Kungani ukuhlela ifayela le-.ovpn kungakwazi ukuvula i-MFA kuseva

Ufaka i-auth-user-pass kuphrofayela, uxhuma kabusha, futhi umxhasi ucela igama lomsebenzisi nephephawu lokungena. Kubonakala sengathi i-MFA ivuliwe. Bese utayipha ikhodi evela ku-akhawunti engalungile, noma ikhodi ephelelwe yisikhathi emizuzwini eyishumi edlule, futhi umhubhe usakhula. Leso yisibonakaliso: umxhasi washintsha, iseva ayizange ishintshe. Iphasiwedi yesikhathi esisodwa iyisici kuphela lapho isiqinisekisi kuseva sinquma ukuthi iyasebenza yini kubunikazi obuyifunayo.

Isicelo sikhombisa kuphela ukuthi umxhasi ubuze, akukho okunye

Ifayela le-.ovpn liyidokhumenti ohlangothini lomxhasi. Lingatshela umxhasi ukuthi acele ubufakazi bokungena, abugcine kusilondolozi noma ayeke ukwenza lokho. Alikwazi ukubhalisa umsebenzisi, ukufaka imojuli ye-PAM, noma ukwenza iseva ifune isici sesibili engasihloli njengamanje.

Ukufaka uhlelo lokusebenza lokuqinisekisa ocingweni nakho akukudali lobo buhlobo. Iphrojekthi ye-Google Authenticator PAM iyingxenye yokuqinisekisa i-OTP engahlala ngemuva kwe-OpenVPN; akuyona indlela yokunamathisela ukungena kwe-akhawunti ye-Google kuphrofayela elethwe ngaphandle.

Ukubhaliswa yingxenye iphrofayela engakwazi ukuyenza

I-TOTP idinga impahla yokubhalisa eyabiwe phakathi kohlelo lokuqinisekisa nesiqinisekisi salo. Izinhlamvu eziyisithupha ocingweni ziwumphumela; imbewu engemuva kwazo iyimfihlo, futhi ingeyobunikazi obubodwa.

Ngakho-ke umqhubi udinga inqubo yokubhalisa ehlanganisa imbewu efanele nobunikazi be-VPN obufanele, kanye nendlela yokushintsha eqinisekisiwe yocingo olahlekile. Ukuvumela abasebenzisi ukuthi balayishe ifayela eliqanjwe ngabo kwenza ukubhaliswa kube yithuba lokuthatha i-akhawunti, futhi ukubethela okulayishiwe akukushintshi lokho.

Idizayini esekelwe ku-PAM akudingeki idale i-akhawunti ye-Unix ehlukile kumsebenzisi ngamunye we-VPN. Imibhalo yemojuli isekela izindlela eziyimfihlo ezihlukile kanye ne-akhawunti ezinikezelwe yokufinyelela amafayela, okuwubunikazi bohlelo lwamafayela hhayi ubunikazi bokungena obuqinisekiswayo.

Iphutha elivamile indlela yemfihlo egxilile egcina ngokugama lomsebenzisi oyedwa, ekopishwe kusibonelo somsebenzisi oyedwa. Lokho kuwukubonisa ubunikazi obubodwa, hhayi ukusesha kumsebenzisi ngamunye, futhi ukukusebenzisa kuwo wonke isicelo akuniki muntu uhlelo lokuqinisekisa olubhaliswe ngokuzimela. Bhala imephu yobunikazi, vikela amafayela embewu, futhi ugcine izihlolo zephasiwedi, isitifiketi ne-akhawunti kusiteki esisodwa sokuqinisekisa.

Funda isiteki se-PAM ukuze ubone ukuthi kudingeka ini ngempela

Umgqa ofana ne-account required pam_permit.so awusebenzisi ukufaneleka kwe-akhawunti futhi awunezi isici. Uvumela leso sigaba sokuphatha ama-akhawunti e-PAM, okuyisitatimende ngesigaba hhayi ngabasebenzisi bakho.

Kuyafana ngezinketho zokubhalisa ezivulekile. Ukwamukela abasebenzisi abangenayo imfihlo ebhalisiwe kungaba isinqumo sokwethula esenziwe ngamabomu, kepha akusona ubufakazi bokuthi i-MFA iphoqelekile, futhi kufanele kubhalwe njengokuhlukile kwesikhashana okunosuku lokuphela.

Vumelanisa ukusebenzisana komxhasi nedizayini yeseva

auth-user-pass

Lowo myalo ucela ukufakwa kwegama lomsebenzisi nephasiwedi. Awulungiseleli i-PAM, awudali irekhodi lokubhalisa, futhi awutsheli iseva ukuthi inkambu yephasiwedi iqukethe inani le-TOTP. Ukuhlanganiswa kweseva nomxhasi kufanele kuvumelane ngokusebenzisana okusekelwa ngempela ukusetshenziswa: inselelo, ifomethi ehlanganisiwe yobufakazi ebhalisiwe, noma ukugeleza okuqondile komkhiqizo.

Ungangezi ikhodi kuphasiwedi ngenxa nje yokuthi umxhasi ukhombisa inkambu eyodwa. Lokho kusebenza kuphela lapho isengezo seseva silindele khona ngqo leyo fomethi, futhi kwehluleka ngendlela edidayo kuzo zonke ezinye izindawo.

Gcina imbewu kanye nempahla ye-QR kude namaphrofayela abiwe kanye namalogi wokuxilonga avamile. Ikhodi ethunyelwe ngesiteshi sokungena esiqinisekisiwe ayiyona into efanayo nembewu enikezwe ngesikhathi sokubhalisa okulawulwayo, futhi ukuxuba kokubili kutikithi lokusekela yiyo indlela izimfihlo eziphuma ngayo.

Ukuxhuma kabusha, amathokheni kanye nokuhlolwa okunqumayo

Hlela ukuthi kwenzekani ngemuva kokungena kokuqala okuphumelelayo. Ikhodi eyamukelwe ngaphambili ingase ibe iphelelwe yisikhathi noma inqatshwe njengokuphinda ekuhlolweni okulandelayo. I-auth-nocache ilawula ukugcinwa kobufakazi bokungena futhi ayifaki i-MFA, futhi i-reneg-sec 0 ayisona incazelo yokusekelwa kwe-TOTP, kungakhathaliseki ukuthi ivela kangaki emicu yezinkundla.

Ukusetshenziswa okunye kukhipha amathokheni okuqinisekisa ngemuva kokuhlolwa kokuqala ukuze ukuxhuma kabusha kungaphindi kubuza. Leso yisinqumo sedizayini esinewindi lokuqinisekisa nendaba yokuhoxiswa yalo, hhayi okuzenzakalelayo okuzuzayo.

Bese uhlola inqubomgomo yokwamukela ngomxhasi abantu abawusebenzisa ngempela. Umsebenzisi obhalisiwe onephasiwedi, isitifiketi nekhodi yamanje efanele kufanele axhume. Ikhodi engalungile, umsebenzisi ongenakho ukubhaliswa kanye ne-akhawunti evinjelwe kufanele kwehluleke ngakunye, futhi isizathu kufanele sibonakale kulogi yeseva. Kuze kube uyabona lokho kwenqatshwa, unesicelo, hhayi inqubomgomo.