Umzamo we-VPN ongafanele: iliphi igaba lobufakazi obudlule umngcele?
Umzamo ohlulekile kungenzeka awuzange uthumele lutho, noma wanikeza iphasiwedi kulowo ophendulile. Hlukanisa ubufakazi ngaphambi kokunquma ukuthi yini ezocinywa.
Uxhumane ne-VPN okungewona, futhi iklayenti labika ukwehluleka. Ukuthi lokho kwakubalulekile noma cha kuncike kulokho okwadlula ocingweni ngaphambi kokwehluleka, futhi igama ngokwalo alikutsheli lokho. Okunye ukuxhawulana akuthwali mfihlo nhlobo, kanti okunye kunikeza iphasiwedi kunoma ubani ophendule ikheli. Thola ukuthi yikuphi kwalawa mabili okwenzekile ngaphambi kokucinya noma yini.
Yima futhi ugcine ubufakazi
Gcina ilogi yeklayenti, iphrofayili ekhethiwe, ikheli olibhalile kanye nesikhathi esiseduze. Zibhale endaweni engaphandle kweklayenti, ngoba ukuhlela iphrofayili noma ukufaka kabusha kucekela phansi irekhodi ozolidinga. Misa noma yimuphi umzamo olandelayo kuze kube yilapho indawo yokugcina iqinisekisiwe ngendlela oyilawulayo.
Ungalokothi uthumele iphrofayili noma ilogi engahlanziwe kunkundla yomphakathi ngenkathi ubuza ukuthi umzamo wawuphephile yini. Lawa madokhumenti avame ukuba nendlela yokhiye oyimfihlo, igama lomsingathi wangaphakathi noma ithokheni, ngakho hlambulula kuqala bese wabelana nomlawuli ongumnikazi wendawo yokugcina.
Yini engadlula umngcele
Iningi lokudideka livela ekuthatheni konke ukwehluleka njengohlobo olulodwa lwesigameko. Izinto ezine ezahlukene zingafinyelela kolunye uhlangothi: isitifiketi somphakathi, isiginesha ebonisa ukuthi ukhiye usetshenzisiwe, iphasiwedi noma ikhodi yokusetshenziswa kanye, kanye nefayela olikhethile wena. Ngayinye inomphumela wayo nokulungiswa kwayo. Ukuhlukanisa ubufakazi yisinyathelo esinquma konke okulandela.
Icala lesitifiketi lincane kakhulu, ngoba into ehambayo isesidlangalaleni ngokwakhiwa futhi izinkambu zayo zokuhlonza sezivele zibonakala kunoma ubani oxhumayo. Isiginesha phezu kophonsela inselelo sithi ukhiye usetshenzisiwe, hhayi ukuthi uthunyelwe. Iphasiwedi iyingxenye ephambene: lowo oyitholayo angayizama kwenye indawo, futhi isevisi eyakhelwe ukuqinisekisa amaphasiwedi ingumamukeli ohlosiwe walelo nalelo nani.
Ubufakazi bokhiye akubona ukulayisha ukhiye
I-TLS yanamuhla yehlukanisa leyo mibono emibili ngamabomu. RFC 8446 ichaza umlayezo we-CertificateVerify, lapho iklayenti lisayina khona inselelo ngokhiye oyimfihlo ohambisana nesitifiketi salo. Isiginesha ibonisa ubunikazi ngaphandle kokuphatha ukhiye, yingakho umzamo oqinisekiswe ngesitifiketi awubona ngokuzenzakalela ukuchephuka kokhiye.
Lokho kududuzeka kunomkhawulo okufanele ukushiwo. Ubufakazi bubonisa ukuthi ukhiye ubambe iqhaza kulokho kushintshisana, futhi akusho lutho mayelana nalokho uhlelo lwangaphakathi kumsini okungenzeka selukufundile. Futhi akusho ukuthi umzamo ongaziwa wafinyelela kude kangakanani ngempela, yingakho ilogi isabalulekile ukudlula ithiyori.
Amaphasiwedi alandela imodeli yokwethemba ehluke ngokuphelele. Isihlanganisi esilungiselelwe ngomhloli wangaphandle singadlulisela inani elithunyelwe, ngakho ukwamukela kwayo kuwumsebenzi ohlosiwe futhi indawo okungeyona iwukuchayeka kwangempela hhayi kwethiyori.
Yakha kabusha umzamo kusukela kulogi
Amaqiniso amane akha kabusha umzamo: ikheli elixhunyaniswe nalo ngempela, ukuthi ubunikazi bomsingathi buqinisekisiwe yini, ukuthi iyiphi indlela yokuqinisekisa ekhethiwe, nokuthi inqubo yama ngaphi. Ngakunye kuvela kulogi yeklayenti, futhi ngakunye kususa indaba ehlukile. Iphutha elimayelana nemizila noma ikheli elinikeziwe alisho lutho mayelana nalokho obekuvele kucingo, ngoba ukuqinisekisa kungenzeka kwaqedwa ngaphambi kokuthi ukusethwa komhubhe kwehluleke.
Khipha lawo maqiniso kulogi yeklayenti uqobo hhayi enkumbulweni. Isihluzi esincane sigcina okukhishiwe kufushane ngokwanele ukuba kuhlanzwe futhi kwabiwe:
grep -n -i -E 'verify|authentication|certificate|error|timeout' client.log | tail -30Ungashintshi igama lomsingathi nganoma yikuphi kwalokhu. Igama elijwayelekile, impendulo ye-DNS yamanje kanye nesixwayiso sesitifiketi esikhonjiswa isofthiwe kuchaza okwamanje hhayi ukuxhumana kwangaphambilini. Isicelo sephasiwedi naso akubona ubufakazi bokuthi kukhona okuthunyelwe, ngoba iklayenti kungenzeka lehluleka ngaphambi kokukuthumela.
Nquma, bese wenza
Isinqumo sivela kubufakazi, hhayi ekutheni ukwehluleka kwakubukeka kusabisa kangakanani. Funda imigqa emine ngokumelene namaqiniso owakhe kabusha:
| Decision | Evidence that puts you here | Evidence that rules it out |
|---|---|---|
| Change the password now | A password was submitted and a server reply arrived | The log stops before any submission |
| Review active sessions | A one-time code was accepted by the wrong endpoint | The code was never sent, or was rejected before use |
| Revoke and reissue | The file you selected contained key material, not just settings | The upload was a profile with no embedded key |
| No further action | The attempt ended before any authentication value was offered | You later find an earlier attempt you had forgotten |
Uma iphasiwedi yafinyelela isevisi engahlosiwe, yishintshe ngomzila wokuphatha i-akhawunti bese uhlola ukuthi yayisetshenziswa kuphi futhi. Ikhodi yokusetshenziswa kanye ephelelwe yisikhathi ivale leyo ndlela, kodwa iseshini eyakhiwe ngayo ayivali, ngakho cela umlawuli wobunikazi ukuthi abuyekeze amaseshini. Uma ifayela likhiye lalilayishwe ngempela, landela inqubo yokuhoxiswa yenhlangano ekhiphayo esikhundleni sokulindela ubufakazi bokuhlukumeza.
Bese ubhala umphumela onomkhawulo: yini ethunyelwe, yini esahlale ingaziwa, nakuphi ubufakazi obudinga isinyathelo. Leyo rekhodi yiyo ezocelwa ukubuyekezwa kamuva, futhi inenzuzo ukwedlula noma yisiphi salezi ziphetho ezimbili ezinethezekile.