Ukuvalwa kwe-akhawunti nokuvinjelwa kwekheli: lapho i-OpenVPN ibala khona ngempela

Ukuvimba ikheli nokuvala i-akhawunti kuyizindlela ezimbili ezihlukene, futhi zehluleka ezinhlangothini eziphambene. Ukuvinjelwa kwekheli kumisa umthombo owodwa futhi i-akhawunti eqondiwe isatholakala kwenye indawo; ukuvalwa kwe-akhawunti kumisa lobo bunjalo yonke indawo, ngisho kukhompyutha yomsebenzisi uqobo.

Kwi-VPN edlulisela ukuqinisekiswa ku-PAM, isibali yilapho kufinyelela khona isitaki se-PAM, hhayi lokho okwaqoshwa umlaleli.

Izibali ezimbili, izisulu ezimbili ezihlukene

Isinqandi sesivinini sibheka umthombo futhi sibuza ukuthi zingaki izizamo eza kuwo muva nje. Ukuvalwa kubheka ubunjalo futhi kubuza ukuthi i-akhawunti iqoqe ukwehluleka okungaki. Okokuqala kuvikela ukutholakala, okwesibili ubufakazi; akukho okuthatha indawo kwesinye.

Yingakho umusho sivinja i-IP ngemuva kokwehluleka kahlanu awuyona impendulo embikweni wokugcwalisa ubufakazi. Umhlaseli ushintsha imithombo, ngamunye uthola izizamo ezimbalwa, futhi i-akhawunti ayibalwa neze. Ngokuphambene, ukuvalwa okungenakulawulwa komthombo kuvumela umhlaseli ukugcina i-akhawunti ivaliwe ngokungenamkhawulo ngokwehluleka ngamabomu.

Lezi zinto ezimbili zokulawula zinezinganekwane zokubuyisela ezihlukene. Ukuvinjelwa kwekheli kuphelelwa yisikhathi ngesibali sesikhathi okungekho muntu okufanele acabange ngaso; ukuvalwa kwe-akhawunti kungadinga umphathi, isikhathi sokulinda esibhaliwe noma ukusetha kabusha okuzisebenzelayo.

Thola isitoreji esivele sinesibalo

Ngaphambi kokwengeza noma yini, thola ukuthi isitoreji sokwehluleka sikhona yini. I-akhawunti yasekhaya ye-Linux, insizakalo yombhalo kanye nomhlinzeki wobunjalo bangaphandle ngakunye kugcina isibalo sako, futhi imojuli ye-PAM ebekwe phambi kwabo yakha eyesibili esikhundleni sokwandisa eyokuqala.

grep -rnE 'faillock|pam_tally|pam_unix' /etc/pam.d/
ls -l /etc/pam.d/ | head -20

Funda ifayela lensizakalo elishiwo yi-VPN ngempela futhi ulandele imigqa yalo yokufaka. Ezabelweni eziningi insizakalo ye-VPN ifaka ifayela elabiwe, okusho ukuthi isibalo osilungisayo sisebenza nakwi-SSH nasekungeneni kwasekhaya.

Uma umbhalo usuvele uphoqa ukuvalwa, umbuzo owusizo ukuthi ingxoxo ye-PAM ifinyelela kanjani kuleso sinqumo nokuthi i-VPN isibika kanjani. Isibalo sasekhaya esengezwe phezulu asibi isibali sombhalo, futhi izinqubomgomo ezimbili zingase zingavumelani ngokuthi i-akhawunti ivulwa nini.

I-pam_faillock inezindawo ezintathu zocingo, hhayi eyodwa

Imojuli ihlukanisa imisebenzi emithathu umugqa okopishiwe ovame ukuyifiphalalisa: ukuhlola ukuthi i-akhawunti isivaliwe yini, ukuqopha ukwehluleka nokusula umlando ngemuva kokuphumelela.

Yilapho ukufuduka kusuka kumojuli yakudala yokubala kuvame ukwehluleka khona. Ukukopisha umugqa kusuka esibonelweni pam_tally2 esisebenzayo kuya esitakini pam_faillock akukona ukuqamba kabusha; ukuhlelwa okubhaliwe kwehlukile, futhi ucingo olubekwe endaweni engalungile lungaqopha ukwehluleka ngaphandle kokukuhlola.

faillock --user alice
faillock --user alice --reset

Ithuluzi lokuhlola liyindlela eshesha kakhulu yokubona ukuthi isibali singeqiniso: likhombisa ukwehluleka okuqoshiwe kwe-akhawunti futhi lingakusula. Uma ukwehluleka okulawulwayo kungakushintshi lokho okukhishiwe, indawo yocingo ayilungile.

Igama lensizakalo elikhethekile akukona ukwehlukanisa

Ukunikeza i-VPN ifayela layo lensizakalo ye-PAM kwenza inqubomgomo ehlosiwe ibonakale, kodwa akukhawuleli umphumela. Noma yikuphi ukufakwa kwefayela elabiwe kuletha lokho okwenziwa yilelo fayela, kuhlanganise nezibalo zohlelo lonkana.

Thathela isinqumo ngokucacile ukuthi ukuvalwa kuhlanganisa kuphela ukufinyelela kwe-VPN noma yonke insizakalo eqinisekisa i-akhawunti efanayo. Zombili izimpendulo ziyavikeleka; ukwehluleka ukukholelwa ukuthi ukhethe okukodwa ngenkathi isitaki sisebenzisa okunye.

Bese ucabanga ngezindleko. Umhlaseli angabangela ukuvalwa, futhi umsebenzisi ohluphekayo ungumnikazi we-akhawunti. Umkhawulo, isikhathi sokulinda kanye nendlela yokubuyisela yokuphatha konke kuyingxenye yenqubomgomo, futhi ukubuyisela akumele kuncike ekuhlelweni kabusha kwe-VPN ngesikhathi sesehlakalo.

Yamukela ukulandelana, hhayi ukwenqatshwa okukodwa

Hlola ngobunjalo obuqokiwe ngaphansi kohlelo olugunyaziwe, futhi uhlole uchungechunge hhayi isehlakalo esisodwa: i-akhawunti evumelekile iyaqinisekisa, iphasiwedi eyenziwe ngamabomu engalungile ihambisa isibali, ukuvalwa okuhleliwe kuqala ukusebenza, futhi ukubuyisela okubhaliwe kubuyisela ukufinyelela.

faillock --user test-vpn-01
journalctl -u openvpn-server@lab -n 30 --no-pager | grep -i 'auth\|pam'

Bheka ukuziphatha kokuphumelela ngokucophelela okufanayo nokwehluleka. Uma ukungena okuphumelelayo kungasuli umlando, i-akhawunti izovalwa ngemuva kokuqoqwa kancane kwamaphutha ajwayelekile. Uma kusula konke kuyo yonke insizakalo, isibali sibuthaka kunalokho okushiwo inqubomgomo.

Ekugcineni, misa amaklayenti angagadiwe ngaphambi kokumemezela ukunqoba. Ubufakazi obugciniwe obuzama futhi ngemuva kuzokwakha futhi ukwehluleka ngemva kwemizuzu embalwa yokubuyisela futhi kuvalwe i-akhawunti futhi. Ukukhawulwa kwesivinini okusekelwe kumthombo kungahlala njengokunye ukulawula, kodwa akusona inqubomgomo ye-akhawunti.