I-EAP ngokusebenzisa isango le-VPN: ubani oqeda indlela

Amathikithi osizo achaza ukungena kwe-VPN okuhlulekile kanye nenqubomgomo ye-RADIUS efuna indlela enamandla kakhulu njengokungathi inkinga eyodwa, kodwa akunjalo. Isango lamukela imininingwane yokungena bese iyidlulisa, noma lithwala ingxoxo ye-EAP phakathi kweklayenti nesiphakamisi sokuqinisekisa. Ukuthi yikuphi okwenzekayo kunquma ukuthi ushintsho ohlangothini lwesiphakamisi lungalungisa yini. Funda ukushintshana ngaphambi kokuhlela iqembu lesiphakamisi.

Izindlela ezimbili zokuqinisekisa ezibukeka zifana kurekhodi

Endleleni yokuqala isango le-VPN liqoqa igama lomsebenzisi nephasiwedi bese lithumela i-RADIUS Access-Request enesici sephasiwedi. Isiphakamisi sokuqinisekisa siyiqhathanisa nesitoreji saso bese siphendula ngokwamukela noma ukwenqaba. Iklayenti alikaze lisebenzise indlela ye-EAP, ngoba akukho okukucelile lokho.

Endleleni yesibili iklayenti nesiphakamisi sokuqinisekisa basebenzisa indlela ye-EAP kusukela ekuqaleni kuze kube sekugcineni, futhi isango lidlulisa izici ze-EAP-Message phakathi kwazo. Isango lisaphetha ingxoxo ye-RADIUS yangaphandle, kodwa umqondo wendlela uhlala ezinhlangothini zombili.

Zombili izindlela zikhiqiza umugqa kurekhodi othi ukuqinisekisa kuhlulekile. Yindlela yesibili kuphela engathonywa indlela ye-EAP ethandwa isiphakamisi, futhi yindlela yokuqala kuphela ethonywa indlela isango elifunda ngayo iphasiwedi. Ukuziphatha njengezingashintshana yikho okwenza amaqembu achithe usuku lonke eshintsha amaqembu esiphakamisi eklayenti elalingeke likhulume i-PEAP.

Indlela isebenza kuphi ngempela

RFC 3579 ichaza ukuhlelwa kokudlulisa: i-NAS ithwala amaphakethe e-EAP ezicini ze-RADIUS futhi ayidingi ikhodi eqondene nendlela yohlobo ngalunye lwe-EAP. Yingakho isango lingasekela i-PEAP ne-EAP-TLS ngaphandle kokusebenzisa noma yikuphi.

Isango elithumela iphasiwedi alithwali i-PEAP, ngisho noma ingemuva lingamukela i-PEAP evela kwelinye iklayenti. Ukuvula i-PEAP kunqubomgomo yesiphakamisi akwengezi ndlela eklayentini elingakaze linikeze eyodwa.

Izilungiselelo zokuqinisekisa ze-PPP ngezesevisi ye-PPP. Azilungiseleli kabusha buthule zonke izindlela ze-IPsec noma ze-XAuth endala ezisebenzisa isiphakamisi se-AAA esifanayo, ngakho ushintsho olusebenza ohlotsheni olulodwa lokufinyelela lungashiya olunye lungathintekile.

I-NAS kufanele isekele ini

Ukudlulisa kuhambisa imfuneko isuka ekhodini yendlela iye ekusekelweni komthwali. Isango kufanele likwazi ukuthwala i-EAP ngokwekhodi yalo ye-VPN, futhi iklayenti le-RADIUS eliphezu kwalo kufanele likwazi ukuthumela nokwamukela izici ze-EAP-Message ezinobukhulu obufanele.

Ku-IKEv2, i-EAP iyingxenye yokugeleza kokuqinisekisa okuchaziwe, futhi ukuhlolwa kobuwena nokuthembela kwesiphakamisi kuvela kulokho kugeleza. Ilebula le-PEAP elibolekwe ekusetshenzisweni kwe-802.1X alidluli ngokuzenzakalela, ngoba izingxoxo ezilizungezile zihlukile.

Uhlangothi lweklayenti nalo lunezimfuno. Kufanele lulungiselelwe indlela, luthembe isitifiketi sesiphakamisi esethulwa yindlela, futhi lube nemininingwane yokungena indlela engayisebenzisa. Indlela esekelwe kusitifiketi ngaphandle kwesitifiketi seklayenti yehluleka ngaphambi kokuba i-RADIUS ibone noma yini, futhi leyo yinkinga yokuhlinzeka hhayi yenqubomgomo yesiphakamisi.

Funda umzamo owodwa ngaphambi kokushintsha inqubomgomo

Thwebula umzamo owodwa ogunyaziwe esangweni nakusiphakamisi sokuqinisekisa. Bukela izici ze-EAP-Message esicelweni se-RADIUS. Ukuba khona kwazo kusho ukuthi indlela yokudlulisa iyasetshenziswa; ukungabikho kwazo kukhombisa ukushintshana kwemininingwane yokungena.

Esangweni le-Linux, ukuthwebula esiteshini se-RADIUS kukhombisa ukuthi iziphi izici ezisocingweni:

sudo tcpdump -ni any -X 'udp port 1812' -c 20

Bese uqhathanisa indawo yokwenqaba. Ukwehluleka esangweni ngaphambi kwanoma yiliphi iphakethe le-RADIUS kusho ukuthi iklayenti nesango azivumelani ngendlela. Ukwenqaba kwe-RADIUS okuthwala izici ze-EAP kusho ukuthi izinhlangothi zisebenzisile indlela futhi enye yazo yenqaba umphumela.

Hlela ukufuduka njengoshintsho olulodwa kusukela ekuqaleni kuze kube sekugcineni

Ukushintsha indlela kusho ukushintsha ndawonye ukulungiselelwa kweklayenti, ukusekelwa komthwali esangweni, inqubomgomo yendlela esiphakamisi kanye nesitoreji semininingwane yokungena. Kwenze ngalolo hlelo futhi ugcine indlela esebenzayo kuze kube yilapho entsha ifakazelwa. Ushintsho ohlangothini lwesiphakamisi kuphela luwukuqagela futhi ngokuvamile lwephula amaklayenti abesebenza. Lungiselela ushintsho kubuwena obulodwa bokuhlola ngaphambi kokuthinta iqembu.

Bhala inhlanganisela esebenzayo: iphrothokholi ye-VPN, umthwali we-EAP, indlela yomlingani, indlela yesiphakamisi, uhlobo lwemininingwane yokungena nokuhlolwa kobuwena besiphakamisi.

Hlukanisa i-AAA yokungena kokuphatha nokuqinisekisa kwe-VPN ngaphandle uma umsebenzi uhlanganisa kokubili ngokusobala. Ushintsho olwenzelwe ukufinyelela kude akufanele lukususele amandla okuphatha idivayisi elikuphethayo.