Indlela yokuqinisekisa ukuba ixesha nge-se ayixoki ukuba unesigidi esikhulu kunye nezixhobo ezincinci ezinxibelelana nge-TCP / IP? Ngapha koko, nganye kuzo inewotshi, kwaye ixesha lifanele lichaneke kubo bonke. Le ngxaki ayinakuthintelwa ngaphandle kwe-ntp.
Makhe sicinge ngomzuzu ukuba kwelinye icandelo le-IT ye-industrial infrastructure kukho ubunzima kunye neenkonzo zokuvumelanisa ngexesha. Ngoko nangoko i-cluster stack ye-Software yeShishini iqala ukungaphumeleli, imimandla iyaqhekeka, iinkosi kunye neendawo zokulinda ezingaphumeleliyo zizame ukubuyisela imeko ekhoyo.
Kwakhona kunokwenzeka ukuba umhlaseli uzama ngamabomu ukuphazamisa ixesha ngokuhlaselwa kwe-MiTM okanye iDDOS. Kwimeko enjalo, nantoni na inokwenzeka:
- Iiphasiwedi zeakhawunti yomsebenzisi ziyakuphelelwa;
- Izatifikethi ze-X.509 ziya kuphelelwa lixesha;
- I-TOTP yoqinisekiso lwezinto ezimbini iya kuyeka ukusebenza;
- ii-backups ziya kuphelelwa lixesha kwaye inkqubo iya kuzicima;
- I-DNSSec iya kwaphuka.
Kucacile ukuba isebe ngalinye le-IT linomdla ekusebenzeni okuthembekileyo kweenkonzo zokuvumelanisa ixesha, kwaye kuya kuba kuhle ukuba zithembeke kwaye zikhuselekile ekusebenzeni kwezoshishino.
Yaphula i-NTP kwimizuzu engama-25
Iiprothokholi zeNethiwekhi - iimillennials zinento eyodwa eyodwa, ziye zaba kwaye azisalungelanga nantoni na, kodwa ukuzibuyisela endaweni yazo akulula kangako naxa inyambalala yabantu abanomdla kunye nenkxaso-mali iqokelelwe.
Esona sikhalazo siphambili malunga ne-NTP yakudala kukunqongophala kweendlela ezithembekileyo zokukhusela kuhlaselo lwabangeneleli. Kuye kwenziwa iinzame ezahlukeneyo zokusombulula le ngxaki. Ukufezekisa oku, siqale sasebenzisa isitshixo ekwabelwana ngaso ngaphambili (PSK) indlela yokutshintshiselana ngezitshixo zesymmetric.
Ngelishwa, le ndlela ayizange ihlawule ngesizathu esilula - ayilingani kakuhle. Uqwalaselo lweManuwali luyafuneka kwicala lomxhasi ngokuxhomekeke kumncedisi. Oku kuthetha ukuba awukwazi ukongeza omnye umxhasi ngolo hlobo. Ukuba kukho into etshintshayo kumncedisi we NTP, bonke abaxumi kufuneka baqwalaselwe kwakhona.
Emva koko beza ne-AutoKey, kodwa ngokukhawuleza bafumanisa inani lobuthathaka obunzulu kuyilo lwe-algorithm ngokwayo kwaye kwafuneka bayilahle. Into kukuba imbewu iqulethe i-32-bits kuphela, incinci kakhulu kwaye ayinayo i-computational complex computational uhlaselo olungaphambili.
- I-ID engundoqo - i-symmetric 32-bit key;
- I-MAC (ikhowudi yokuqinisekisa umyalezo) - i-NTP ipakethe checksum;
I-Autokey ibalwa ngolu hlobo lulandelayo.
Autokey=H(Sender-IP||Receiver-IP||KeyID||Cookie)Apho i-H () ngumsebenzi we-cryptographic hash.
Umsebenzi ofanayo usetyenziselwa ukubala i-checksum yeepakethi.
MAC=H(Autokey||NTP packet)Kuyavela ukuba yonke imfezeko yokuhlolwa kwephakheji ixhomekeke kubunyani beekuki. Nje ukuba unazo, unokubuyisela i-autokey kwaye emva koko ukhuphe i-MAC. Nangona kunjalo, iseva ye-NTP isebenzisa imbewu xa ivelisa. Kulapho kubanjwe khona.
Cookie=MSB_32(H(Client IP||Server IP||0||Server Seed))Umsebenzi we-MSB_32 usika awona masuntswana abalulekileyo angama-5 kwisiphumo sokubala se-md32 hashi. Icookie yomxhasi ayitshintshi nje ukuba iiparamitha zeseva zihlala zingatshintshi. Emva koko umhlaseli unokubuyisela kuphela inani lokuqala kwaye akwazi ukuzimela ngokuzimeleyo ii-cookies.
Okokuqala, kufuneka uqhagamshele kwiseva ye-NTP njengomthengi kwaye ufumane iikuki. Emva koku, usebenzisa indlela ye-brute force, umhlaseli ubuyisela inani lokuqala ngokulandela i-algorithm elula.
I-algorithm yokuhlasela ukubalwa kwenani lokuqala usebenzisa indlela ye-brute-force.
for i=0:2^32 − 1 do
Ci=H(Server-IP||Client-IP||0||i)
if Ci=Cookie then
return i
end if
end forIidilesi ze-IP ziyaziwa, ngoko konke okuseleyo kukwenza i-2^32 hashes de icookie eyenziwe ifane naleyo ifunyenwe kwiseva ye-NTP. Kwisikhululo sasekhaya esiqhelekileyo kunye ne-Intel Core i5, oku kuya kuthatha imizuzu engama-25.
I-NTS-iqhosha elitsha le-Auto
Kwakungenakwenzeka ukunyamezela loo mingxuma yokhuseleko kwi-Autokey, kwaye ngo-2012 yavela iprotocol. Ukuze babeke esichengeni igama, bagqiba ekubeni babuyisele igama, ngoko ke i-Autokey v.2 yabizwa ngokuba yi-Network Time Security.
Iprotocol ye-NTS lulwandiso lokhuseleko lwe-NTP kwaye okwangoku ixhasa kuphela imowudi ye-unicast. Inika ukhuseleko oluluqilima lwe-cryptographic ngokuchasene nokuguqulwa kwepakethi, inqanda ukukrola, ukukala kakuhle, iyakwazi ukumelana nokulahleka kwepakethi yenethiwekhi, kwaye iphumela kubuncinci belahleko echanekileyo eyenziwe ngexesha lokhuseleko lonxibelelwano.
Uqhagamshelo lwe-NTS lunezigaba ezibini ezisebenzisa umaleko osezantsi. Vula yokuqala Kweli nqanaba, umxhasi kunye nomncedisi bayavumelana kwiiparameters ezahlukeneyo zoqhagamshelwano kunye nokutshintshiselana ngeekuki eziqulethe izitshixo kunye nayo yonke isethi yedatha ehamba kunye. Vula Isibini Kweli nqanaba, eyona seshoni ye-NTS ekhuselweyo yenzeka phakathi komxhasi kunye nomncedisi we-NTP.
I-NTS iqulathe iiprothokholi ezimbini ezisezantsi: Utshintshiselwano lweXesha loKhuseleko lweXesha leNethiwekhi (NTS-KE), oluqalisa uqhagamshelo olukhuselekileyo phezu kwe-TLS, kunye ne-NTPv4, ukuzalwa okutsha kwe-NTP protocol. Okunye okuncinci malunga noku ngezantsi.
Inqanaba lokuqala - NTS KE
Kweli nqanaba, umxhasi we-NTP uqalisa iseshoni ye-TLS 1.2/1.3 ngaphezulu koqhagamshelwano lwe-TCP olwahlukileyo kunye nomncedisi we-NTS KE. Ngexesha lale seshini oku kulandelayo kwenzeka.
- Amaqela amisela iiparamitha i-algorithm yenqanaba lesibini.
- Amaqela achaza iprotocol yesibini esezantsi, kodwa okwangoku kuphela i-NTPv4 exhaswayo.
- Amaqela amisela idilesi ye-IP kunye nesibuko seseva ye-NTP.
- Iseva ye-NTS KE ikhupha iikuki phantsi kwe-NTPv4.
- Amaqela akhupha iperi yezitshixo ze-symmetric (i-C2S kunye ne-S2C) kwizinto eziphathekayo ze-cookie.
Le ndlela inenzuzo enkulu yokuba wonke umthwalo wokudlulisa ulwazi oluyimfihlo malunga neeparitha zoqhagamshelwano ziwela kwiprotocol ye-TLS eqinisekisiweyo nethembekileyo. Oku kuphelisa isidingo sokuphinda uqalise ivili lakho lokuxhawula izandla ngokukhuselekileyo kwe-NTP.
Inqanaba lesibini - i-NTP phantsi kokhuseleko lwe-NTS
Kwinqanaba lesibini, umxhasi ungqamanisa ngokukhuselekileyo ixesha kunye neseva ye-NTP. Ngenxa yale njongo, ihambisa izandiso ezine ezikhethekileyo (imimandla yokwandisa) kwisakhiwo sepakethe ye-NTPv4.
- Ulwandiso lweSazisi esilulodwa luqulethe i-nonce engakhethiyo yokuthintela uhlaselo lokudlala kwakhona.
- I-NTS Cookie Extension iqulethe enye yeekuki ze-NTP ezifumanekayo kumxhasi. Ekubeni kuphela umxhasi une-symmetric AAED C2S kunye ne-S2C izitshixo, iseva ye-NTP kufuneka ikhuphe kwizinto ze-cookie.
- I-NTS Cookie Placeholder Extension yindlela yokuba umxhasi acele iikuki ezongezelelweyo kwiseva. Olu lwandiso luyimfuneko ukuze kuqinisekiswe ukuba impendulo yeseva ye-NTP ayinde kakhulu kunesicelo. Oku kunceda ukuthintela uhlaselo lokukhulisa.
- IsiQinisekiso se-NTS kunye neNdawo Enoguqulelo Oluntsonkothileyo Isolulo seNdawo iqulethe i-AAED cipher eneqhosha le-C2S, i-header ye-NTP, izitampu zexesha, kunye ne-EF engentla njengedatha ekhaphayo. Ngaphandle kolu lwandiso kuyenzeka ukonakalisa izitampu zexesha.
Ekufumaneni isicelo kumxhasi, umncedisi uqinisekisa ubunyani bepakethi ye-NTP. Ukwenza oku, kufuneka akhuphe i-cookies, akhuphe i-algorithm ye-AAED kunye nezitshixo. Emva kokujonga ngempumelelo ipakethe ye-NTP yokuqinisekisa, umncedisi uphendula umxhasi ngendlela elandelayo.
- Ukwandiswa kweSichongi esisodwa yikopi yesipili yesicelo somthengi, umlinganiselo ngokuchasene nohlaselo lokudlala kwakhona.
- I-NTS Cookie Extension cookies ezininzi ukuqhubeka neseshoni.
- IsiQinisekiso se-NTS kunye neNdawo Efihliweyo Eyongezelelweyo Eyongeziweyo iqulethe i-AEAD cipher eneqhosha le-S2C.
Ukuxhawula isandla okwesibini kunokuphinda kuphindwe kaninzi, kudlula inyathelo lokuqala, ekubeni isicelo ngasinye kunye nempendulo inika umxhasi icookies ezongezelelweyo. Oku kunenzuzo yokuba imisebenzi ye-TLS enzima kakhulu ye-computing kunye nokudlulisa idatha ye-PKI yahlulwe ngenani lezicelo eziphindaphindiweyo. Oku kulungele ngokukodwa abagcini bexesha beFPGA abakhethekileyo, xa yonke imisebenzi engundoqo inokupakishwa ibe yimisebenzi emininzi ukusuka kummandla we-symmetric cryptography, ukudlulisela isitakhi sonke seTLS kwesinye isixhobo.
NTPSec
Yintoni ekhethekileyo nge-NTP? Ngaphandle kwento yokuba umbhali weprojekthi, uDave Mills, wazama ukubhala ikhowudi yakhe kangangoko kunokwenzeka, ngumdwelisi wenkqubo onqabileyo oya kukwazi ukuqonda ubucukubhede be-algorithms yokuvumelanisa ixesha elineminyaka engama-35 ubudala. Enye ikhowudi yabhalwa ngaphambi kwexesha le-POSIX, kwaye i-Unix API ngoko yahluke kakhulu kwinto esetyenziswayo namhlanje. Ukongeza, ulwazi lwezibalo luyafuneka ukucima umqondiso ekuphazamisekeni kwimigca enengxolo.
I-NTS yayingelomzamo wokuqala wokulungisa i-NTP. Nje ukuba abahlaseli bafunde ukuxhaphaza ukuba semngciphekweni kwe-NTP ukukhulisa uhlaselo lwe-DDoS, kuye kwacaca ukuba utshintsho olumandla luyafuneka. Kwaye ngelixa iidrafti ze-NTS zazilungiswa kwaye zigqityezelwa, iSiseko seSayensi yeSizwe sase-US ekupheleni kuka-2014 sabelwa ngokukhawuleza isibonelelo sokuphucula i-NTP.
Iqela elisebenzayo lalingakhokelwa nguye nabani na, kodwa - omnye wabaseki kunye neentsika zoluntu lwe-Open Source kunye nombhali wencwadi . Into yokuqala u-Eric kunye nabahlobo bakhe bazama ukuyenza kukuhambisa ikhowudi ye-NTP kwiqonga le-BitKeeper ukuya kwi-git, kodwa ayizange isebenze ngaloo ndlela. Inkokeli yeprojekthi uHarlan Stenn wayechasene nesi sigqibo kwaye uthetha-thethwano lwamiswa. Emva koko kwagqitywa ukuba kufakwe ikhowudi yeprojekthi, kwaye i-NTPSec yazalwa.
Amava aqinileyo, kubandakanya umsebenzi kwi-GPSD, imvelaphi yezibalo kunye nobuchule bomlingo bokufunda ikhowudi yakudala - u-Eric Raymond wayengumgqekezi onokuthi akhuphe iprojekthi enjalo. Iqela lifumene ingcali yokufuduka kwekhowudi kwaye kwiiveki nje ze-10 ze-NTP kwiGitLab. Umsebenzi wawuqhubela phambili.
Iqela lika-Eric Raymond lathatha umsebenzi ngendlela efanayo naleyo u-Auguste Rodin wenzayo ngebhloko yamatye. Ngokususa i-175 KLOC yekhowudi endala, bakwazi ukunciphisa kakhulu indawo yokuhlaselwa ngokuvala imingxuma emininzi yokhuseleko.
Nalu uluhlu olungaphelelanga lwabo baqukwe kunikezelo:
- I-refclock engabhalwanga, ephelelwe lixesha, ephelelwe lixesha okanye eyaphukileyo.
- Ithala leencwadi le-ICS elingasetyenziswanga.
- libopts/autogen.
- Ikhowudi endala yeWindows.
- ntpdc.
- Autokey.
- Ikhowudi ye-ntpq C ibhalwe kwakhona kwiPython.
- Ikhowudi ye-sntp/ntpdig C ibhalwe kwakhona kwiPython.
Ukongeza kokucoca ikhowudi, iprojekthi yayineminye imisebenzi. Nalu uluhlu oluyinxenye lwempumelelo:
- Ukukhuselwa kwekhowudi ngokuchasene nokuphuphuma kwebuffer kuye kwaphuculwa kakhulu. Ukuthintela ukuphuphuma kwebuffer, yonke imisebenzi yentambo engakhuselekanga (strcpy/strcat/strtok/sprintf/vsprintf/gets) ithathelwe indawo ngeenguqulelo ezikhuselekileyo eziphumeza imida yobungakanani bebuffer.
- Inkxaso eyongeziweyo ye-NTS.
- Ukuchaneka kwenyathelo lexesha eliphuculweyo ngokuphindwe kalishumi ngokudibanisa ihardware ebonakalayo. Oku kungenxa yokuba iiwotshi zekhompyuter zanamhlanje ziye zachaneka ngakumbi kunezo zaxa kwazalwa i-NTP. Abona baxhamli abakhulu koku ibiyiGPSDO kunye noonomathotholo bexesha elizinikeleyo.
- Inani leelwimi zokucwangcisa liye lancitshiswa laya kutsho ezimbini. Endaweni yePerl, i-awk kunye nemibhalo ye-S, ngoku iyiPython yonke. Ngenxa yoku, kukho amathuba amaninzi okusetyenziswa kwakhona kwekhowudi.
- Esikhundleni se-noodle yemibhalo ye-autotools, iprojekthi yaqala ukusebenzisa inkqubo yokwakha isoftware .
- Amaxwebhu eprojekthi ahlaziyiweyo kwaye alungelelaniswe ngokutsha. Ukusuka kwingqokelela yamaxwebhu aphikisanayo kwaye ngamanye amaxesha akudala, bayile amaxwebhu afikelelekayo. Lonke utshintsho lomgca womyalelo kunye nequmrhu ngalinye loqwalaselo ngoku linoguqulelo olunye lwenyaniso. Ukongeza, amaphepha omntu kunye namaxwebhu ewebhu ngoku adalwe kwiifayile ezingundoqo ezifanayo.
I-NTPSec iyafumaneka kwinani losasazo lweLinux. Okwangoku, inguqulelo yamva nje ezinzileyo yi-1.1.8, yeGentoo Linux yeyona iphambili.
(1:696)$ sudo emerge -av ntpsec
These are the packages that would be merged, in order:
Calculating dependencies... done!
[ebuild R ] net-misc/ntpsec-1.1.7-r1::gentoo USE="samba seccomp -debug -doc -early -gdb -heat -libbsd -nist -ntpviz -rclock_arbiter -rclock_generic -rclock_gpsd -rclock_hpgps -rclock_jjy -rclock_local -rclock_modem -rclock_neoclock -rclock_nmea -rclock_oncore -rclock_pps -rclock_shm -rclock_spectracom -rclock_trimble -rclock_truetime -rclock_zyfer -smear -tests" PYTHON_TARGETS="python3_6" 0 KiB
Total: 1 package (1 reinstall), Size of downloads: 0 KiB
Would you like to merge these packages? [Yes/No]
Chrony
Bekukho enye inzame yokutshintsha i-NTP endala ngenye indlela ekhuseleke ngakumbi. I-Chrony, ngokungafaniyo ne-NTPSec, ibhaliwe ukusuka kumhlaba kwaye yenzelwe ukusebenza ngokuthembekileyo phantsi kweemeko ezininzi, kubandakanywa uxhulumaniso lwenethiwekhi olungaqinisekanga, ukufumaneka kwenethiwekhi inxalenye okanye ukuxinana, kunye nokutshintsha kweqondo lokushisa. Ukongeza, i-chrony inezinye izibonelelo:
- ikhrony inokulungelelanisa iwotshi yenkqubo ngokukhawuleza ngokuchaneka okukhulu;
- Ichrony incinci, idla inkumbulo encinci, kwaye ifikelela kwi-CPU kuphela xa ifuneka. Le yindibano enkulu yokugcina izixhobo kunye namandla;
- I-chrony ixhasa izitampu zexesha zehardware kwiLinux, ivumela ungqamaniso oluchanekileyo kakhulu kuthungelwano lwasekhaya.
Nangona kunjalo, i-chrony ayinazo ezinye zeempawu ze-NTP yakudala, ezinje ngosasazo kunye ne-multicast client/server. Ukongeza, i-NTP yakudala ixhasa inani elikhulu leenkqubo zokusebenza kunye namaqonga.
Ukuyekisa ukusebenza komncedisi kunye nezicelo ze-NTP kwinkqubo yekhronyd, bhala nje izibuko 0 kwifayile ye-chrony.conf. Oku kwenziwa kwiimeko apho kungekho mfuneko yokugcina ixesha kubaxhasi be-NTP okanye abalingane. Ukususela kwinguqulo ye-2.0, i-port ye-NTP yomncedisi ivuliwe kuphela xa ukufikelela kuvunyelwe ngumyalelo wokuvumela okanye umyalelo ofanelekileyo, okanye i-peer ye-NTP iqwalaselwe, okanye umyalelo wokusasaza usetyenziswa.
Inkqubo ineemodyuli ezimbini.
- chronyd yinkonzo eqhuba ngasemva. Ifumana ulwazi malunga nomahluko phakathi kwewotshi yenkqubo kunye nomncedisi wexesha langaphandle kwaye ihlengahlengisa ixesha lendawo. Ikwasebenzisa iNTP protocol kwaye inokusebenza njengomthengi okanye umncedisi.
- I-chronyc sisixhobo esiluncedo somgca womyalelo wokujonga inkqubo kunye nolawulo. Isetyenziselwa ukulungisa kakuhle iiparamitha zenkonzo ezahlukeneyo, umzekelo ikuvumela ukuba wongeze okanye ususe iiseva ze-NTP ngelixa i-chronyd iqhubeka nokusebenza.
Ukusukela kwinguqulelo 7 yeRedHat Linux chrony njengenkonzo yongqamaniso lwexesha. Iphakheji ikwakhona kwezinye izinikezelo zeLinux. Inguqulo yakutshanje ezinzileyo yi-3.5, ilungiselela ukukhululwa kwe-v4.0.
(1:712)$ sudo emerge -av chrony
These are the packages that would be merged, in order:
Calculating dependencies... done!
[binary N ] net-misc/chrony-3.5-r2::gentoo USE="adns caps cmdmon ipv6 ntp phc readline refclock rtc seccomp (-html) -libedit -pps (-selinux)" 246 KiB
Total: 1 package (1 new, 1 binary), Size of downloads: 246 KiB
Would you like to merge these packages? [Yes/No]
Useta njani eyakho iseva yekhrony ekude kwi-Intanethi ukulungelelanisa ixesha kwinethiwekhi yeofisi. Ngezantsi umzekelo wokumisela iVPS.
Umzekelo wokuseta iChrony kwi-RHEL / CentOS kwiVPS
Masiziqhelise kancinci kwaye simise eyethu iseva ye-NTP kwiVPS. Kulula kakhulu, khetha nje umrhumo ofanelekileyo kwiwebhusayithi ye-RuVDS, fumana iseva esele yenziwe kwaye uchwetheze ishumi elinesibini imiyalelo elula. Ngeenjongo zethu, olu khetho lufanelekile.
Masiqhubele phambili ukuseta inkonzo kwaye siqale sifake iphakheji yekhrony.
[root@server ~]$ yum install chronyI-RHEL 8 / CentOS 8 isebenzisa umphathi wephakheji eyahlukileyo.
[root@server ~]$ dnf install chronyEmva kokufaka i-chrony, kufuneka uqale kwaye uvule inkonzo.
[root@server ~]$ systemctl enable chrony --nowUkuba uyanqwena, ungenza utshintsho kwi/etc/chrony.conf, ubuyisela iiseva ze-NPT ngezona zikufutshane zendawo ukunciphisa ixesha lokuphendula.
# Use public servers from the pool.ntp.org project.
# Please consider joining the pool (http://www.pool.ntp.org/join.html).
server 0.ru.pool.ntp.org iburst
server 1.ru.pool.ntp.org iburst
server 2.ru.pool.ntp.org iburst
server 3.ru.pool.ntp.org iburst
Emva koko, siseta ungqamaniso lweseva ye-NTP kunye neenodi ukusuka kwidama elichaziweyo.
[root@server ~]$ timedatectl set-ntp true
[root@server ~]$ systemctl restart chronyd.service
Kwakhona kuyimfuneko ukuvula i-port ye-NTP ngaphandle, ngaphandle koko i-firewall iya kuvala uxhulumaniso olungenayo oluvela kwiindawo zabaxhasi.
[root@server ~]$ firewall-cmd --add-service=ntp --permanent
[root@server ~]$ firewall-cmd --reload
Kwicala lomxhasi, kwanele ukuseta ummandla wexesha ngokuchanekileyo.
[root@client ~]$ timedatectl set-timezone Europe/MoscowIfayile /etc/chrony.conf ichaza i-IP okanye igama lomninimzi weseva yethu yeVPS eqhuba iseva ye-NTP yechrony.
server my.vps.serverKwaye ekugqibeleni, ukuqala ungqamaniso lwexesha kumxhasi.
[root@client ~]$ systemctl enable --now chronyd
[root@client ~]$ timedatectl set-ntp true
Ngexesha elizayo ndiza kukuxelela ukuba zeziphi iinketho ezikhoyo zokuvumelanisa ixesha ngaphandle kwe-Intanethi.
umthombo: www.habr.com
