Isikhathi se-SSTP siphelile noma iphutha lesitifiketi: ukuhlukanisa kokubili

Ukuxhumana kwe-SSTP kwehluleka ngezindlela ezimbili ezibonakala zifana esihlalweni somsebenzisi, futhi ukulungiswa kwakho ngakunye kusegumbini elihlukile. Isikhathi esiphelile sisho ukuthi ukushintshana okudingekayo akukaze kuqedwe; iphutha lesitifiketi lisho ukuthi impahla yobuwena yafika futhi yenqatshwa. Ukuthatha okwesibili njengokokuqala kukuholela ezindongeni zomlilo namagama ayimfihlo ayengakaze abe yinkinga. Ubufakazi obuhlukanisayo busekuqophweni kwekhasimende ngokwalo, uma ukufunda ngaphambi kokushintsha noma yini.

Ukwehluleka okubili, ukushintshana okubili okuhlukile

I-SSTP ithwala umhubhe ngaphakathi kwesikhathi esinesimo se-HTTPS, yingakho isinda kumanethiwekhi avumela kuphela u-443. Ikhasimende liqeda ukuxhawulana kwe-TLS, lithumela isicelo se-HTTP ngendlela eqondene nephrothokholi, bese umhubhe ugijima ngaphakathi kwalowo mfudlana. Ukwehluleka kwesinye salezi zinyathelo kumisa ukuxhumana, futhi izinyathelo zakamuva kuphela ezihlobene nemininingwane yokungena.

Lolo hlelo luwukuxilonga. Uma ukuxhawulana kwe-TLS kungaqedi, akukho mininingwane yokungena eyathunyelwa, ngakho ukusetha kabusha igama ayimfihlo ngeke kusize. Uma ukuxhawulana kuqeda bese kuma, ubuwena bamukelwe futhi okuthile endleleni yesicelo kwakunqaba. Uma ukuxhawulana kwehluleka ngomlayezo wokuqinisekisa, iseva yaphendula futhi ikhasimende alikuthandanga elakuzwa. Imiphumela emithathu, izingqimba ezintathu.

Umugqa wokuqopha uvame ukusho ukuthi ukuphi kwezintathu, ngakho kufanele ukubhale phansi ngaphambi koshintsho lokuqala.

Isikhathi esiphelile sisho ukuthi isigaba asikaze saqedwa

Qala ngokuxazululwa kwamagama nokufinyeleleka kwe-TCP, ngoba isikhathi esiphelile lapho sibonakala sifana ncamashi nesikhathi esiphelile kamuva. Isihloli sembobo esibika ukuthi u-443 uvuliwe sifakazela kuphela ukuthi umlaleli wamukele ukuxhumana, hhayi okunye.

Umsolwa olandelayo umzila hhayi umhambi. Ama-proxy kanye nezindonga zomlilo ezaziyo izinhlelo ngezinye izikhathi zenqaba indlela yesicelo esetshenziswa yi-SSTP, noma zilahla umfudlana ohlala uvuliwe amahora, futhi zombili lezi zimo zibonakala njengesikhathi esiphelile ngasohlangothini lwekhasimende. Ikhasi le-HTTPS elijwayelekile elihlinzekwa umhambi ofanayo lilayisha ngokuphelele ngenkathi indlela yomhubhe inqatshwa, yingakho ukuphequlula ukuya ekugcineni kufakazela okuncane kangako. Hlola kusuka kunethiwekhi engenawo ama-proxy ukuze uhlukanise lezo zimo ezimbili.

Test-NetConnection vpn.example.com -Port 443
netsh http show sslcert
Get-WinEvent -LogName 'Microsoft-Windows-RasSstp/Operational' -MaxEvents 20

Isikhathi esiphelile ngaphambi kwanoma iyiphi impendulo yomunye akusho lutho mayelana ne-akhawunti, futhi ukushintsha igama ayimfihlo ngaleso sikhathi kunezela ukuguquguqukayo okukodwa kuphela.

Iphutha lesitifiketi lisho ukuthi ubuwena bunqatshiwe

Lapha iseva yaphendula ngempela, ngakho inethiwekhi iyasebenza futhi umbuzo udlulela ebuneni. Qhathanisa igama ikhasimende elishayayo namagama isitifiketi esiwashiqelayo ngempela, bese uhlola izinsuku zokusebenza kanye nochungechunge lomkhiphi.

I-CA yangasese ikhasimende engayethembi iletha isigaba esifanayo sephutha njengesitifiketi esiphelelwe yisikhathi, futhi kanjalo newashi elihamba ngamahora amaningi ngokungalungile. Ukushaya ikheli elingahluziwe kwakha ukungafani okusha, ngoba isitifiketi siqela amagama hhayi amakheli. Ekusetshenzisweni okuphethwe, thola ukuhlelwa kokwethemba okuhlosiwe kumlawuli waso esikhundleni sokwamukela impande yokushintsha enikezwa ikhasi lephutha. Ukuqinisekisa kuhlala kuvuliwe ngenkathi ulungisa imbangela.

openssl s_client -connect vpn.example.com:443 -servername vpn.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
w32tm /query /status

Gcina isigaba se-TLS esiphumelele singathintekile uma sesedlule, ngoba ukusihlehlisa kamuva kufihla ukuthi yiluphi ushintsho olwalungisa umhubhe ngempela.

Lapho lezi ezimbili zidideka khona

Zombili izinselelo zibonakala njengokuxhumana okungakheki, futhi zombili zifika ngemva kokuba umsebenzisi eshintshe okuthile okungahlobene. Yilokho kuqondana okwenza ukulungiswa okungalungile kubonakale kukholakala isikhashana.

Imikhuba emibili ihlukanisa lezi. Bhala phansi ukuqopha kwekhasimende ngaphambi kokuthinta ukuhlelwa, ukuze isimo sokuqala sigcinwe. Shintsha ingqimba eyodwa ngokuzama ngakunye, ukuze umphumela olandelayo ube ngowokuguquguqukayo okwaziwayo. Isihloli sembobo nesiphequluli kungukubona okuyingxenye hhayi ukulandelana okuphelele, futhi akukho kokubili okuthatha indawo yombiko wekhasimende ngokwalo. Akukho mkhuba okhokhayo, futhi kokubili kufinyeza uphenyo.

Umbuzo wesitifiketi nombuzo wokufinyeleleka kubhalwe ngokwehlukana ngesizathu.

Hlola futhi ngekhasimende langempela, bese ungenelela ngaphakathi

Uma ukulungiswa okuqondile sekusesimweni, zama futhi ngekhasimende le-SSTP langempela kanye nephrofayili yangempela, hhayi ngethebhu yesiphequluli.

rasdial "Corp SSTP" /disconnect
rasdial "Corp SSTP" user '*'
Get-VpnConnection -Name "Corp SSTP" | Select-Object ServerAddress, TunnelType, AuthenticationMethod

Uma isikhathi sixhuma kodwa izinsiza zisahluleka, umhubhe awuseyena umsolwa: dlulela ekuhlelweni komzila, i-DNS nokufinyelela kwezinsizakalo. Lokho kungolunye uphenyo olunobunye ubufakazi. Ukugcina izigaba ze-TLS nokuqinisekisa ezisebenzayo kuvimbela ukuba kube ukuphindwa kokokuqala. Bhala kuthikithi isigaba esihlulekile, ngaphandle kwalokho umuntu olandelayo uzoqala phezulu futhi.