{"id":39000,"date":"2019-10-31T22:27:16","date_gmt":"2019-10-31T19:27:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika\/"},"modified":"2019-10-31T22:27:16","modified_gmt":"2019-10-31T19:27:16","slug":"shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","title":{"rendered":"Ne kodojm\u00eb sipas GOST: udh\u00ebzues p\u00ebr konfigurimin e rrjedhjes dinamike t\u00eb trafikut","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Ne
\nN\u00ebse kompania juaj transmeton ose merr informacion t\u00eb ndjesh\u00ebm dhe t\u00eb dh\u00ebna personale p\u00ebrmes rrjetit, t\u00eb cilat k\u00ebrkojn\u00eb mbrojtje sipas legjislacionit, \u00ebsht\u00eb e nevojshme t\u00eb aplikohet kriptimi sipas GOST. Sot do t'ju tregojm\u00eb se si implementuam nj\u00eb kriptim t\u00eb till\u00eb n\u00eb baz\u00ebn e port\u00ebs s\u00eb kriptimit (K\u0160) S-Terra p\u00ebr nj\u00eb nga klient\u00ebt tan\u00eb. Kjo histori do t\u00eb jet\u00eb interesante p\u00ebr specialist\u00ebt e siguris\u00eb IT, si dhe p\u00ebr inxhinier\u00ebt, projektuesit dhe arkitekt\u00ebt. Nuk do t\u00eb thellojm\u00eb n\u00eb nuancat e konfigurimit teknik n\u00eb k\u00ebt\u00eb postim \u2014 do t\u00eb ndalemi n\u00eb pikat kryesore t\u00eb konfigurimit baz\u00eb. Ka nj\u00eb mori dokumentacioni p\u00ebr konfigurimin e demon\u00ebve t\u00eb sistemit operativ Linux, mbi t\u00eb cilin bazohet K\u0160 S-Terra, i cili \u00ebsht\u00eb n\u00eb dispozicion t\u00eb lir\u00eb n\u00eb internet. Dokumentacioni p\u00ebr konfigurimin e softuerit pronar S-Terra gjithashtu \u00ebsht\u00eb i disponuesh\u00ebm n\u00eb portal<\/a><\/noindex> i prodhuesit.
\n<\/a><\/noindex><\/p>\n

Pak fjal\u00eb mbi projektin <\/h2>\n

\nTopologjia e rrjetit te klienti ishte tipike \u2014 full mesh midis qendr\u00ebs dhe filialeve. Ishte e nevojshme t\u00eb implementohej kriptimi i kanaleve t\u00eb informacionit midis t\u00eb gjitha vendeve, t\u00eb cilat ishin 8 n\u00eb total. <\/p>\n

Zakonisht n\u00eb projekte t\u00eb tilla, gjith\u00e7ka \u00ebsht\u00eb statike: n\u00eb portat e kriptimit (K\u0160) vendosen rrug\u00eb statike n\u00eb rrjetin lokal t\u00eb vendit, dhe p\u00ebrfshihen lista t\u00eb IP-adresave (ACL) p\u00ebr kriptimin. Megjithat\u00eb, n\u00eb k\u00ebt\u00eb rast, vendet nuk kan\u00eb menaxhim t\u00eb centralizuar, dhe brenda rrjeteve t\u00eb tyre lokale mund t\u00eb ndodh\u00eb gjith\u00e7ka: rrjetet mund t\u00eb shtohen, fshihen dhe modifikohen n\u00eb t\u00eb gjitha m\u00ebnyrat. P\u00ebr t\u00eb shmangur riparametrizimin e rrug\u00ebzimit dhe ACL n\u00eb K\u0160 gjat\u00eb ndryshimit t\u00eb adresave t\u00eb rrjeteve lokale n\u00eb vendet, u mor vendimi p\u00ebr t\u00eb p\u00ebrdorur tunelizimin GRE dhe rrug\u00ebzimin dinamik OSPF, n\u00eb t\u00eb cilin p\u00ebrfshihen t\u00eb gjith\u00eb K\u0160 dhe shumica e ruter\u00ebve t\u00eb nivelit t\u00eb kernelit n\u00eb vendet (n\u00eb disa vende, administrator\u00ebt e infrastruktur\u00ebs preferuan t\u00eb p\u00ebrdorin SNAT n\u00eb drejtim t\u00eb K\u0160 n\u00eb ruter\u00ebt e kernelit). <\/p>\n

Tunelizimi GRE leht\u00ebsoi zgjidhjen e dy problemeve:
\n1.<\/b> T\u00eb p\u00ebrdoren n\u00eb ACL p\u00ebr kriptimin IP-adresa e nd\u00ebrfaqes s\u00eb jashtme t\u00eb K\u0160, n\u00eb t\u00eb cilin inkapsulohet t\u00eb gjith\u00eb trafiku q\u00eb drejtohet ndaj vendeve t\u00eb tjera.
\n2.<\/b> T\u00eb organizohen tunele p-t-p midis K\u0160, t\u00eb cilat lejojn\u00eb t\u00eb konfigurohet rrug\u00ebzimi dinamik (n\u00eb rastin ton\u00eb midis vendeve \u00ebsht\u00eb organizuar nj\u00eb MPLS L3VPN ofruesi).<\/p>\n

Klienti k\u00ebrkoi implementimin e enkriptimit si sh\u00ebrbim. P\u00ebrndryshe, ai do t\u00eb duhej jo vet\u00ebm t\u00eb mbante porta kripto ose t'ia besonte nj\u00eb organizate tjet\u00ebr, por gjithashtu t\u00eb ndjek\u00eb vet\u00eb ciklin e jet\u00ebs s\u00eb sertifikatave t\u00eb enkriptimit, duke i rinovuar n\u00eb koh\u00eb dhe duke instaluar t\u00eb reja.
\n\"Ne
\nTani, kujtesa \u2013 si dhe \u00e7far\u00eb kemi konfiguruar.<\/p>\n

Subjekti KII n\u00eb v\u00ebmendje: konfigurimi i port\u00ebs kripto. <\/h2>\n

<\/p>\n

Konfigurimi baz\u00eb i rrjetit.<\/h3>\n

\nS\u00eb pari, nisim port\u00ebn e re kripto dhe hyjm\u00eb n\u00eb konsol\u00ebn e administrat\u00ebs. Duhet t\u00eb fillojm\u00eb me ndryshimin e fjal\u00ebkalimit t\u00eb administratorit t\u00eb integruar \u2014 komanda. ndrysho fjal\u00ebkalimin e administratorit.<\/b>Pas k\u00ebsaj, duhet t\u00eb kryhet procedura e inicializimit (komanda. initialize.<\/b>) gjat\u00eb s\u00eb cil\u00ebs vendosen t\u00eb dh\u00ebnat e licenc\u00ebs dhe inicizohet gjeneratori i numrave t\u00eb rast\u00ebsish\u00ebm (GNU).<\/p>\n

Keni parasysh!<\/u><\/b> Gjat\u00eb inicializimit t\u00eb port\u00ebs S-Terra, vendoset politika e siguris\u00eb, sipas s\u00eb cil\u00ebs interface t\u00eb port\u00ebs s\u00eb siguris\u00eb nuk lejojn\u00eb kalimin e paketave. Duhet ose t\u00eb krijoni nj\u00eb politik\u00eb t\u00eb vet\u00ebn, ose me an\u00eb t\u00eb komand\u00ebs. ekzekuto csconf_mgr aktivizo.<\/b> t\u00eb aktivizoni politik\u00ebn e miratuar t\u00eb vendosur paraprakisht.
\nM\u00eb pas, duhet t\u00eb konfigurojm\u00eb adresimin e interfaceve t\u00eb jashtme dhe t\u00eb brendshme, si dhe rrug\u00ebn e paracaktuar. Puna me konfigurimin e rrjetit t\u00eb port\u00ebs dhe konfigurimi i enkriptimit preferohet t\u00eb b\u00ebhet p\u00ebrmes konsol\u00ebs Cisco-like. Kjo konsol\u00eb \u00ebsht\u00eb e dedikuar p\u00ebr futjen e komandave t\u00eb ngjashme me komandat Cisco IOS. Konfigurimi, i formuar p\u00ebrmes konsol\u00ebs Cisco-like, t\u00ebrthorazi konvertohet n\u00eb skedar\u00ebt p\u00ebrkat\u00ebs t\u00eb konfigurimit, me t\u00eb cil\u00ebt punojn\u00eb demon\u00ebt e sistemit operacional. T\u00eb kalojm\u00eb n\u00eb konsol\u00ebn Cisco-like nga konsola e administrat\u00ebs mundet me komand\u00ebn. konfiguro.<\/b>.<\/p>\n

Ndryshojm\u00eb fjal\u00ebkalimet p\u00ebr p\u00ebrdoruesin e integruar cscons dhe enable: <\/p>\n

>enable.
\nFjal\u00ebkalimi: csp (parazgjedhur).
\n#configure terminal
\n#username cscons privilege 15 secret 0 #enable secret 0 \u041d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e:<\/p>\n

#interface GigabitEthernet0\/0
\n#ip address 10.111.21.3 255.255.255.0
\n#no shutdown
\n#interface GigabitEthernet0\/1
\n#ip address 192.168.2.5 255.255.255.252
\n#no shutdown
\n#ip route 0.0.0.0 0.0.0.0 10.111.21.254<\/p>\n

GRE.<\/h3>\n

\nDale nga konsola Cisco-like, dhe kaloni n\u00eb shell-in debian me komand\u00ebn. sistem.<\/b>Vendosim fjal\u00ebkalimin ton\u00eb p\u00ebr p\u00ebrdoruesin. root<\/b> n\u00ebp\u00ebrmjet komand\u00ebs. passwd<\/b>.
\n\u00c7do der\u00eb kripto ka nj\u00eb tunel t\u00eb ve\u00e7ant\u00eb p\u00ebr \u00e7do vendndodhje. Konfigurimi i interface-t t\u00eb tunelit kryhet n\u00eb skedarin. \/etc\/network\/interfaces<\/b>. Krijimi i vet\u00eb interface-it p\u00ebrkujdeset nga utiliti IP tunnel, q\u00eb b\u00ebn pjes\u00eb n\u00eb paket\u00ebn e parazgjedhur iproute2. Komanda p\u00ebr krijimin e interface-it Shtrohet n\u00eb opsionin pre-up.<\/p>\n

Shembuj i konfigurimit tipik t\u00eb interface-t t\u00eb tunelit:
\nauto site1.
\niface site1 inet static.
\nadresa 192.168.1.4.
\nmaske e rrjetit 255.255.255.254.
\npre-up ip tunnel add site1 mode gre local 10.111.21.3 remote 10.111.22.3 key hfLYEg^vCh6p.<\/p>\n

Keni parasysh!<\/u><\/b> Duhet theksuar se konfigurimet e interfazheve t\u00eb tunelit duhet t\u00eb vendosen jasht\u00eb seksionit <\/p>\n

###netifcfg-begin###
\n*****
\n###netifcfg-end###<\/p>\n

N\u00eb t\u00eb kund\u00ebrt, k\u00ebto konfigurime do t\u00eb fshihen kur ndryshohen configurimet e natyrshme t\u00eb interfazheve fizike p\u00ebrmes konsol\u00ebs Cisco-like.<\/p>\n

Routimi dinamik<\/h3>\n

\nN\u00eb S-Terra, routimi dinamik realizohet me ndihm\u00ebn e paket\u00ebs s\u00eb programeve Quagga. P\u00ebr t\u00eb konfiguruar OSPF, na nevojitet aktivizimi dhe konfigurimi i demon\u00ebve zebra<\/b> \u0438 ospfd<\/b>. Demoni zebra merret me nd\u00ebrveprimin mes demon\u00ebve t\u00eb routimit dhe OS. Demoni ospfd, si\u00e7 kuptohet nga emri, merret me implementimin e protokollit OSPF.
\nKonfigurimi i OSPF mund t\u00eb b\u00ebhet ose p\u00ebrmes konsol\u00ebs s\u00eb demonit, ose drejtp\u00ebrdrejt p\u00ebrmes skedarit t\u00eb konfigurimit \/etc\/quagga\/ospfd.conf<\/b>. N\u00eb skedarin shtohen t\u00eb gjith\u00eb interfazet fizike dhe t\u00eb tunelit q\u00eb marrin pjes\u00eb n\u00eb routimin dinamik, si dhe shpallen rrjetet q\u00eb do t\u00eb anonsohen dhe t\u00eb pranojn\u00eb anonsimet.<\/p>\n

Shembulli i konfigurimit, q\u00eb duhet t\u00eb shtohet n\u00eb ospfd.conf<\/b>:
\ninterface eth0
\n!
\ninterface eth1
\n!
\ninterface site1
\n!
\ninterface site2
\nrouter ospf
\n ospf router-id 192.168.2.21
\n network 192.168.1.4\/31 area 0.0.0.0
\n network 192.168.1.16\/31 area 0.0.0.0
\n network 192.168.2.4\/30 area 0.0.0.0<\/p>\n

N\u00eb k\u00ebt\u00eb rast, adresat 192.168.1.x\/31 jan\u00eb rezervuar p\u00ebr rrjetet point-to-point (ptp) t\u00eb tunelit nd\u00ebrmjet vendeve, nd\u00ebrsa adresat 192.168.2.x\/30 p\u00ebr rrjetet transit nd\u00ebrmjet KSH dhe router\u00ebve t\u00eb b\u00ebrtham\u00ebs. <\/p>\n

Keni parasysh!<\/b><\/u> P\u00ebr t\u00eb reduktuar tabel\u00ebn e rutimit n\u00eb instalime t\u00eb m\u00ebdha, mund t\u00eb filtrohet anonsimi i vet\u00eb rrjeteve transit duke p\u00ebrdorur konstrukte no redistribute connected<\/b> \u0438\u043b\u0438 redistribute connected route-map<\/b>.<\/p>\n

Pas konfigurimit t\u00eb demon\u00ebve, \u00ebsht\u00eb e nevojshme t\u00eb ndryshohet statusi i aktivizimit t\u00eb demon\u00ebve n\u00eb \/etc\/quagga\/daemons<\/b>. N\u00eb opsionet zebra<\/b> \u0438 ospfd<\/b> no ndryshohet n\u00eb yes. Aktivizo demonin quagga dhe vendos automatikisht aktivizimin e tij gjat\u00eb nisjes s\u00eb KSH me komand\u00ebn update-rc.d quagga enable<\/b>.<\/p>\n

N\u00ebse konfigurimi i tunelave GRE dhe OSPF \u00ebsht\u00eb realizuar si\u00e7 duhet, at\u00ebher\u00eb n\u00eb KSH dhe router\u00ebt e b\u00ebrtham\u00ebs duhet t\u00eb shfaqen rruget n\u00eb rrjetin e vendeve t\u00eb tjera dhe k\u00ebshtu krijohet lidhja n\u00eb rrjet nd\u00ebrmjet rrjeteve lokale.<\/p>\n

Kriptojm\u00eb trafikun q\u00eb kalon <\/h3>\n

\nSi \u00ebsht\u00eb p\u00ebrmendur tashm\u00eb, zakonisht gjat\u00eb kriptimit midis platformave ne tregojm\u00eb intervalet e adresave IP (ACL), midis t\u00eb cilave kriptohet trafiku: n\u00ebse adresat e burimit dhe marr\u00ebsit bien brenda k\u00ebtyre intervaleve, traffiku midis tyre kriptohet. Megjithat\u00eb, n\u00eb k\u00ebt\u00eb projekt struktura \u00ebsht\u00eb dinamike dhe adresat mund t\u00eb ndryshojn\u00eb. Duke qen\u00eb se ne tashm\u00eb kemi konfiguruar tunelimin GRE, si adresat e burimit ashtu edhe ato t\u00eb marr\u00ebsve p\u00ebr kriptimin e trafikut mund t\u00eb jen\u00eb adresat e jashtme t\u00eb QK - sepse traffiku q\u00eb vjen p\u00ebr kriptimin, \u00ebsht\u00eb tashm\u00eb i inkapsuluar me protokollin GRE. Me fjal\u00eb t\u00eb tjera, kriptohet gjith\u00e7ka q\u00eb hyn n\u00eb QK nga rrjeti lokal i nj\u00eb platforme drejt rrjeteve q\u00eb jan\u00eb shpallur nga platforma t\u00eb tjera. Dhe brenda secil\u00ebs platform\u00eb, mund t\u00eb realizohet \u00e7do ridrejtim. K\u00ebshtu, n\u00eb rast t\u00eb ndonj\u00eb ndryshimi t\u00eb rrjeteve lokale, administratori mjafton t\u00eb modifikoj\u00eb shpalljet q\u00eb vijn\u00eb nga rrjeti i tij drejt QK, dhe ajo do t\u00eb jet\u00eb e disponueshme p\u00ebr platformat e tjera.<\/p>\n

Kriptimi n\u00eb QK S-Terra b\u00ebhet n\u00ebp\u00ebrmjet protokollit IPSec. Ne p\u00ebrdorim algoritmin \"Kuznecik\" n\u00eb p\u00ebrputhje me GOST R 34.12-2015, dhe p\u00ebr p\u00ebrputhshm\u00ebri me versionet m\u00eb t\u00eb vjetra mund t\u00eb p\u00ebrdoret GOST 28147-89. Autentifikimi teknikisht mund t\u00eb kryhet si me \u00e7el\u00ebsa t\u00eb p\u00ebrcaktuar paraprakisht (PSK), ashtu edhe me certifikata. Megjithat\u00eb, n\u00eb p\u00ebrdorimin industrial \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrdoren certifikata t\u00eb l\u00ebshuara sipas GOST R 34.10-2012.<\/p>\n

Puna me certifikatat, kontenier\u00ebt dhe CRL kryhet p\u00ebrmes utilit cert_mgr<\/b>. E para, me an\u00eb t\u00eb komand\u00ebs cert_mgr create<\/b> duhet t\u00eb formohet nj\u00eb kontenier p\u00ebr \u00e7el\u00ebsin privat dhe nj\u00eb k\u00ebrkes\u00eb p\u00ebr certifikat\u00ebn, e cila do t\u00eb d\u00ebrgohet n\u00eb Qendr\u00ebn e Menaxhimit t\u00eb Certifikatave. Pas marrjes s\u00eb certifikat\u00ebs, ajo s\u00eb bashku me certifikat\u00ebn rr\u00ebnj\u00ebsore t\u00eb CA dhe CRL (n\u00ebse p\u00ebrdoret) duhet t\u00eb importohet me komand\u00ebn cert_mgr import<\/b>. T\u00eb sigurohemi se t\u00eb gjitha certifikatat dhe CRL e instaluar jan\u00eb t\u00eb dukshme me komand\u00ebn cert_mgr show<\/b>.<\/p>\n

. Pas instalimit t\u00eb suksessh\u00ebm t\u00eb certifikatave, kalojm\u00eb n\u00eb konsol\u00ebn Cisco-like p\u00ebr konfigurimin e IPSec.
\nKrijojm\u00eb nj\u00eb politik\u00eb IKE, n\u00eb t\u00eb cil\u00ebn p\u00ebrcaktojm\u00eb algoritmet dhe parametrat e d\u00ebshiruar p\u00ebr kanalin e siguruar q\u00eb do t\u00eb ofrohet partnerit p\u00ebr pajtim. <\/p>\n

#crypto isakmp policy 1000
\n#encr gost341215k
\n#hash gost341112-512-tc26
\n#authentication sign
\n#group vko2
\n#lifetime 3600<\/p>\n

Kjo politik\u00eb p\u00ebrshtatet n\u00eb nd\u00ebrtimin e faz\u00ebs s\u00eb par\u00eb t\u00eb IPSec. Rezultati i nj\u00eb kalimi t\u00eb suksessh\u00ebm t\u00eb faz\u00ebs s\u00eb par\u00eb \u00ebsht\u00eb themelimi i SA (Asociacioni i Siguris\u00eb).
\nM\u00eb pas, do t\u00eb duhet t\u00eb p\u00ebrcaktojm\u00eb list\u00ebn e adresave IP t\u00eb burimit dhe merr\u00ebsit (ACL) p\u00ebr enkriptimin, t\u00eb formojm\u00eb nj\u00eb grup transformimesh (transform set), t\u00eb krijojm\u00eb nj\u00eb hart\u00eb kriptografike (crypto map) dhe ta lidhim at\u00eb me nd\u00ebrfaqen e jashtme t\u00eb KSH. <\/p>\n

P\u00ebrcaktojm\u00eb ACL:
\n#ip access-list extended site1
\n#permit gre host 10.111.21.3 host 10.111.22.3<\/p>\n

Grupi i transformimeve (ashtu si p\u00ebr faz\u00ebn e par\u00eb, p\u00ebrdorim algoritmin e enkriptimit \"Kuznjec\" me p\u00ebrdorimin e modit t\u00eb prodhimit t\u00eb imitosh):<\/p>\n

#crypto ipsec transform-set GOST esp-gost341215k-mac<\/p>\n

Krijojm\u00eb nj\u00eb hart\u00eb kriptografike, duke treguar ACL, grupin e transformimeve dhe adres\u00ebn e peer:<\/p>\n

#crypto map MAIN 100 ipsec-isakmp
\n#match address site1
\n#set transform-set GOST
\n#set peer 10.111.22.3<\/p>\n

Lidhim harten kriptografike me nd\u00ebrfaqen e jashtme t\u00eb KSH:<\/p>\n

#interface GigabitEthernet0\/0
\n#ip address 10.111.21.3 255.255.255.0
\n#crypto map MAIN<\/p>\n

P\u00ebr t\u00eb enkriptuar kanalet me platforma t\u00eb tjera, \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrs\u00ebrisim procedur\u00ebn e krijimit t\u00eb ACL dhe harten kriptografike, duke ndryshuar emrin e ACL, adresat IP dhe numrin e harten kriptografike.<\/p>\n

Keni parasysh! <\/u><\/b>N\u00eb rastin q\u00eb nuk p\u00ebrdoret verifikimi i certifikatave p\u00ebrmes CRL, kjo duhet t\u00eb tregoj\u00eb qart\u00eb:<\/p>\n

#crypto pki trustpoint s-terra_technological_trustpoint
\n#revocation-check none<\/p>\n

Monitorojm\u00eb \"sh\u00ebndetin\" e sistemit<\/h2>\n

\nN\u00eb KSH S-Terra p\u00ebr monitorimin p\u00ebrdoret demon standard snmpd. P\u00ebrve\u00e7 parametrave tipik\u00eb p\u00ebr Linux, S-Terra \"nga fabrika\" mb\u00ebshtet ofrimin e t\u00eb dh\u00ebnave n\u00eb lidhje me tunel\u00ebt IPSec sipas CISCO-IPSEC-FLOW-MONITOR-MIB, p\u00ebr \u00e7far\u00eb ne p\u00ebrdorim, duke ndjekur gjendjen e tunel\u00ebve IPSec. gjithashtu mb\u00ebshtetet funksionaliteti i OID-ve t\u00eb personalizuara q\u00eb jepin si vlera rezultatet e ekzekutimit t\u00eb skriptit. Kjo mund\u00ebsi na lejon t\u00eb ndjekim afatet e skadenc\u00ebs s\u00eb certifikatave. Skripti i shkruar analiz\u00ebn e dolllimit t\u00eb komand\u00ebs cert_mgr show<\/b> dhe si rezultat jep numrin e dit\u00ebve deri n\u00eb skadenc\u00ebn e certifikatave lokale dhe atyre t\u00eb rr\u00ebnj\u00ebs. Ky proces \u00ebsht\u00eb i paz\u00ebvend\u00ebsuesh\u00ebm p\u00ebr administrimin e nj\u00eb numri t\u00eb madh t\u00eb KSH.
\n\"Ne
\n<\/p>\n

Cila \u00ebsht\u00eb r\u00ebnd\u00ebsia e k\u00ebtij enkriptimi?<\/h2>\n

\nT\u00eb gjitha funksionalitetet e p\u00ebrmendura m\u00eb sip\u00ebr p\u00ebrkrahen \"nga kutia\" nga KSH S-Terra. Kjo do t\u00eb thot\u00eb se nuk ishte e nevojshme t\u00eb instalonin module shtes\u00eb q\u00eb mund t\u00eb kishin ndikim n\u00eb certifikimin e kripto-gateway-ve dhe n\u00eb vler\u00ebsimin e t\u00ebr\u00eb sistemit informacion. Kanalet midis vendeve mund t\u00eb jen\u00eb t\u00eb ndryshme, madje edhe p\u00ebrmes internetit. <\/p>\n

Fal\u00eb faktit se nuk \u00ebsht\u00eb e nevojshme t\u00eb rinisni kripto-gateway-t gjat\u00eb ndryshimit t\u00eb infrastruktur\u00ebs s\u00eb brendshme, sistemi funksionon si nj\u00eb sh\u00ebrbim<\/b>, q\u00eb \u00ebsht\u00eb shum\u00eb praktike p\u00ebr klientin: ai mund t\u00eb vendos\u00eb sh\u00ebrbimet e tij (klientike dhe serverike) n\u00eb \u00e7do adres\u00eb, dhe t\u00eb gjitha ndryshimet do t\u00eb shp\u00ebrndahen dinamikisht nd\u00ebrmjet pajisjeve t\u00eb kriptimit. <\/p>\n

Pa dyshim, kriptimi p\u00ebr shkak t\u00eb ngarkesave (overhead) ndikon n\u00eb shpejt\u00ebsin\u00eb e transferimit t\u00eb t\u00eb dh\u00ebnave, por n\u00eb m\u00ebnyr\u00eb t\u00eb pap\u00ebrfillshme \u2014 kapaciteti i kanalit mund t\u00eb ulet maksimumi me 5\u201410 %. Teknologjia \u00ebsht\u00eb testuar dhe ka treguar rezultate t\u00eb mira edhe n\u00eb kanale satelitore, t\u00eb cilat jan\u00eb mjaft t\u00eb pasigurta dhe kan\u00eb kapacitet t\u00eb ul\u00ebt. <\/p>\n

Igor Vinokhodov, inxhinier i linj\u00ebs s\u00eb dyt\u00eb t\u00eb administrat\u00ebs \"Rostelecom-Solar\"<\/i>
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0438\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0435\u0440\u0441\u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043f\u043e\u0434\u043b\u0435\u0436\u0430\u0449\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0435 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c, \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e \u0413\u041e\u0421\u0422\u0443. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0442\u0430\u043a\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0448\u043b\u044e\u0437\u0430 (\u041a\u0428) S-Terra \u0443 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432. \u042d\u0442\u0430 \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430 \u0418\u0411-\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c, \u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430\u043c \u0438 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u043e\u0440\u0430\u043c. \u0413\u043b\u0443\u0431\u043e\u043a\u043e \u043f\u043e\u0433\u0440\u0443\u0436\u0430\u0442\u044c\u0441\u044f \u0432 \u043d\u044e\u0430\u043d\u0441\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29260,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39000","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kriptimi sipas GOST: udh\u00ebzues p\u00ebr konfigurimin e rrug\u00ebtimit dinamik t\u00eb trafikut | ProHoster","description":"N\u00ebse kompania juaj.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0428\u0438\u0444\u0440\u0443\u0435\u043c\u0441\u044f \u043f\u043e \u0413\u041e\u0421\u0422\u0443: \u043f\u0430\u043c\u044f\u0442\u043a\u0430 \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:16+00:00","article:modified_time":"2019-10-31T19:27:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39000","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 15:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:58:40","updated":"2026-02-04 15:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/39000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=39000"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/39000\/revisions"}],"predecessor-version":[{"id":156680,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/39000\/revisions\/156680"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/29260"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=39000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=39000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=39000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

N\u00eb k\u00ebt\u00eb pik\u00eb, konfigurimi mund t\u00eb konsiderohet i p\u00ebrfunduar. N\u00eb dolllimin e komandave t\u00eb konsol\u00ebs Cisco-like show crypto isakmp sa<\/b> \u0438 show crypto ipsec sa<\/b> duhet t\u00eb pasqyrohen fazat e para dhe t\u00eb dyta t\u00eb IPSec. K\u00ebt\u00eb informacion mund ta marrim gjithashtu me komand\u00ebn sa_mgr show<\/b>, e cila ekzekutohet nga sh\u00ebll debian. N\u00eb dolllimin e komand\u00ebs cert_mgr show<\/b> duhet t\u00eb shfaqen certifikat e platformave t\u00eb larg\u00ebta. Statusi i atyre certifikatave do t\u00eb jet\u00eb remote<\/b>. N\u00eb rast se tunel\u00ebt nuk ndodhin, duhet t\u00eb shikoni n\u00eb logun VPN<\/a>-sh\u00ebrbimit, i cili ruhet n\u00eb skedarin \/var\/log\/cspvpngate.log<\/b>. Lista e plot\u00eb e skedave t\u00eb logut me p\u00ebrshkrimin e p\u00ebrmbajtjes s\u00eb tyre \u00ebsht\u00eb e pranishme n\u00eb dokumentacion.<\/p>\n