tls-auth key-direction: u-0 no-1 kufanele kwehluke, hhayi ukufana
Nge-tls-auth iziphetho zombili zidinga izindawo eziphambene, u-0 no-1, noma zombili kufanele zishiye isilungiselelo. Inombolo efanayo iyehluleka, futhi i-tls-crypt ayisebenzisi neze.
Uhlangothi olulodwa lwethumbu lusayina isiteshi sokulawula ngesikhala sokhiye esingakaze sihlolwe kolunye uhlangothi, futhi uxhumano lufa ngephutha lokuqinisekisa ngaphambi kokushintshwa kwesitifiketi esisodwa. Yileyo ndlela ukungafani kwendlela ku-tls-auth okubukeka ngayo, futhi kuqinisekile: lawo mafayela amabili afanayo ayehluleka kuwo wonke umzamo, kunoma iyiphi inethiwekhi. Akukho lutho kurokhi olusho igama lenketho oyifunayo, yingakho abantu bakha kabusha okhiye futhi bakhiphe kabusha izitifiketi ezingakaze zephuke. Isixazululo ukwenza iziphetho zombili zihambisane, noma ukushiya zombili zihamba nhlangothi zombili, hhayi ukwenza buthaka ukuqinisekisa.
Ukwehluleka kwenzeka ngaphambi kwezitifiketi
Nge-tls-auth izinhlangothi zombili ziphethe ukhiye ofanayo owabiwe futhi ngayinye isebenzisa esisodwa sezikhala ezimbili ezisuselwe kuwo: isikhala esisodwa sisayina amaphakethe okulawula aphumayo, esinye siqinisekisa lawo angenayo. Indlela u-0 nendlela u-1 zabela lezo zindima ngokulandelana okuphambene, ngakho-ke umbhangqwana kufanele uhambisane ukuze ukuhlolwa kwe-HMAC kuhambelane. Lapho ukwabiwa kuphendulwa ohlangothini olulodwa, umamukeli ufuna isiginesha esikhathini esingalungile futhi wenqaba iphakethe. Isikhathi sesiphela lapho, yingakho iphutha liphathelene nokuqinisekisa amaphakethe hhayi noma yini isitoreji sezitifiketi esingayikhiqiza.
Ukuqiniseka kubalulekile ekuxilongeni, ngoba inkinga yesikhathi noma yendlela ishiya umkhondo ohlukile: ukunqamuka ngezikhathi, uhlangothi olulodwa lwehluleka, noma isikhathi esifa kuphela kunethiwekhi ethile. Ukungafani kwendlela kwehluleka ekuxhawuliseni kokuqala njalo, futhi kwehluleka ngendlela efanayo kumshini omunye ophethe lawo mafayela amabili afanayo. Funda irokhi ku---verb 4 bese uthola iphakethe lokuqala elenqatshiwe esikhundleni somugqa wokugcina. Uma lokho kwenqatshwa kwenzeka ngaphambi kokushintshwa kwanoma yisiphi isitifiketi, ukhiye owabiwe nendlela yawo yizinto ezimbili okufanele zihlolwe.
| What you see | What it rules out | Next check |
|---|---|---|
| Authentication error before any certificate is sent | The data channel is irrelevant; the control channel never authenticated | Compare tls-auth and its direction on both ends |
| Certificate or handshake failure after the control channel authenticates | The shared key and its direction already agree | Check the CA, the certificate dates and the hostname |
| Session completes but throughput or cipher warnings appear | Direction was never the problem | Compare the data-channel cipher settings |
| Startup stops on an options error | The number itself is not the issue | Re-read the inline versus external directive syntax |
Inombolo ihlala kuphi
Incwadi ye-OpenVPN 2.6 ibhala izindawo ezimbili zendlela: ingxenye yesibili ye-tls-auth lapho ukhiye usefayeleni elake, nomugqa we-key-direction ozimele lapho ukhiye ufakwe kuphrofayela. Kokubili kubeka inani elifanayo, ngakho-ke iphrofayela kufanele isebenzise ifomu elilodwa noma elinye, hhayi kokubili neze. Ukushiya kuyisinqumo futhi, futhi kubeka izinhlangothi zombili ekuhlelweni kwezinhlangothi ezimbili okusebenza lapho kungekho uhlangothi olusho indlela. Izinhlangothi ezimbili ezinombolo efanayo azikho kulokho kuhlelwa: ngayinye ilindele ukusayina esikhathini esisodwa nokuqinisekisa kwesinye, futhi zombili zikwenza ngendlela efanayo.
# server.conf, external key tls-auth ta.key 0 # client.ovpn, external key tls-auth ta.key 1 # client.ovpn, inline key key-direction 1
Ifomu elifakiwe liwumyalelo emugqeni walo, hhayi isici kuthagi yokuvula yesigaba sokhiye, futhi ukwengeza ingxenye kuleyo thagi kuyiphutha, hhayi ukushintsha kwendlela. Indawo nayo ibalulekile: umyalelo ungaphandle kwesigaba okungesaso, ngakho-ke inani elibhalwe ngaphakathi kwesigaba lifundwa njengezinto zokhiye. Kopisha ukuhlelwa obekuhloswe ngumsabalalisi wephrofayela esikhundleni sokuzakhela umbhangqwana, ngoba iphrofayela esebenza ngokumelene neseva eyodwa kungenzeka ukuthi isivele ibonisiwe kolunye uhlangothi.
Okungakuthinti ukukhetha
Akubethelisi ithrafikhi yohlelo lokusebenza. I-tls-auth ibeka i-HMAC ezungeze amaphakethe esiteshi sokulawula, kuyilapho isiteshi sedatha sivikelwe ngokhiye besikhathi okuxoxisanwe ngabo ngesikhathi sokuxhawulana, ngakho-ke umbuzo wokugeleza noma wokubethela awunandlela yokuhlangana nenombolo yendlela. Isilungiselelo asengezi isendlalelo sesibili sokubethela, futhi yilo mbono othumela abantu ukuthi bayofuna ukhiye omude.
Akusebenzi ku-tls-crypt, enye indlela yesiteshi sokulawula enezinketho zayo nokuphathwa kokhiye, futhi akusho lutho mayelana nobunikazi besitifiketi sanoma yiluphi uhlangothi. Ngakho-ke ukuhambelana kwendlela okusebenzayo kuqinisekisa kuphela ukuthi iziphetho zombili ziyavumelana ngendlela yokuqinisekisa isiteshi sokulawula, hhayi ukuthi uchungechunge lokwethembana luqinisekisiwe.
Qondanisa umbhangqwana, bese uxhuma kabusha
Qhathanisa izilungiselelo ezimbili ngaphambi kokushintsha noma yisiphi, ngoba ukuhlela uhlangothi obelulungile kakade kuphinda umsebenzi. I-grep engezansi ikhombisa ukuthi yiliphi ifayela elikhetha iphi indlela; ukusebenza okunemininingwane kukhombisa ukuthi isiteshi sokulawula saqinisekiswa yini nhlobo. Gcina kokubili okuphumayo, ukuze ushintsho olulandelayo luqhathaniswe nesimo esaziwayo.
grep -n -E 'tls-auth|tls-crypt|key-direction' server.conf client.ovpn openvpn --config client.ovpn --verb 4 2>&1 | grep -i -E 'hmac|tls error|control channel'
Qalisa kabusha iziphetho zombili ngemva kwanoma yiluphi ushintsho, ngoba lezi zinketho zifundwa kanye lapho kuqalwa futhi ukulayisha kabusha uhlangothi olulodwa kushiya umbhangqwana ungahambelani isikhathi sonke sokuphila kwesikhathi esidala. Uma ukusetshenziswa kusebenza manje ngaphandle kwendlela elungisiwe, ukwengeza isilungiselelo ohlangothini olulodwa kukhiqiza kabusha ukwehluleka owaqala ngakho; kuyashiywa kokubili noma kulungiswe kokubili. Shintsha isiphetho esisodwa ngesikhathi futhi ugcine ifayela langaphambilini, ukuze ukuhlehla kube ukubuyiselwa kwemizuzu emibili hhayi ukwakhiwa kabusha.
Bhala indlela, ifayela lokhiye nendlela yesiphetho ngasinye kumanothi okusetshenziswa, ngoba uma kungenjalo umuntu olandelayo uzofunda amafayela amabili afanayo futhi acabange ukuthi izinombolo kufanele zihambelane. Indlela iwumininingwane wokuxhumanisa, hhayi ukuthuthukiswa kwezokuphepha: ihlukanisa izindlela ezimbili zesiteshi sokulawulo futhi ayenzi enye into.