I-SSTP ithathe iphothi u-443: kungani i-Apache ingaqali

I-Apache iyeka ukuphendula ku-443 ntambama lapho othile evula ukuxhumana kwe-VPN okungena, futhi ilogi yayo yamaphutha isola i-bind esikhundleni sokubhukhiwe ngemuva kwayo. I-Windows Routing and Remote Access ivula SSTP nga leso sikhathi, futhi isilaleli se-SSTP sifuna i-TCP 443 ngesitaki se-HTTP ngaphambi kokuba noma yiliphi iklayenti liqinisekiswe. Isimangalo sihlala sisebenza ngisho lapho isitifiketi singekho, igama lingalungile noma yonke i-handshake yenqatshwa, ngakho i-VPN okungekho muntu ongayangena ihlala ibamba iphothi. Funda kuqala ithebula lokulalela; i-PID ephethe u-443 iyona enquma ukuthi yikuphi ukulungiswa ngezansi okuvulekile kuwe.

Ukubhuka kuphila isikhathi eside kunesitifiketi esiphukile

I-SSTP isonga i-PPP esimweni se-TLS, yingakho idinga u-443 nyingakho idlula kumaproxy alahla eminye imigudu. Isilaleli akusona isokhethi i-VPN evula ngokwayo: i-SstpSvc iyibhalisa kudrayva ye-HTTP ye-kernel, ngakho iphothi lihlala libhukiwe inqobo nje uma isevisi isebenza. Lokho kubhalisa akukaze kubuza isitifiketi, okusho ukuthi igama eliphelelwe yisikhathi, i-subject engahambisani noma ukungabi nasitifiketi nhlobo kushiya u-443 ubambekile. Khona-ke ukwehluleka kwehlukana ngezindlela ezimbili: ama-handshake enqatshiwe angena kulogi ye-System ngaphansi kwe-RasSstp, kuyilapho iseva yewebhu ingakwazi ukubika kuphela ukuthi yehlulekile ukubopha.

netstat -aon | findstr :443
tasklist /svc /fi "PID eq <pid>"

Umgqa wokuqala ubuyisela i-PID engumnikazi; owesibili usho isevisi engemuva kwayo, futhi impendulo ivamise ukuba isevisi ye-HTTP noma isitaki se-RRAS. Lapho tasklist iphendula ngenqubo yomsingathi eyabiwe, funda ikholomu yesevisi esikhundleni sokuqagela ngokusuka egameni lenqubo.

Izixwayiso ze-RasSstp zifanele ukufundwa ngemuva kwalokho kuphela, ngoba zichaza i-handshake ehlulekile futhi azisho lutho mayelana nokubhukwa okubangele ukungqubuzana. Iphendulo le-VPN elinqaba wonke amaklayenti lisaphethe iphothi. Thatha ilogi njengombuzo wesibili, hhayi owokuqala.

I-IIS iyabelana ngodrayva, i-Apache ivula isokhethi

I-IIS inikeza ama-bindings ayo kudrayva ye-kernel efanayo esetshenziswa yi-SSTP, futhi lowo drayva uhlukanisa ukuxhumana okungena ngokwegama lomsingathi nangomucu wokuqala we-URL, ngakho zombili izevisi zingacelwa ukuthi zifune u-443 ngaphandle kokuthi noma iyiphi ihluleke. I-Apache ne-nginx zenza okuphambene: zishaya i-bind kusokhethi yazo, futhi uhlelo lokusebenza luyanqaba ngoba ikheli selibambiwe. Akukho okungalungile kukho kokubili ukuhlela; umehluko usekulweni ukuthi iyiphi i-API ephethe iphothi. Yingakho futhi ukuvula i-VPN kuwisa isizinda esisodwa kumsingathi oyedwa futhi kushiye isizinda esifanayo kumsingathi omunye singathintwanga.

Lokhu kungalingani kunquma ukuma kokulungiswa. Uma i-IIS isivele iwumnyango wangaphambili, ukungqubuzana kuba umbuzo weziqalo, ama-bindings nezitifiketi. Uma i-Apache iwumnyango wangaphambili, kungaba yiyo ehoxa ku-443 noma isilaleli se-SSTP, futhi isigaba esilandelayo sihlanganisa zombili izinyathelo.

Khetha ukuthi iyiphi isevisi egcina u-443

Iphothi lesilaleli lihlala kunani elilodwa lerejista, i-DWORD yedesimali ngaphansi kokhiye wezimo ze-Sstpsvc. Shintsha inani, qala kabusha i-Routing and Remote Access, futhi uqinisekise kwithebula lokulalela ukuthi iphothi elidala likhululekile.

reg query "HKLM\SYSTEM\CurrentControlSet\Services\Sstpsvc\Parameters" /v ListenerPort
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Sstpsvc\Parameters" /v ListenerPort /t REG_DWORD /d 4443 /f
Restart-Service RemoteAccess

Khetha iphothi okungekho okunye kumsingathi okulifunayo, futhi ulibhale ngokwedesimali: reg add igcina i-DWORD njengoba ibhaliwe, ngakho inani elihlosiwe njenge-hexadecimal lihlala njengelinye iphothi. Uma umbuzo uthi inani alikho, umugqa wesibili uyalidala. Restart-Service RemoteAccess ikhipha wonke oxhunyiwe, okufanele kuhlelwe. Bese uphinda uhlole ukulalela, ngoba umbhalo omdala ku-443 usho ukuthi isevisi igcine ukubhalisa kwayo kwakudala.

Ukuhambisa isilaleli kunenani elingaboniswa ukuhlelwa kwerejista. Amaklayenti ajwayelekile e-SSTP ashaya u-443, ngakho iphrofayili ngayinye yeklayenti idinga iphothi elisha, futhi ukugeleza akuyekile ukufana nesicelo sewebhu kunoma yini ehlola umzila. Kunethiwekhi ekhuthazela kuphela ithrafikhi ebukeka njenge-HTTPS, lokho kususa ingxenye enkulu yesizathu sokukhethwa kwe-SSTP. Iqembu elincane futhi elilawulwayo lamaklayenti liyakwamukela lokho; isisekelo sabasebenzisi esivamile noma i-BYOD asikwamukeli.

Elinye inyathelo ligcina u-443 ku-IIS futhi lithatha i-Apache njenge-backend umproxy odlulisela kuyo. Ligcina okumisiwe kwe-SSTP futhi lishiya umnikazi oyedwa wephothi, ngenani lamakhanda adlulisiwe, ikheli leklayenti uhlelo olungasaboni ngqo, kanye ne-backend okufanele ikhulume iphrothokholi umproxy oyithumelayo ngempela.

Fakazela umnikazi, isitifiketi ne-handshake ngokulandelana

Ukuxhumana kwe-TCP okuqediwe kufakazela ukuthi kukhona isilaleli futhi akukho okunye, yingakho ukuskena kwezimbobo kungabukeka kunempilo ngenkathi umgudu usahluleka. Izigaba ezine zihluleka ngezindlela ezahlukene, futhi ukulungiswa okuqondiswe esigabeni ongasiphulanga ngokuvamile kujulisa ukungqubuzana. Sebenza ngazo ngokulandelana futhi ume lapho impendulo ihlukana khona.

netstat -aon | findstr :443
certutil -store My
Get-WinEvent -LogName System -ProviderName RasSstp -MaxEvents 20

Umgqa wokuqala usho i-PID ebamba u-443, futhi kufanele kube isevisi osanda kuyimisa. Owesibili ubala izitifiketi zomshini namasubject azo, ngakho igama elingahambisani nekheli kusiphrofayili seklayenti ligqama ngokushesha. Umbuzo wezehlakalo ubuyisela amarekhodi e-SSTP akamuva, futhi i-handshake engakaze ifinyelele ukuqinisekiswa kwe-PPP ishiya irekhodi elihlukile kunalelo eliqinisekisiwe bese lenqatshwa. Isigaba sokugcina sibonakala kuphela kuklayenti, lapho umbhalo ubika ukuxhumekile noma usho iphutha le-PPP.

Lapho umsingathi oyedwa kufanele enze imisebenzi yomibili, khetha umnikazi ka-443 ngamabomu futhi ubhale phansi ukukhetha, ngoba uma kungenjalo umuntu olandelayo ovula isici uzophinde athole lokhu kungqubuzana. Ukuhlukanisa izindima kuseyimpendulo ehlanzekile: iseva yewebhu yomphakathi nephendulo lokufinyelela kude kuthwala imijikelezo ehlukene yamaphakethe, izitifiketi nokuqalisa kabusha, futhi leyo mijikelezo ihlangana ngokohlelo lwayo. Noma ngabe yikuphi, shiya ukuhlolwa kokulalela, umzila werejista kanye nephothi elikhethiwe kunothi lokunikezela.