TLS VPN ngokumelene ne-IPsec: izinkambu ezinhlanu okufanele zibuyekezwe

Ukuhlunga ama-TLS VPN ngokumelene nama-IPsec VPN ngomndeni weprothokholi kuphendula umbuzo ongazange ubuzwe muntu, futhi ngokuvamile ucaphuna isakhiwo imindeni yomibili eyashiya eminyakeni edlule. Lokho umhloli angakuhlola ngempela ukunakekelwa okuvunyelwene ngakho, ubunikazi bozakwethu, imodeli yeklayenti kanye nensizakalo edaluliwe. Lezi zinto ezine ziyabonakala ekusetshenzisweni, futhi akukho nokukodwa ezivela kulebula yomkhiqizo. Cela izinkambu ezinhlanu futhi ingxoxo iba ecacile.

Izinkambu ezinhlanu, futhi ilebula ayisiyo enye yazo

Inkambu yokuqala ukukhishwa kwesoftware okusekelwayo, ngoba incazelo yeprothokholi engenawo inguqulo iyincwajana yokukhangisa. Eyesibili inguqulo yeprothokholi okuvunyelwene ngayo, enquma ukuthi iziphi izakhiwo ziyatholakala ngisho. Eyesithathu isethi yokuvikela, eyesine indlela yokuqinisekisa kokubili uzakwethu nomsebenzisi, kanti eyesihlanu ububanzi bokufinyelela umkhiqizo okunikeza ngemva kokwamukelwa.

Ilebula le-SSL VPN ihlanganisa okungenani imikhiqizo emithathu ehlukene: iklayenti eliphelele lenethiwekhi, ummeleli wezinhlelo zokusebenza kanye nengosi yendabuko esekelwe kuphequluli. Zidalula izinsizakalo ezihlukene futhi zehluleka ngezindlela ezihlukene, ngakho ilebula ayikwazi ukuthatha indawo yenkambu yobubanzi.

Yini ukubethela okuqinisekisiwe okushintshayo ngempela

I-TLS 1.3 idinga ukubethela okuqinisekisiwe, okususa isakhiwo esidala se-MAC-then-encrypt kuphrothokholi esikhundleni sokushiya singakhethwa. I-IPsec ESP inamasethi okubethela aqinisekisiwe isikhathi eside esifanayo, i-AES-GCM ichazwe kwi-RFC yayo. Kuzo zombili izindlu isiqinisekiso sivela kusethi okuvunyelwene ngayo hhayi egameni lomndeni, yingakho uhlu lwezinkambu luqala ngenguqulo. Umhloli ongakwazi ukusho isethi akanakho angakuhlola.

Yingakho ukuqhathanisa komlando kuduka. Ukusetshenziswa okuboshwe kunguqulo endala ye-TLS enesethi ye-CBC kanye nokunye okusebenza nge-TLS 1.3 enesethi ye-AEAD akusona isimo esifanayo sokuphepha, nakuba kokubili kungama-TLS VPN. Ukuhlukana okufanayo kukhona ohlangothini lwe-IPsec phakathi kwesethi ye-ESP yesimanje nenhlanganisela endala.

Funda amanani okuvunyelwene ngawo hhayi ukuhlela obukuhlose. Imiyalo engezansi ikhombisa lokho iphoyinti lokugcina elisebenzayo kanye nomhubhe osebenzayo abavumelana ngakho ngempela.

openssl s_client -connect vpn.lab.example:443 -tls1_3 -brief
ip xfrm state
swanctl --list-sas

Uma iphoyinti lokugcina lingafuni ukuxoxa nge-TLS 1.3, lokho kuwukutholakala hhayi ukuthanda. Uma umhubhe ubalula isethi obuwungalindele, ukuhlela okubalulekile yilokho abalingani abakukhethile, hhayi lokho okusesifanekisweni.

Ubunikazi bozakwethu umbuzo ohlukile

Ukubethela ngaphandle kozakwethu oqinisekisiwe kuvikela ukuhamba kwedatha kubabukeli futhi kukunikeza lowo ophendule ukuxhumana. Ukuqinisekisa uzakwethu kubuza ukuthi yibuphi ubunikazi obulindelekile, iyiphi impahla yokuthembela eqinisekisa, nokuthi iklayenti lenza kanjani uma impendulo ingafani. Uchungechunge lwesitifiketi, ukhiye oboshelwe kanye nasesifihlweni esabiwe kusengaphambili kuyizimpendulo ezintathu ezihlukene ezinezindleko zokusebenza ezintathu ezihlukene.

Bese ubuza imibuzo efanayo ngomsebenzisi noma idivayisi. Isango eliqinisekisa umshini futhi lamukele noma ubani ongumsebenzisi, noma okuphambene, linesimo esithile okufanele sibhalwe hhayi sicalwe. Izimvume zezinsiza ezisetshenziswa ngemva kokwamukelwa ziyingxenye yenkambu efanayo, ngoba ukuqinisekisa akulona igunya.

Ukugcina ukuhlolwa kwegama lomsingathi nesitifiketi kubaluleke kakhulu kunokujwayeleka kwewindi lokungena. Iklayenti elihlelwe ukunganaki ukuqinisekisa lisuse isinyathelo esisodwa esihlukanisa isango lakho nokulingisa okukholisayo.

Umngcele umkhiqizo oyidalulayo

Ingosi engenakho iklayenti imelela imisebenzi yezinhlelo ezikhethiwe ngokusebenzisa isango, ngakho umsebenzisi ufinyelela isixhumi esibonakalayo hhayi inethiwekhi. Iklayenti lomhubhe ogcwele lithwala lokho okukhethwa yimizila yalo nenqubomgomo yokuhlunga, okuyindawo enkulu kakhulu. Ukuqhathanisa kokubili ngamandla eprothokholi kweqiwe umehluko kulokho umhlaseli angakufinyelela ngakho. Okunye kudalula isixhumi sezinhlelo, okunye kudalula inethiwekhi eqondisiwe, futhi kokubili kudinga ukubuyekezwa okuhlukene.

Buza ukuthi iyiphi insizakalo edaluliwe, imiphi imisebenzi egunyaziwe nokuthi isango ngokwalo lilalela ini. Isixhumi sokuphatha esifinyeleleka ekhelini elifanayo nengosi yomsebenzisi kuwukutholakala kokusetshenziswa, futhi akukho kukhetha kweprothokholi okukukhokhelayo.

Ububanzi bohlobo ngalunye lohlelo lunciphisa indawo, futhi bushintsha nokuziphatha kokwehluleka uma umhubhe uwile. Idizayini ecabanga ukufinyelela komhubhe ogcwele izophuka ngezindlela idizayini yohlelo ngalunye engazazi, futhi umthwalo wokusekela uyalandela.

Nquma umphumela wokwehluleka nomjikelezo wempilo

Okwenzeka uma ukuqinisekisa noma ukuvikela kungatholakali isinqumo senqubomgomo esiyingxenye yokubuyekezwa. Umphumela ovaliwe kanye nokubuyela emuva okuqondile okungamenyezelwanga kunemiphumela ehlukene, futhi umehluko awubonakali ohlwini lwezici. Shono ukuziphatha okuhloswe eduze kwensiza eyivikelayo.

Faka umjikelezo wempilo wamaphakethe nokwesekwa kwesango, izici zalo zangaphandle ezivuliwe kanye nendlela yokubuyekeza yamaklayenti. Ukukhetha iprothokholi okuyikho akukwenzi kuphephe insizakalo esetshenziswe kabi, futhi izigameko eziningi zihlala kulelo gebe hhayi kusethi.

Bhala izinkambu ezinhlanu, inqubomgomo yokwehluleka kanye nomnikazi womjikelezo wempilo ekhasini elilodwa. Lelo khasi ukubuyekezwa; ukuqhathanisa imindeni yeprothokholi umbono.