{"id":38110,"date":"2019-10-31T22:21:42","date_gmt":"2019-10-31T19:21:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/dpi-inspektsiya-ssl-protivorechit-smyslu-kriptografii-no-kompanii-eyo-vnedryayut\/"},"modified":"2019-10-31T22:21:42","modified_gmt":"2019-10-31T19:21:42","slug":"dpi-inspektsiya-ssl-protivorechit-smyslu-kriptografii-no-kompanii-eyo-vnedryayut","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dpi-inspektsiya-ssl-protivorechit-smyslu-kriptografii-no-kompanii-eyo-vnedryayut","title":{"rendered":"DPI (inspektimi SSL) \u00ebsht\u00eb n\u00eb kund\u00ebrshtim me kuptimin e kriptografis\u00eb, por kompanit\u00eb e zbatojn\u00eb at\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"DPI
\nZgjidhja e besimit. CC BY-SA 4.0 Yanpas<\/a><\/noindex><\/i><\/p>\n

Inspektimi i trafikut SSL (dekriptimi SSL\/TLS, analiza SSL ose DPI) \u00ebsht\u00eb b\u00ebr\u00eb nj\u00eb tem\u00eb gjithnj\u00eb e m\u00eb e nxeht\u00eb diskutimi n\u00eb sektorin korporativ. Ideja e dekriptimit t\u00eb trafikut duket se \u00ebsht\u00eb n\u00eb kund\u00ebrshtim me konceptin e kriptografis\u00eb. Megjithat\u00eb, fakti \u00ebsht\u00eb se gjithnj\u00eb e m\u00eb shum\u00eb kompani po p\u00ebrdorin teknologji DPI, duke e arsyetuar k\u00ebt\u00eb nevoj\u00ebn p\u00ebr t\u00eb kontrolluar p\u00ebrmbajtjen p\u00ebr malware, rrjedhje t\u00eb dh\u00ebnash etj.<\/p>\n

Mir\u00eb, n\u00ebse e pranojm\u00eb si fakt se \u00ebsht\u00eb e nevojshme t\u00eb implementohet nj\u00eb teknologji e till\u00eb, at\u00ebher\u00eb duhet t\u00eb shqyrtojm\u00eb m\u00ebnyrat p\u00ebr ta b\u00ebr\u00eb k\u00ebt\u00eb n\u00eb nj\u00eb m\u00ebnyr\u00eb sa m\u00eb t\u00eb sigurt dhe t\u00eb menaxhuar mir\u00eb. T\u00eb pakt\u00ebn, mos t\u00eb mb\u00ebshtetemi n\u00eb ato certifikata, p\u00ebr shembull, q\u00eb ju jep ofruesi i sistemit DPI.<\/p>\n

Ka nj\u00eb aspekt t\u00eb implementimit q\u00eb nuk e din\u00eb t\u00eb gjith\u00eb. N\u00eb t\u00eb v\u00ebrtet\u00eb, shum\u00eb jan\u00eb t\u00eb habitur kur e d\u00ebgjojn\u00eb at\u00eb. Ky \u00ebsht\u00eb nj\u00eb qend\u00ebr private certifikimi (C\u0421). Ajo gjeneron certifikata p\u00ebr dekriptimin dhe ri-enkriptimin e trafikut.
\n<\/a><\/noindex>
\nN\u00eb vend q\u00eb t\u00eb mb\u00ebshteteni n\u00eb certifikatat e vet\u00ebshkruara ose certifikatat nga pajisjet DPI, mund t\u00eb p\u00ebrdorni nj\u00eb CA t\u00eb dedikuar nga nj\u00eb qend\u00ebr e tret\u00eb e sertifikimit, si GlobalSign. Por s\u00eb pari, le t\u00eb b\u00ebjm\u00eb nj\u00eb p\u00ebrmbledhje t\u00eb vog\u00ebl t\u00eb problemit t\u00eb vet\u00eb.<\/p>\n

\u00c7far\u00eb \u00ebsht\u00eb inspektimi SSL dhe pse p\u00ebrdoret ai?<\/h2>\n

\nNj\u00eb num\u00ebr n\u00eb rritje i faqeve publike po kalojn\u00eb n\u00eb HTTPS. P\u00ebr shembull, sipas statistikave t\u00eb Chrome<\/a><\/noindex>, n\u00eb fillim t\u00eb shtatorit 2019, pjesa e trafikut t\u00eb enkriptuar n\u00eb Rusi arriti n\u00eb 83%.<\/p>\n

\"DPI<\/a><\/noindex><\/p>\n

Fatkeq, kriptimi i trafikut po p\u00ebrdoret gjithnj\u00eb e m\u00eb shpesh nga keqb\u00ebr\u00ebsit, sidomos tani q\u00eb Let\u2019s Encrypt shp\u00ebrndan mij\u00ebra certifikata SSL falas n\u00eb m\u00ebnyr\u00eb automatike. Si rezultat, HTTPS po p\u00ebrdoret gjithandej \u2014 dhe ikona e \u00e7el\u00ebsit n\u00eb shiritin e adres\u00ebs s\u00eb shfletuesit nuk \u00ebsht\u00eb m\u00eb nj\u00eb indikator i besuesh\u00ebm i siguris\u00eb.<\/p>\n

K\u00ebto pozita p\u00ebrdoren nga prodhuesit e zgjidhjeve DPI p\u00ebr t\u00eb promovuar produktin e tyre. Ato nd\u00ebrhyjn\u00eb midis p\u00ebrdoruesve t\u00eb fundit (dmth. punonj\u00ebsve tuaj q\u00eb shohin faqe web) dhe Internetit, duke filtruar trafikun e d\u00ebmsh\u00ebm. Aktualisht n\u00eb treg existe nj\u00eb gam\u00eb e till\u00eb produktesh, por proceset jan\u00eb esencialisht t\u00eb nj\u00ebjta. Trafiku HTTPS kalon p\u00ebrmes pajisjes s\u00eb verifikimit, ku ajo dekodifikohet dhe kontrollohet p\u00ebr malware.<\/p>\n

Pasi p\u00ebrfundon verifikimi, pajisja krijon nj\u00eb sesion t\u00eb ri SSL me klientin p\u00ebrfundimtar p\u00ebr dekodimin dhe ribllokimin e p\u00ebrmbajtjes.<\/p>\n

Si funksionon procesi i dekodimit\/ribllokimit<\/h2>\n

\nP\u00ebr t\u00eb dekoduar dhe ribllokuar paketat para se t'i d\u00ebrgoj\u00eb tek p\u00ebrdoruesit p\u00ebrfundimtar, pajisja e inspektimit SSL duhet t\u00eb ket\u00eb mund\u00ebsin\u00eb t\u00eb l\u00ebshoj\u00eb certifikata SSL n\u00eb koh\u00eb reale. Kjo do t\u00eb thot\u00eb se duhet t\u00eb ket\u00eb nj\u00eb certifikat\u00eb CA t\u00eb instaluar.<\/p>\n

P\u00ebr nj\u00eb kompani (apo nj\u00eb tjet\u00ebr person n\u00eb mes), \u00ebsht\u00eb e r\u00ebnd\u00ebsishme q\u00eb k\u00ebto certifikata SSL t\u00eb jen\u00eb t\u00eb besueshme n\u00eb shfletues (pra, t\u00eb mos shkaktojn\u00eb mesazhe alarmuese si ato q\u00eb ilustrohet m\u00eb posht\u00eb). Prandaj, zinxhiri i CA-s\u00eb (ose hierarkia) duhet t\u00eb ndodhet n\u00eb depozitat e besueshm\u00ebris\u00eb s\u00eb shfletuesit. Duke qen\u00eb se k\u00ebto certifikata nuk l\u00ebshohen nga qendrat e certifikimit t\u00eb besueshme publike, \u00ebsht\u00eb e nevojshme t\u00eb transmetohet manualisht hierarkia e CA-s\u00eb te t\u00eb gjith\u00eb klient\u00ebt p\u00ebrfundimtar\u00eb.<\/p>\n

\"DPI
\nMesazhi i alarmit p\u00ebr nj\u00eb certifikat t\u00eb vet\u00ebshkruar n\u00eb Chrome. Burimi: BadSSL.com<\/a><\/noindex><\/i><\/p>\n

N\u00eb kompjuter\u00ebt me Windows, mund t\u00eb p\u00ebrfshihet Active Directory dhe politika grupore, por p\u00ebr pajisjet mobile procedura \u00ebsht\u00eb m\u00eb e komplikuar.<\/p>\n

Situata b\u00ebhet edhe m\u00eb e komplikuar kur duhet t\u00eb mb\u00ebshtetet n\u00eb nj\u00eb mjedis korporate edhe certifikata t\u00eb tjera rr\u00ebnj\u00ebsore, p\u00ebr shembull nga Microsoft, ose ato t\u00eb bazuara n\u00eb OpenSSL. Plus mbrojtja e \u00e7el\u00ebsave sekret\u00eb dhe menaxhimi i tyre, n\u00eb m\u00ebnyr\u00eb q\u00eb asnj\u00eb nga \u00e7el\u00ebsat t\u00eb mos skadoj\u00eb papritur.<\/p>\n

Zgjidhja m\u00eb e mir\u00eb: nj\u00eb certifikat rr\u00ebnj\u00ebsor privat dhe t\u00eb dedikuar nga nj\u00eb CA t\u00eb jashtme.<\/h2>\n

\nN\u00ebse menaxhimi i disa rr\u00ebnj\u00ebve ose certifikatave t\u00eb vet\u00eb-n\u00ebnshkruara nuk \u00ebsht\u00eb t\u00ebrheq\u00ebs, ka nj\u00eb alternativ\u00eb: mund t\u00eb besoni n\u00eb nj\u00eb CA t\u00eb jashtme. N\u00eb k\u00ebt\u00eb rast, certifikatat l\u00ebshohen nga nj\u00eb<\/b> qend\u00ebr e besimit private, e cila \u00ebsht\u00eb e lidhur n\u00eb zinxhirin e besimit me nj\u00eb rr\u00ebnj\u00eb private t\u00eb certifikimit, e krijuar posa\u00e7\u00ebrisht p\u00ebr kompanin\u00eb.<\/p>\n

\"DPI<\/a><\/noindex>
\nArkitektur\u00eb e thjeshtuar p\u00ebr certifikatat e rr\u00ebnj\u00ebs s\u00eb dedikuar t\u00eb klient\u00ebve<\/i><\/p>\n

Kjo konfigurim eliminon disa nga problemet e p\u00ebrmendura m\u00eb par\u00eb: t\u00eb pakt\u00ebn redukton numrin e rr\u00ebnj\u00ebve q\u00eb nevojitet t\u00eb menaxhohen. K\u00ebtu mund t\u00eb p\u00ebrdoret vet\u00ebm nj\u00eb qend\u00ebr private rr\u00ebnj\u00eb p\u00ebr t\u00eb gjitha nevojat e brendshme t\u00eb PKI me \u00e7do num\u00ebr t\u00eb qendrave t\u00eb nd\u00ebrmjetme t\u00eb certifikimit. P\u00ebr shembull, n\u00eb diagramin e m\u00ebsip\u00ebrm tregohet nj\u00eb hierarki shum\u00eb-niveli, ku nj\u00ebra nga qendrat e nd\u00ebrmjetme t\u00eb certifikimit p\u00ebrdoret p\u00ebr verifikimin\/dekriptimin e SSL, nd\u00ebrsa tjetra \u2014 p\u00ebr kompjuter\u00ebt e brendsh\u00ebm (laptop\u00ebt, server\u00ebt, kompjuter\u00ebt desktop, etj.).<\/p>\n

N\u00eb k\u00ebt\u00eb skem\u00eb nuk \u00ebsht\u00eb e nevojshme t\u00eb vendosni CA te t\u00eb gjith\u00eb klient\u00ebt, sepse CA e nivelit t\u00eb lart\u00eb \u00ebsht\u00eb vendosur te GlobalSign, duke zgjidhur problemet me mbrojtjen e \u00e7el\u00ebsit privat dhe afatin e tij.<\/p>\n

Nj\u00eb tjet\u00ebr avantazh i k\u00ebtij qasje \u00ebsht\u00eb mund\u00ebsia e t\u00ebrheqjes s\u00eb autoritetit t\u00eb certifikimit SSL p\u00ebr \u00e7do arsye. N\u00eb vend t\u00eb tij, krijohet thjesht nj\u00eb i ri, i cili lidhet me rr\u00ebnj\u00ebn tuaj private dhe mund t\u00eb p\u00ebrdoret menj\u00ebher\u00eb.<\/p>\n

Pavar\u00ebsisht t\u00eb gjitha kund\u00ebrshtimeve, bizneset po vendosin gjithnj\u00eb e m\u00eb shum\u00eb t\u00eb zbatojn\u00eb inspektimin SSL t\u00eb trafikut si pjes\u00eb t\u00eb infrastruktur\u00ebs s\u00eb brendshme ose private PKI. Opsione t\u00eb tjera t\u00eb p\u00ebrdorimit t\u00eb PKI private p\u00ebrfshijn\u00eb l\u00ebshimin e certifikatave p\u00ebr autentikimin e pajisjeve ose p\u00ebrdoruesve, SSL p\u00ebr serverat e brendsh\u00ebm, si dhe konfigurime t\u00eb ndryshme q\u00eb nuk lejohet n\u00eb certifikatat e besuara publike sipas k\u00ebrkesave t\u00eb CA\/Browser Forum.<\/p>\n

Shfletuesit jan\u00eb t\u00eb rezistuesh\u00ebm.<\/h2>\n

\nDuhet t\u00eb theksohet se zhvilluesit e shfletuesve po p\u00ebrpiqen t\u00eb kund\u00ebrshtojn\u00eb k\u00ebt\u00eb tendenc\u00eb dhe t\u00eb mbrojn\u00eb p\u00ebrdoruesit p\u00ebrfundimtar\u00eb nga MiTM. Shembull, disa dit\u00eb m\u00eb par\u00eb Mozilla mori nj\u00eb vendim<\/a><\/noindex> aktivizoni p\u00ebr parazgjedhje protokollin DoH (DNS-over-HTTPS) n\u00eb nj\u00ebr\u00ebn nga versionet e m\u00ebposhtme t\u00eb shfletuesit Firefox. Protokolli DoH fsheh k\u00ebrkesat DNS nga sistemi DPI, duke e v\u00ebshtir\u00ebsuar inspektimin SSL.<\/p>\n

P\u00ebr planet e ngjashme m\u00eb 10 Shtator 2019 njoftoi<\/a><\/noindex> kompania Google p\u00ebr shfletuesin Chrome.<\/p>\n

\"DPI<\/a><\/noindex><\/p>\n

Vet\u00ebm p\u00ebrdoruesit e regjistruar mund t\u00eb marrin pjes\u00eb n\u00eb anket\u00eb. Hyni<\/a><\/noindex>, ju lutemi.<\/p>\n

Si mendoni, a ka t\u00eb drejt\u00eb kompania t\u00eb inspektoj\u00eb trafikun SSL t\u00eb punonj\u00ebsve t\u00eb saj?<\/h2>\n