Kungani Ukuxhumana Kabusha Kwe-VPN Kucela Imininingwane Yokuqinisekisa Futhi
Iphasiwedi egciniwe kanye nethokheni esetshenziswa kabusha kuphelela ezikhathini ezihlukene. Funda ukuthi yiziphi izinto ukuxhumana kabusha okucelile ngaphambi kokushintsha noma yini kuklayenti.
Ithuneli elisebenze amahora amaningi licela iphasiwedi ngesikhathi ilaptop ivuka, futhi akukho okushintshile ekumisweni. Okushintshile yisimo semininingwane yokuqinisekisa ukuxhumana kabusha okuzamile ukuyisebenzisa kabusha. Izinhlobo ezintathu zezinto zilawula lokhu, futhi eyodwa kuphela yazo eyasinda esikhaleni sanoma yiluphi ubude.
Funda ukuthi iyiphi iklayenti eyicelile, ngoba zontathu ziphelela ngamawashi ahlukene futhi zihluleka ngemilayezo ehlukene.
Izinhlobo ezintathu zezinto ezingasetshenziswa kabusha
Iphasiwedi egcinwe kukhashi iyimfihlo ephethwe iklayenti, futhi ihlala isebenza kuze kube i-akhawunti iyishintsha. Ithokheni yesikhathi inikezwa iseva ngemuva kokungena okuphumelelayo, inesikhathi sayo sokuphila futhi ingahoxiswa nganoma yisiphi isikhathi. Ithikithi lesikhathi se-TLS noma inhlangano yezokuphepha ye-IKE yisimo sephrothokholi, ishibhile ukuqhubeka futhi izimele ngokuphelele kuyiphasiwedi yakho. Ngayinye inikezwa ingxenye ehlukene, futhi ngayinye iphelela ngemibandela yayo.
Eyokuqala isinda ekuqaliseni kabusha, eyesibili ivamise ukusinda ekulaleni, eyesithathu ingase ingasindi nhlobo ekushintsheni kwenethiwekhi. Ukuzixuba kukhiqiza isisombululo esingalungile, njengokuhlela kabusha iphasiwedi engakaze yenqatshwe.
Isicelo ngokwaso siwukuxilonga. Iwindi lesiphequluli noma ikhodi yesici sesibili kusho ukuthi iseva ifune ukuqinisekisa okusebenzisanayo, kuyilapho ukwehluleka okuthule ngaphandle kwesicelo kusho ukuthi iklayenti ayizange ifinyelele lapho ingabuzwa khona.
| Material | Typical lifetime | What invalidates it |
|---|---|---|
| Cached password | Until changed | Account or password policy change |
| Session token | Minutes to hours | Expiry, revocation, reauthentication policy |
| Tunnel SA or TLS ticket | Configured rekey interval | Rekey, network change, peer restart |
Ukuvuselela okhiye akulona ukuqinisekisa kabusha
Ukuvuselela okhiye kushintsha okhiye kuyilapho kugcina ubunikazi obuqinisekisiwe, yingakho kwenzeka buthule ngezikhathi ezithile ethunelini elinempilo. Ukuqinisekisa kabusha kuphinda ukuhlolwa kobunikazi ngokwako, futhi yisigameko esidinga wena. I-IKEv2 ihlukanisa kokubili ngokusobala, futhi umlingani angafuna ukuqinisekisa kabusha okugcwele ngesikhathi esimisiwe kungakhathaliseki ukuthi kube nokuvuselelwa okungaki okhiye phakathi. Izigameko zombili zibukeka zifana ngaphandle kuze kube ufunda ukuthi ilogu ibiza okukuphi.
OpenVPN yenza ngendlela efanayo kusilulumagama sayo: isikhathi sokuxoxisana kabusha sivuselela ishaneli yedatha, futhi ithokheni yokuqinisekisa ingabuyiselwa kuklayenti ukuze kugwenywe ukungena okugcwele ekuxhumaneni okulandelayo. Leyo thokheni inesikhathi sokuphila, futhi iseva inquma ukuthi iyamukele futhi yini.
Ngakho ukuxhumana kabusha ngemuva kwamahora ayisishiyagalombili kungase kwehluleke lapho ukuxhumana kabusha ngemuva kwamaminithi ayisishiyagalombili kwaphumelela khona, ngaphandle koshintsho lokumisa kuzo zombili izinhlangothi. Yikho konke ukuchazwa kwesicelo esivela kuphela ngemuva kwesidlo sasemini.
Uma iklayenti ingakwazi ukuqeda inselele entsha
Inqubomgomo edinga isinyathelo sesiphequluli izohluleka kuklayenti engenayo indlela yokukubonisa. Amaseva angenakhanda, imibhalo yokuqalisa kanye namaphrofayili amadala akhelwe ukuqinisekisa ngephasiwedi kuphela konke kushayisana nalolo donga, futhi ukwehluleka kuvamise ukuvela njengesikhathi sokuphela esivamile hhayi iphutha lokuqinisekisa.
Ukushintsheka kwedivayisi nenethiwekhi nakho kungawela ngaphakathi kwewindi lokuhlola inqubomgomo, ngakho ukusuka ku-Wi-Fi kuye endaweni eshisayo kuhambisana nokuhlolwa obekuzokwenzeka noma kunjalo. Leyo ngelekela yenza inethiwekhi ibonakale inecala kuyilapho imbangela iyisibali sikhathi.
openvpn --config client.ovpn --verb 3 2>&1 | grep -i -E "reneg|auth" ipsec statusall | grep -i -E "rekey|reauth"
Umgqa wokuqala ukhombisa izigameko zokuxoxisana kabusha nokuqinisekisa kwilogu yeklayenti ngokwayo, kanti owesibili ukhombisa izinhlangano zokuphepha ezihlolwa umlingani we-strongSwan manje. Qhathanisa izimpawu zesikhathi nesikhathi isicelo esavela ngaso; ukufana kuqinisekisa isibali sikhathi hhayi inethiwekhi.
Yini okufanele ibikwe, nokuthi yini okungafanele icishwe
Uma ukungena ngesandla kuphumelela futhi ukusetshenziswa kabusha okuzenzakalelayo kwehluleka njalo, tsho lokho ngqo kumqhubi. Lokho kubiza ingxenye: indlela yokusetshenziswa kabusha, hhayi imininingwane yokuqinisekisa. Faka isikhathi sokwehluleka, i-akhawunti esetshenziswayo kanye nohlobo lwesicelo osibonile.
Ungacishi isici sesibili, ungeqe ukuqinisekiswa kwesitifiketi futhi unganamathiseli imininingwane yokuqinisekisa kumbhalo wokuhlela ukuze ukuxhumana kabusha kube buthule. Ngakunye kwalokhu kususa ukuhlolwa okukhona inqubomgomo ukuze kuphoqelelwe, futhi ngakunye kuguqula isicelo sokungena sibe yisigameko.
Esikhundleni salokho cela ukugeleza okusekelwayo: iklayenti elingaqeda inselele, isikhathi sokuphila sethokheni esihambisana nosuku lomsebenzi, noma iphrofayili engasebenzisani egunyaziwe yomshini ongakwazi ukubuza. Konke lokho kuyizinqumo zokumisa umuntu angazigunyaza, okuyinto isisombululo sedlula singakona.