blocks|key|4266549|text|一个问题是，身份验证确保只有受信任的设备才能在网络上交换路由。如果不进行身份验证，则可能会引入不受信任的设备并导致重大的路由问题。例如：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4266550|如果未对区域0进行身份验证，则将区域0中的路由器与伪造的路由附加到null0。您甚至可以创建一个默认路由，并将其注入到拓扑中，从而导致糟糕的路由器到黑洞流量。或者，该路由可能会迫使流量流向一个伪造的网关，该网关的目的是在正确的路径上发送连接和提取不安全的数据。|4266551|身份验证确保只有您所知道和信任的路由器才能交换信息。|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|H|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|I|8|@]|9|@]|A|$]]]|F|$]]

One issue is that authentication ensures that only trusted devices are capable of exchanging routes on the network. Without authentication, you could introduce a non-trusted device and cause significant routing issues. For example:

If area 0 is not authenticated, attach a router in area 0 with bogus routes to null0. You could even create a default route and inject it into the topology leading to the bad router to black hole traffic. Or the route could force traffic toward a bogus gateway designed to sniff connections and pull out insecure data before sending it on the right path.

Authentication ensures that only routers you know about and trust are exchanging information.

blocks|key|3122395|text|这取决于您的网络拓扑结构。如果非被动链路是孤立的(点到点)，并被固定在堆栈的较低层(路由器的物理访问控制)，那么我将很难确定一个可行的攻击矢量。当流氓路由器能够在给定的链路上显示任意流量时，身份验证是至关重要的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|4|5|6|7|C|8|@]|9|@]|A|$]]]|B|$]]

It depends on your network topology. If the non-passive links are isolated (point-to-point) and secured at lower layers of the stack (physical access control of the routers), then I would be hard pressed to identify a viable attack vector. Authentication is critical when it is possible for a rogue router to present arbitrary traffic on a given link.

blocks|key|4266447|text|如果有人能够访问实际的设备，并以某种方式将另一个设备插入到链路的远端，那么他们就可以访问您的网络，将路由插入到您的路由表和其他类似的讨厌的东西中。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4266448|这样的场景在一些地方是非常理论的，比如在安全位置的骨干网络，但是如果连接到客户或另一个第三方，某种形式的身份验证可能是非常明智的。|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|E|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|F|8|@]|9|@]|A|$]]]|D|$]]

If anyone were to gain access to the actual equipment and somehow insert another device to the far end of the link, that would give them access to your network, to inject routes into your routing table and other nasty stuff like that.

A scenario like this would be very theoretical in places such as backbone networks that are in secured locations, but should the link go to a customer or to another third party, some sort of authentication would probably be very wise.

blocks|key|4266575|text|如果我们假设您的层1-3比OSPF更安全，那么认证就没有任何意义了。但是由于第1-3层并不一定是安全的，所以OSPF采用了自己的安全方法--身份验证。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4266576|OSPF中的身份验证防止攻击者嗅探和注入数据包以欺骗路由器和修改OSPF拓扑。例如，当攻击者改变拓扑结构时，MITM可能发生这样的情况，即某些/所有流量通过由他控制的机器。当攻击者丢弃流经他的流量时，拒绝服务。另一个结果可能是所有路由器崩溃时，攻击者很快宣布新的信息，虽然这可以部分解决通过调整SPF定时器。|4266577|身份验证还可以防止重放攻击，例如，它防止攻击者发布过去过期的信息。此外，它还通过插入另一个具有现有OSPF配置的网络的路由器来防止混乱，例如，可以注入重叠的路由(因此，即使您的第1-3层安全了，身份验证也是好的)。|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|H|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|I|8|@]|9|@]|A|$]]]|F|$]]

If we make an assumption that your layers 1-3 are secure than OSPF authentication doesn't make any sense. But because layer 1-3 are not necessarily secure OSPF employs it's own security method - authentication.

Authentication in OSPF prevents an attacker who can sniff and inject packets to fool routers and modify OSPF topology. Results are for example: possible of MITM when attacker changes the topology in such way that certain/all traffic flows through machine controlled by him. Denial of service when the attacker discards traffic which flows through him. Another result could be meltdown of all routers when attacker announces new information very rapidly, although this could be partially solved by tuning SPF timers.

Authentication also prevents replay attacks, for example it prevents attacker from advertising expired information from past. Also it prevents mayhem by plugging a router from another network with existing OSPF configuration which could inject overlapping routes for example (thanks to this, authentication is good even if you have your layer 1-3 secured).

blocks|key|4266697|text|可以加密OSPF吗？|type|blockquote|depth|inlineStyleRanges|entityRanges|data|4266698|OSPFv2只支持身份验证。即使使用身份验证，仍然可以看到LSA的有效负载。身份验证所做的唯一事情就是验证邻居。没有有效载荷加密。|unstyled|4266699|RFC+4552:|header-two|4266700|OSPF+(开放最短路径优先)版本2在其协议头中定义了字段AuType和身份验证，以提供安全性。在OSPF+for+IPv6+(OSPFv3)中，两个身份验证字段都从OSPF标头中删除。OSPFv3依赖于IPv6身份验证头(AH)和封装安全有效载荷(ESP)的IPv6来提供完整性、身份验证和/或机密性。|4266701|所以，如果是OSPFv3，我们可以用IPSec来保护整个包。|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$]]|$1|E|3|F|5|G|7|O|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|P|8|@]|9|@]|A|$]]|$1|J|3|K|5|D|7|Q|8|@]|9|@]|A|$]]]|L|$]]

<blockquote>
 Is it possible to encrypt OSPF?
</blockquote>

OSPFv2 only supports authentication. You can still see the LSAs payload even if you use authentication. The only thing authentication does is authenticate neighbors. There is no payload encryption.

RFC 4552:

<blockquote>
 OSPF (Open Shortest Path First) Version 2 defines the fields AuType and Authentication in its protocol header to provide security.
 In OSPF for IPv6 (OSPFv3), both of the authentication fields were removed from OSPF headers. OSPFv3 relies on the IPv6 Authentication Header (AH) and IPv6 Encapsulating Security Payload (ESP) to provide integrity, authentication, and/or confidentiality.
</blockquote>

So, if OSPFv3 we can ecrypt entire packet by IPSec.

blocks|key|4266626|text|一旦将接口设置为被动接口，就不会有太多的开放。身份验证确实添加了两个可能的向量来解决问题：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4266627|CPU利用率-这不一定是一个大问题，但不应该忘记当你做你的计算。但是，如果您运行的网络的收敛时间比您想要的时间更长，那么每一点都很重要。|4266628|故障排除。它很容易错过一些东西，这可以减缓新的连接，更换路由器，等等。|4266629|如果您担心OSPF被监听，并且有恶意的入侵者注入数据，那么您可能会运行一些比身份验证更强的东西:从运行实际加密开始，而不是使用OSPFv2获得的薄弱的OSPFv2，而BGP更适合于不受信任的链接。|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|J|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|K|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|L|8|@]|9|@]|A|$]]]|H|$]]

Once you have interfaces set to passive, you're not open to much. Authentication does add two possible vectors for trouble: 

CPU utilization - this isn't necessarily a huge issue, but shouldn't be forgotten when you're doing your calculations. However, if you are running a network where convergence times take longer than you want, every little bit counts.

Troubleshooting. It's easy to miss something, and that can slow down bringing up a new connection, replacement router, etc. 

If you're worried about getting OSPF sniffed and having a malicious intruder inject data, you should probably be running something stronger than authentication: start with running actual encryption rather than the weak MD5 you're going to get with OSPFv2, and BGP is better for untrusted links.

I know that to secure OSPF you should 1) use OSPF authentication, 2) use passive interface command on interfaces that do not have ospf neighbors. If I only use the passive interface command and not ospf authentication, what vulnerabilities am I left open to?

Securing OSPF with only passive interfaces

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我知道要保护OSPF，您应该使用OSPF身份验证，2)在没有ospf邻居的接口上使用被动接口命令。如果我只使用被动接口命令而不使用ospf身份验证，那么还存在哪些漏洞？

问仅用被动接口保护OSPF
EN

回答 6

Network Engineering用户

Network Engineering用户

Network Engineering用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问仅用被动接口保护OSPFEN

回答 6

Network Engineering用户

Network Engineering用户

Network Engineering用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问仅用被动接口保护OSPF
EN