I-SSTP ngemuva kwe-proxy ehlola i-TLS: lapho iseshini inqamuka khona

Isiphequluli sakho silayisha i-intranet yenkampani, isitifiketi se-proxy siyathenjwa, kodwa iklayenti le-SSTP liyawa eduze kokuphela kokuxhumana. Leli phatheni likhomba umehluko phakathi kwesicelo sewebhu neseshemu esemhubheni, hhayi iphasiwedi engalungile. Hamba ukuxhumana kusukela ku-TCP kuye phezulu futhi ubhale isigaba sokuqala esihlulekayo. Isigaba, hhayi ikhodi yephutha, sikutshela ukuthi i-proxy iyimbangela yini.

Qala lapho iklayenti lima khona

Iklayenti lidlula ngokulandelana okungaguquki: ukuxhumana kwe-TCP kumbobo 443, ukuxhawula kwe-TLS, ukuqinisekiswa kwesitifiketi, ukushintshana kwe-HTTP kwe-SSTP, ukuxoxisana nokuqinisekiswa kwe-PPP, bese kuba ukucushwa kwe-IP. Ukwehluleka esigabeni ngasinye kushiya umkhondo ohlukile, futhi ukukuhlanganisa kukuholela ekhasini lokucushwa elingalungile.

Ukwehluleka kwe-TCP ukuphela kwesikhathi noma ukusethwa kabusha ngaphambi kokuba kuvele noma iyiphi ibhayithi ye-TLS. Ukwehluleka kwe-TLS isixwayiso noma ukuphela kwesikhathi kokuxhawula. Ukwehluleka kwesitifiketi kukhiqiza isixwayiso mayelana nochunge noma igama. Ukwehluleka kwe-HTTP kufika ngemva kokuxhawula okuphumelelayo, ngokuvamile njengekhodi yesimo noma ukuvalwa ngokushesha. Ukwehluleka kwe-PPP kufika ngemva kokuba umhubhe ususungulwe ngokobuchwepheshe, yingakho kubonakala njengenkinga yokuqinisekisa.

Funda ilogi yeklayenti ukuthola isigaba sokugcina esiphumelelayo, hhayi umugqa wokuqala wephutha. Umugqa wephutha ngokuvamile ubika umphumela, kuyilapho umngcele wesigaba usho ingxenye enqabile.

Okufunwa yi-SSTP enetilokweni ukuthi ikuthwale

I-SSTP isebenza phezu kwe-TLS ku-TCP 443 bese ithumela isicelo se-HTTP esibizwa nge-SSTP_DUPLEX_POST, esichazwe ku-isimiso se-SSTP, iye emkhondweni wesimo /sra_{GUID}/. Isicelo simemezela ubude bokugcwalisa obungenawo umkhawulo ngokwezinto ezibonakalayo futhi sigcina ukusakazwa kuvuliwe kuzo zombili izinhlangothi isikhathi sonke seseshini. Amafreyimu e-PPP ahamba ngaphakathi kwalokho kusakazwa.

Yingakho i-proxy ephethe ukuphequlula okuvamile isengahluleka. I-GET noma i-POST enomzimba onomkhawulo ingagcinwa esikhashana, ihlolwe futhi idluliswe; ukusakazwa kwezigaba ezimbili okunomzimba ongapheli nakancane akunakwenzeka. I-proxy elinda ukuthi umzimba uqede ilinda ingunaphakade, futhi iklayenti ekugcineni liyaphela isikhathi.

Ukuhlunga kwezindlela nokuqinisekisa kunezela izindlela zazo zokwehluleka. Uma i-proxy icela ubufakazi besicelo, iklayenti le-VPN lingase lingaphenduli nakuba isiphequluli singaphendula. Uma isusa noma ibhala kabusha indlela, isango lenqaba isicelo ngaphambi kokuba i-PPP iqale.

Kungani ukuhlola kushintsha ubunikazi

I-proxy ehlola i-TLS iphelisa ukuxhumana kwe-TLS kweklayenti bese ivula olunye ukuxhumana oluya esangweni. Ngakho iklayenti liqinisekisa isitifiketi se-proxy, hhayi esesango, futhi isango libona i-proxy njengomlingani walo. Lapho inhlangano isabalalisa impande yayo, kokubili isiphequluli neklayenti le-VPN kungamukela lolo chunge, ngakho ukuxhawula kuyaphumelela futhi inkinga idlulela esigabeni esilandelayo.

Ukuqinisekisa okuphumelelayo akusho ukuthi i-proxy ingathwala iseshini. Kusafanele idlulise i-POST yezinhlangothi ezimbili engenamkhawulo ngaphandle kokugcina esikhashana, futhi igcine zombili izixhumanisi ziphilile amahora amaningi. Imikhiqizo eminingi yokuhlola yakhelwe ukuhamba kwesicelo-nempendulo futhi ayikusingathi kahle lesi simo noma ayisisingathi nakancane.

Yingakho ukwengeza impande engaziwa noma ukucisha ukuqinisekisa kuwukulungisa okungalungile. Kushintsha ukuthi iklayenti lamukela isiphi isitifiketi; akwenzi lutho mayelana nokuphathwa kokusakazwa okuqede iseshini ngempela.

Khomba umkhiphi ngaphambi kokushintsha izilungiselelo

Buza iphuzu lokugcina ukuthi lethula siphi isitifiketi nokuthi ubani wasayina. Imiyalo engezansi ikhombisa uchunge nomkhiphi ngaphandle kokuqala iseshini ye-VPN:

openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts
curl -vI https://vpn.example.com/

Uma umkhiphi kuyi-CA yomphakathi, ukuxhumana kwale host cishe akubanjwanga futhi ukwehluleka kukwenye indawo. Uma umkhiphi kuyi-CA yenhlangano uqobo, ukuhlola kuyasebenza futhi isango lifinyelelwa nge-proxy. Qhathanisa isigxivizo somunwe nalokho okulindelwe yithimba lenethiwekhi ngaphambi kokuphetha ngokusekelwe egameni kuphela.

Ukuhlolwa kwesiphequluli okuya kulelo host kufakazela kuphela ukuthi i-proxy yamukela i-GET. Akusho lutho mayelana nendlela ye-SSTP, i-URI yesicelo noma impilo yomzimba, ngakho ungathathi ikhasi le-intranet elisebenzayo njengobufakazi bokuthi umkhondo womhubhe uyasekelwa.

Khetha umkhondo osekelwe

Buza umnikazi wenethiwekhi umbuzo owodwa oqondile: ingabe i-proxy ivumela i-POST yezinhlangothi ezimbili engagcinwanga esikhashana eya kulesi sango kumbobo 443? Uma kunjalo kuholela ekukhululweni ku-proxy noma ekweqiweni okubhalisiwe kwehost ye-VPN. Uma kungenjalo kusho ukuthi umkhondo ohloliwe awukwazi ukuthwala i-SSTP, futhi ukulungiswa okusekelwayo kungomunye umkhondo noma iphrothokholi, hhayi ukulungisa iklayenti.

Izinketho ngokuvamile zihlanganisa ukuphuma okungahlolwanga kwesango le-VPN, umklamo womhubhe ohlukanisiwe othumela kuphela ukuhamba kwenkampani nge-proxy, noma enye iphrothokholi esekelwa yinhlangano kwenye imbobo. Ngayinye iyingxenye yomklamo wenethiwekhi, futhi ngayinye kufanele ihlolwe ngedivayisi neprofayili efanayo ukuze ukuqhathanisa kwehlukanise umkhondo.

Bhala umphumela: umkhiphi, isigaba esihlulekile, umthetho we-proxy nomkhondo okhethiwe. Umuntu olandelayo obona ukuma okufanayo kumaphesenti angu-98 uzokwazi ukuhlola iqiniso elilodwa esikhundleni sokuphinda uhambo lonke.