Ukhiye oyimfihlo we-VPN kufanele uhlale kuphi: ifayela, CNG noma TPM?

Imibuzo emibili inquma ukuthi ukhiye oyimfihlo we-VPN uhlala kuphi: ingabe impahla yokhiye ingakhotshelwa isuka kusibungazwa, nokuthi ingabe inqubo ingawusebenzisa ngaphandle komuntu osebhodini lokhiye. Ilebele lokuthengisa lesitoreji aliphenduli noma yikuphi kwalokhu. I-daemon yomhubhe okufanele ibuye ngemva kokuqalisa kabusha idinga ukusetshenziswa ngaphandle kokuqapha, okukhipha konke okuncike ku-PIN efakwa umuntu.

Khetha phakathi kokukhopisha nokusebenzisa

Ukukhopisha nokusebenzisa kwehluleka ngendlela ehlukile, ngakho-ke kubheke njengezimfuneko ezimbili, hhayi eyodwa. Umhlaseli ongakwazi ukufunda amabhayithi okhiye uthwala ubunikazi kwenye isibungazwa, futhi umshini wokuqala awuboni. Umhlaseli ongakwazi ukufunda amabhayithi kodwa ofinyelela inqubo yokusayina usaqinisekisa isikhathi sonke lokho kufinyelela kukhona.

Ukhiye osefangileni uyakhotshelwa kalula, yingakho futhi kuwukona okulula ukusekela nokubuyisela. Isitoreji sokhiye sesofthiwe sishintsha i-API, hhayi umngcele: umhlinzeki wenqaba izingcingo zaso zokukhipha, kodwa umongo ofanayo womphathi owafaka ukhiye ngokuvamile unazo ezinye izindlela eziya empahleni. Ukungakwazi ukukhishwa kumhlinzeki wesofthiwe isitatimende ngemisebenzi esekelwayo, hhayi ubufakazi bodonga lwezingxenyekazi. Kuthatha njengesithiyo ekukhopisheni okungazelele, hhayi isivikelo kumuntu osesewatholile isikhathi sakho.

I-TPM noma ikhadi elihlakaniphile lenza umsebenzi wokusayina ngaphakathi kwezingxenyekazi futhi libuyisa umphumela kuphela. Lokho kuvala indlela yokukhopisha futhi kushiya indlela yokusebenzisa ivulekile kunoma yini engacela isiginesha.

Hlanganisa isitoreji ne-daemon yomhubhe

I-daemon ikhawulela lokhu ngaphezu kwenqubomgomo yezokuphepha. I-WireGuard ithatha ukhiye oyimfihlo we-base64 kusuka efayelini noma kumingeni ye-wg set futhi ayinayo indlela eya esitorejini sezitifiketi, ngakho-ke ukhiye wesixhumanisi osekelwa yi-TPM awucatshangelwa. I-OpenVPN eyakhiwe ngokumelene ne-OpenSSL 3 ingalayisha ukhiye nge-URI yomhlinzeki, futhi i-strongSwan ihlinzeka ngesengezo se-TPM eceleni kokusekelwa kwe-PKCS#11, kodwa kokubili kuncike ekutheni iphakethe lakho lahlelwa kanjani.

I-daemon engakwazi ukufinyelela isitoreji esikhethiwe yenza umngcele wezingxenyekazi ube umhlobiso. Othile ukhipha ukhiye kanye, awushiye efayelini, futhi ingxenye esele yedizayini ihamba buthule kulelo khophi.

Ukuvuselela ingxenye yesibili yokuhambisana, futhi yilapho iningi ledizayini liwa khona. Isitoreji esisebenza ekubhaliseni kokuqala kodwa esidinga ukungena kwekhonsoli njalo lapho kukhishwa kabusha siyagwenywa ngokokuqala lapho isitifiketi siphelelwa isikhathi ngehora elingalungile. Hlola indlela yokukhishwa kabusha ngenkathi ukhiye wamanje usenezinyanga.

Bhala uhlu lokhiye ngaphambi kokuwuhambisa

Bhala ukuthi ukhiye uyini nokuthi uhlala kuphi ngaphambi kokushintsha, ngoba ukufuduka okulahlekelwa ama-subject alternative names kwephula umhubhe ngendlela efundwa njengephutha lokuhambisa. Khipha isitifiketi, qinisekisa ukuthi ukhiye oyimfihlo uyafundeka lapho i-daemon ilindele khona, futhi hlola ukuthi ipheya liyafana ngempela.

openssl x509 -in vpn.crt -noout -subject -ext subjectAltName
openssl pkey -in vpn.key -check -noout
openssl x509 -in vpn.crt -noout -pubkey | openssl sha256
openssl pkey -in vpn.key -pubout | openssl sha256

Izifinyezo ezimbili zokugcina kufanele zifane. Uma zingafani, i-daemon iqeda ukusetha bese yehluleka kuwo wonke umzamo ngephutha lesitifiketi noma lesiginesha elingakhomobi ndawo eduze nembangela yangempela. Ukufana kwe-WireGuard kufushane, ngoba ukhiye womphakathi utholakala ngqo kusuka kowangasese: i-wg pubkey < /etc/wireguard/wg0.key kufanele iphrinte ukhiye wozakwethu osevele ugcinwe yiseva yakho.

Izimvume ziyingxenye yohlu olufanayo. I-stat -c '%a %U:%G' /etc/wireguard/wg0.key kufanele ibuyise i-600 root:root, futhi noma yini efundeka yiqembu noma umhlaba isho ukuthi ukhiye wawuvele utholakala ezinqubweni obungakaze uzicabangele.

Hlola isitoreji nendlela yokusebenzisa

Ukuqinisekisa kunezingxenye ezintathu, futhi eyesithathu iyona eyedlulwayo. Qinisekisa ukuthi ukhiye ukhona esitorejini osikhethile, qinisekisa ukuthi i-daemon ilayishe lowo khiye hhayi ikhophi esele, bese uqinisekisa ukuthi isaqala lapho into yokukhipha ingasekho.

certutil -store -user My
certutil -csp "Microsoft Platform Crypto Provider" -key -user
certutil -verifykeys -user My
ipsec listcerts

Ku-Windows umyalo wokuqala ubala isitoreji somuntu siqu futhi uphrinte umhlinzeki wokhiye eceleni komugqa ngamunye, futhi yilapho isitifiketi esibonakala sisekelwa izingxenyekazi kodwa sihlezi kumhlinzeki wesofthiwe sivelayo khona. Owesibili ubala okhiye abagcinwe umhlinzeki we-crypto weplatfomu, ngakho-ke ubunikazi be-VPN obungekho lapho ngenkathi isitifiketi saso sikhona kusho ukuthi ingxenye eyimfihlo ihlala kwenye indawo. Esangweni le-Linux i-ipsec listcerts ibika lokho i-strongSwan ekulayishile, kuhlanganise nokhiye abavela esengezweni se-TPM. Qhathanisa izigxivizo zeminwe noma ama-hash okhiye womphakathi nohlu esikhundleni sokuthemba inani lemigqa.

Ukuhlolwa okungalungile yikho okuqinisekisa idizayini. Hambisa ukhiye okhishiwe ngaphandle kwedirectory yokuhlela ye-daemon, qalisa kabusha isevisi, futhi ufunde kungobo yomlando ukuthi yiluphi ubunikazi olwethulayo. Umhubhe okhuphuka noma kunjalo usebenzisa isitoreji; ukuqalisa okwehlulekile kusho ukuthi idizayini yayigijima kwikhophi ngempela.

Bhala ukuvuselela nokuhlehla

Ukuhlehla kuhluke kakhulu phakathi kwemindeni emibili, futhi lowo mehluko ungowencwadi yedizayini, hhayi ucingo lwesigameko. Ukhiye wefayela ungasekelwa ngokubhalwa kwaso futhi ubuyiselwe, ngakho-ke ukufuduka okwehlulekile kuyabuyiseleka. Ukhiye ongakwazi ukukhishwa awukwazi ukusekelwa nhlobo, okwenza ukukhishwa kabusha nokubhalisa kabusha kube ukuphela kwendlela yokululama lapho idivayisi ifa.

Hlola ukuphelelwa yisikhathi ngaphambi kokuba kube ukuphazamiseka: i-openssl x509 -in vpn.crt -noout -checkend 2592000 iphetha ngekhodi engeyona uziro lapho isitifiketi siphela phakathi kwezinsuku ezingamashumi amathathu, ngakho-ke ingena ngqo ekuhlolweni kokuqapha. Ukugijimisa lowo mugqa masonto onke kubamba ukuvuselela okungazange kuhlelwe muntu.

Ukususa kwenzeka kusevani: susa uzakwethu noma hoxisa inombolo yokulandelana, bese uqinisekisa ukuthi umhubhe wehluleka, ngoba iklayenti elinesikhathi esigciniwe lingafihla ukuhoxiswa okungaphelele isikhashana. Ukuhoxiswa kufanele futhi kufinyelele indlela ye-CRL noma ye-OCSP yesihlanganisi, hhayi idathabheyisi ye-CA kuphela. Isitifiketi siyidokhumenti yomphakathi, futhi i-phrofayili ye-RFC 5280 ihlanganisa indlela esiqinisekiswa ngayo; akukho lutho kulokho kuqinisekisa okukuvikela ukhiye oyimfihlo okhothshwe ngaphambi kokushintshwa.

Bhala isinqumo endaweni eyodwa: yisiphi isitoreji esigcina ukhiye, iyiphi inqubo engawusebenzisa, ubani ongawukhipha kabusha futhi yini ukuhlehla. Leso sigaba yiso esibuzwa abacwaningi mabhuku, futhi yiso esihlala isikhathi eside ngemva kokushintsha kwabasebenzi.