SSL VPN noma isembozo se-TLS? Qhathanisa umngcele owehlulekile

Amadizayini amabili angasebenzisa i-TLS kuphothi 443 futhi asho izinto ezihluke ngokuphelele. Isembozo sivikela ukuxhumana okukodwa okulungisiwe phakathi kwephothi lendawo kanye ne-backend ekude. Idizayini yokufinyelela kwinethiwekhi ithwala ithrafikhi ekhethiwe futhi ishintsha lokho iklayenti elingakufinyelela. Yenza izihlolo ezine ezingezansi ngokulandelana futhi uzokwazi ukuthi ubhekene nakuphi, okujwayelekile ukuthi kwanele ukwazi ukuthi yiluphi ungqimba olwehlulekile.

Qala ngokuxhumana okulungise ngempela

Bhala ingxenye yangaphambili nengemuva ngaphambi kokuqhathanisa imikhiqizo. Isembozo silalela ikheli lendawo futhi sidlulisa kwelikude, noma siqala uhlelo ohlangothini olukude, futhi lelo bhangqa yisivumelwano saso sonke. Ezinye izinhlelo zeklayenti aziqondi lutho ngaso ngaphandle uma uzikhomba kuso. Lokhu akusona isiphambeko sethuluzi, ithuluzi lenzelwe lokhu.

Isivumelwano sedizayini yenethiwekhi sihlukile, futhi sivezwa emizileni nasemgomeni, hhayi kubhangqa yamaphothi.

Qaphela ukuthi iziphi kulezi zincazelo ezimbili ezihambisana nomdwebo wakho. Uma impendulo iwukuhlela kwephothi elilodwa elinesitifiketi phakathi, unesembozo ngisho noma igama lomkhiqizo lithi VPN. Uma impendulo iwukuxhumana komhubhe nezinguquko zemizila, unedizayini yenethiwekhi ngisho noma isebenza ku-443.

Hlola ukuthi isembozo sixhumana nani

Funda izilungiselelo zokulalela nokuxhuma bese uzilandela kuze kufike ku-backend yangempela. Isembozo esidlulisela kuphothi lesizindalwazi asivuli uhlelo lwewebhu, futhi isembozo esiqalisa uhlelo siqala lolo hlelo esikhundleni sokushicilela konke okunye okusetshenziswa umphathi. I-backend iyona kuphela into isembozo esiyaziyo.

Bese unquma ukuthi umfudlana odluliswayo uwumbhalo ovamile yini uma i-TLS isiphelile. Ukuxhumana okusembozekile kuvikela ingxenye phakathi kwemibhoxo emibili, futhi okwenzeka ngemva kwesembozo esikude kuwumbuzo ohlukile. Yingakho ukumboza into esevele inokuzivikela kwayo kwesinye isikhathi kunengqondo futhi kwesinye isikhathi kumane kuyizingxenye ezinyakazayo ezengeziwe. Hlola igxathu elilandelayo esikhundleni sokucabanga eyodwa yezimpendulo.

openssl s_client -connect wrapper.lab.example:443 -servername wrapper.lab.example -verify_return_error
sudo ss -ltnp | grep 443

Umyalo wokuqala ukhombisa isitifiketi esinikezwa iklayenti ngempela, futhi owesibili ukhombisa okulalelayo kumphathi. Qhathanisa lelo gama lesitifiketi nalelo obulindele ngaphambi kokufunda enye into.

Hlola ukuthi idizayini ithwala ithrafikhi ini

Amadizayini okufinyelela kwinethiwekhi athwala ithrafikhi ekhethiwe futhi ahlangana nokuhlela kwemizila nengqubo yokufinyelela yeklayenti. Ukwamukelwa akulona igunya, ngakho ukuxhumana okuqinisekisiwe kusadinga isinqumo mayelana nokuthi yiziphi izinsiza engazifinyelela. Ingosi engenaklayenti imodeli yesithathu eyenza umfakeli wezinye izinqubo ezisekelwayo ngaphandle kokuvela njengokuxhumana kwe-tun.

Ilebula yomkhiqizo ayikutsheli ukuthi yimuphi kulezi zinhlobo oyithengile, futhi inombolo yephothi itshela ngisho okuncane.

Ukuhlangana kwezingqimba kungenzeka futhi akufanele kudide ukuqhathanisa. Iphrothokholi yomhubhe ngokwayo ingaseyembozwe nge-TLS ekuhleleni kwe-TCP okusekelwayo, okwengeza ungqimba oluzungeze umhubhe ngaphandle kokwenza isembozo sibe umhubhe. Lesi yisinqumo sedizayini esinesimilo saso sokusebenza nokwehluleka, futhi sifanele umugqa emdwebeni. Sibhale phansi, bese uqhathanisa amamodeli ayisisekelo hhayi isembozo sangaphandle.

Hlola umngcele owehlulekile, hhayi ilebula

Bhala amaqiniso omzamo owodwa ohlulekile: ikheli langaphambili, umlaleli, ubunikazi iklayenti elibuqinisekisile, umgomo we-backend nomsebenzi oceliwe. Ukuxhawulana okuphumelelayo kufakazela ukuthi i-TLS yangaphandle yaqedwa futhi akusho lutho nge-backend. Ukwenqatshwa kwe-backend kuyisenzakalo esihlukile ekwehlulekeni kobunikazi ngaphambili, futhi akukho okuphuma kangcono ngokususa i--verify_return_error kuklayenti. Qhathanisa okufanayo nokufanayo, ngoba impumelelo ngelinye igama lomphathi noma iphothi ayikhombisi ukuthi izimo zazifana.

Iphothi 443 iwumkhuba ovumela i-TLS ukuba idlule emabhokisini aphakathi. Awukwenzi ukuthrafikhi okungahleliwe kufane nesicelo sewebhu kudivayisi yengqubo.

Qeda ngomusho owodwa osho ibhangqa yamaphoyinti okugcina, okuthwalwayo, yiziphi izinhlelo ezikusebenzisayo nomthetho osegcinwayo yindawo okuyiwa kuyo. Idizayini engakwazi ukugcwalisa lezo zikhala ezine ayiphelele, noma ilebula yayo ithini. Lowo musho futhi uyindlela eshesha kakhulu yokuchaza idizayini kumuntu ophethe i-firewall.