpenSSH iyasiqonda nesimo sayo sesitifiketi. Konke lokho kuwukumelela, futhi ukumelela akulona ukuthembela.

Into ukuguqula okungeke kwenze iwukudala isiginesha esivela esiphathimandla sezitifiketi esingakaze sibone ukhiye wakho. Isitifiketi siyisimemezelo somkhiphi sokuthi ukhiye othile womphakathi ungowesihloko esithile ngenjongo ethile. Ukubhala kabusha amakhodi kugcina amabhayithi okhiye futhi kushiye isimemezelo singekho, ngakho isango alinanto elingayiqhathanisa nesitoreji salo sokuthembela.

Lesi yisinyathelo lapho imizamo eminingi ihluleka khona buthule: ifayela manje liphetha nge-.crt, ikhasimende liyifunda ngaphandle kwesikhalazo, futhi ukuxhawulana kusaqhubeka nokunqanyulwa ngoba uhlangothi olulandelayo alunakwakha uchunge olufinyelela kumkhiphi othembekile.

Isiphathimandla sezitifiketi singena kuphi esithombeni

Ukubhaliswa kwangempela kuqala ngababili bokhiye olawulayo kanye nesicelo sokusayina isitifiketi esithwala isihloko esilindelwe umqhubi. Umqhubi uqinisekisa ilungelo, usayina isicelo ngokhiye we-CA, futhi ubuyisela isitifiketi esikhishiwe kanye nanoma yiluphi uchunge oluphakathi okufanele ikhasimende luluveze. Ngemva kwalokho ikhasimende lidinga isitifiketi se-CA esasicile, ngoba yiso esilivumela ukuthi liqinisekise ukuthi iseva elikhuluma nayo ingeyokufakwa okufanayo.

Lelo fayela lokugcina kulula ukulikhohlwa futhi akunakwenzeka ukulishintsha. Ukhiye wokusayina we-CA ngokwakho awusoze waba yingxenye yokulungiselelwa kwekhasimende, futhi akukho kuguqula kwasendaweni okukhiqiza uchunge obekufanele uluthole.

Kubiza malini ukusebenzisa kabusha ukhiye we-SSH

Ake sithi ukuguqula kwakhiqiza into eyamukelekayo ngempela. Ukusebenzisa kabusha ababili bokhiye oyedwa kokubili ukufinyelela kwe-SSH nokuqinisekisa kwe-VPN kusahlanganisa izinqumo ezimbili ezizimele zokuphepha. Ukususa umugqa ku-authorized_keys kumisa ukungena nge-SSH, futhi akwenzi lutho esitifiketini esikhishwe yi-CA ye-VPN ngalowo khiye womphakathi. Uhlangothi lwe-VPN luhoxiswa ngendlela yalo, okungukuthi uhlu lokuhoxisa izitifiketi noma irekhodi lokubhalisa lomqhubi.

Ngakho uhlu lokuhlola luphetha ngombandela wokuma hhayi ngeqhinga. Uma i-openssl ingayihlaziyi ifayela njengesitifiketi, yeka ukuguqula futhi chaza ukuthi unani: ukhiye we-SSH, isitifiketi se-SSH, isitifiketi se-X.509, ukhiye wangasese noma inqwaba. Uma iphrofayela ingaceli isitifiketi sekhasimende, ma futhi ubuze ukuthi iyiphi indlela yokuqinisekisa iseva eyilindele. Kuphela lapho zombili izimpendulo zikhomba ku-X.509 lapho ukubhalisa kuba yisinyathelo esilandelayo, futhi leyo ngxoxo ihamba ngokushesha kakhulu uma umbhalo wokuqala unebizo elifanele.