Marka hore habka EAP: hash-ka erayga sirta ah ee VPN ay isticmaali karto
VPN waxay hubisaa sirta, ma aha hash-ka web-ka. Akhri habka, ka dibna hubi waxa kaydku hayo ka hor intaadan ballan qaadin in isla erayada sirta ah ay sii shaqeyn doonaan.
Kooxo badan waxay leeyihiin galitaan web shaqeeya iyo VPN diidda eray kasta oo sir ah oo ka yimaada isla shaxdaas. Barnaamijka web-ku wuxuu barbardhigaa hash uu isagu xisaabiyay, halka tunnel-ku ka codsado macmiilka inuu caddeeyo hantida sir ah si uu server-ku u hubin karo. Kuwani waa shuruudo kala duwan oo ku saabsan maaddada la kaydiyay. Farqiga u dhexeeya ayaa inta badan mashruucyadan halkaas ku istaaga.
Marka hore habka, ka dibna qaabka
Qor caddaynta habka la doortay uu doonayo ka hor intaadan eegin qaab kasta. Habka caqabadda-jawaabtu wuxuu u baahan yahay maaddo uu server-ku ka xisaabin karo jawaabta la filayo, taas oo ficil ahaan macnaheedu yahay erayga sirta ah ama qaab la soo saaray oo waafaqsan. Habka erayga sirta ah ku qaata tunnel la ilaaliyay wuxuu u baahan yahay erayga sirta ah laftiisa halka hubiyaha. Akhri dukumeentiga habka arrinta ku saabsan shuruudda hubiyaha, ma aha habaynta macmiilka, maxaa yeelay shuruudaha macmiilku badanaa waa qaybta fudud.
Hash cusbo leh oo ay soo saarto qaab-dhismeedka web-ka casriga ah labadaba ma bixiyo. Wuxuu hubiyaa hal barbardhiga gaar ah lamana soo celin karo sirta uu ka yimid.
Caqabad-jawaab ma isticmaali karo hash cusbo leh
MSCHAPv2 waa isdhaafsi caqabad-jawaab, sidaas darteed server-ku waligiis ma helo erayga sirta ah lamana barbardhigi karo xarig la kaydiyay. Waa inuu jawaabta la filayo ka soo saaro maaddada uu hore u hayo, taasina waa sababta qaababka kaydka ah ee waafaqsan ay u yihiin kuwo aad u cidhiidhi ah. Qiimaha bcrypt ama Argon2 oo leh cusbo isticmaale kasta waa hal jiho si uu isdhaafsiga gabi ahaanba meesha uga saaro. Shaxda hoose waxay ka bilaabataa qaabka kaydka ee ma aha magaca habka, maxaa yeelay qaabka kaydku waa kan go'aamiya jawaabta.
| What the store holds | What that material can verify | What has to change |
|---|---|---|
| A bcrypt or Argon2 value with a per-user salt | nothing challenge-response can use, and not the password either | re-enrol the users, or place a verifying service in front |
| An unsalted NT-hash | MSCHAPv2, and inner PAP through a TLS tunnel | nothing, as long as that store is the verifier |
| A client certificate with a revocation list | EAP-TLS only | move enrolment and revocation to the PKI owner |
Dukumeentiga plugin-ka SQL strongSwan wuxuu qeexayaa qaab u gaar ah habaynta iyo aqoonsiga, mashruucuna weli wuxuu plugin-kaas ku calaamadeeyaa tijaabo. Waxba gudihiisa kuma habboona shaxda isticmaalayaasha barnaamij ee lamana qiyaaso qaabka hash-ka ee soo saaray qiime la kaydiyay. Sidaas darteed xulashooyinka dhabta ah waa u guurista kayd uu irridku isticmaali karo, ama adeeg xaqiijin oo ka horreeya kaydka jira oo samayn kara isdhaafsiga. Wax kasta oo kale waa isku-xire malo qarsoon ku qoran.
RADIUS wuxuu rartaa shaqada, ma aha shuruudda
U wakilaadda EAP server RADIUS waxay beddeshaa halka xaqiijintu dhacdo oo badanaa hagaajisaa raadka hantida. Ma soo celiso eray sir ah oo ka yimid hash hal jiho ah, sidaas darteed adeegga xaqiijintu weli wuxuu u baahan yahay maaddo waafaqsan habka uu dhammeeyo. Kooxuhu waxay taas ogaadaan ka dib markay dhisaan wadada RADIUS oo ay dhanka kale kala kulmaan isla darbigaas.
Halka server RADIUS uu akhrin karo hagaha hayo aqoonsi waafaqsan, naqshaddu way shaqaysaa irridka VPN-na wuu fududaadaa. Halka uusan akhrin karin, jawaabta daacadda ah waa isbeddel diiwaangelin ee ma aha isku-xire kale. Bixinta iyo la-noqoshada waxaa leh kan hantida aqoonsiga, sidaas darteed shax la koobiyeeyay oo aan lahayn hannaan isku-dubarid la taageeray waa wareeg nololeed labaad oo aqoonsi ma aha gelitaan keliya. Waxay leexataa markii ugu horreysay ee qof erayga sirta ah dib u dejiyo hal meel oo keliya, leexashaduna way aamusnaataa ilaa akoon ka jira labada nidaam mid kasta u dhaqmo si ka duwan.
Ku xaddid akoonka akhrinaya hagaha akhriskaas oo keliya, kana sooc akoonka irridku u isticmaalo habayntiisa. Akoon maamule la wadaago wuxuu naqshadda akhris-keliya u beddelaa mid baaxad aad u ballaaran.
Halka akoonku ku noolaan karo
Marka arrinta maaddada la xalliyo, waxaa hadha laba dhismo. Irridku wuxuu yeelan karaa kayd aqoonsi yar oo isagu keliya akhriya, ama wuxuu u wakili karaa adeeg xaqiijin oo hor yimaada hagaha shirkadda.
Tan hore waa fududahay in laga fikiro lamana wanaagsana isticmaalaha, kaas oo ku dhammaanaya eray sir ah labaad uu ilaaliyo. Tan labaad waxay haysataa hal aqoonsi oo waxay ku dartaa ku-tiirsanaan adeeg ay tahay inuu hadda shaqeeyo ka hor inta qof uusan xiriirin karin. Midkoodna khalad ma aha, laakiin doorashada waa in lagu qoraa dhinaca habaynta irridka, haddii kale injineerka xiga wuxuu u malaynayaa in tan kale la doortay. Wax kasta oo aad dooratid, labada amarrood ee hoose waa kuwa muujiya xaaladda hadda ka hor inta aadan beddelin.
mysql -N -e "SELECT id, username FROM vpn_users WHERE active = 1 LIMIT 5" vpn
swanctl --list-connsXaqiijinta akoonku sidoo kale ma xalliso fasax bixinta. Xubinnimada kooxda, xaaladda qalabka iyo fasaxa shabakadda weli waxay u baahan yihiin khariidad cad ka dib marka isticmaalahu caddeeyo aqoonsiga loo baahan yahay. Xiriirka si fiican u xaqiijiya oo aan waxba fasaxin waa natiijada siyaasad, ma aha cilad habka ku jirta.