Sida gelitaanka VPN uu u gaaro RADIUS iyo bixiyaha aqoonsigaaga
Raac gelitaanka VPN laga bilaabo macmiilka ilaa codsiga RADIUS ee gateway-ka, bixiyaha aqoonsiga ee ka dambeeya iyo siyaasadda la hirgeliya ka dib aqbalaadda.
Toddobaadkii hore isticmaale wuu geli karaa VPN haddana wuxuu ku dhacay shabakad aan waxba ka xallin. Macmiilku wuxuu yiri waa xiran yahay, log-ga gateway-ku wuxuu yiri Access-Accept, kooxda aqoonsiguna waxay tidhi akoonku waa hagaagsan yahay. Gelitaanku wuu shaqeeyay; fasaxa ka dambeeyay ma shaqayn. Marka gelitaanka VPN guuldareysto, waxaan maraa jidka codsigu runtii maro — macmiil, gateway, server RADIUS, bixiye aqoonsi — oo waxaan joogsadaa tallaabada ugu horeysa ee jawaabteeda aan la jaanqaadin tan xigta.
Macmiilku waligiis ma hadlo RADIUS
Wax kasta oo app-ka laptop-ka muujiyo, tallaabadiisa ugu horeysa waa borotokoolka VPN: IKEv2, OpenVPN, WireGuard ama macmiil ku saleysan TLS. RADIUS kama muuqdo isdhaafsigaas. Macmiilku wuxuu isku caddeeyaa gateway-ga iyada oo adeegsanaya shahaado, magac isticmaale iyo furaha sirta ah, ama hab EAP oo lagu qaado habaynta tunnel-ka.
Taasi waa muhiim marka log-yada la akhrinayo, sababtoo ah khaladka guud ee aqoonsiga ee isticmaaluhu arko waxaa soo saara gateway-ka ka dib markii uu horey ula hadlay wax kale. Haddii macmiilku waligiis gaari waayo gateway-ga, ma jiro codsi RADIUS la baaro, saacadna lagu qaatay server RADIUS waa lumay. Xaqiiji in tunnel-ku uu kacay ka hor inta aanad taaban backend-ka.
Gateway-ga waa macmiilka RADIUS
Marka habaynta tunnel-ku gaarto barta ay tahay in la hubiyo aqoonsiga, gateway-ga wuxuu noqdaa server gelitaan shabakadeed. Wuxuu dhisaa Access-Request: User-Name, furaha sirta ama EAP payload, NAS-IP-Address ama NAS-Identifier, iyo Message-Authenticator marka habku u baahdo. Codsigu wuxuu caadi ahaan tagaa UDP 1812, xisaabtuna 1813. Rakabyo hore ayaa wali isticmaala 1645 iyo 1646, sidaas darteed qaanuun firewall loo qoray hal lammaane ayaa sharraxaya guuldarro badan oo aamusan.
Labada dhinac waxay wadaagaan sir, mana aha aqoonsiga isticmaale. Waxay saxeexaa isdhaafsiga, jawaab kastaana waa lagu xaqiijiyaa. Sirta u habee si ka duwan labada dhinac oo server-ku kuma jawaabo sir xun — wuu tuuraa codsiga ama jawaabtu ku guuldareysataa xaqiijinta, sidaas darteed gateway-ga wuxuu soo sheegaa waqti-dhaaf. Sir khaldan iyo server dhintay ayaa gateway-ga ka muuqda si isku mid ah, sidaas darteed waxaan tallaabada ku tijaabiyaa qalab macmiil ka hor inta aanan eedayn tusmada.
Borotokoolku wuu yar yahay oo duug yahay — RFC 2865 wuxuu qeexayaa isdhaafsiga aqoonsiga — laakiin astaamaha uu qaado waa aasaaska inta badan siyaasadda VPN lagu dhisay.
# ask the RADIUS server directly, from the gateway host
radtest alice 'test-password' 127.0.0.1 0 testing123
# watch the exchange the gateway actually sends
tcpdump -ni any -c 20 'udp port 1812'Server RADIUS waxaa laga yaabaa inuu kaliya yahay wejiga hore ee bixiyaha aqoonsiga
Dadku waxay ka hadlaan RADIUS iyo bixiyaha aqoonsiga sidii sanduuq isku mid ah. Inta badan ma aha. Server RADIUS wuxuu helaa Access-Request ka dibna wuxuu weydiiyaa wax kale ka hor inta aanu jawaabin — Active Directory iyada oo loo marayo LDAP ama Kerberos, fayl isticmaale maxalli ah ama adeeg dibadeed. FreeRADIUS oo leh module LDAP ama krb5, Windows NPS iyo Cisco ISE dhammaantood waxay taagan yihiin booskan.
Farqiga ayaa go'aamiya meesha aad eegto. Furaha sirta ee la diiday waa jawaabta bixiyaha aqoonsiga oo RADIUS gudbiyo. Waqti-dhaafku caadi ahaan waa qaybta RADIUS-ilaa-tusmada: akoon bind dhacay, tusmo aan la gaari karin, ama codsi loo diray backend khaldan. Haddii magaca isticmaaluhu leeyahay daba-gelinta domain-ka, server-ku wuu ku dari karaa, isla akoonkaas oo loo diray CORP\alice iyo [email protected] wuxuu ku dhici karaa meelo kala duwan. Windows NPS dhexdiisa, log-ga Security wuxuu diiwaangeliyaa 6272 marka la bixiyo iyo 6273 marka la diido, taas oo kuu sheegta haddii go'aanku ka yimid NPS.
Akhri guuldarada tallaabada soo saartay
Hal fariin ma-xirmin-karo ayaa daboola afar guuldarro oo kala duwan. Ka hor inta aanad wax beddelin, calaamadda la jaanqaad tallaabada soo saartay.
| What you see | Where it comes from | First check |
|---|---|---|
| Gateway timeout, no reply | Shared secret mismatch, UDP 1812 blocked, unknown NAS, wrong server address | tcpdump at the gateway; radtest from the gateway host |
| Immediate reject | Credentials, account state, domain suffix, RADIUS policy | NPS 6273 or the FreeRADIUS auth log; test the account directly |
| Repeated challenge or MFA loop | Access-Challenge state not returned, or a token that expired mid-flow | Client prompt timing and the State attribute in debug output |
| Accept, then no access | Authorization attributes unmapped, wrong pool, route or ACL policy | Gateway policy and the attributes in the Access-Accept |
Sadarka ugu dambeeya waa kan dadka u dira kooxda khaldan. Access-Accept macneheedu waa aqoonsiga la aqbalay; macneheedu maaha in gateway-ga uu isticmaalaha dhigay barkada saxda ah ama uu riixay waddooyin. Astaamaha kooxdu waxay muhiim yihiin kaliya haddii siyaasadda gateway-ga ay akhrido. Waxaan arkay gelitaan sax ah oo ku dhacay barkada martida sababtoo ah khariidaynta kooxda dhinaca RADIUS waxaa loo habeeyay astaan ka duwan tan gateway-ga baaro.
Raac hal gelitaan bilow ilaa dhammaad
Dooro hal akoon tijaabo iyo hal gateway, ka dib fiiri isla isku dayga afarta dhibcood. Bilow socodka debug dhinaca RADIUS — freeradius -X wuxuu daabacaa codsiga iyo module kasta oo uu taabto — raac log-ga aqoonsiga gateway-ga, oo ordi tcpdump isdhaafsiga UDP. Hal mar ku xir oo akhri afarta raadadood si taxane ah.
Waxa aad rabto inaad aragto waa isku afgarad: gateway-ga wuxuu weyddiiyay isticmaalaha aad filaysay, server RADIUS wuxuu doortay backend-ka aad filaysay, backend-kaas wuxuu soo celiyay go'aan, astaamaha jawaabtuna waxay la jaanqaadaan siyaasadda gateway-ga hirgeliya. Meesha ugu horeysa ee raadadku isku afgaran waayaan waa khadkaaga ciladda. Haddii jawaabtu aanay qaadin astaan koox, dhibaatadu waxay ku taal dhinaca RADIUS, ma aha profile-ka VPN; haddii astaantu jirto oo gateway-ga iska indhatiro, siyaasadda gateway-ga ayaa dhibaatada ah.
Hal qoraal amni ah inta aad halkaas joogto. Sirta la wadaago waxay ilaalisaa isdhaafsiga, laakiin ma qarinayso inta badan astaamaha. Haddii gateway-ga iyo server RADIUS ay ku kala jiraan qaybo kala duwan, tallaabadaas dhig RADIUS oo TLS ah ama waddo gaar ah. Tunnel isticmaale oo sir ah waxba kama sheego xiriirka backend-ka.
Ka hor inta aanad xirto tikit-ka, xaqiiji afar shay. Gateway-ga wuxuu gaari karaa server RADIUS dekedda loo habeeyay dhab ahaan. Sirta la wadaago way isku beegan tahay labada dhinac. Server RADIUS wuxuu xalliyaa qaabka saxda ah ee magaca isticmaale ee gateway-ga soo diro. Aqbalaaddu waxay qaaddaa astaamaha ay siyaasadda gateway-ga u baahan tahay. Marka afarta oo dhan ay sax yihiin, gelitaan wali guuldareysta waa dhibaatada siyaasadda gateway-ga, ma aha aqoonsiga.