Ukulandelela amaphakethe okulawula e-OpenVPN: tls-auth ngaphambi kwe-TLS

Ukwehluleka kwe-tls-auth kuvame ukubikwa njengenkinga ye-handshake, nakuba kungakaze kube njalo. I-HMAC ihlolwa kuphakethe lokulawula ngaphambi kokuba noma yikuphi ukucutshungulwa kwe-TLS kwenzeke, ngakho ukhiye noma ingqondo engahambisani kukhiqiza ukwehluleka okubonakala njengenkinga yesitifiketi futhi kunqunywa izingqimba ezimbili ngaphambili. Ukubheka i-envelope njengento yayo kufinyeza ukuxilongwa: funda izinkambu, qinisekisa ukuthi ukuhlolwa kwenzeka kusenesikhathi, bese uqhathanisa izinto ezintathu okumele zombili iziphetho zivumelane ngazo.

Funda i-envelope ngokulandelana eyakhiwa ngakho

Iphakethe lokulawula liphethe isihlonzi sesikhathi, i-tls-auth HMAC yokuzikhethela, ulwazi lokuphinda nokuvuma, kanye nesihlonzi somyalezo esithembekile, bese kulandela umthwalo wohlu lomyalezo. Uma umyalezo kuwumyalezo we-handshake, umthwalo uba umbhalo oguquliwe we-TLS. Lobu bonke ubudlelwano: izinto ze-TLS zihamba ngaphakathi komyalezo i-envelope esivele iyivikela. Bheka isihlahla somthetho wenethiwekhi we-OpenVPN esibala izinkambu zeshubhu lokulawula ngalolo kulandelana.

Izingqimba zokwethembeka kulula ukuzidida nobucikili. Ukuvuma, ukuthumela futhi kanye nesihlonzi somyalezo kukhona ukuze imiyalezo yokulawula ifike kanye nangokulandelana phezu kokuthutha okungathembekile. Akuzona ukuqinisekisa, futhi isihlonzi somyalezo esifanele asifakazi lutho mayelana nokuthi ngubani othumele iphakethe.

Gcina leli qembu lingumqondo. Akusona isithombe sokulandelana kwamabhayithi, futhi akwanele ukubala ithegi, ngoba izinkambu ezingena ku-HMAC zincike ekusetshenzisweni, enguqulweni kanye nemodi.

Khombisa ukuthi ukuhlolwa kwenzeka ngaphambi kwe-handshake

Umamukeli ophethe ukhiye owabiwe angakwazi ukuqinisekisa i-HMAC futhi alahle ngokushesha iphakethe lokukhohlisa, ngaphandle kokwaba isimo se-handshake noma ukwenza umsebenzi wokhiye womphakathi. Ukuvikelwa kuhlanganisa namaphakethe okuqala e-handshake, yikho lokho ukhiye ongalungile ubonakala njengokuxhumana okwehlulekile hhayi njengephutha lokuqinisekisa elisemuva.

Khuphuka ukukhuluma kwe-daemon futhi ubheke ishubhu lokulawula esikhundleni sedivayisi ye-tun:

openvpn --config /etc/openvpn/server.conf --verb 6

Lokho okufunayo ukwehluleka kokuqinisekiswa kwe-HMAC kweshubhu lokulawula okubikwa ezingeni lamaphakethe, ngaphambi kwanoma yisiphi isexwayiso se-TLS. Isexwayiso se-TLS kusigcawu sisho ukuthi i-envelope yamukelwa futhi ukwehluleka kwagxumela ngaphakathi, okuwuphenyo olunye ngesixazululo esinye.

Ukuphathwa kwengqondo kukhona futhi lapha. Uma ifayela lokhiye elingashintshi lisetshenziswa ne-tls-auth, iziphetho ezimbili zithatha izinkombandlela zokhiye eziphambene, futhi umthetho usebenzisa lokho kwehlukanisa ukuze iphakethe elibanjiwe lingakwazi ukubuyiselwa emuva kumthumeli walo. Ukuphendula ingqondo kugcina ukhiye ufana futhi nokho wonke amaphakethe ayahluleka. Shintsha isiphetho esisodwa ngesikhathi, bese uqala kabusha ama-daemon womabili ukuze ipheya lilayishwe ndawonye.

Qondanisa ukhiye, ingqondo kanye ne-digest kuzo zombili iziphetho

Amanani amathathu kumele avumelane futhi eyodwa kuphela yawo iyifayela. Okuqukethwe kukhiye ongashintshi kumele kufane kuzo zombili iziphetho, ingqondo kumele iphambane, futhi i-digest esetshenziselwa i-HMAC kumele ihambisane. Hlola ukulungiselelwa ngaphambi kokuthinta into yokhiye, ngoba ingqondo eyodwa ephenduliwe ichaza ukwehluleka okuningi kunefayela elonakele:

grep -E 'tls-auth|tls-crypt|key-direction|auth ' /etc/openvpn/server.conf

Dala imfihlo eyabiwe ngethuluzi hhayi ngomhleli, futhi gcina izimvume ziqinile:

openvpn --genkey secret /etc/openvpn/ta.key
chmod 600 /etc/openvpn/ta.key

Izinguqulo ezindala zamukela ukulandelana kwezinketho okwehluke kancane kokwakha ukhiye, futhi amaphrofayili abhalelwe lezo zinguqulo asajikelezayo. Ifayela elidalwe liwuhlobo olufanayo lwento kuzo zombili izimo, ngakho ukuhlolwa ukuthi iziphetho zombili zinamabhayithi afanayo yini, hhayi ukuthi isipelingi sini esiwadalile.

Ungadidi i-tls-auth ne-tls-crypt. Zombili zivikela ishubhu lokulawula, kodwa i-tls-crypt iyibethela futhi ifihla i-handshake kubabukeli, futhi ishintsha ukwehlukanisa kwengqondo ngokuphatha kwayo ukhiye. Iphrofayili esebenzisa okukodwa ngeke isebenzisane nozakwabo olungiselelwe okunye, futhi akukho ukulungisa kwe-digest okuvala lelo gebe.

Phinda udale ithegi kusukela efomeni yangempela kuphela

Ukukhiqiza kabusha okunemba ngebhayithi kuwumsebenzi ohlukile ekusebenziseni i-VPN, futhi kusebenza kuphela ngokufakwayo kwangempela: ukusetshenziswa nenguqulo eyakha iphakethe, i-digest ekhethiwe, ingqondo, kanye namabhayithi angempela kuhlanganise nesihlonzi sesikhathi kanye nohlu lokuvuma. Ukwethulwa kombhalo kohlu lwezinkambu akusiwo lawo mabhayithi.

Ubude bethegi bulandela i-digest, ngakho umcabango wobude obugxilile uyaphuka ngesikhathi othile eyishintsha. Hasha iphakethe ngendlela okwenza ngayo ukusetshenziswa, hhayi ngendlela ithebula elikuposi ye-blog eliyethula ngayo, futhi uqhathanise nokuthwebuliwe okuthathwe kuzakwabo ofanayo hhayi nokulindelwe othole ngokwakho ngesandla.

Gcina lesi sifundo kude namaphrofayili okukhiqiza. Akukho lutho ekukhiqizeni kabusha ithegi okutshela ukuthi ukusetshenziswa kumele kuvule ukuvikelwa yini.

Buyisela emuva ukungahambisani ngaphandle kokususa ukuvikelwa

Isivivinyo esilingayo ukususa i-tls-auth, ubone ukuxhumana kuphumelela bese uphetha ngokuthi ukhiye wawungalungile. Leyo mpendulo ikulahlekisela ukuvikelwa futhi ayikufundisi lutho mayelana nokuthi iliphi kulawa manani amathathu elingavumelananga. Esikhundleni salokho, thola ukulungiselelwa okuhambisanayo okuvunyiwe okuvela ohlangothini lweseva bese uqhathanisa nakho.

Lungiselela ushintsho ukuze lukwazi ukubuyiselwa. Gcina ukulungiselelwa kweseva yangaphambili kanye nefayela lokhiye, sebenzisa ipheya elilungisiwe, qinisekisa ukuthi iklayenti liqeda i-handshake, bese kuthi ngemva kwalokho ususe isipele. Uma amaklayenti ehluleka ngemva koshintsho, buyisela amafayela angaphambili esikhundleni sokwakha okunye okwesithathu ngesikhathi sokuphazamiseka. Ukubuyisela kumele kube umyalo owodwa osewukwazi ngaphambi kokuba uqale.

Ekugcineni, khumbula okushiwo ukuhlolwa okuphumelele. Kuqinisekisa ukuthi uzakwabo unokhiye owabiwe, hhayi ukuthi isitifiketi sakhe noma i-akhawunti yakhe igunyaziwe, futhi akusho lutho mayelana ne-cipher yeshubhu ledatha okuxoxisanwe ngayo. Ukugunyazwa nokuvikelwa kwedatha kusungulwa kamuva, ngakho ukuhlolwa kwe-envelope okuhlanzekile kuyisiqalo hhayi isigwebo.