Yini empeleni evikelayo i-phrase yokungena kukhiye oyimfihlo we-VPN

Isicelo esivela lapho iklayenti le-VPN liqala kulula ukusifunda kabi. Akulona iphasiwedi ye-akhawunti ye-VPN, akulona iphasiwedi yethuneli, futhi ukusifaka akufakazeli ukuthi uxhumano luvikelekile. Livula isethulo esisodwa esigciniwe sokhiye oyimfihlo ukuze iklayenti likwazi ukufunda impahla yokhiye futhi liyisebenzisele ukuqinisekisa. Konke okwenzeka ngemva kwalokho kuwumbuzo ohlukile.

Empeleni impendulo iphambana emaphethelweni: abantu bacabanga ukuthi i-phrase yokungena ivikela ithuneli esebenzayo, noma ukuthi ukuyishintsha kususa ikhophi yokhiye osekuvele saphuma. Zombili izicabango ziyahluleka, futhi zombili ziyahluleka ngendlela eshiya imininingwane yokungena iveziwe kuyilapho umsebenzisi ekholelwa ukuthi isibhekiwe.

Ingxoxo eyodwa, izimfihlo eziningana ezihlukene

I-phrase yokungena yokhiye oyimfihlo isusa ukubethela kwefayela. Iphasiwedi ye-akhawunti ikufakazela kusevisi. Iphasiwedi yokungenisa ye-PKCS#12 isusa ukubethela kwengxenye equkethe ukhiye nesitifiketi sawo, futhi kungenzeka ukuthi akuwona umucu ofanayo ne-phrase yokungena yokhiye uqobo. Lezi zicelo zingabonakala zicishe zifane, futhi ukuqagela ukuthi iyiphi imfihlo iyaphi yikho okwenza okhiye bagcine benamathele emkhakheni ongafanele.

Ukubethela kwethuneli uqobo kuyinto yesine. Isiteshi sedatha sisebenzisa okhiye besikhathi abaxoxelwane ngesikhathi sokuxhawulana; i-phrase yokungena yokhiye oyimfihlo ayinayo indima ekuvikeleni amaphakethe ngamanye. Uma othile engakwazi ukufunda ifayela lokhiye, angazama ukuqagela i-phrase yokungena ngaphandle kwenethiwekhi, kodwa uma engakwazi ukufunda amaphakethe, i-phrase yokungena ayinamsebenzi.

Ukubethela kudiski kuhlanganisa ini

Ukhiye we-PEM obethelwe uza ngezimo ezimbili, futhi isihloko sikutshela ukuthi unesiphi. Isimo sesimanjemanje se-PKCS#8 siqala nge------BEGIN ENCRYPTED PRIVATE KEY-----; isimo esidala se-PEM, esisetshenziswa kakhulu kuzilungiselelo zakudala ze-OpenVPN, siqala nge------BEGIN RSA PRIVATE KEY----- futhi sithwala i-Proc-Type: 4,ENCRYPTED kanye nomugqa we-DEK-Info ngqo ngaphansi kwawo. Ifayela ligcina ukhiye oyimfihlo ubethelwe ngaphansi kokhiye osuselwe ku-phrase yakho yokungena, ngokuvamile nge-KDF esekelwe kwiphasiwedi enenani elishiwo lokuphindaphinda noma isici somsebenzi. Amadokhumenti e-OpenSSL pkey ahlanganisa izimo nezinketho ze-phrase yokungena ezisebenza lapho kufundwa.

Imiphumela emibili iyalandela. I-phrase yokungena ebuthakathaka ingahlaselwa ngaphandle kwenethiwekhi ngezinga elivunyelwe yi-KDF, ngakho izimvume zefayela nokufinyelela kumakhophi asekelayo kusabalulekile ngisho nalapho ifayela libethelwe. Futhi umhlaseli othola ifayela kuphela ngaphandle kwe-phrase yokungena kufanele aqagele; lowo othola ifayela ne-phrase yokungena unokhiye, kanye njengokungathi wawungakaze ubethelwe.

head -3 vpn.key
openssl pkey -in vpn.key -noout -pubout
openssl pkcs12 -in bundle.p12 -info -noout

head -3 ikhombisa isihloko futhi, kufayela elidala, imigqa ye-Proc-Type ne-DEK-Info efakazela ukubethela; umugqa owodwa awusona ubufakazi kunoma yiluphi uhlangothi. Umugqa we-pkey ucela i-phrase yokungena futhi uprinta kuphela ingxenye yomphakathi, okufakazela ukuthi ifayela ne-phrase yokungena ziyasebenza ngaphandle kokudalula ukhiye oyimfihlo. Ungasebenzisi i--text kulokho kuhlola: iprinta izingxenye eziyimfihlo, i-privateExponent, i-prime1, i-prime2 nokunye, futhi lokho kuphuma akufanele kunanyathiselwe noma kuphi, hhayi kutikithi, engxoxweni noma kulogi. Umyalo we-PKCS#12 futhi ukutshela ukuthi ingxenye inephasiwedi ye-MAC noma yokubethela ehlukile yini, okufanele ukwazi ngaphambi kokuyinika ozakwenu.

Okushiye ukuvikela lapho ukhiye usulayishiwe

Ukuvula kuyisigameko sendlela eyodwa kuleyo nqubo. Iklayenti licela ukhiye ku-KDF, lisusa ukubethela kwefayela, futhi ligcina ukhiye oyimfihlo enkumbulweni isikhathi esidingekayo. Kusukela ngalowo mzuzu i-phrase yokungena ayivikeli lutho mayelana nesikhathi esisebenzayo: hhayi inkumbulo yenqubo, hhayi idumpu yenkaba, hhayi isikhathi sokulungisa amaphutha esixhunywe kuklayenti, futhi hhayi ikhophi yasekelayo yomshini ethathwe ngesikhathi ukhiye usetshenziswa.

Lona umngcele ofanayo nokhiye we-SSH one-phrase yokungena, noma isigcina-mali esivuliwe somphathi wamaphasiwedi. Kukhulisa izindleko zokweba ifayela lapho liphumule futhi akwenzi lutho ngokumelene nesofthiwe enonya esebenza njengomsebenzisi wakho, uhlelo olugunyaziwe olucela iklayenti ukuthi lisayine, noma umphathi ongafunda inkumbulo. Kubheke njengengqimba eyodwa, hhayi njengokulawula okwenza ukhiye uphephe ukushiywa lapho.

Kungani isicelo sibuya njalo

Iklayenti elibuza futhi njalo lapho lixhuma kabusha akudingekile ukuthi libe liphukile. Amanye amaklayenti agcina i-phrase yokungena kukhashi yesikhathi, amanye ayigcina kuchungechunge lokhiye lwe-OS, futhi amanye angasetshenziswa aqondiswe kumsizi oyinikezayo, ngakho indlela ozithola ngayo incike kuklayenti nasemisebenzisaneni yalo, hhayi kufayela lokhiye.

Uma isicelo esiphindayo siyisikhalazo sangempela, hlola izinketho zekhashi nokuqinisekisa zeklayenti ngaphambi kokususa ukubethela kukhiye. Ukususa i-phrase yokungena kuguqula ifayela elivikelwe libe ukhiye wombhalo ocacile, futhi ukuxhuma kabusha kuthula ngezindleko zokulawula okuphumule kuphela owawunakho. Impendulo engcono ngokuvamile iyisitolo semininingwane yokungena esekelwayo esinezimvume zefayela ofanayo obuzozisebenzisa noma kunjalo.

Ukulahleka nokuvezwa akusona isisombululo esisodwa

I-phrase yokungena elahlekile ayikwazi ukubuyiswa kusitifiketi. Isitifiketi siyimpahla yomphakathi ehlanganisa igama nokhiye; asinayo indlela ebuyela kukhiye oyimfihlo futhi asinayo inkomba nge-phrase yokungena. Izinketho ezingokoqobo yikhophi yasekelayo egunyaziwe yokhiye, noma ubunikazi obusha obukhishwe ngenqubo evamile yomsebenzisi. Noma ubani ophakamisa 'ukubuyisela' i-phrase yokungena uphakamisa ukuyiqagela.

Ukuvezwa kudinga impendulo ehlukile. Ukubethela kabusha ukhiye ofanayo nge-phrase yokungena entsha kushiya impahla yokhiye ingashintshile, ngakho ikhophi esivele yavulwa kwenye indawo isasebenza. Isisombululo ukuhoxisa noma ukushintsha imininingwane yokungena: khipha ukhiye nesitifiketi esisha, sabela, futhi uthatha umhlalaphansi kwesidala kumlingani. Kuze kube yilapho, ukushintsha iphasiwedi yefayela kuwumsebenzi wasekhaya, hhayi ukuvimba. Gcina ifayela elidala ngaphandle kwamakhophi asekelayo kuphela ngemva kokuqinisekiswa ukuthi ubunikazi obusha buyasebenza, futhi bhala ukuthi iyiphi inombolo yokulandelana noma umnyatselo wezwane oyithathe indawo.