Recentemente, quando abbiamo iniziato a contribuire a un progetto ospitato su GitHub, abbiamo osservato che ci sono problemi con la connessione in modo sicuro:
$ ssh -T [email protected]
Connection closed by 192.30.253.112 port 22
Abbiamo dovuto ripetere il tentativo di connessione più volte all'inizio di ogni giorno, e poi ha funzionato per il resto della giornata. Abbiamo contattato il dipartimento IT e hanno detto qualcosa del genere: "OK, aggiungeremo il filtro per non decodificare le chiavi ssh per GitHub". Da allora GitHub sta funzionando bene, ma ho paura di usare il computer all'interno della rete aziendale anche per aprire la mia email.
Altro esempio relativo a ssh:
$ ssh -v ******@*****.home.pl
OpenSSH_7.6p1 Ubuntu-4, OpenSSL 1.0.2n 7 Dec 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to *****.home.pl [***.***.220.52] port 22.
debug1: Connection established.
debug1: identity file /home/goto/.ssh/id_rsa type 0
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/goto/.ssh/id_ed25519-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_7.6p1 Ubuntu-4
debug1: Remote protocol version 2.0, remote software version HomeSSH-v1.2
debug1: no match: HomeSSH-v1.2
debug1: Authenticating to *****.home.pl:22 as '*****'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: aes128-ctr MAC: hmac-sha2-256 compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: hmac-sha2-256 compression: none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:iiQ18jC************dyxJJ4FhOWK/1o
The authenticity of host '*****.home.pl (***.***.220.52)' can't be established.
ECDSA key fingerprint is SHA256:iiQ18jC*********dyxJJ4FhOWK/1o.
Oggi volevo usare NordVPN per poter usare tranquillamente la mia e-mail privata, ma anche lì ho un problema di connessione:
$ sudo openvpn /etc/openvpn/ovpn_tcp/us327.nordvpn.com.tcp.ovpn
Mon Jul 9 13:26:42 2018 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 10 2018
Mon Jul 9 13:26:42 2018 library versions: OpenSSL 1.1.0g 2 Nov 2017, LZO 2.08
Enter Auth Username: **********
Enter Auth Password: **********
Mon Jul 9 13:26:55 2018 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Mon Jul 9 13:26:55 2018 NOTE: --fast-io is disabled since we are not using UDP
Mon Jul 9 13:26:55 2018 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 9 13:26:55 2018 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Jul 9 13:26:55 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]104.145.235.35:443
Mon Jul 9 13:26:55 2018 Socket Buffers: R=[87380->87380] S=[16384->16384]
Mon Jul 9 13:26:55 2018 Attempting to establish TCP connection with [AF_INET]104.145.235.35:443 [nonblock]
Mon Jul 9 13:26:56 2018 TCP connection established with [AF_INET]104.145.235.35:443
Mon Jul 9 13:26:56 2018 TCP_CLIENT link local: (not bound)
Mon Jul 9 13:26:56 2018 TCP_CLIENT link remote: [AF_INET]104.145.235.35:443
Mon Jul 9 13:27:56 2018 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Jul 9 13:27:56 2018 TLS Error: TLS handshake failed
Mon Jul 9 13:27:56 2018 Fatal TLS error (check_tls_errors_co), restarting
Mon Jul 9 13:27:56 2018 SIGUSR1[soft,tls-error] received, process restarting
Mon Jul 9 13:27:56 2018 Restart pause, 5 second(s)
Mon Jul 9 13:28:01 2018 WARNING: --ping should normally be used with --ping-restart or --ping-exit
Mon Jul 9 13:28:01 2018 NOTE: --fast-io is disabled since we are not using UDP
Mon Jul 9 13:28:01 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]104.145.235.35:443
Mon Jul 9 13:28:01 2018 Socket Buffers: R=[87380->87380] S=[16384->16384]
Sono sicuro che sia correlato ad alcuni criteri aziendali e impostazioni sul firewall. La domanda è che il dipartimento IT stia facendo lì e quali sono le minacce alla sicurezza correlate a ciò. Il mio traffico web SSL è esposto? Cosa posso fare per utilizzare l'accesso a Internet sicuro (o come collegare NordVPN)?