Iphirosesi ye-VPN ethintekayo yilokho kutholakala kobuthakathaka?

Umiphumela wesihloli usho ikheli, imbobo kanye nento okwavunyelwana ngayo lapho. Awusho inqubo engemuva kwaleso socket, futhi kumtshina we-VPN izinqubo eziningi zingabelana ngomshini kuyilapho eyodwa kuphela yazo iwumhubhe. Ukufunda umucu wenguqulo kusuka kuthuluzi lohlangothi noma ukuthola ifayela lomtapo wolwazi kudiski kunezela ubufakazi mayelana nomsingathi, hhayi mayelana nesilaleli. Okutholakele kuba nokwenzeka kuphela lapho kuxhunywa engxenyeni eyodwa esebenzayo bese kuqondaniswa nobubanzi isaziso esibusho ngempela.

Ukulandelana kubalulekile: ingxenye kuqala, isaziso sesibili, ukulungisa kwesithathu.

Umbiko usho imbobo, hhayi uhlelo

Qala endaweni yokugcina eyahlolwa ngempela. Ukuhlola kwimbobo yokuphatha ye-HTTPS kwalinganisa insizakalo yewebhu, isitaki sayo se-TLS kanye nanoma iyiphi i-proxy engaphambili kwayo; akufundanga lutho mayelana nesilaleli se-OpenVPN noma i-WireGuard kwelinye imbobo. Ama-proxy aphambukayo nama-ejenti okuphatha kukhulisa lokhu, ngoba isitifiketi nebhanela kungase kube sezingeni langaphambili kuyilapho umtapo wolwazi obuthakathaka ulele ngemuva kwayo enqubweni yangemuva.

Qopha indawo ekuyiwa kuyo, ukuthutha, imbobo negama lensizakalo kanye nomphumela ukuze ububanzi buhambe nokutholakele.

Yini ngempela ukwakhiwa okusebenzayo

Kumsingathi wenjongo evamile, iphakheji efakiwe kanye nomtapo wolwazi olayishiwe kuyimibuzo emibili ehlukene. Isisekelo sedatha samaphakheji singabala inguqulo eboshiwe kuyilapho idemon esebenza isikhathi eside isabambe into eyabiwe endala ememorini, futhi isithombe sedivayisi esiboshiwe singathwala imitapo yolwazi yaso uqobo okungekho mqedisi wamaphakheji oyibikayo. Buza umphathi wensizakalo ukuthi yini esebenzayo, bese uhlola inqubo nokuxhumana kwayo.

systemctl status openvpn-server@server --no-pager
ps -o pid,lstart,args -C openvpn
ss -lntup | grep -E '1194|443'
dpkg -l | grep -i -E 'openvpn|libssl'
ldd "$(command -v openvpn)" | grep -i ssl

Isikhathi sokuqala kuhlu lwezinqubo yimininingwane abantu abayishiyayo. Idemon eqalwe ngaphambi kokuthuthukiswa kwephakheji yokugcina isasebenza ngokwakhiwa eyakulayisha ngesikhathi sokuqalisa, futhi lesi yisimo lapho uhlu luthi kulungisiwe kanti i-socket ithi okunye.

Ukuqondanisa ukwakhiwa nobubanzi besaziso

Izaziso zichaza imikhiqizo, izinguqulo futhi ngezinye izikhathi izimo ezidingekayo, futhi lezo zinkambu ezintathu azihlali zihambisana nenguqulo yephakheji. Isaziso se-Heartbleed se-OpenVPN sango-April 2014 siyisibonelo somlando esiwusizo ngoba sihlukanisa izinguqulo ze-Access Server ezithintekile ezinsizakalweni zewebhu namademon e-VPN, ezazinokuchayeka okuhlukile. Isifundo ukufunda ukuthi yiluphi uhlangothi olumbozwa umbhalo esikhundleni sokuqondanisa igama elithi OpenSSL ngendlela.

Leso saziso naso sidlulelwe yisikhathi. Izinombolo zaso zokukhishwa eziboshiwe aziseyona iseluleko sokufaka manje, futhi iphutha elalungiswa ngo-2014 alisho lutho mayelana nezinkinga zakamuva egatsheni olisebenzisayo namuhla.

Ukuxazulula ukungavumelani, bese uvala ukuchayeka

Lapho uhlu nokuhlolwa kungavumelani, hlola ukuthi kokubili kuchaza indawo yokugcina efanayo nesimo sokusebenza esifanayo: elinye ikheli, i-proxy yangaphambili, insizakalo yesibili, inqubo endala esaboshelwe embobeni, noma umtapo wolwazi oboshiwe umqedisi wamaphakheji angakaze awubone. Xazulula lokho emngceleni ngaphambi kokubhala kabusha umbiko.

Sebenzisa ukulungiswa okusekelwayo, qalisa kabusha insizakalo ethintekile futhi qinisekisa ukuthi ukwakhiwa okusha yikho manje okusebenzayo. Ifayela eliboshiwe kudiski kuyilapho inqubo endala isahlinzeka ithrafiki akulona ukulungiswa.

Bese ubhekana nalokho ingxenye okungenzeka yayikubambe phakathi nesikhathi sokuchayeka. Ukubopha nokushintsha izifakaziso kuyaphendula imibuzo ehlukene, futhi isitifiketi esigcinwe eduze komsingathi othintekile akulona ngokwaso uhlu lwalokho okuvuzelekile. Landela inqubo yomnikazi wesigameko yokuhoxiswa, ukususwa kwemihlangano nokubuyekezwa kwamaklayenti, futhi uqophe ukuthi iyiphi ingxenye ethintekile, kungani ubufakazi babusebenza nokuthi yini eyayivala. Lelo rekhodi yilona olizofundwa ukubuyekezwa kwakamuva.