RouterOS OpenVPN da NPS: saita user-auth-method, ba auth ba

RouterOS na iya isa NPS da shigar OpenVPN sannan a ƙi shi, kuma sanadin da aka saba shi ne saiti biyu waɗanda sunayensu duka suna kama da tabbatarwa. Ɗaya yana zaɓar digest na sirri don tunnel; ɗayan yana yanke yadda ake gabatar da bayanan shaidar mai amfani ga RADIUS. Canza digest ba zai taɓa mai da buƙatar PAP zuwa MS-CHAPv2 ba, duk sau nawa aka sake kunna sabis ɗin. Jerin bincike da ke ƙasa ya raba biyun, sannan ya bi shiga ɗaya da ya gaza ta cikin manufar NPS da ta yi hukunci a kansa.

Mataki 1: karanta saitin biyun kafin canza ɗaya

Buga ingantaccen tsarin sabar OpenVPN a kan router ɗin da ke ƙare tunnel ɗin, ba daga ajiya ba ko saƙon dandalin da aka kwafa ba. Filayen biyu da kuke buƙata yawanci suna cikin menu ɗaya kuma ana karanta su kamar zaɓuɓɓuka ne. Ba haka ba ne: ɗaya ya shafi tashar bayanai, ɗayan kuma ya shafi musayar bayanan shaidar.

/interface ovpn-server server print
/interface ovpn-server server export

Filin auth yana lissafa digest kamar sha1 da sha256 kuma yana sarrafa HMAC da ke tabbatar da fakitin tunnel. Filin user-auth-method yana zaɓar pap ko mschap2 kuma yana yanke yadda router ɗin ke gabatar da bayanan shaidar mai amfani ga RADIUS. Canjin digest ba zai iya canza halin na biyu ba, shi ya sa wannan ƙin ɗin ke wanzuwa bayan kowane gyara na farko.

Tsaya a nan idan sigar ku ba ta bayyana user-auth-method kwata-kwata ba. Tsofaffin gine-ginen RouterOS ƙila ba sa bayar da shi a sabar OpenVPN, kuma gyaran ya kasance cikin sigar da za ku iya tallafawa, ba cikin umarnin da aka kwafa daga sabuwa ba.

Mataki 2: nemo manufar da ta ƙi shiga ɗin da gaske

A gefen NPS, ana kimanta buƙatar haɗi bisa manufofin cibiyar sadarwa, kuma hanyar tabbatarwa da aka ambata a manufar da ta dace dole ta kasance ɗaya daga waɗanda abokin ciniki ya bayar da gaske. Haɗa shiga ɗaya da ya gaza ta lokaci da mai amfani maimakon karanta jimillar ƙididdiga. Log ɗin tsaro yana rubuta buƙatun da aka yarda da waɗanda aka ƙi tare da lambar dalili, wanda ke gaya muku fiye da layin kuskure na gama-gari na router.

Get-WinEvent -LogName Security -MaxEvents 200 |
  Where-Object { $_.Id -in 6272,6273 } |
  Format-List TimeCreated,Id,Message

Karanta abubuwa uku a cikin abin da ya faru: sunan manufar da ta dace, hanyar tabbatarwa da lambar dalili. Manufar da ke buƙatar MS-CHAPv2 tana ƙin buƙatar PAP koda kalmar sirri daidai ce, kuma manufar da ke buƙatar asusun yanki tana ƙin na gida. Shigar abokin ciniki na RADIUS kuma dole ya dace da adireshin tushen router, in ba haka ba ana watsar da buƙatar kafin a tuntuɓi kowace manufa. Babu ɗaya daga cikin waɗannan da ke bayyana a log ɗin OpenVPN.

Tsaya a nan idan buƙatar ba ta taɓa isa NPS ba. Wannan matsala ce ta sirrin da aka raba, adireshin abokin ciniki ko UDP 1812, kuma canza hanyoyin tabbatarwa ba zai gyara ta ba.

Mataki 3: canza hanya ɗaya, a ɓangarorin biyu

Idan tsarin da aka amince da shi MS-CHAPv2 ne, saita shi a router ɗin kuma tabbatar da manufar da ta dace ta karɓe shi. Canza ɓangare ɗaya, sake gwadawa, sannan canza ɗayan; canza duka biyu tare yana barin ku ba za ku iya cewa wane ne ya fi muhimmanci ba.

/interface ovpn-server server set user-auth-method=mschap2
/interface ovpn-server server print
/log print where topics~"radius"

Kada ku kunna kowace hanya mafi rauni a NPS don kuskuren ya ɓace. Backend ɗin dole ya riƙe kayan da zaɓaɓɓiyar hanyar za ta iya tabbatarwa: MS-CHAPv2 yana buƙatar samun kalmar sirri ko yankin, kuma manufa ba za ta iya ƙirƙirar wannan kayan ba. Faɗaɗa manufar yana faɗaɗa abin da mai hari zai iya gwadawa a kan asusu ɗaya. Rubuta hanyar, sunan manufar da ma'anar canjin tare, domin na gaba ya gaji shawara maimakon zato.

Bar tabbatar da takardar shaidar tunnel ɗin daidai yadda yake. Hanyar bayanan shaidar ba ta maye gurbin asalin sabar ba, kuma rage duban TLS don gwaji ya wuce yana musanya matsala da mafi muni.

Mataki 4: gwada shiga uku da izini ɗaya

Gwada mai amfani da aka yarda da shi, kalmar sirri mara kyau da mai amfani da aka ware, kowanne a cikin sabon zama. Na farko yana tabbatar da hanya, na biyu yana tabbatar da cewa duban bayanan shaidar gaskiya ne, na uku kuma yana tabbatar da manufar har yanzu tana ware waɗanda ya kamata. Zaman da aka ajiye a cache na iya ɓoye duka ukun, don haka cire haɗin tsakanin yunƙuri.

/log print where topics~"ovpn"
/radius monitor 0

Nasarar tabbatarwa ba ita ce ƙarshen jerin ba. Duba adireshin da abokin ciniki ya samu da albarkatun da wannan adireshin zai iya isa, domin mai amfani na iya tabbatarwa daidai sannan ya faɗa cikin tafki mara kyau. Idan adireshin da aka sanya ba daidai ba ne, matsalar tana cikin bayanin martaba ko halayen amsar RADIUS, ba cikin hanyar ba. Tabbatar da duka biyun kafin rufe tikit ɗin.

Jerin binciken ya cika lokacin da saitin router da manufar NPS suka ambaci hanya ɗaya, mai amfani da aka yarda ya haɗa da sabon zama, an ƙi kalmar sirri mara kyau, mai amfani da aka ware ya kasance a ware, kuma adireshin da aka sanya ya dace da tafkin da aka nufa. Duk abin da bai kai haka ba yana barin shiga na gaba ga kwatsam.