Ukufaka umsebenzisi eqenjini le-VPN akuniki ukufinyelela ngokwako
Ubulungu beqembu yisimo esisodwa, hhayi imvume. Bheka ukuthi isango lifanise ini ngempela, funda irekhodi lokwamukela noma lokwenqaba, futhi uhlole imiphumela yomibili.
I-akhawunti iseqenjini elifanele, ukungena kuphumelele, kodwa uxhumano lusalukwa noma alufinyeleli lutho olusizo. Ukwengeza amaqembu kunikeza okungaphezulu kwalokho okucelwa yithikithi. Ubulungu yisifakelo esisodwa, hhayi isinqumo: isango lixhumanisa amaqiniso nomgomo ohleliwe bese linquma. Uma omunye umbandela wehla, iqembu lishintsha kuphela ukuchayeka kwakho.
Ubulungu beqembu yisimo, hhayi imvume
Ku-RADIUS iqembu lifika njengesici sokugunyaza, futhi izici zichaza isikhathi, azikugunyazi. Iseva iphendula nge-Access-Accept noma Access-Reject futhi ingafaka i-Filter-Id, i-Class noma izici zomhubhe ze-RFC 2868. Akukho okuguqula iqembu libe ukufinyelela okuphelele.
Yikho igama elifanayo leqembu liziphatha ngendlela ehlukile ezinhlelweni ezimbili. Microsoft NPS yakha imigomo ngezimo, imikhawulo nezilungiselelo bese iyihlola ngokulandelana. OpenVPN Access Server inemodeli yayo, futhi iseva yomphakathi ivamise ukunikela konke ku-client-connect noma i-client-config-dir.
Umthetho ofanile unquma, hhayi iqembu obulilindele
Injini eziningi zima kumgomo wokuqala ofanayo noma ocacile kakhulu. Uma umgomo 3 wenqaba futhi umgomo 7 uvuma, isikhathi singasehluleka ngaphambi kokufika kumthetho obekuzovumela.
Izimo ezihamba neqembu ziyingxenye yesibili: isimo sedivayisi, indlela yokuqinisekisa, i-MFA eqediwe, inethiwekhi yomthombo, isihloko sesitifiketi noma iwindi lesikhathi. Uma esisodwa singekho, umgomo awufani futhi kusebenza ukwenqaba okuzenzakalelayo.
Imininingwane yedatha yokubhalisa idala umbono ofanayo. Umgomo we-Windows group ufunda ama-SID kutokheni, lapho kukhona amaqembu okuphepha kuphela; iqembu lokusabalalisa alibonakali.
Funda irekhodi lokwamukela noma lokwenqaba ngaphambi kokuthinta iqembu
Buza okukodwa kuqala: ingabe isicelo safika esigabeni sokugunyaza? Ku-NPS, u-6272 ubhalisa ukufinyelela okunikeziwe, u-6273 ukwenqaba, kanti u-6274 isicelo esachithwa ngaphambi kokuhlolwa. Lezi zinombolo ezintathu zihlukanisa inkinga ibe uphenyo oluthathu, futhi olulodwa kuphela lumayelana namaqembu.
| What the record shows | What it means | Where to look next |
|---|---|---|
| 6272, access granted | Authentication and authorization both succeeded | Routes, split tunnel, DNS, per-resource rules |
| 6273, access denied | A policy matched and denied, or nothing matched and the default denied | The conditions of the policy that fired, in order |
| 6274, request discarded | The request never reached authorization | Shared secret, NAS client entry, proxy chain, malformed attributes |
Uma irekhodi lingafinyeleleki, buza iseva ngqo futhi ufunde impendulo. Ngaphandle kwe-Filter-Id nezici zomhubhe, iseva ibona isikhathi njengesijwayelekile futhi isango lisebenzisa imithetho yalo.
radtest alice 'password' 10.0.0.5 0 testing123Qhathanisa izici ezibuyisiwe nalezo ezibhalwe yisango, hhayi lokho okushiwo igama leqembu. Lokho kuhlukanisa inkinga yomgomo nenkinga yokuphoqelela.
Ushintsho lweqembu alusebenzi emuva
Izici zokugunyaza zibuyiswa kanye kuphela lapho isikhathi siqinisekiswa. Isango lizigcina esikhathini futhi alifundi idatha yokubhalisa kuwo wonke amaphakethe, ngakho isikhathi esisunguliwe siyaqhubeka ngemva kokukhipha umuntu eqenjini.
Ukuze ushintsho lusebenze kudingeka isinqumo esisha sokugunyaza, hhayi izikhiya ezintsha kuphela. Uma iseva isekela i-RFC 5176, i-Disconnect-Request noma i-CoA-Request ku-UDP 3799 iphoqa ukuhlolwa kabusha.
Lungisa isimo, hhayi iqembu
Uma wazi ukuthi wuphi umgomo osebenzile, ukulungisa kuvamise ukuba kuncane: hlela kabusha ukwenqaba okumboza imvume ehlosiwe, engeza isimo sedivayisi noma se-MFA esingekho, noma bhala umthetho omncane wensiza eyodwa.
Umjikelezo omfushane ugcina ushintsho luthembekile:
- Phinda ukwenqaba nge-akhawunti yasekuqaleni futhi bhala i-ID yomcimbi ngaphambi kokushintsha noma yini.
- Shintsha into eyodwa, ukulandelana kwemigomo, isimo esisodwa noma iqembu elilodwa, futhi bhala ukuthi yikuphi.
- Vula isikhathi esisha, qinisekisa ukuthi imvume iyavela erekhodini nokuthi insiza iyavuleka ngempela.
- Hlola umsebenzisi okufanele asenqatshwe, ukuze ukulungisa kungakhulisi umgomo.
Uma imvume ilungile kodwa insiza ingavuleki, inkinga isidlulele ekuhambiseni noma ekuxazululeni amagama ngesikhathi ukugunyaza kudlula.