I-SSTP ne-SSL 3.0: ilebula ngokuqhathaniswa nenguqulo okwaxoxelwana ngayo

Abantu ababili bangabheka ukusetshenziswa kwe-SSTP okufanayo futhi bafinyelele eziphethweni eziphikisanayo. Omunye ufunda imibhalo yomkhiqizo, abone izinhlamvu ze-SSL futhi acabange ukuthi ithuneli isebenzisa iphrotokholi eyahoxiswa eminyakeni edlule. Omunye ukhomba ukuxhawana kwezandla kwesimanje futhi athi umbuzo uvaliwe. Bobabili baphikisana ngamalebula hhayi ngenguqulo okwaxoxelwana ngayo, futhi kukodwa kwalokhu okuwubufakazi. Ukuqhathanisa okufanele kwenziwe kungukuthi phakathi kwalokho igama elikuthembisayo nalokho isevisi ekukhethayo ngempela.

Izimpendulo ezimbili embuzweni owodwa

I-agumenti yelebula ilula ukuyisho: i-SSTP ichazwa njengephrotokholi yethuneli ephephile ngamasokhethi, igama lomlando lithi SSL, ngakho ukuxhumana kufanele kube yi-SSL 3.0. Iyaqhubeka ngoba igama livela ngempela kulolo hlu futhi ngoba iningi labo abayiphinda alikaze libheke ukuxhawana kwezandla. Iyaqhubeka futhi ngoba isiphetho sizwakala siqaphile, kube sengathi ukucabanga okubi kakhulu ukukhetha okuphephile. Ukucabanga okubi kakhulu nokukala inguqulo yangempela kuyimisebenzi emibili ehlukene, futhi kukodwa kuphela okuyishintshayo into ethile.

I-agumenti yobufakazi ibuza umbuzo omncane. Yiluphi uhlobo lwenguqulo yephrotokholi iqembu leklayenti nalesi sevisi abavumelana ngalo, kuleli phoyinti lokugcina, ngalesi sikhathi? Impendulo ivela kusevisi eqeda i-TLS, hhayi ekhasini lokukhangisa noma kubhrawuza elifinyelele isiza esinegama elifanayo.

Lezi zingxoxo ezimbili ziyahluka kulokho ezingakufakazela. Ilebula ayikwazi ukuhlukanisa ukusetshenziswa kwakudala kulokho okulungisiwe, futhi ukuxhawana kwezandla akukwazi ukukutshela ukuthi isevisi engahlobene yenzani kulo hosti ofanayo. Sebenzisa eyesibili futhi uyeke ukusebenzisa eyokuqala.

Funda inguqulo isevisi eyikhetha ngempela

Qala ngokusho izingxenye: ukusetshenziswa kweklayenti, ukusetshenziswa kweseva, iphoyinti lokugcina le-TLS nakho konke okuphakathi okuphetha futhi kusungule kabusha i-TLS. I-load balancer ephetha i-TLS futhi ekhuluma i-HTTP elula ne-backend ishintsha ukuthi yiluphi idivayisi umthetho walo okufanele uwufunde.

openssl s_client -connect vpn.example.com:443 -servername vpn.example.com </dev/null> | grep -E 'Protocol|Cipher'
Get-WinEvent -LogName System -ProviderName Schannel -MaxEvents 20

Bhala iphoyinti lokugcina nesikhathi eceleni komphumela, ngoba ukushintsha komthetho kamuva kwenza ukubhekwa okungenalo usuku kungabi nalusizo. Phinda ukuhlola kusuka kuklayenti elisendleleni efanayo yenethiwekhi nabasebenzisi obakhathalelayo, ngoba idivayisi yokungena ingaqeda i-TLS ngezilungiselelo zayo. Uma izimo ezimbili zingavumelani, uthole ingxenye ebalulekile. Uma zivumelana, unobufakazi hhayi isiqubulo.

Hlukanisa inkambu yerekhodi nezingxoxo

Inombolo yenguqulo ebukeka indala enkambini eyodwa ayilona iqiniso elifanayo neseseshini ye-SSL 3.0. RFC 7568 ithatha inguqulo yesendlalelo serekhodi nephrotokholi okwaxoxelwana ngayo njengezinto ezihlukene, futhi kuvela kuleyo mehluko izimpendulo ezingalungile ezinethemba. Funda iphrotokholi okwaxoxelwana ngayo, bese kuba i-cipher, futhi kuphela bese uthatha isiphetho ngeseshini.

Umbhalo ofanayo ucacile ngephrotokholi ngokwayo: i-SSL 3.0 akufanele isetshenziswe, futhi ukuxoxisana noma ukuhlehla kuyo kwenqatshiwe. Isizathu isakhiwo se-CBC esiphukile esasetshenziswa ukuhlasela kwe-POODLE, futhi lokho kuyisici sephrotokholi, hhayi ukulungiselelwa kohlelo olulodwa.

Yingakho „lo mthwalo womsebenzi mhlawumbe unzima ukuwusebenzisa kabi” akuyona i-agumenti yokushiya i-SSL 3.0 ivuliwe. Isidingo ukususa iphrotokholi, hhayi ukunqoba ingxoxo ngombukiso owodwa.

Hoxisa i-SSL 3.0 ngomthetho ongawuvikela

Ku-Windows izilungiselelo zephrotokholi ze-Schannel zingaphansi kokhiye i-Protocols futhi zifundwa ngokuhlukile endimeni yeklayenti neyeseva, yingakho ukushintsha okulungisa uhlangothi olulodwa kungashiya olunye lungathintwanga. Izilungiselelo zamanje nezidingo zazo zokuqalisa kabusha kubhalwe yi-Microsoft, futhi ilabhulali ye-TLS yomuntu wesithathu kulelo hosti izishaya indiva ngokuphelele.

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server'
Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols'

Shintsha umthetho ngendlela yokuphatha esekelwayo, qinisekisa ukuthi isevisi engumnikazi ithola kabusha ukulungiselelwa kwayo, futhi gcina indlela yokubuyela evunyelwe. Ukunamathisela iskripthi esibanzi serejista esivela kwenye indawo yilokho okwenza ukulungiswa kwesevisi eyodwa kube ukuphazamiseka kukho konke iklayenti le-TLS emshinini. Ubukhulu bokuqalisa kabusha bubalulekile lapha: isilungiselelo esibonakala sifakiwe singase sisabanjwe enkumbulweni yesevisi engakalayishi kabusha.

Uzakwethu osafuna inguqulo engaphelelwe yisikhathi udinga isibuyekezo noma uhlelo lokufuduka. Isimo esingabhalwanga esibuyisela buthule iphrotokholi endala akulona isu lokuhambisana futhi ngeke kusinde ekuhlolweni okulandelayo.

Amukela ushintsho ngezixhumo ezintsha

Hlola ngamaseshini amasha ngemuva kokushintsha komthetho, ngoba ukuxhumana okwasungulwa ngaphambi koshintsho akufakazeli lutho mayelana nokulungiselelwa okusebenzayo manje. Qinisekisa ukuthi iphrotokholi evunyelwe iyaphumelela nokuthi eyenqatshiwe iyehluleka enqubweni yokuqinisekisa egunyaziwe, bese ushiya ubunikazi besitifiketi nokuhlolwa kokwethembana kunjalo njengoba bekunjalo.

Khumbula ukuthi ukuxhawana kwezandla akukuhlawuli. I-SSTP ithwala ukuqinisekiswa kwe-PPP ngemuva kwesendlalelo se-TLS, ngakho inguqulo yephrotokholi yesimanje ayisho lutho mayelana nokuthi yimuphi umsebenzisi ogunyaziwe noma yiziphi izinsiza iseshini engazifinyelela. Lokho kuyizilawuli ezihlukene ezinobufakazi obuhlukene.

Bhala umphumela njengesevisi, i-backend, umthetho ovunyelwe kanye nenguqulo ebhekiwe. Ireyikhodi enjalo iphendula umbuzo wokuphepha ngokunembile, okuyinto okungeke kuyenza i-agumenti yelebula noma i-agumenti yobunzima.