Okokuqala indlela ye-EAP: iyiphi i-hash yephasiwedi i-VPN engayisebenzisa
I-VPN iqinisekisa imfihlo, hhayi i-hash yewebhu. Funda indlela, bese uhlola ukuthi isitoreji sivikele ini ngaphambi kokuthembisa ukuthi amaphasiwedi afanayo azoqhubeka esebenza.
Amaqembu amaningi anokungena kwewebhu okusebenzayo kanye ne-VPN enqaba yonke iphasiwedi evela kulelo thebula. Uhlelo lwewebhu luqhathanisa i-hash eluyibale ngokwalo, kuyilapho umhubhe ucela iklayenti ukuthi lifakaze ukuthi liphethe imfihlo ngendlela iseva okumele ikwazi ukuyiqinisekisa. Lezi zidingo ezihlukene mayelana nempahla egciniwe. Isikhala phakathi kwalezi zinto zombili yilapho iningi lalawa maphrojekthi lima khona.
Funda indlela, bese kuba isikimu
Bhala ukuthi iyiphi ubufakazi indlela ekhethiwe eyidingayo ngaphambi kokubheka noma yisiphi isikimu. Indlela yenselelo-nempendulo idinga impahla iseva engabala impendulo elindelekile kuyo, okusho empeleni iphasiwedi noma isimo esisuselwe esihambisana nayo. Indlela ethwala iphasiwedi ngaphakathi komhubhe ovikelisiwe idinga iphasiwedi ngokwayo kumqinisekisi. Funda imibhalo yendlela ngenxa yesidingo somqinisekisi hhayi ngokuhlelwa kweklayenti, ngoba izidingo zeklayenti ngokuvamile ziyingxenye elula.
I-hash enosawoti ekhiqizwa uhlaka lwewebhu lwesimanjemanje ayikunikezi kokubili. Iqinisekisa ukuqhathanisa okukodwa okuthile futhi ayikwazi ukubuyiselwa emfihlweni eyavela kuyo.
Inselelo-nempendulo ayikwazi ukusebenzisa i-hash enosawoti
I-MSCHAPv2 iwukushintshana kwenselelo-nempendulo, ngakho iseva ayilitholi neze iphasiwedi futhi ayikwazi ukuqhathanisa umucu ogciniwe. Kumele ikhiphe impendulo elindelekile empahleni eseyinayo, yingakho izimo ezigciniwe ezihambisanayo ziwumkhawulo kangaka. Inani le-bcrypt noma le-Argon2 elinosawoti kumsebenzisi ngamunye lihamba ngendlela eyodwa ngendlela ekhipha ngokuphelele ukushintshana. Ithebula elingezansi liqala esimweni sokugcina hhayi egameni lendlela, ngoba isimo sokugcina yiso esinquma impendulo.
| What the store holds | What that material can verify | What has to change |
|---|---|---|
| A bcrypt or Argon2 value with a per-user salt | nothing challenge-response can use, and not the password either | re-enrol the users, or place a verifying service in front |
| An unsalted NT-hash | MSCHAPv2, and inner PAP through a TLS tunnel | nothing, as long as that store is the verifier |
| A client certificate with a revocation list | EAP-TLS only | move enrolment and revocation to the PKI owner |
Imibhalo yesengezo se-SQL ye-strongSwan ichaza isikimu sayo sokuhlela nobufakazi, futhi iphrojekthi isakha uphawu lokuthi leso sengezo siwukuhlola. Akukho lutho kuyo oluzivumelanisa nethebula labasebenzisi bohlelo noma oluqagelayo ukuthi yiluphi uhlelo lwe-hashing olukhiqize inani eligciniwe. Ngakho izinketho ezingokoqobo ukuwukuthutha endaweni yokugcina i-VPN engayisebenzisa, noma isevisi yokuqinisekisa phambi kwendawo yokugcina ekhona engenza ukushintshana. Noma yini enye iyisixhumi esinomqondo ocashile ngaphakathi kwaso.
I-RADIUS ihambisa umsebenzi, hhayi isidingo
Ukudlulisela i-EAP kuseva ye-RADIUS kushintsha lapho ukuqinisekisa kwenzeka khona futhi ngokuvamile kuthuthukisa umkhondo wokucwaninga. Akubuyisi iphasiwedi kusuka ku-hash yendlela eyodwa, ngakho isevisi yokuqinisekisa isadinga impahla ehambisana nendlela eyiqedayo. Amaqembu akuthola lokhu ngemva kokwakha indlela ye-RADIUS nokuhlangana nodonga olufanayo ngaphesheya.
Lapho iseva ye-RADIUS ingafunda uhla olunobufakazi obuhambisanayo, umklamo uyasebenza futhi isango le-VPN lihlala lilula. Lapho ingakwazi, impendulo eqotho ukushintsha kokubhalisiwe hhayi esinye isixhumi. Ukuhlinzeka nokuhoxiswa kungokomuntu ophethe ubunikazi, ngakho ithebula elikopishiwe ngaphandle kwenqubo yokuvumelanisa esekelwe iwumjikelezo wesibili wokuphila kobufakazi hhayi ukungena okukodwa. Lihluka okokuqala lapho othile esetha kabusha iphasiwedi endaweni eyodwa kuphela, futhi lokho kwehluka kuthule kuze kube yilapho i-akhawunti ekhona kuzo zombili izinhlelo iziphatha ngendlela ehlukile kuyo ngayinye.
Khakhela i-akhawunti efunda uhla kuleso sifundo kuphela, futhi uyihlukanise ne-akhawunti esetshenziswa isango ekuhleleni kwayo. I-akhawunti yokuphatha eyabiwe iguqula umklamo wokufunda-kuphela ube yindawo ebanzi kakhulu yomthelela.
I-akhawunti kufanele ihlale kuphi
Lapho udaba lwempahla luxazululiwe, kusala izakhiwo ezimbili. Isango lingaba nendawo yokugcina ubufakazi encane eliyifunda yedwa, noma lingadlulisela kusevisi yokuqinisekisa emi phambi kohla lwenkampani.
Eyokuqala ilula ukucabanga ngayo futhi imbi kumsebenzisi, ogcina enephasiwedi lesibili okufanele alinakekele. Eyesibili igcina ubunikazi obubodwa futhi yengeza ukuncika kusevisi okumele manje ibe isebenza ngaphambi kokuthi noma ubani axhumane. Akukho kokubili okuyiphutha, kodwa ukukhetha kufanele kubhalwe eduze kokuhlelwa kwesango, ngoba uma kungenjalo unjiniyela olandelayo uzocabanga ukuthi okunye kukhethiwe. Noma yini oyikhethayo, imiyalo emibili engezansi yiyo ekhombisa isimo samanje ngaphambi kokushintsha.
mysql -N -e "SELECT id, username FROM vpn_users WHERE active = 1 LIMIT 5" vpn
swanctl --list-connsUkuqinisekisa i-akhawunti nakho akuxazululi ukugunyazwa. Ubulungu beqembu, isimo sedivayisi nemvume yenethiwekhi kusadinga ukuhlelwa okucacile ngemva kokuba umsebenzisi efakaze ubunikazi obudingekayo. Ukuxhumana okuqinisekisa ngokuphelele futhi kungagunyazi lutho kuwumphumela wenqubomgomo, hhayi iphutha endleleni.