Ƙara mai amfani cikin rukunin VPN ba ya ba da izini shi kaɗai
Kasancewa cikin rukuni sharadi ne, ba izini ba. Dubi abin da ƙofar ta haɗa da gaske, karanta rikodin karɓa ko ƙi, kuma gwada duka sakamakon.
Ka saka asusun cikin rukunin da ya dace, shiga ya yi nasara, amma har yanzu ana ƙin haɗin, ko ya haɗa kuma bai isa wani abu mai amfani ba. Abin da aka saba yi shi ne ƙara mai amfani cikin ƙarin rukuni har wani abu ya sassauta, kuma haka ƙungiyoyi suke bayar da fiye da abin da tikitin ya nema. Kasancewa cikin rukuni shigarwa ɗaya ce cikin shawarar izini, ba ita kanta shawarar ba: ƙofar tana tattara ƴan bayanai game da zaman, tana daidaita su da manufa mai tsari, sannan ta yanke shawarar abin da zaman zai iya taɓawa. Idan wani sharadi ya kasa, canza rukuni ba ya canza kome sai fallalar ka.
Kasancewa cikin rukuni sharadi ne, ba izini ba
A cikin RADIUS rukuni yana zuwa a matsayin sifa ta izini, kuma sifofi suna bayyana zaman maimakon ba da izini. Sabar tana amsawa da Access-Accept ko Access-Reject; idan ta karɓa tana iya haɗa Filter-Id, Class ko sifofin tunnel daga RFC 2868, kuma kayan cibiyar a wancan gefen suna fassara su yadda masana’anta ya yanke. Babu abin da ke cikin ka’idar da ke mai da rukuni zuwa cikakken izini; wanda ya saita manufa a ƙofar ko sabar shiga cibiyar ne ke rubuta wannan daidaitawa.
Shi ya sa sunan rukuni ɗaya yake yin daban a tsarin biyu. Microsoft NPS yana gina manufofin cibiyar daga sharodoji, iyaka da saituna kuma yana tantance su cikin tsari da aka tsara. OpenVPN Access Server yana da nasa tsarin rukuni da dokokin shiga, yayin da sabar OpenVPN ta al’umma sau da yawa tana ba da dukan tambayar ga rubutun client-connect ko fayil na client-config-dir. Kowanne yana cinye rukuni; babu wanda ke raba dabarar fifiko ta ɗayan.
Dokar da ta dace ce ke yanke hukunci, ba rukunin da ka zata ba
Yawancin injuna suna tsayawa a manufar farko da ta dace ko mafi ƙayyadaddun. Idan manufa 3 ta ƙi kuma manufa 7 ta yarda, zaman na iya kasawa ba tare da ta taɓa isa dokar da za ta bar ta ta wuce ba. Tsari saiti ne na gaske a NPS da yawancin kayan sarrafa shiga cibiyar, kuma yana motsawa cikin shekaru.
Sharodojin da ke tafiya tare da rukuni su ne rabin sauran. Yanayin na’ura, hanyar tabbatarwa, MFA da aka kammala, cibiyar tushe, batun takardar shaida ko taga lokaci na iya kasancewa cikin manufa ɗaya. Idan ɗaya bai cika ba manufar ba ta dace, injin ya faɗi, kuma ana amfani da ƙin da aka saba.
Bayanan littafin adireshi suna haifar da wannan ruɗi. Manufar da ta dace da kasancewa cikin rukunin Windows tana karanta SID a cikin alamar mai amfani, kuma a can ana lissafa rukunin tsaro kawai, rukunin rarraba ba ya bayyana.
Karanta rikodin karɓa ko ƙi kafin ka taɓa rukuni
Tambaya ɗaya da farko: shin buƙatar ta isa matakin izini ko kaɗan? A NPS amsar tana cikin rikodin abubuwan da suka faru, inda 6272 ke rubuta izinin da aka bayar, 6273 ƙi, da 6274 buƙatar da sabar ta watsar kafin tantance manufa. Waɗannan lambobi uku suna raba matsalar zuwa bincike uku daban-daban, kuma ɗaya ne kawai game da rukuni.
| What the record shows | What it means | Where to look next |
|---|---|---|
| 6272, access granted | Authentication and authorization both succeeded | Routes, split tunnel, DNS, per-resource rules |
| 6273, access denied | A policy matched and denied, or nothing matched and the default denied | The conditions of the policy that fired, in order |
| 6274, request discarded | The request never reached authorization | Shared secret, NAS client entry, proxy chain, malformed attributes |
Idan ba a sami rikodin ba, tambayi sabar kai tsaye ka karanta abin da ta mayar. Amsa marar Filter-Id kuma marar sifofin tunnel tana nuna sabar tana ɗaukan zaman a matsayin na yau da kullum kuma ƙofar tana amfani da nata dokoki. Amsa mai sifofin da wurin aiwatarwa ba ya aiwatarwa wata matsala ce: izini ya wuce kuma na’urar ta yi watsi da sakamakon.
radtest alice 'password' 10.0.0.5 0 testing123Kwatanta sifofin da aka mayar da waɗanda ƙofar ke rubutawa, ba abin da sunan rukuni ke nunawa ba. Wannan kwatancen yawanci yana raba matsalar manufa daga matsalar aiwatarwa.
Canjin rukuni ba ya aiki a baya
Ana mayar da sifofin izini sau ɗaya, lokacin tabbatar da zaman. Ƙofar tana ajiye su a zaman kuma ba ta sake karanta littafin adireshi ga kowane fakiti, shi ya sa zaman da aka kafa yana ci gaba bayan ka cire wani daga rukuni.
Don canjin ya yi aiki ana buƙatar sabuwar shawarar izini, ba sabbin makullai kawai ba. Inda sabar ke goyon bayan izini mai motsi RFC 5176, Disconnect-Request ko CoA-Request zuwa UDP 3799 na tilasta a sake tantance zaman; in ba haka ba ka cire abokin haɗin ka bar shi ya sake haɗawa. Sake tattaunawa yana sabunta makullan tunnel kuma yawanci ba ya taɓa sakamakon izini.
Gyara sharadin, ba rukuni ba
Da zarar ka san wace manufa ta yi aiki, gyaran yawanci ƙarami ne: sake tsara ƙin da ke rufe izinin da ake so, ƙara sharadin na’ura ko MFA da ya ɓace cikin manufar da kake nufi, ko rubuta ƙaramar doka ga wannan hanya ɗaya maimakon ɗaga mai amfani cikin rukunin da ke ɗauke da wasu goma.
Ƙaramin zagaye yana kiyaye canjin da gaskiya:
- Sake haifar da ƙin da asusun asali ka rubuta ID na abin da ya faru kafin ka canza kome.
- Canza abu ɗaya, tsarin manufa, sharadi ɗaya ko rukuni ɗaya, ka rubuta wanne.
- Buɗe sabon zaman, tabbatar izinin ya bayyana a rikodin kuma hanyar tana buɗewa da gaske.
- Gwada mai amfani wanda ya kamata a ƙi har yanzu, don gyaran bai faɗaɗa manufar da gangan ba.
Idan izinin daidai ne kuma hanyar ba ta buɗewa, matsalar ta koma ga tuƙi ko warware suna a lokacin da izinin ya wuce. Ka raba waɗannan matsalolin biyu, tikitin na gaba zai ɗauki minti ba da rana.