eapol_test phezu kwe-VPN: ingabe ukushintshana kwe-RADIUS kudinga isigaba 2?

Cela imbobo yeswishi yaselabhorethri ukuze ukwazi ukusebenzisa eapol_test — futhi kungenzeka ukuthi uwufunde kabi uthuluzi. I-peer neklayenti le-RADIUS zombili zihlala ngaphakathi kwaleyo bhinary eyodwa, ngakho ingxoxo eyodwa kuphela ephuma emshinini iwukushintshana kwe-RADIUS ngokwako. Ithuneli egudisiwe phakathi komsingathi wokuhlola neseva yokuqinisekisa iyisidingo sonke senethiwekhi. Indlela ebonakalayo ye-802.1X ingenye into okungenzeka usadinga ukuyihlola, futhi akusiyo lena.

Kungani igama lihambisa abantu ukuba bafune imbobo yeswishi

I-EAPOL iyisimo sefremu esetshenziswa yi-supplicant neswishi ku-LAN, futhi ithuluzi liboleka igama ngoba lakhula kusukela kulelo zwe. Okulethwayo wuhlelo lokuhlola oluthwala umshini wesimo we-peer neklayenti le-RADIUS ohlelweni olulodwa, ngakho izingxenye ezimbili zengxoxo ye-802.1X azihlangani neze ocingweni. Igama ingumlando, hhayi isidingo somumo wokuxhumana.

Abantu basacela imbobo ngoba uhlelo lusekelwe ekuziphatheni komqinisekisi, futhi lokho kuzwakala njengengxenyekazi yomshini. Isinamathiselo salo siphinda sisebenzise umshini wesimo womqinisekisi, ngakho ukuhlola kuqedwa ngaphandle kwanoma yiluphi iphuzu lokufinyelela ekamelweni; ibhinary ehlanganisiwe ixhumanisa i-EAP peer ye-wpa_supplicant neklayenti le-RADIUS le-hostapd. Ukususa iswishi kususa ukugxuma kwe-EAPOL, hhayi umqondo wokuqinisekisa. Okusalayo ukushintshana kweklayenti-neseva phakathi kwabasingathi ababili be-IP.

Landela ukushintshana kwe-RADIUS okukodwa ngokugxuma

Landela umzamo owodwa futhi indlela imfushane. eapol_test ngaphakathi i-peer ikhiqiza i-EAP-Response yendlela oyilungiselele, futhi iklayenti le-RADIUS kuhlelo olufanayo lifaka kwi-Access-Request, lithwala umthwalo kuzimiso ze-EAP-Message eceleni kwe-Message-Authenticator. Leyo dathagramu iqondiswa kuseva embotsheni ye-UDP 1812 futhi ishiya umsingathi njenganoma yiliphi elinye iphakethe le-IP, futhi yilapho ithuneli ingena khona. Iseva iyihlola ngokwemigomo yayo namamojula endlela yayo, bese iphendula nge-Access-Challenge, i-Access-Accept noma i-Access-Reject.

eapol_test -c peap-mschapv2.conf -a 198.51.100.20 -p 1812 \
  -s REPLACE_WITH_RADIUS_SECRET -t 30

Ibhinary ithatha ikheli leseva, imbobo kanye nesisusa esabiwe emgqeni womyalo, kanye nendlela nezicelo zokungena esigabeni sokulungiselela sesitayela se-wpa_supplicant. Akukho lutho kulokho kubiza okuncike ekusondelaneni kwesigaba 2: -a kufinyelelwa ngokugudiswa, futhi i-VPN eyigudisayo iyanele. Uma ithuneli ilahla idathagramu, ukuhlola kwehluleka ngendlela efanayo nakuya kuseva engafinyeleleki ku-LAN eyisicaba.

Ibhinary nomgomo wesava kuyizinhlu ezihlukene

Izinhlu ezimbili ezizimele zinquma ukuthi indlela ingadlula yini, futhi ukuzihlanganisa kuchitha usuku. Uhlu lokuqala luhlanganiswe ebhinaryini: ukulungiselela kokwakha kukhetha ukuthi iziphi izindlela ze-EAP ezikhona, ngakho ukwakha okungenayo indlela akukwazi ukuxoxisana ngayo noma iseva ivumela ini. Uhlu lwesibili luhlala kuseva, lapho umgomo usho ukuthi iziphi kwezindlela ezisekelwayo ikilasi lamaklayenti elingazisebenzisa. Ukudlula kudinga ukuhlangana, futhi alukho uhlu olungagcwalisa isikhala kolunye.

Hlola lolo hlu lokuqala ngaphambi kokusola iseva. Sesha igama lendlela ebhinaryini efakiwe, noma funda ukulungiselela kokwakha ekuvela kukho. Uma indlela ingekho, yakha kabusha esikhundleni sokuhlela umgomo we-RADIUS; uma ikhona futhi ukushintshana kusahluleka, inkinga isidlulele ezicelweni zokungena, kumgomo noma ekwethembeni isitifiketi.

Okungakasetshenziswa ukudlula

Ukusebenza okuphumelelayo kufakazela indlela eyodwa, eqoqweni lezicelo zokungena elilodwa, ngokumelene nomgomo we-RADIUS owodwa, emzileni wenethiwekhi owodwa. Akukuqeqeshi ukudlidliza kwenethiwekhi yephuzu lokufinyelela, ukuphathwa kwe-EAPOL kweswishi, ukwabiwa kwe-VLAN okulandela ukuqinisekisa, noma indlela i-concentrator ye-VPN ehlangana ngayo neseva efanayo. Lezo zingxenye azikaze zibe semzileni ohloliwe. Thatha umphumela njengobufakazi obunomkhawulo, futhi usho ukuthi uwuvala muphi umkhawulo lapho ubika.

Irekhodi ewusizo yilokho iseva nohlelo ngakunye okubonile: iyiphi indlela okwaxoxiswanwa ngayo, ukushintshana kwama kuphi, nokuthi iseva yabhala ini. Gcina izimfihlo ezabiwe nezinkinobho zangasese ngaphandle kwaleyo rekhodi.

Uhlu lokuhlola ngaphambi kokucaphuna umphumela

Ngaphambi kokuba othile athathe okukhishiwe njengokugunyazwa, qinisekisa izinto ezine. Ukwakha kufaka indlela ehlolwayo, iphuzu lokugcina le-RADIUS nesisusa esabiwe kungokwemvelo ehlolwayo, umgomo wesava wamukela lobu bunjalo bokuhlola, futhi umzila wenethiwekhi usekilasini elifanayo nomzila osetshenziswa amaklayenti okukhiqiza. Bese usho lokho ukusebenza okungakuthintanga: iphuzu lokufinyelela, iswishi, i-VLAN nokuhlanganiswa kwe-concentrator ngakunye kudinga umugqa wakho ohlelweni lokuhlola.

Ukuhlola okubili okunabanikazi ababili kunqoba ukugunyazwa okukodwa okungacacile. Ukusebenza kwe eapol_test kuphendula umbuzo wendlela neseva; insizakalo yokufinyelela iphendula umbuzo wokuphoqelela.