Ingabe ukuthuthukiswa kwe-Ubuntu kwehlukanisa i-L2TP/IPsec? Qhathanisa iziphakamiso ze-IKEv1

Uxhumano lwalusebenza ngoLwesine, ukuthuthukiswa kwenziwa ngoLwesihlanu, futhi ngoMsombuluko iklayenti liyazungeza ku “connecting” bese liyeka. I-laptop efanayo, iseva efanayo, i-akhawunti efanayo, ukhiye ofanayo owabiwe ngaphambili. Akukho okushintshiwe kuphrofayela, yingakho abasolwa abagqama, iphasiwedi ne-firewall, bachitha isikhathi sakho.

Okushintshile uhlu lwezinguquko izimashi yakho ezikulungele ukukunikeza. Womabili ama-IPsec stack asetshenziswa ku-Ubuntu, i-strongSwan ne-Libreswan, asusa ama-algorithm abangasaboni ephephile, futhi i-plugin ye-NetworkManager engaphambi kwawo inohlu lwayo, oluhamba ngesimiso sesikhathi esihlukile. Iseva eboshiwe ku-3DES, SHA1 neqembu le-Diffie-Hellman lamabhithi angu-1024 ingagcina ingezwa lutho ekwamukelayo.

Ukuthuthukiswa kushintshe ini ngempela

Izingqimba ezimbili zondla isiphakamiso se-IKEv1. I-daemon iletha isethi yeziphakamiso eziyisisekelo ezifakwe ekuhlanganisweni, futhi i-plugin ye-L2TP iyancika kuyo noma inikeza uhlu lwayo. Ngaphambi kwe-NetworkManager-l2tp 1.2.16 i-plugin yayincika kuyo, ngakho isiphakamiso sakho kwakuyilokho i-daemon efakiwe eyayikubona kunengqondo. Kusukela ku-1.2.16 i-plugin ithumela uhlu olubhaliwe olwenziwe ngokwesibonelo samaklayenti e-Windows ne-Apple, futhi lolo hlu lubanzi kunokwezinsi eziyisisekelo kodwa alusenazo zonke izinhlanganisela zakudala ezisemgqeni wokuqala.

Lokho kwehlukana kuchaza indlela yokuhluleka abantu abayibona idida: imishini emibili kuhlelo olulodwa lwe-Ubuntu ingaziphatha ngendlela ehlukile ngoba enye inephakethe lokusabalalisa kanti enye ine-backport, futhi inguqulo ye-daemon kuzo zombili ibonakala ifana kumbiko wephutha. Hlola inguqulo ye-plugin, hhayi inguqulo ye-daemon kuphela, ngaphambi kokuphetha ngokuthi ukuthuthukiswa akushintshanga lutho oluhambisanayo.

Kunesicu esincane endaweni efanayo. Ama-daemon amabili abhala amaqembu e-Diffie-Hellman ejika eliyindilinga ngendlela ehlukile, elinye libhala ecp384 kanti elinye libhala ecp_384. Namathisela isipelingi esingalungile kudayalogi ye-Advanced futhi i-daemon izokwenqaba ukulungiselelwa njengokungahlaziyekiyo, okubonakala kulogi njengenkinga yezingxoxo hhayi njengephutha lokuthayipha ekulungiselelweni.

Funda ukuhluleka ngaphambi kokushintsha noma yini

Qala ngokuthi iyiphi i-backend oyisebenzisayo, ngoba impendulo inquma kokubili i-syntax nendawo yelogi.

ipsec --version
nmcli connection show "Your VPN name" | grep -i ipsec

Bese ufunda ukushintshana uqobo. Ku-strongSwan i-daemon ibhala ku-journal kunguqulo yamanje naku-/var/log/syslog kunguqulo endala, futhi ingxenye ethakazelisayo isiphakamiso esisithumelayo, hhayi umugqa wokugcina. Ufuna amagama mayelana nokuthi akukho siphakamiso esihambisanayo, okuyinkinga ye-algorithm; ukuhluleka kokuqinisekisa, okukhomba ukhiye noma i-akhawunti; noma isikhathi sokulinda esilula, esikhomba ukufinyeleleka.

Le miphumela emithathu ivame ukuthathwa njengophawu olulodwa. Isikhathi sokulinda esinelogi ye-daemon engenalutho sisho ukuthi amaphakethe awafiki. Ukwenqatshwa kwesiphakamiso kusho ukuthi afikile futhi anqatshwa. Uma ilogi yakho ithule, phakamisa izinga lokususa amaphutha le-plugin kumzamo owodwa bese wehlisa ngemuva kwalokho, ngoba okukhiphayo okuningiliziwe kugcwalisa i-journal ngokushesha.

Isigaba 1 nesigaba 2 kuyizibhejo ezihlukene

I-IKEv1 ixoxisana kabili. Imodi eyinhloko yakha inhlangano yezokuphepha ye-IKE kusukela ku-algorithm yokubethela, i-algorithm yobuqotho, iqembu le-Diffie-Hellman kanye nendlela yokuqinisekisa. Imodi esheshayo bese yakha inhlangano ye-ESP ezothwala i-L2TP. Iseva ikhululekile ukwamukela eyokuqala futhi inqabe eyesibili, ngakho iphrofayela elungile ngengxenye ihluleka kamuva kunalokho okulindele, futhi ibonakala njengenye iphutha.

Phase 1: 3des-sha1-modp1024!
Phase 2: 3des-sha1!

Uphawu lwesibabazo ku-syntax ye-strongSwan lusho umugqa oqinile: nikeza le nhlanganisela eyodwa futhi akukho okunye. Ngaphandle kwalo umugqa ujoyina uhlu lokubuyela emuva, okuhle lapho ozakwethu uyesimanjemanje futhi okungalungile lapho kuyithuluzi elinomgomo owodwa obhalwe ngokuqinile. Thatha lezi zimbili ezingenhla njengesibonelo sesimo, hhayi njengesincomo sanoma yini oyakhayo namuhla.

Shintsha inkambu eyodwa, bese uphinda ukuhlolwa

Ku-plugin yamanje, ukuhlolwa kokuqala okusheshayo ukusula ngokuphelele izinkambu zombili zeziphakamiso bese uxhuma kabusha, ngoba uhlu oluyisisekelo olunikeziwe seluvele lunazo izinhlanganisela ezijwayelekile ze-Windows ne-Apple. Ku-plugin endala, ukuzisula kubuyisela ukulawula ku-daemon okungenzeka ukuthi yashiya i-algorithm iseva yakho ekuphoqayo, futhi ukuhluleka kuba kubi nakakhulu.

Uma ukusula kungasizi, setha izimbili eziqinile iseva yakho ezibhalile, isigaba ngasinye ngasikhathi. Shintsha isigaba 1, xhuma kabusha, futhi ufunde ilogi ngaphambi kokuthinta isigaba 2. Lapho inhlanganisela isisebenza ekugcineni, yibhale phansi eceleni kwemodeli yeseva nenguqulo ye-plugin, ngoba izinto eziyisisekelo zizoshintsha futhi, futhi lelo nothi iyona eyenza ukuthuthukiswa okulandelayo kube ukuhlola kwemizuzu emihlanu.