strongSwan: uhlobo lokhiye, umlayishi kanye ne-backend engalungile

I-PEM iyisitsha, hhayi uhlobo lokhiye. Qhathanisa ukhiye womphakathi wesitifiketi nowangasese, bese uyilayisha nge-backend eyikufunda ngempela.

Izandiso zamafayela azikwazi ukuhlukanisa ama-algorithm okhiye, futhi isigaxa se-.pem singaqukatha into ye-RSA noma ye-ECDSA. I-PEM ichaza ukuthi amabhayithi asongwa kanjani, kuyilapho i-RSA ne-ECDSA zisho ama-algorithm ahlukene, futhi ifayela le-PKCS12 liyenye into futhi. I-strongSwan ilayisha ubufakazi ngezithasiselo kanye ne-backend yokuhlela, ngakho isitifiketi singavela ohlwini kuyilapho ukhiye wangasese ungaze ube usefsebenzisekayo. Hlukanisa lezo zingqimba ngaphambi kokuhlela noma iyiphi imfihlo.

Ukufaka ikhodi, i-algorithm nokupakisha kuyizingqimba ezintathu

Ifayela lokhiye linokufaka ikhodi, i-algorithm futhi ngokuvamile isitsha. I-PEM yisigaxa esijwayelekile se-base64; i-DER ingumlingani wayo kanambambili; i-PKCS12 ihlanganisa isitifiketi nokhiye waso kanye nochungechunge lwaso. Ifayela lochungechunge lwezitifiketi lisesinye isitsha, futhi ngokuvamile alinakho noma yimuphi ukhiye wangasese. Awekho kulawo maculo akhombayo ukuthi into engaphakathi i-RSA noma i-ECDSA.

Funda i-algorithm esetshenzisweni ngokwayo. Igama lokumaketha lomhlinzeki noma isandiso sefayela akusona ubufakazi, ngoba umkhiphi oyedwa angakhipha izinhlobo ezahlukene zokhiye.

Qhathanisa okhiye bomphakathi ngaphambi kokusola umlayishi

Isitifiketi esilayishwayo sifakazela ukuthi isitifiketi sihlaziyiwe, hhayi ukuthi ukhiye waso wangasese ukhona noma uyasebenza. Khipha ukhiye womphakathi esitifiketini nasesikhombisiwe sokhiye wangasese, bese uqhathanisa ama-digest amabili. Uma noma yikuphi ukukhipha kuhluleka, yima lapho, ngoba i-digest yokuphuma okungenalutho ayifakazeli lutho. Ama-digest afanayo afakazela ukuthi ipheya lihambisana, futhi akukho okunye mayelana nokuthi isitifiketi siyafaneleka yini umsebenzi.

openssl x509 -in server.crt -pubkey -noout |
    openssl pkey -pubin -outform DER |
    openssl dgst -sha256

openssl pkey -in server-key.pem -pubout -outform DER |
    openssl dgst -sha256

Umyalo wesibili uthinta into yangasese emshinini wakho kodwa ukhipha kuphela ingxenye yomphakathi. Kugcine kunjalo, futhi ungaze unamathisele ukhiye wangasese kuthikithi. Uma ukhiye ufihliwe, vumela ithuluzi elisekwayo ukuthi libuze umushwana wokugqithisa esikhundleni sokuwubeka emgqeni womyalo lapho uhlu lwezinqubo lungase luwudalule.

I-ipsec.secrets yakudala noma ubufakazi be-swanctl

I-strongSwan inezindlela ezimbili zobufakazi ezisetshenziswa kakhulu. Isitaki sakudala se-starter sifunda amangeno aqondene nohlobo kusukela ipsec.secrets, futhi ingeno ngayinye kufanele isho uhlobo olufanele lwento. Isitaki se-swanctl ne-vici silayisha okhiye kusukela kunkomba yaso yobufakazi ngokuhlela kwaso. Ukuhlela ifayela i-backend esebenzayo engayifundiyo akushintshi lutho.

: ECDSA "/etc/ipsec.d/private/server-key.pem"

Thola ukuthi iyiphi i-backend esebenza ngempela, bese ubeka ukhiye lapho i-backend leyo ibheka khona. incwadi yakudala ye-strongSwan 5.9 ichaza amangeno emfihlo aqondene nohlobo, futhi lokhu akusona isiqondiso se-swanctl. Ukuhlanganisa kokubili kwenza i-daemon elinganakalayo ifayela umlawuli akholelwa ukuthi ligunyaziwe. Ukulayisha kabusha okungabiki iphutha kusho kuphela ukuthi ukuhlela kuhlaziyiwe.

Funda umcimbi wokulayisha nomphumela wokuqinisekisa

Ngemva kokulayisha kabusha okulawulwayo, funda umphumela wokulayisha we-daemon ngokwayo wokhiye othile. Isitifiketi esisohlwini kudampo lesimo asikhombisi ukuthi ukhiye wangasese wahlanganiswa naso.

Uma iklayenti lisahluleka, hlukanisa umcimbi weseva nephutha leklayenti. Ukuqinisekiswa kochungechunge, ukufaniswa kobunikazi kanye nokuhambisana kwezindlela yimibuzo yakamuva enobufakazi bayo. Bhala umphumela ngendlela efanele yokhiye kanye ne-digest oyiqhathanisile, ngoba uma kungenjalo ishifti elilandelayo lizophinda ukulayisha okufanayo. Ukushintsha i-CA akusona isisombululo sokuqala sokungafani komlayishi.

Izihloko ezihlobene