Okufakazelwa isicaciso sephrothokholi ye-VPN nokungakufakazeli

Idokhumenti yephrothokholi iyisivumelwano phakathi kokuqaliswa, futhi ukuyifunda ngokucophelela kukutshela ukuthi izinhlangothi ezimbili ezihambisana zizoshintshana ngani nokuthi yiziphi izici abaklami ababehlose ukuqinisekisa. Kodwa akukutsheli ukuthi iyiphi ifayela le-binary elisebenza kuseva ohlangana nayo, ukuthi leyoseva yalungiselelwa kanjani noma ukuthi kwenzekani kamuva kurekhodi ye-akhawunti yakho. Lezi yizinhlobo ezintathu ezahlukene zobufakazi, futhi ukuthatha isicaciso njengazo zontathu kuyindlela igama lephrothokholi eliqala ukwenza umsebenzi elingakwazi ukuwenza. Ukwehlukanisa lezi zintathu kuwukuzivocavoca konke.

Idokhumenti iwukuqala kwengxoxo, hhayi isiphetho sayo.

Isicaciso sichaza ini ngempela

Ku-WireGuard, incazelo yephrothokholi ichaza ukuxhawulana kwe-Noise IK, iqoqo eliqinile lama-primitive, izakhiwo zemiyalezo kanye nokufakwa kwezingaba ezithwala amaphakethe kamuva. Ku-IKEv2 idokhumenti efanayo yi-RFC 7296, echaza ukushintshana, imithwalo kanye nokuxoxisana ngeziphakamiso. Kuzo zombili izimo ububanzi bunembile: imiyalezo, umshini wesimo kanye nokuqagela okusebenza ngaphansi kwako izinhloso zokuphepha.

Izindlela zokuzikhethela zenza ukufunda kube nzima. Isici esisebenza ekuxhawulaneni okukodwa kungenzeka singasebenzi ekusetshenzisweni okunohlelo oluhlukile lokuqinisekisa noma ukulungiselelwa kwe-fallback.

Lapho iziqinisekiso ziphela khona

Ukuhlaziya okusemthethweni kuphendula umbuzo mayelana nemodeli. Umsebenzi wokuqinisekisa we-WireGuard usebenzisa imodeli yezimpawu ku-Tamarin prover, engabonisa ukuthi umklamo umelana nokuhlaselwa okuthile ngaphansi kokuqagela kwawo; awubonisi ukuthi ukuqaliswa okuhanjisiwe endaweni yomsebenzisi akunaphutha lokuphepha kwememori. Kuleli gebe phakathi kwemodeli nomshini yilapho izehlakalo zangempela zihlala khona. Ukufunda ubufakazi njengesitifiketi sokuqaliswa kuyiphutha lesigaba.

Imfihlo eqhubekela phambili ikhombisa umngcele ofanayo. Isici sincike ekubhujisweni kokhiye njengoba iphrothokholi ihlose, futhi lokho kuyisici sokuqaliswa nendawo yaso, hhayi sefomethi yomlayezo. Umklamo ochaza ukususwa awukwazi ukukuphoqelela endaweni ekhipha imemori iye kudiski.

Ukuncika okunezingqimba kwandisa igebe: ilabhulali ye-TLS ngemuva kwethumbu elisekelwe ku-TLS, isixhumanisi se-kernel esisetshenziswa ithumbu endaweni yomsebenzisi, kanye nomkhiqizi wezinombolo ezingahleliwe konke kungaphandle kombhalo wephrothokholi.

Landela amabhayithi uze ungene ekwakhiweni

Suka edokhumentini uye ezintweni ngokukhomba izinguqulo, bese uziqhathanisa nalokho okusebenzela ithrafikhi ngempela. Umkhiqizo osho iphrothokholi ungangeza izingxenye zokuhlinzeka, i-telemetry kanye nokuphatha isicaciso esingakaze sizichaze.

openvpn --version | head -3
wg --version
dpkg -l | grep -E 'openvpn|wireguard|libssl'
ss -lunp | grep -E '1194|51820'
sha256sum ./wireguard-tools_1.0.20210914_amd64.deb

Ukwakhiwa okungaphindwa kanye nama-checksum ashicilelwe kwenza kube nokwenzeka ukuxhumanisa isihlahla somthombo nefayela le-binary elisatshalaliswa. Ngaphandle kwalokho kuxhumana, umthombo oshicilelwe ufakazela kuphela ukuthi ukuhlola kungenzeka, hhayi ukuthi ifayela elisebenzayo lihambisana nalo.

Ukulungiselelwa kungokwesinyathelo esifanayo. Amaqoqo e-cipher, ozakwethu abavunyelwe kanye nezilungiselelo zomzila kuyizinqumo zokusetshenziswa, futhi ukwakhiwa okuhambisanayo okulungiselelwe ngokunganaki kusakhiqiza ithumbu elibuthakathaka.

Hlukanisa imikhuba yokusebenza

Amarekhodi e-akhawunti, idatha yokukhokha kanye nokuthunyelwa kosizo kuyizinqumo zomqhubi okungekho mbhalo wephrothokholi owubekelayo umkhawulo. Umbiko wokucwaninga uhlanganisa izingxenye eziqanjiwe ngaphakathi kobubanzi obumisiwe, futhi inqubomgomo yobumfihlo ichaza izinhloso nemikhuba; akukho okunye okuthatha indawo yokunye, futhi akukho okunye okuyisitatimende se-cryptography.

Isiphetho esinembile siyahlangana: isicaciso sichaza umklamo, ukwakhiwa nokulungiselelwa kuchaza ithumbu, futhi imikhuba ebhaliwe yomqhubi ichaza konke ithumbu elingakaze likubone. Shono ukuthi yikuphi kwalokhu okukuqinisekisile, futhi isimangalo sihlala siyiqiniso.