Kungani ikhodi esebenza kanye kuphela isehluleka ukungena ku-VPN

Uvula iklayenti le-VPN, uthayipha iphasiwedi, futhi izinombolo eziyisithupha ezivela kusiqinisekisi sakho zibuya zingavumelekile — kabili, bese kuba ngokwesithathu. Akukho okushintshile ku-akhawunti kusukela izolo, ngakho umuzwa wokuqala ukususa okufakiwe kusiqinisekisi bese usikena futhi — ngokuvamile lokhu kuwukulungisa okungalungile. Ikhodi esebenza kanye kuphela ayiyona iphasiwedi yesibili: isango kufanele liyicele esigabeni esithile, kusuka kokufakiwe okubhalisiwe okuthile, ngaphakathi kwewindi lesikhathi elithile, futhi ukwenqatshwa okuningi kwenzeka ngaphambi kokuba izinombolo ziqhathaniswe. Thola ukuthi usesigabeni sini ngaphambi kokuthinta ukubhalisa.

Ukulandelana kwemibuzo kukutshela ukuthi usesigabeni sini

Izinhlobo ezintathu zihlanganisa cishe konke ukungena ku-VPN okuhlanganisa ikhodi. Esimweni sezinyathelo ezimbili iklayenti lithumela iphasiwedi, iseva ikhipha inselelo, futhi iklayenti liphinda libuze. Esimweni esihlanganisiwe isango lifuna iphasiwedi nekhodi ekuthunyelweni okukodwa — ngezinye izikhathi kuxhunywe, ngezinye izikhathi ngemuva kwesihlukanisi esibhalwe umsebenzi kuphela. Esimweni sesiphequluli iklayenti alinaso ngisho insimu: ikhodi ingena ekhasini lewebhu, noma imvume yokusunduza iyithatha indawo, futhi iklayenti ledeskithophu lilindele umphumela.

Isimo esingalungile sibukeka njengekhodi embi. Namathisela ikhodi entsha ensimini eyenzelwe iphasiwedi kuphela, iseva izoyifunda njengengxenye yephasiwedi. Ngasohlangothini lweklayenti, i-OpenVPN 2.4 nangemuva kwayo kwenza umehluko ubonakale: iseva ephendula nge-AUTH_FAILED,CRV1: ilindele impendulo yenselelo, ngakho iphrofayela idinga i-static-challenge noma ifayela lephasiwedi ngendlela ye-SCRV1:. Iphrofayela endala ene-auth-user-pass kuphela iqinisekisa iphasiwedi bese iyama, lokhu okubonakala kurekhodi njengokwehluleka kwe-OTP nakuba kungekho khodi ethunyelwe.

I-WireGuard ifanele ukushiwo njengesihloko esihlukile: iqinisekisa amapheya okhiye hhayi abantu, ngakho ayinayo insimu yekhodi. Uma umhlinzeki ekhangisa enjalo, kukhona into ngaphandle komhubhe eyamukelayo.

Iseva yenzani ngezinombolo eziyisithupha

Amakhodi asuselwa esikhathini alandela i-RFC 6238, ehlanganisa isakhiwo sakudala esisekelwe esibali sika-RFC 4226: i-HMAC phezu kwento enyakazayo, inqunywa yaba izinombolo eziyisithupha ngokuzenzakalela. Ku-TOTP into enyakazayo yisikhathi samanje se-Unix esihlukaniswe ngesinyathelo, imizuzwana engu-30 ngaphandle uma umsebenzi eyishintshile. Isiqinisekisi asiqhathanisi izinombolo zakho nenani eligciniwe; sibala kabusha ikhodi elindelekile kusuka embewini eyabiwe futhi ngokuvamile samukela nezinyathelo ezingomakhelwane, ngakho uhambo oluhamba kancane alwenzi ukungena kuhluleke.

Imiphumela emibili ayinakwa. Isikhathi sendawo yocingo asibalulekile, ngoba imbewu ayiboni iwashi lendawo; ukwehluka ku-UTC yangempela kuphela okubalulekile, futhi idivayisi egijima imizuzu emibili ngaphambili ihluleka kukho konke ikhodi ngenkathi ibonisa ukubala okuphindayo okuhlanzekile. Futhi ikhodi isebenza kanye kuphela ngokwakhiwa: isiqinisekisi sikhumbula inani lokugcina lesibali elalikwamukele kuleyo mbewu, ngakho lezo zinombolo ezifakwa futhi ziyenqatshwa ngisho nangaphakathi kwewindi elifanayo. Iklayenti elizama futhi ngemuva kokuphela kwesikhathi lingasha ikhodi esanda kuyithumela.

Amathokheni asekelwe esibali ashintsha isibali sawo ngakho konke ukucindezela, ngakho aphuma ekuxhumaneni ngemuva kokuthi amakhodi akhiwe kodwa angathunyelwanga; ukulungisa okuvamile iwindi lokuxhumanisa kabusha elamukela amanani ambalwa phambili. Uma umsebenzi ebhalise i-HOTP kanti uhlelo lwakho lubonisa i-TOTP, wonke inani alilungile ngendlela ebukeka njengenkinga yewashi. I-URI yokuhlinzeka ngemuva kwekhodi ye-QR isho uhlobo, izinombolo, isikhathi ne-hash.

Ukwehluleka okubukeka njengekhodi engalungile

Okufakiwe okubhalisiwe kuyimbangela evame kakhulu. Izinhlelo zokuqinisekisa zibeka amalebula kokufakiwe ngokomkhiphi nange-akhawunti, ngakho noma ubani onobunikazi obubili ku-VPN eyodwa angaba nokufakiwe okubili okuhlukaniswa ngohlamvu olulodwa emalebula awo. Ikhodi ivumelekile kuleyo mbewu eyikhiqizile kuphela, hhayi enye into. Qhathanisa ilebula elisocingweni negama lomsebenzisi elirekhodwa iseva, hhayi nalokho okukhumbula ukuthi wakubhala.

Okwesibili isethi yamapharamitha engahambisani. Imbewu ebhaliswe ngezinombolo eziyisishiyagalombili, isikhathi semizuzwana engu-60 noma i-SHA-256 ikhipha amakhodi isiqinisekisi esilindele izinombolo eziyisithupha, imizuzwana engu-30 ne-SHA-1 ezenqabayo, futhi kuklayenti lokho akuhlukaniseki nekhodi engalungile. Kubonakala ngemuva kokufuduka lapho okufakiwe kwengezwe khona futhi kusuka esithombeni sekhodi ye-QR, noma lapho irekhodi lethokheni lakhiwa kabusha ngamanani okuzenzakalela.

Okwesithathu akumayelana nekhodi. Amasango ngokuvamile abuyisela ukwehluleka kokuqinisekisa okukodwa okujwayelekile kwiphasiwedi engalungile, ikhodi ephelelwe yisikhathi ne-akhawunti ekhutshaziwe, ngamabomu, ukuze kungabikho othola ukuthi iyiphi into ehlulekile. Funda irekhodi lesango noma le-RADIUS esikhundleni somlayezo weklayenti: inselelo engakaze ikhishwe, ukunqatshwa kokufinyelela okungenaso isici se-OTP nokunqatshwa ngenqubomgomo kubonakala kufana esibukweni futhi kuholela ezinyathelweni ezilandelayo ezihlukile.

Ukulandelana okufushane okunciphisa lokhu

Qala ngokuhlola okushibhe kakhulu futhi ume esinyathelweni sokuqala esingagcini.

1. Linda ikhodi entsha, yithumele kanye, futhi qaphela ukuthi inselelo ivela ngaphambi noma ngemuva kokwamukelwa kwephasiwedi.
2. Hlanganisa ilebula elikusiqinisekisi negama lomsebenzisi eligcinwa iseva.
3. Qinisekisa ukuthi iphrofayela ingaphendula inselelo, njengakwicala le-CRV1 ngenhla.
4. Qhathanisa iwashi ledivayisi nomthombo wesikhathi owaziwayo; ukwehluka okungaphezu kwamashumi ambalwa emizuzwana kwephula i-TOTP ngokwako.
5. Buza umsebenzi ukuthi ithokheni yi-TOTP noma i-HOTP, futhi yiziphi izinombolo, isikhathi ne-hash ebhalisiwe.

Imikhawulo emibili ivimbela lokhu ukuthi kungabi kubi nakakhulu. Ungazami futhi izikhathi eziningi: amasango amaningi abala ukwehluleka nge-akhawunti ngayinye futhi awuyivaleli noma aqala ukubambezela izimpendulo, ngakho ukuqhuma okukodwa kushintsha iphutha elincane lokucwangciswa kube ithikithi lokusekelwa. Futhi ungabhalisi ithokheni futhi njengokuxilonga, ngoba lokho kwenza imbewu endala ingasebenzi; uma iphutha langempela kwakuyinselelo iklayenti elingakaze liyithumele, manje unezinguquko ezimbili okufanele uzichaze esikhundleni sokukodwa.

Gcina imbewu namakhodi okubuyisela ngaphandle komjikelezo

Izinombolo eziyisithupha nemfihlo engemuva kwazo akushintshisani. Ikhodi ye-QR yokuhlinzeka noma imbewu ye-Base32 yenza wonke ikhodi yesikhathi esizayo ye-akhawunti, ngakho ingena esigabeni esifanayo nephasiwedi: hhayi kusithombe sesikrini, hhayi kumbono wethikithi, futhi hhayi engxoxweni nomuntu oqale ukuxhumana nawe. Amakhodi okubuyisela ayindlela ehlukile — asebenza kanye, ngokuvamile adlula ngokuphelele umbuzo wekhodi, futhi ukusebenzisa elilodwa ukuze uhlole i-akhawunti kususa indlela yokubuyisela ongase uyidinge kamuva.

Ikhodi ayenzi nekhasi lokungena lithembeke: umbuzo we-OTP esizindeni esifanayo uqoqa ikhodi evumelekile bese uyiphindaphinda ngaphakathi kwewindi, futhi isitifiketi sisewukho okutshela lapho uthayipha khona.

Uma ukulandelana kuphelela kuphrofayela engakwazi ukuphendula inselelo, lungisa iphrofayela bese uhlola futhi ngekhodi entsha eyodwa. Uma kuphelela kumapharamitha okubhalisa angahambisani, cela umsebenzi afunde irekhodi lethokheni ngaphambi kokuba noma ubani asikene okuthile. Uma kuphelela ekukhiyweni, linda kuphele esikhundleni sokushintsha amaklayenti — isithiyo yisimo se-akhawunti, hhayi uhlelo.