Ama-cipher e-Windows ne-strongSwan: fanisa isendlalelo esifanele

Izinhlangothi zombili zithi i-AES-128 kanti umhubhe usenqaba ukwakhiwa. I-CBC ne-GCM zinguquko ezihlukene ezithi ngamazwi adlulayo zabelane ngobude bokhiye obufanayo, futhi iklayenti elihlinzeka ngokunye akwanelisi isango elamukela okunye kuphela. Igama i-AES lichaza umndeni, hhayi isivumelwano.

Kukhona ne-eksisi yesibili, futhi iyona ekhiqiza amaphutha adidayo.

Izendlalelo ezimbili, izinhlu ezimbili ezizimele

I-IKE ivikela ukuxoxisana ngokwako, kuyilapho inhlangano yengane ivikela ithrafikhi okukhathazayo ngayo ngempela. I-Windows iveza okokuqala njengendlela yokubethela nendlela yobuqotho, kanti okwesibili njengezinto ezingaguquki zokuguqulwa kwe-cipher nokuqinisekisa. Lezo zinkambu azizona iziteketiso zomunye komunye, futhi inani elivumelekile kwelinye lingaba ngeliyize noma elingalungile kwelinye. Ukufunda iphrofayela ngalokho kwehlukanisa engqondweni kususa iningi lokudideka.

Umphumela ongokoqobo ukuthi ungaba nenqubomgomo yokushintshisana kokhiye eyamukelekayo ngokuphelele kanye nenqubomgomo yesiteshi sedatha umlingani angeke ayamukele. Uhlu olulodwa luyaxoxisana; olunye luvikela amaphakethe. Ukushintsha inani kwelokuqala akunawo umphumela kwelesibili, noma ngabe zombili zibukeka zifana kangakanani kudayalogi yokulungiselela.

Bhala zombili izinhlu ngaphambi kokuziqhathanisa nesango. Ukuqhathanisa okusuka enkumbulweni yindlela inkambu eyodwa ehlelwa kabili ngayo kanti enye ayihlelwa neze. Gcina ikhonsoli yesango ivuliwe eceleni kwephrofayela.

Funda iphutha eceleni kweziphakamiso

Isigaba esihlulekile sikutshela ukuthi yiluphi uhlu okufanele luhlolwe. Ukwenqaba ngesikhathi sokushintshisana kokhiye kokuqala kuyinkinga yesiphakamiso se-IKE, futhi kwenzeka ngaphambi kokuba kube khona noma iyiphi inhlangano yengane. Ukwehluleka ngesikhathi kuxoxiswana ngenhlangano yethrafikhi evikelwe kuyinkinga yesiphakamiso se-ESP, futhi ukushintshisana kokhiye sekuvele kwaphumelela. Umlayezo ojwayelekile wokufanisa inqubomgomo ovela kuklayenti awusho noma isiphi isigaba, yingakho umbono wesango ngokwalo uwona owusizo.

swanctl --list-conns
swanctl --list-sas
journalctl -u strongswan -n 60 --no-pager

Qhathanisa isiphakamiso esitholiwe, isiphakamiso esilungisiwe kanye nesikhethiwe salowo mzamo owodwa. Izinhlu ezintathu ezihlukene zibalulekile lapha, futhi uhlu lokugcina kuphela oluchaza okwasetshenziswa ngempela. Caphuna ngamazwi ebhokisini esikhundleni sokufingqa.

Gcina i-CBC ne-GCM njengezinye izindlela ezihlukene

Isango elivunyelwe ngamabomu ukwamukela noma yimuphi umndeni sidinga iziphakamiso ezimbili, hhayi esisodwa. Ku-strongSwan ukhefana wehlukanisa ezinye izindlela, futhi i-hyphen ixhumanisa izingxenye zesethi eyodwa. Ukuhlanganisa imindeni yomibili ngama-hyphen kukhiqiza isiphakamiso esisodwa esingenakwenzeka esikhundleni sezimbili ezamukelekayo.

proposals = aes128gcm16-prfsha256-ecp256, aes128-sha256-ecp256
esp_proposals = aes128gcm16-ecp256

Enye indlela yokuqala ithwala ukubethela okuqinisekisiwe futhi isabiza umsebenzi wokungahleliwe, ngoba ukukhishwa kokhiye kudinga owodwa ngisho nalapho ubuqotho buvela ku-cipher. Enye indlela yesibili ukubethela kwendabuko okune-algorithm yobuqotho ehlukile. Zombili zisalincike kulokho okusekelwa ukusetshenziswa kwe-crypto okulayishiwe.

Isiphakamiso se-ESP akusona isiphakamiso se-IKE esiqanjwe kabusha

Ithokheni ye-cipher ibukeka ifana kuzo zombili izinhlu, futhi cishe akukho okunye okudluliswayo. Isiphakamiso se-ESP asinawo umsebenzi wokungahleliwe wokushintshisana kokhiye, futhi izimfuno zaso zobuqotho nokugcinwa kwemfihlo phambili ziphikiswa ngokumelene nenqubomgomo ye-Windows ohlangothini olunye esikhundleni sokukopishwa emgqeni we-IKE. Ukuhumusha uhlu olulodwa kolunye ngomshini kukhiqiza into eqinisekisayo futhi engaxoxisani neze.

Khetha indlela futhi uhlale kuyo. Noma isango ligcina inqubomgomo ye-GCM kuphela futhi iklayenti lisabalalisa inqubomgomo ehambisanayo ephelele, noma isango lamukela imindeni yomibili futhi iklayenti ligcina isethi yalo ekhona. Ukuvula indlela yokubuyela emuva evinjelwe inqubomgomo yezokuphepha akulona ikhambi, noma ngabe isusa iphutha ngokushesha kangakanani.

Qinisekisa zombili izethi, bese kuba ukuvuselelwa kokhiye

Qinisekisa ngokwehlukana isethi yokushintshisana kokhiye ekhethiwe kanye nesethi yethrafikhi ekhethiwe, ngoba zivela ezinhlu ezihlukene futhi zingaphumelela ngokuzimela. Bese uvumela ukuvuselelwa kokhiye kwenzeke futhi ukuqinisekise nakho. Ukuxhawula kokuqala okusebenzayo nokuvuselelwa kokhiye okwehlulekayo kuchaza isethi yeziphakamiso eyamukelekayo ngokwengxenye kuphela.

Gcina lobo bufakazi kanye noshintsho. Ukunqamuka kokuxhumana okuphindaphindayo kudinga irekhodi lako lokushintshisana okwehlulekile ngaphambi kokuba othile asole isikhathi noma iphutha leplathifomu.