Ukuklama amathephulethi e-AD CS emisebenzini yegeyithiye ye-VPN nekhasimende

I-CA yebhizinisi ingakhipha zonke izitifiketi ezidingwa yi-VPN ngaphandle kokuba yona ngokwayo ibe igeyithiye. Umsebenzi wokuklama ukunquma ukuthi uhlangothi ngalunye kufanele kufakazele ini, bese kuba ukuthi iyiphi ithephulethi engakhipha isiqinisekiso esifakazela khona lokho. Ngiqala ngethebula lezindima, ngikopa ithephulethi efanele esikhundleni sokuhlela elikhona endaweni yalo, ngibeka umthombo wesihloko ngendima ngayinye, ngishicilela umphumela ku-CA ekhiphayo, futhi ngibhalisa i-pilot eyodwa ngaphambi kokuba othile ayenze ngokuzenzakalelayo. Isinyathelo ngasinye esingezansi yindawo lapho i-CA esebenzayo isakhiqiza khona isitifiketi i-VPN ezokwenqaba.

Bhala ithebula lezindima ngaphambi kokuvula ikhonsoli yamathephulethi

Izindima ezimbili, izinhloso ezimbili. Igeyithiye ifakazela ubunikazi besevisi, ngakho isitifiketi sayo sidinga i-Server Authentication (1.3.6.1.5.5.7.3.1), ukusetshenziswa kokhiye kwesiginesha yedijithali nokubethela kokhiye, kanye negama lomsingathi amakhasimende ashayela kulo egameni elihlukile lesihloko. Amakhasimende aziqinisekisa ngezitifiketi adinga i-Client Authentication (1.3.6.1.5.5.7.3.2) nobunikazi obuhambisana nalokho igejithiye elikulindele ekuhloleni kwalo uhlangothi olunye. Isitifiketi somsebenzisi nesitifiketi sekhompyutha akushintsheki, ngoba zihlala ezindaweni zokugcina ezihlukile futhi zisetshenziswa izinqubo ezihlukile.

Bhala amakholomu amane endimeni ngayinye: ubunikazi obufanele buvele, inhloso, umsebenzisi wokhiye, kanye nokuthi ukhije ungaphuma yini emshinini. Lelo thebula linquma isikhombisi ngasinye ngokuhamba kwesikhathi, futhi yilo osinika umhloli. Ukuqinisekiswa kwamakhasimende ngephasiwedi kuyigatsha elihlukile: uma igejithiye liqinisekisa abasebenzisi ngezifakazelo, ukusatshalaliswa kwezitifiketi zekhasimende kunezela umsebenzi ngaphandle kokunezela ubufakazi.

Kopa ithephulethi esikhundleni sokuhlela elabiwe

Qala ngethephulethi elinenhloso ecishe ilungile, njenge-RAS and IAS Server yegejithiye noma i-Computer kumadivayisi ajoyine isizinda, bese uyalikopa futhi unikeze ikhophi igama elisho ukuthi yenzelwe ini. Ukwandisa ithephulethi osekuvele lisetshenziswa ezinye izinsiza ukushintsha okwephula into engahlobene emasontweni ayisithupha. Kukhophi, setha izinqubomgomo zohlelo lokusebenza kunhloso evela kuthebula lezindima, gcina ukusetshenziswa kokhiye kuhambisana nakho, khetha i-algorithm nobude bokhiye obamukelwa amagejithiye akho, futhi uphawule ukhije oyimfihlo njengongakwazi ukuthunyelwa ngaphandle ngaphandle uma idivayisi idinga ukuwuthumela ngaphandle ukuze iwususe.

Ukuvumeleka nokuvuselelwa nakho kungokwethephulethi. Impilo emfushane kulula ukuyihoxisa futhi inzima ukuyiqhuba; ende yehlisa umsebenzi wokubhalisa futhi yandisa isikhathi sokuchayeka kokhiye ophuzile. Khetha inombolo ongayivikela, futhi qaphela ukuthi ukuvumeleka kwe-CA uqobo nesikhathi sokuvuselela sethephulethi kungafinyeza umphumela.

Nquma ukuthi isihloko sivela kuphi

Kukhompyutha noma umsebenzisi wesizinda, akha isihloko kusukela olwazini lwencwadi yokubhalisa ukuze umfakisicelo angakwazi ukuthayipha igama. Kugejithiye elingajoyinanga isizinda, noma idivayisi okunikezwa ubunikazi bayo ngaphandle kwe-AD, ithephulethi lidinga indlela yokucela elawulwayo esikhundleni salokho. Ukunika amandla isihloko namagama ahlukile anikezwa umfakisicelo kuyisinqumo sangempela: akusona imvume yokuthi wonke obhalisiwe afune noma yiliphi igama, futhi inqubomgomo yohlangothi lwe-CA kusafanele isho ukuthi ubani angacela nokuthi buphi ubufakazi obudingekayo.

I-Windows IKEv2 iqinile lapha. Isitifiketi segejithiye siqhathaniswa negama elilungiswe ikhasimende, ngakho igama le-DNS kufanele libe khona lapho ikhasimende likufuna khona, ngokuvamile ukufakwa kwe-dNSName egameni elihlukile lesihloko. Ukucisha ukuhlola igama noma ukuhlola inhloso ukuze isitifiketi esingahambisani sisebenze kususa ukuhlola obekuzobamba ukungahambisani ekukhiqizeni.

Shicilela ithephulethi, bese unciphisa izimvume

Ukwakha into yethephulethi ku-AD DS nokulishicilela ku-CA ekhiphayo kuyimisebenzi ehlukene, eyenziwa kumakhonsoli ahlukene. Shicilela ikhophi kukhonsoli ye-Certification Authority ngaphansi kwe-Certificate Templates, bese uqinisekisa emugqeni womyalo ukuthi i-CA manje iyalinikezela:

certutil -CATemplates
certutil -TCAInfo

Izimvume zilandelile. Nikeza i-Read ne-Enroll emaqenjini okufanele alicele futhi akukho okunye, gcina ukufinyelela kokufunda kwe-CA uqobo, futhi unikeze i-Autoenroll kuphela lapho ukubhaliswa okuzenzakalelayo kuhloswe futhi kusekelwa inqubomgomo yokuthunyelwa eyenza kusebenze. Isikhombisi esthephulethini asibhalisi lutho sodwa, futhi ithephulethi elishicilelwe ngaphandle kwemvume yokubhalisa lenza ingosi ebalayo isitifiketi bese inqaba isicelo.

Bhalisa i-pilot eyodwa kumsebenzisi wangempela

Cela isitifiketi kumongo ozosisebenzisa, bese uhlola okubuyile esikhundleni sokuthemba igama lefayela. Isitifiketi somsebenzisi siwela endaweni yokugcina yomsebenzisi wamanje futhi esekhompyutha endaweni yokugcina yekhompyutha yasendaweni, futhi i-MMC ikhombisa kokubili, yingakho ukubhalisa “okwasebenza” kungahlala kungabonakali kusevisi ye-VPN.

certlm.msc
certutil -dump vpn-gateway.cer

Funda okukhiphiwe mayelana nesihloko, amagama ahlukile, ukusetshenziswa kokhiye okunwetshiwe kanye nochungechunge. Kugejithiye elingeyona i-Windows, thumela isicelo ngomgudu womsebenzi osekelwayo esikhundleni sokucabanga ukuthi ukubhaliswa okuzenzakalelayo kwesizinda kufinyelela kulo, futhi qinisekisa ukuthi ifomethi ethunyelwe ngaphandle yileyo umsebenzisi ayithumela ngaphakathi kanye nokhiye wayo oyimfihlo ohambisanayo. Ekugcineni, hlukanisa ukwethemba nokugunyaza: i-VPN kusafanele inqume ukuthi abaphi abasebenzisi noma amadivayisi afinyelela kuphi izinsiza, futhi ukuhoxiswa kususa ukufinyelela kuphela uma igejithiye lihlola ukuhoxiswa nhlobo. Umhlahlandlela we-Microsoft wokuphatha amathephulethi ezitifiketi uhlanganisa ikhonsoli yamathephulethi, izimvume kanye nesinyathelo sokushicilela esihlukile.