{"id":39000,"date":"2019-10-31T22:27:16","date_gmt":"2019-10-31T19:27:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika\/"},"modified":"2019-10-31T22:27:16","modified_gmt":"2019-10-31T19:27:16","slug":"shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","title":{"rendered":"Kriptimi sipas standardeve: kujtes\u00eb p\u00ebr konfigurimin e dinamik\u00ebs s\u00eb rrug\u00ebzimit t\u00eb trafikut","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Kriptimi
\nN\u00ebse kompania juaj transferon ose merr t\u00eb dh\u00ebna personale dhe informacion tjet\u00ebr t\u00eb ndjesh\u00ebm q\u00eb mbrohet nga ligji, \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrdoret enkriptimi sipas standardeve GOST. Sot do t'ju tregojm\u00eb se si kemi implementuar nj\u00eb enkriptim t\u00eb till\u00eb t\u00eb bazuar n\u00eb port\u00ebn kriptografike (K\u0160) S-Terra p\u00ebr nj\u00eb prej klient\u00ebve tan\u00eb. Kjo histori do t\u00eb jet\u00eb interesante p\u00ebr specialist\u00ebt e sigurimeve, si dhe p\u00ebr inxhinier\u00ebt, projektuesit dhe arkitekt\u00ebt. Nuk do t\u00eb thellojm\u00eb n\u00eb nuancat e konfigurimit teknik n\u00eb k\u00ebt\u00eb postim \u2014 do t\u00eb ndalemi n\u00eb pikat ky\u00e7e t\u00eb konfigurimit baz\u00eb. Ka nj\u00eb sasi t\u00eb madhe dokumentacioni p\u00ebr konfigurimin e demon\u00ebve t\u00eb sistemit operativ Linux, mbi t\u00eb cilin bazohet K\u0160 S-Terra, n\u00eb m\u00ebnyr\u00eb q\u00eb ta gjeni leht\u00ebsisht n\u00eb internet. Dokumentacioni p\u00ebr konfigurimin e softuerit t\u00eb pronarit S-Terra \u00ebsht\u00eb gjithashtu n\u00eb qasje t\u00eb hapur n\u00eb portal<\/a><\/noindex> t\u00eb prodhuesit.
\n<\/a><\/noindex><\/p>\n

Disa fjal\u00eb mbi projektin <\/h2>\n

\nTopologjia e rrjetit te klienti ishte standarde \u2014 mesh i plot\u00eb midis qendr\u00ebs dhe filialeve. Ishte e nevojshme t\u00eb implementohej enkriptimi i kanaleve t\u00eb shk\u00ebmbimit t\u00eb informacionit nd\u00ebrmjet t\u00eb gjitha vendeve, t\u00eb cilat ishin 8 n\u00eb num\u00ebr. <\/p>\n

N\u00eb projekte t\u00eb ngjashme, gjith\u00e7ka \u00ebsht\u00eb zakonisht statike: n\u00eb portat e kriptomonedhave (K\u0160) vendosen rute statike n\u00eb rrjetin lokal t\u00eb platformave, shkruhen lista IP-adreshash (ACL) p\u00ebr enkriptim. Megjithat\u00eb, n\u00eb k\u00ebt\u00eb rast, platformat nuk kan\u00eb menaxhim qendror, dhe brenda rrjeteve t\u00eb tyre lokale mund t\u00eb ndodhin gjith\u00e7ka: rrjetet mund t\u00eb shtohen, fshihen dhe modifikohen n\u00eb \u00e7do m\u00ebnyr\u00eb. P\u00ebr t\u00eb shmangur rikonfigurimin e routing-ut dhe ACL-s\u00eb n\u00eb K\u0160 kur ndryshohet adresimi i rrjeteve lokale n\u00eb platformat, u mor vendimi p\u00ebr t\u00eb p\u00ebrdorur tunelimin GRE dhe routing-un dinamik OSPF, i cili p\u00ebrfshin t\u00eb gjitha K\u0160-t\u00eb dhe shumic\u00ebn e ruterave t\u00eb nivelit thelb\u00ebsor t\u00eb rrjetit n\u00eb platformat (n\u00eb disa platforma, administratoret e infrastruktur\u00ebs preferuan t\u00eb p\u00ebrdorin SNAT drejt K\u0160-s\u00eb n\u00eb ruterat e thelb\u00ebsor). <\/p>\n

Tunelimi GRE lejohet t\u00eb zgjidh\u00eb dy detyra:
\n1.<\/b> T\u00eb p\u00ebrdor\u00eb n\u00eb ACL p\u00ebr enkriptimin adres\u00ebn IP t\u00eb nd\u00ebrfaqes s\u00eb jashtme t\u00eb K\u0160-s\u00eb, n\u00eb t\u00eb cil\u00ebn inkapsulohet gjith\u00e7ka trafik q\u00eb drejtohet drejt platformave t\u00eb tjera.
\n2.<\/b> Organizoni tunellet p-t-p midis KSH, q\u00eb lejojn\u00eb konfigurimin e routing-ut dinamik (n\u00eb rastin ton\u00eb midis platformave \u00ebsht\u00eb organizuar nj\u00eb MPLS L3VPN nga ofruesi).<\/p>\n

Klienti k\u00ebrkoi implementimin e enkriptimit si nj\u00eb sh\u00ebrbim. P\u00ebrndryshe, ai do t\u00eb duhej jo vet\u00ebm t\u00eb mbante kripto-portat ose t'i dor\u00ebzonte ato nj\u00eb organizate t\u00eb jashtme, por edhe t\u00eb ndjek\u00eb vet\u00eb ciklin e jet\u00ebs s\u00eb certifikatave t\u00eb enkriptimit, t'i rinovonte n\u00eb koh\u00eb dhe t\u00eb instalonte t\u00eb reja.
\n\"Kriptimi
\nDhe tani, k\u00ebtu \u00ebsht\u00eb nj\u00eb udh\u00ebzues \u2013 si dhe \u00e7far\u00eb kemi konfiguruar.<\/p>\n

Kujtes\u00eb p\u00ebr subjektin KII: konfiguroni kripto-port\u00ebn. <\/h2>\n

<\/p>\n

Konfigurimi i baz\u00ebs s\u00eb rrjetit.<\/h3>\n

\nS\u00eb pari, nisni KSH t\u00eb ri dhe shkoni n\u00eb konsol\u00ebn e administrat\u00ebs. Duhet t\u00eb filloni me ndryshimin e fjal\u00ebkalimit t\u00eb administratorit t\u00eb integruar \u2014 komanda ndrysho fjal\u00ebkalimin administrator<\/b>. M\u00eb pas, duhet t\u00eb kryhet procedura e inicializimit (komanda ini\u00e7ializo<\/b>) gjat\u00eb t\u00eb cil\u00ebs futen t\u00eb dh\u00ebnat e licenc\u00ebs dhe inicializohet gjeneratori i numrave t\u00eb rast\u00ebsish\u00ebm (GNR).<\/p>\n

Vini re!<\/u><\/b> Gjat\u00eb inicializimit t\u00eb KSH S-Terra vendoset politika e siguris\u00eb, n\u00eb t\u00eb cil\u00ebn nd\u00ebrfaqet e port\u00ebs s\u00eb siguris\u00eb nuk lejojn\u00eb kalimin e paketave. Nevojitet ose t\u00eb krijoni nj\u00eb politik\u00eb t\u00eb re, ose me an\u00eb t\u00eb komand\u00ebs run csconf_mgr activate<\/b> aktivizo politik\u00ebn e paracaktuar t\u00eb autorizimit.
\nM\u00eb pas, nevojitet t\u00eb konfigurohen adresat e nd\u00ebrfaqeve t\u00eb jashtme dhe t\u00eb brendshme, si dhe rruga e paracaktuar. Puna me konfigurimin rrjetor t\u00eb KSH-s\u00eb dhe konfigurimi i kriptimit preferohet t\u00eb realizohet p\u00ebrmes konsol\u00ebs Cisco-like. Kjo konsol\u00eb \u00ebsht\u00eb e destinuar p\u00ebr hyrjen e komandave q\u00eb jan\u00eb t\u00eb ngjashme me komandat Cisco IOS. Konfigurimi i krijuar me an\u00eb t\u00eb konsol\u00ebs Cisco-like, nga ana tjet\u00ebr, konvertohet n\u00eb skedar\u00ebt p\u00ebrkat\u00ebs t\u00eb konfigurimit, me t\u00eb cil\u00ebt punojn\u00eb demon\u00ebt e OS-s\u00eb. T\u00eb kalosh n\u00eb konsol\u00ebn Cisco-like nga konsola e administrat\u00ebs mund t\u00eb b\u00ebhet me komand\u00ebn konfiguro<\/b>.<\/p>\n

Nd\u00ebrrimi i fjal\u00ebkalimeve p\u00ebr p\u00ebrdoruesin e integruar cscons dhe enable: <\/p>\n

>enable
\nFjal\u00ebkalimi: csp (i paracaktuar)
\n#configure terminal
\n#username cscons privilege 15 secret 0 #enable secret 0 \u041d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e:<\/p>\n

#interface GigabitEthernet0\/0
\n#ip address 10.111.21.3 255.255.255.0
\n#no shutdown
\n#interface GigabitEthernet0\/1
\n#ip address 192.168.2.5 255.255.255.252
\n#no shutdown
\n#ip route 0.0.0.0 0.0.0.0 10.111.21.254<\/p>\n

GRE<\/h3>\n

\nDalim nga konsola Cisco-like dhe kalojm\u00eb n\u00eb shell-in debian me komand\u00ebn system<\/b>Vendosim fjal\u00ebkalimin ton\u00eb p\u00ebr p\u00ebrdoruesin root<\/b> me komand\u00ebn passwd<\/b>.
\nN\u00eb \u00e7do KSH konfigurohet nj\u00eb tunel i ve\u00e7ant\u00eb p\u00ebr \u00e7do vend. Konfigurimi i nd\u00ebrfaqes s\u00eb tunelit b\u00ebhet n\u00eb skedarin \/etc\/network\/interfaces<\/b>. Krijimi i vet\u00eb nd\u00ebrfaqes \u00ebsht\u00eb p\u00ebrgjegj\u00ebsi e utilitarit IP tunnel, i cili \u00ebsht\u00eb n\u00eb setin e paracaktuar iproute2. Komanda p\u00ebr krijimin e nd\u00ebrfaqes shkruhet n\u00eb opsionin pre-up.<\/p>\n

Shembulli i konfigurimit t\u00eb nj\u00eb nd\u00ebrfaqe tipike t\u00eb tunelit:
\nauto site1
\niface site1 inet statik
\nadresa 192.168.1.4
\nnetmask 255.255.255.254
\npre-up ip tunnel add site1 mode gre local 10.111.21.3 remote 10.111.22.3 key hfLYEg^vCh6p<\/p>\n

Vini re!<\/u><\/b> Duhet theksuar se konfigurimet e nd\u00ebrfaqeve t\u00eb tunelit duhet t\u00eb vendosen jasht\u00eb seksionit <\/p>\n

###netifcfg-begin###
\n*****
\n###netifcfg-end###<\/p>\n

N\u00eb t\u00eb kund\u00ebrt, k\u00ebto konfigurime do t\u00eb fshihen kur t\u00eb ndryshohen cil\u00ebsimet e rrjetit t\u00eb nd\u00ebrfaqeve fizike p\u00ebrmes nj\u00eb konsol\u00eb si Cisco.<\/p>\n

Rruga dinamike<\/h3>\n

\nN\u00eb S-Terra, rruga dinamike realizohet p\u00ebrmes paket\u00ebs s\u00eb programeve Quagga. P\u00ebr t\u00eb konfiguruar OSPF, do t\u00eb na nevojitet aktivizimi dhe konfigurimi i demon\u00ebve zebra<\/b> dhe ospfd<\/b>. Demoni zebra \u00ebsht\u00eb p\u00ebrgjegj\u00ebs p\u00ebr nd\u00ebrveprimin midis demon\u00ebve t\u00eb rrug\u00ebs dhe OS-it. Demoni ospfd, si\u00e7 tregohet nga emri, \u00ebsht\u00eb p\u00ebrgjegj\u00ebs p\u00ebr realizimin e protokollit OSPF.
\nKonfigurimi i OSPF b\u00ebhet ose p\u00ebrmes konsol\u00ebs s\u00eb demonit, ose drejtp\u00ebrdrejt p\u00ebrmes skedarit t\u00eb konfigurimit \/etc\/quagga\/ospfd.conf<\/b>. N\u00eb skedarin shtohen t\u00eb gjitha nd\u00ebrfaqet fizike dhe t\u00eb tunelit q\u00eb marrin pjes\u00eb n\u00eb rrug\u00ebn dinamike, si dhe shpallen rrjetet q\u00eb do t\u00eb reklamohen dhe do t\u00eb pranojn\u00eb reklama.<\/p>\n

Shembulli i konfigurimit q\u00eb duhet t\u00eb shtohet n\u00eb ospfd.conf<\/b>:
\nnd\u00ebrfaqja eth0
\n!
\nnd\u00ebrfaqja eth1
\n!
\nnd\u00ebrfaqja site1
\n!
\nnd\u00ebrfaqja site2
\nrouter ospf
\n ospf router-id 192.168.2.21
\n rrjeti 192.168.1.4\/31 zona 0.0.0.0
\n rrjeti 192.168.1.16\/31 zona 0.0.0.0
\n rrjeti 192.168.2.4\/30 zona 0.0.0.0<\/p>\n

N\u00eb k\u00ebt\u00eb rast, adresat 192.168.1.x\/31 jan\u00eb rezervuar p\u00ebr rrjetet PTP t\u00eb tunelit nd\u00ebrmjet vendeve, nd\u00ebrsa adresat 192.168.2.x\/30 jan\u00eb p\u00ebr rrjetet tranzit midis KSH dhe router\u00ebve t\u00eb b\u00ebrtham\u00ebs. <\/p>\n

Vini re!<\/b><\/u> P\u00ebr t\u00eb reduktuar tabel\u00ebn e rutimit n\u00eb instalime t\u00eb m\u00ebdha, mund t\u00eb filtrohet shpallja e vet\u00eb rrjeteve tranzit duke p\u00ebrdorur konstrukcione no redistribute connected<\/b> ose redistribute connected route-map<\/b>.<\/p>\n

Pasi t\u00eb konfigurohen demon\u00ebt, duhet t\u00eb ndryshohet statusi i nisjes s\u00eb demon\u00ebve n\u00eb \/etc\/quagga\/daemons<\/b>. N\u00eb opsione zebra<\/b> dhe ospfd<\/b> no duhet t\u00eb riprodhohet me yes. Aktivizoni demonin quagga dhe vendosni q\u00eb t\u00eb aktivizohet automatikisht kur KSH fillon me komand\u00ebn update-rc.d quagga enable<\/b>.<\/p>\n

N\u00ebse konfigurimi i tunel\u00ebve GRE dhe OSPF \u00ebsht\u00eb b\u00ebr\u00eb sakt\u00eb, at\u00ebher\u00eb n\u00eb KSH dhe router\u00ebt e b\u00ebrtham\u00ebs duhet t\u00eb shfaqen rrug\u00eb n\u00eb rrjetin e vendeve t\u00eb tjera dhe k\u00ebshtu krijohet lidhshm\u00ebria n\u00eb rrjet midis rrjeteve lokale.<\/p>\n

Kriptimi i trafikut t\u00eb transmetuar <\/h3>\n

\nSi\u00e7 \u00ebsht\u00eb shkruar m\u00eb par\u00eb, zakonisht gjat\u00eb enkriptimit midis platformave, ne specifikojm\u00eb gamat e adresave IP (ACL) midis t\u00eb cilave enkriptohet trafiku: n\u00ebse adresat e burimit dhe t\u00eb marr\u00ebsit bien n\u00eb k\u00ebto gama, trafiku midis tyre enkriptohet. Megjithat\u00eb, n\u00eb k\u00ebt\u00eb projekt struktura \u00ebsht\u00eb dinamike dhe adresat mund t\u00eb ndryshojn\u00eb. Si\u00e7 e kemi konfiguruar tashm\u00eb tunelimin GRE, si adresat e burimit ashtu edhe ato t\u00eb marr\u00ebsit p\u00ebr enkriptimin e trafikut mund t\u00eb jen\u00eb adresat e jashtme t\u00eb KSH \u2014 sepse trafiku q\u00eb arrin \u00ebsht\u00eb tashm\u00eb i inkapsuluar n\u00eb protokollin GRE. N\u00eb fjal\u00eb t\u00eb tjera, enkriptohet gjith\u00e7ka q\u00eb arrin n\u00eb KSH nga rrjeti lokal i nj\u00eb platforme drejt rrjeteve q\u00eb jan\u00eb shpallur nga platforma t\u00eb tjera. Nd\u00ebrsa brenda secil\u00ebs platform\u00eb mund t\u00eb realizohet \u00e7do ridrejtim. K\u00ebshtu, n\u00eb rast t\u00eb ndonj\u00eb ndryshimi t\u00eb rrjeteve lokale, administratorit i mjafton t\u00eb modifikoj\u00eb shpalljet q\u00eb dalin nga rrjeti i tij n\u00eb drejtim t\u00eb KSH dhe ajo do t\u00eb b\u00ebhet e aksesueshme p\u00ebr platforma t\u00eb tjera.<\/p>\n

Kriptimi n\u00eb KSH S-Terra realizohet n\u00ebp\u00ebrmjet protokollit IPSec. Ne p\u00ebrdorim algoritmin \"Kuznechik\" n\u00eb p\u00ebrputhje me GOST R 34.12-2015, dhe p\u00ebr kompatibilitet me versione m\u00eb t\u00eb vjetra, mund t\u00eb aplikohet GOST 28147-89. Autentifikimi mund t\u00eb b\u00ebhet teknikisht si n\u00eb \u00e7el\u00ebsat e paracaktuar (PSK), ashtu edhe n\u00eb certifikata. Megjithat\u00eb, n\u00eb p\u00ebrdorimin industrial, \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrdoren certifikatat e l\u00ebshuara sipas GOST R 34.10-2012.<\/p>\n

Puna me certifikata, kontejner\u00eb dhe CRL b\u00ebhet p\u00ebrmes utilitetit cert_mgr<\/b>. E para q\u00eb duhet b\u00ebr\u00eb \u00ebsht\u00eb p\u00ebrdorimi i komand\u00ebs cert_mgr create<\/b> p\u00ebr t\u00eb formuar nj\u00eb kontejner t\u00eb \u00e7el\u00ebsit privat dhe nj\u00eb k\u00ebrkes\u00eb p\u00ebr certifikat\u00ebn, e cila do t\u00eb d\u00ebrgohet n\u00eb Qend\u00ebr e Menaxhimit t\u00eb Certifikatave. Pas marrjes s\u00eb certifikat\u00ebs, ajo duhet s\u00eb bashku me certifikat\u00ebn e rr\u00ebnj\u00ebs t\u00eb CA dhe CRL (n\u00ebse p\u00ebrdoret) t\u00eb importohet me komand\u00ebn cert_mgr import<\/b>. Verifikoni q\u00eb t\u00eb gjitha certifikatat dhe CRL jan\u00eb instaluar me komand\u00ebn cert_mgr show<\/b>.<\/p>\n

Pas instalimit t\u00eb suksessh\u00ebm t\u00eb certifikatave, kaloni n\u00eb konsol\u00ebn Cisco-like p\u00ebr t\u00eb konfiguruar IPSec.
\nKrijojm\u00eb nj\u00eb politik\u00eb IKE, n\u00eb t\u00eb cil\u00ebn specifikohen algoritmet dhe parametrat e d\u00ebshiruara p\u00ebr krijimin e nj\u00eb kanali t\u00eb sigurt, t\u00eb cilat do t\u00eb ofrohen p\u00ebr miratim nga partneri. <\/p>\n

#crypto isakmp policy 1000
\n#encr gost341215k
\n#hash gost341112-512-tc26
\n#authentication sign
\n#group vko2
\n#lifetime 3600<\/p>\n

Kjo politik\u00eb aplikohet gjat\u00eb nd\u00ebrtimit t\u00eb faz\u00ebs s\u00eb par\u00eb t\u00eb IPSec. Rezultati i kalimit me sukses t\u00eb faz\u00ebs s\u00eb par\u00eb \u00ebsht\u00eb vendosja e SA (Association Security).
\nM\u00eb pas, na nevojitet t\u00eb p\u00ebrcaktojm\u00eb list\u00ebn e IP adresave t\u00eb burimit dhe marr\u00ebsit (ACL) p\u00ebr enkriptimin, t\u00eb formojm\u00eb nj\u00eb grup transformimesh (transform set), t\u00eb krijojm\u00eb nj\u00eb hart\u00eb kriptografike (crypto map) dhe ta lidhim at\u00eb me nd\u00ebrfaqen e jashtme t\u00eb KSh. <\/p>\n

Caktojm\u00eb ACL:
\n#ip access-list extended site1
\n#permit gre host 10.111.21.3 host 10.111.22.3<\/p>\n

Grupi i transformimeve (p\u00ebr faz\u00ebn e par\u00eb, p\u00ebrdorim algoritmin e enkriptimit \"Kuznec\" duke p\u00ebrdorur modalitetin e krijimit t\u00eb n\u00ebnshkrimeve):<\/p>\n

#crypto ipsec transform-set GOST esp-gost341215k-mac<\/p>\n

Krijojm\u00eb nj\u00eb hart\u00eb kriptografike, specifikojm\u00eb ACL, grupin e transformimeve dhe adres\u00ebn e partnerit:<\/p>\n

#crypto map MAIN 100 ipsec-isakmp
\n#match address site1
\n#set transform-set GOST
\n#set peer 10.111.22.3<\/p>\n

Lidhim hart\u00ebn kriptografike me nd\u00ebrfaqen e jashtme t\u00eb KSh:<\/p>\n

#interface GigabitEthernet0\/0
\n#ip address 10.111.21.3 255.255.255.0
\n#crypto map MAIN<\/p>\n

P\u00ebr enkriptime t\u00eb kanaleve me vende t\u00eb tjera, nevojitet t\u00eb p\u00ebrs\u00ebrisim procedur\u00ebn e krijimit t\u00eb ACL dhe hart\u00ebs kriptografike, duke ndryshuar emrin e ACL, adresat IP dhe numrin e hart\u00ebs kriptografike.<\/p>\n

Vini re! <\/u><\/b>N\u00eb rast se nuk p\u00ebrdoret verifikimi i certifikatave p\u00ebrmes CRL, kjo duhet t\u00eb specifikohet qart\u00eb:<\/p>\n

#crypto pki trustpoint s-terra_technological_trustpoint
\n#revocation-check none<\/p>\n

Monitorojm\u00eb \"sh\u00ebndetin\" e sistemit<\/h2>\n

\nN\u00eb KSH S-Terra p\u00ebr monitorimin p\u00ebrdoret demon standard snmpd. P\u00ebrve\u00e7 parametrave tipik\u00eb p\u00ebr Linux, S-Terra \"nga fabrika\" mb\u00ebshtet l\u00ebshimin e t\u00eb dh\u00ebnave p\u00ebr tunel\u00ebt IPSec n\u00eb p\u00ebrputhje me CISCO-IPSEC-FLOW-MONITOR-MIB, t\u00eb cil\u00ebn e p\u00ebrdorim p\u00ebr t\u00eb ndjekur gjendjen e tunel\u00ebve IPSec. Gjithashtu mb\u00ebshtetet funksionaliteti i OID-ve t\u00eb personalizuara q\u00eb japin si vlera rezultatet nga ekzekutimi i skriptit. Kjo mund\u00ebsi na lejon t\u00eb ndjekim skadimin e certifikatave. Skripti i shkruar parse daljen e komand\u00ebs cert_mgr show<\/b> dhe si rezultat jep numrin e dit\u00ebve deri n\u00eb skadimin e certifikatave lokale dhe rr\u00ebnj\u00ebsore. Ky proces \u00ebsht\u00eb i paz\u00ebvend\u00ebsuesh\u00ebm gjat\u00eb administrimit t\u00eb nj\u00eb numri t\u00eb madh t\u00eb KSH.
\n\"Kriptimi
\n<\/p>\n

Cila \u00ebsht\u00eb thelbi i k\u00ebtij kodimi?<\/h2>\n

\nE gjith\u00eb funksionaliteti i p\u00ebrshkruar m\u00eb sip\u00ebr mb suportuar \"nga kutia\" nga KSH S-Terra. Pra, nuk ishte e nevojshme t\u00eb instaloheshin asnj\u00eb module shtes\u00eb q\u00eb mund t\u00eb ndikonin n\u00eb certifikimin e kriptoportave dhe n\u00eb akreditimin e t\u00eb gjith\u00eb sistemit informatik. Kanalet nd\u00ebrmjet vendeve mund t\u00eb jen\u00eb t\u00eb ndryshme, madje edhe p\u00ebrmes internetit. <\/p>\n

Fal\u00eb faktit se gjat\u00eb ndryshimit t\u00eb infrastruktur\u00ebs s\u00eb brendshme nuk \u00ebsht\u00eb e nevojshme rikonfigurimi i kriptoporteve, sistemi funksionon si nj\u00eb sh\u00ebrbim<\/b>, q\u00eb \u00ebsht\u00eb shum\u00eb e p\u00ebrshtatshme p\u00ebr klientin: ai mund t\u00eb vendos\u00eb sh\u00ebrbimet e tij (klient dhe server) n\u00eb \u00e7do adres\u00eb, dhe t\u00eb gjitha ndryshimet do t\u00eb kalojn\u00eb dinamikisht mes pajisjeve shifruese. <\/p>\n

Sigurisht, enkriptiimi p\u00ebr shkak t\u00eb kostove shtes\u00eb (overhead) ndikon n\u00eb shpejt\u00ebsin\u00eb e transmetimit t\u00eb t\u00eb dh\u00ebnave, por n\u00eb m\u00ebnyr\u00eb t\u00eb pap\u00ebrfillshme \u2014 kapaciteti i kanalit mund t\u00eb zvog\u00eblohet maksimum 5\u201410%. Teknologjia \u00ebsht\u00eb testuar dhe ka treguar rezultate t\u00eb mira edhe n\u00eb kanalet satelitore, t\u00eb cilat jan\u00eb mjaft t\u00eb paq\u00ebndrueshme dhe kan\u00eb kapacitet t\u00eb ul\u00ebt. <\/p>\n

Igor Vinokhodov, inxhinier i nivelit t\u00eb dyt\u00eb t\u00eb administrat\u00ebs \"Rostelecom-Solar\"<\/i>
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442 \u0438\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u043f\u043e \u0441\u0435\u0442\u0438 \u043f\u0435\u0440\u0441\u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u043f\u043e\u0434\u043b\u0435\u0436\u0430\u0449\u0443\u044e \u0437\u0430\u0449\u0438\u0442\u0435 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c, \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e \u0413\u041e\u0421\u0422\u0443. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c, \u043a\u0430\u043a \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0442\u0430\u043a\u043e\u0435 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0448\u043b\u044e\u0437\u0430 (\u041a\u0428) S-Terra \u0443 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u043e\u0432. \u042d\u0442\u0430 \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430 \u0418\u0411-\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c, \u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0430\u043c \u0438 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u043e\u0440\u0430\u043c. \u0413\u043b\u0443\u0431\u043e\u043a\u043e \u043f\u043e\u0433\u0440\u0443\u0436\u0430\u0442\u044c\u0441\u044f \u0432 \u043d\u044e\u0430\u043d\u0441\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29260,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39000","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Enkriptohemi sipas GOST: udh\u00ebzues p\u00ebr konfigurimin e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0435\u0439 t\u00eb trafikut | ProHoster","description":"N\u00ebse kompania juaj.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0428\u0438\u0444\u0440\u0443\u0435\u043c\u0441\u044f \u043f\u043e \u0413\u041e\u0421\u0422\u0443: \u043f\u0430\u043c\u044f\u0442\u043a\u0430 \u043f\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u0432\u0430\u0448\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/shifruemsya-po-gostu-pamyatka-po-nastrojke-dinamicheskoj-marshrutizatsii-trafika","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:16+00:00","article:modified_time":"2019-10-31T19:27:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39000","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 15:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:58:40","updated":"2026-02-04 15:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/39000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=39000"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/39000\/revisions"}],"predecessor-version":[{"id":156680,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/39000\/revisions\/156680"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/29260"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=39000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=39000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=39000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

P\u00ebr k\u00ebt\u00eb konfigurim, mund ta konsideroni t\u00eb p\u00ebrfunduar. N\u00eb daljen e komandave t\u00eb konsol\u00ebs si Cisco-like show crypto isakmp sa<\/b> dhe show crypto ipsec sa<\/b> duhet t\u00eb reflektohen fazat e para dhe t\u00eb dyta t\u00eb nd\u00ebrtimit IPSec. K\u00ebto t\u00eb dh\u00ebna mund t\u00eb merren gjithashtu me komand\u00ebn sa_mgr show<\/b>, e cila ekzekutohet nga debian sh\u0435ll. N\u00eb daljen e komand\u00ebs cert_mgr show<\/b> duhet t\u00eb shfaqen certifikatat e vendeve t\u00eb larg\u00ebta. Statusi i k\u00ebtyre certifikatave do t\u00eb jet\u00eb remote<\/b>. N\u00ebse tunelit nuk krijohen, \u00ebsht\u00eb e nevojshme t\u00eb kontrolloni logun VPN<\/a>-sh\u00ebrbimit, i cili ruhet n\u00eb skedarin \/var\/log\/cspvpngate.log<\/b>. Lista e plot\u00eb e skedareve log me p\u00ebrshkrimin e p\u00ebrmbajtjes s\u00eb tyre \u00ebsht\u00eb e pranishme n\u00eb dokumentacion.<\/p>\n