I-Visual Studio inensa kuphela ku-VPN? Hlola i-CRL ne-OCSP

I-Visual Studio iqala ngokujwayelekile ekhaya, bese kuthi i-laptop efanayo ijoyine umhubhe wenkampani futhi konke ukuqalisa kuma isigamu seminithi esikrinini sokuqala. Susa inqubomgomo bese nokubambezeleka kuhamba nayo; susa umhubhe bese kwenzeka into efanayo. Kokubili ukubona kuqondile, yingakho izingxenye ezimbili zihlala zisola enye enye. Umbuzo onqumayo ukuthi ngabe umbuzo wokukhansela isitifiketi ulinde indlela enikezwa umhubhe kuphela, noma awuyitholi nhlobo.

Kala ukulanda, hhayi ukuqalisa

Inqubomgomo WDAC, esetshenziswe njenge SiPolicy.p7b esayiniwe, inquma ukuthi yiziphi izithombe ezingagijima emshinini. Ubuqotho bekhodi buqinisekisa uchungechunge lwesiginesha sesithombe ngaphambi kokusebenza, futhi lokho kuqinisekisa kungase kuhlanganise umbuzo wokukhansela. Impendulo incike endaweni yokusabalalisa ye-CRL noma kusiphenduli se-OCSP isitifiketi esikushoyo ngaphakathi kwaso.

Lezi yizicelo zezokuxhumana ezijwayelekile, ngakho izindleko zazo zincike ekutheni isiphenduli sikuphi. Uma sifinyeleleka kuphela ngomhubhe, noma igama laso lixazululwa kuphela ngesiphakeli se-DNS esingemuva komhubhe, ukuqinisekisa kulinda umhubhe ukuthi ulungele. I-Visual Studio ilayisha izinhlanganisela nezandiso eziningi ezisayiniwe lapho iqala, futhi ukubambezeleka okuncane kwesithombe ngasinye kuba ukuma okubonakalayo. Akukho okonakele futhi inqubomgomo iziphatha ngqo njengoba ilungisiwe, yingakho kususa inqubomgomo kubonakala kuxazulula inkinga.

Isithombe ngasinye esisayiniwe singadala ucingo lwezokuxhumana

Qala ngefayela le-binary elisayiniwe eselivele likhona kudiski futhi ucele ipulatifomu ukuthi iliqinisekise ngendlela efanayo yokulanda esetshenziswa ukuqalisa. Gijimisa umyalo kanye emhubheni nokanye ngaphandle kwawo, bese uqhathanisa imigqa yokulanda esikhundleni sesinqumo sokugcina.

certutil -verify -urlfetch C:\Tools\Contoso.Editor.dll
nslookup ocsp.contoso.example
Test-NetConnection ocsp.contoso.example -Port 80

Umphumela ubala uchungechunge, amakheli e-CRL ne-OCSP nokuthi ukulanda ngakunye kuphumelele yini. Isiphenduli esiphelelwa isikhathi emhubheni futhi siphendule ngaphandle kwawo siwubufakazi obudingayo, futhi sinesisindo esikhulu kunomuzwa wokunensa. Uma ukulanda kuphumelela ngokunensa, bhala ikheli ukuze isinyathelo esilandelayo sihlole lowo msingathi ngqo.

Xazulula igama lomsingathi wesiphenduli futhi uhlole ukufinyeleleka ngaphandle kohlelo, ngoba igama elingaxazululeki ngeke lilungiswe yisilungiselelo sabanu. Ilogi yokusebenza ye-CodeIntegrity inikeza enye ingxenye yobufakazi, ixhumanisa isigameko sokuqinisekisa nesitembu sesikhathi sokuqalisa okunensa.

Finyeza ukubambezeleka ngaphandle kokususa ukulawula

Ukukhulisa inqubomgomo noma ukuyishintsha ibe yimodi yokuhlola kususa ukubambezeleka futhi kususa ukulawula okusetshenziswe inhlangano, ngakho kuthatha njengokulungisa okungalungile. Izinketho eziwumngcingo wukushintsha umzila ukuze isiphenduli sifinyeleleke ngomhubhe, ukukhishwa emhubheni ohlukanisiwe wabasingathi besiphenduli, ukulungiswa kwe-DNS lapho igama lixazululeka likhombisa ikheli elingafinyeleleki, noma ummeleli wesikhashana osekelwe wedatha yokukhansela. Ngakunye kunomnini ohlukile: ithimba le-PKI liphethe ukufinyeleleka kwesiphenduli, ithimba lezokuxhumana liphethe ukuhlukaniswa komhubhe futhi ithimba lezindawo zokugcina liphethe inqubomgomo.

Ukukhishwa kwawo wonke umsingathi wokukhansela emhubheni akuphephile ngokuzenzakalela, ngoba isiphenduli sangaphakathi singase sibe sangaphakathi ngamabomu. Qinisekisa ukukhishwa nethimba elisebenza nge-PKI ngaphambi kokubhala umthetho othumela ukuhlolwa kwezitifiketi ku-inthanethi yomphakathi buthule. Ushintsho olwenziwe ngaphandle kwalokho kuqinisekisa ulohlobo olubuyiselwa emuva ekuhlaziyweni okulandelayo kwenqubomgomo.

Qinisekisa ukuqalisa okubandayo ngemuva koshintsho

Kala ukuqalisa okubandayo kuzo zombili izimo futhi gcina izinombolo, ngoba ukuqalisa okufudumele akufakazeli cishe lutho uma izinhlanganisela zisekhasini lesikhashana. Phinda ukuqalisa kusuka kuseshini entsha ukuze indlela yokulayisha izandiso isetshenziswe futhi.

Get-WinEvent -LogName Microsoft-Windows-CodeIntegrity/Operational -MaxEvents 40 |
  Where-Object { $_.TimeCreated -gt (Get-Date).AddMinutes(-10) }
Get-ChildItem C:\Windows\System32\CodeIntegrity\CiPolicies\Active
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

Ukuhlelwa okulungisiwe kusaxhumana nesiphenduli, noma kusebenzisa indlela yekhasini lesikhashana evunyelwe ithimba lakho le-PKI, futhi ilogi ikhombisa ukuqinisekisa kucwalisa esikhundleni sokuphelelwa isikhathi. Qinisekisa ukuthi uhlelo olusayiniwe kamuva lusaqala, ngoba inqubomgomo evumela konke ayikona ukulungiswa okuphumelelayo. Hlola futhi ifolda yenqubomgomo esebenzayo nesimo sokuphoqelela, ukuze kwaziwe ukuthi inqubomgomo oyilungisayo iyona esebenzayo. Gcina uchungechunge lwezitifiketi, ikheli lesiphenduli nezitembu zesikhathi zokuqalisa kwithikithi elilodwa, ngoba ukuvuselela kuvame ukuhambisa isiphenduli futhi kushiye umthetho wokukhishwa noma we-DNS usudlule isikhathi.