I-VPN IP engaguquki: i-Framed-IP-Address ku-RADIUS noma ukubekelwa eceleni echibini

Izindawo ezintathu zingagcina ikheli langaphakathi elingaguquki leklayenti le-VPN, futhi kube yinye kuphela kuzo okufanele libe nayo. I-RADIUS ingabuyisela ikheli ku-Access-Accept, isango lingagcina ukuhlelwa okungaguquki kwakhawunti, futhi i-adaptha yeklayenti ingasethwa ngesandla. Ezimbili zokuqala ziyinqubomgomo kanti eyesithathu iwukuqagela kwendawo isango elikhululekile ukulishaya indiva noma ukubhala phezu kwakho. Ukukhetha phakathi kwezimbili zokuqala yisinqumo sangempela, futhi kuncike kulokho okuqhubekayo kweseva yokufinyelela kunethiwekhi empeleni.

Izindawo ezintathu lapho ikheli elingaguquki lingaba khona

I-RADIUS inekheli lapho impendulo iphethe i-Framed-IP-Address futhi isango lisebenzisa lelo nani esikhathini. Isango linekheli lapho umphathi ehlanganisa ikhawunti nekheli elingaguquki ngaphakathi kwechibi. Iklayenti alinakho lutho, ngisho nalokhu i-adaptha yalo ibonisa ikheli lesandla, ngoba iseva yabela ikheli langaphakathi ngesikhathi sezingxoxo futhi isethi yendawo ibalulekile kuphela lapho iseva ingathumeli lutho. Zontathu zibukeka zifana kuxhumano olusebenzayo, yingakho izingxabano zivela sekwephuzile. Umehluko ubonakala ekuxhumaneni kabusha, kudivayisi yesibili nangemva koshintsho lwenqubomgomo.

Abanikazi ababili yilokho ukuhlelwa okwephukayo. Impendulo ye-RADIUS enikeza i-172.28.4.77 ngenkathi isango ligcina ukuhlelwa okungaguquki kwe-172.28.4.90 inikeza inani ikhodi yomthengisi elihlola kuqala, futhi ohluliwe uyalahlwa ngaphandle komugqa welogi. Ikhawunti efanayo kudivayisi yesibili ithola ikheli eliphindwe kabili, futhi uphawu lubukeka njengephutha lokuhamba kwendlela hhayi njengokungqubuzana kokwabiwa. Nquma umnikazi ngaphambi kokwengeza indlela yesibili.

Ukukhetha ohlangothini lweklayenti kufanele kukhulunywe ngakho kuphela ukuze kukhishwe. Ikheli le-adaptha lesandla iwukuthanda okungase kukhombiswe uhlelo lokusebenza, hhayi ukubekelwa eceleni, futhi angeke kuvimbele esinye isikhathi ekuthatheni ikheli elifanayo.

Impendulo ye-RADIUS ingathembisa ini futhi ingakwazi ukuthembisa ini

RFC 2865ichaza i-Framed-IP-Address njengekheli le-IPv4 okufanele lihlelwe kumsebenzisi, futhi lingena ku-Access-Accept. Isici esifanayo ku-Access-Request siwumkhomba nje iseva engawushaya indiva, futhi lokhu kubalulekile lapho iklayenti noma isango lihambisa ikheli elithandwayo. Akukho lutho kuphrothokholi okuphoqa isango ukuhlonipha impendulo, ngoba iseva yokufinyelela kunethiwekhi iyona ngxenye eyisebenzisa esikhathini.

Ukusekelwa kuwumbuzo womkhiqizo hhayi wophrothokholi. Amanye amasango asebenzisa amakheli ahlanganisiwe ngokuzenzakalela, amanye adinga ukuthi iswishi yezinga leqembu ivulwe ngaphambi kokwenza lokho, kanti amanye amukela isici kodwa awasebenzisi neze ezingxoxweni zokufinyelela kude. Isimo sokugcina siyingozi, ngoba irekhodi lokubalwa lingabonisa impendulo ngenkathi iklayenti lithola ikheli lechibi. Qinisekisa ukuziphatha kumodeli yesango nefirmware oyisebenzisayo, hhayi emibhalweni yomkhiqizo ongudadewabo.

Impendulo isango eliyishaya indiva ibukeka ifana ncamashi nempendulo engakaze ithunyelwe. Ukufunda i-Access-Accept nekheli lesikhathi ndawonye iyona ndlela kuphela yokwehlukanisa lezi zimo ezimbili.

Beka ikheli eceleni ngaphakathi kwechibi osuvele ulihambisa

Khetha ikheli elingaguquki kusukela kusubneti yechibi isango elivele liyihambisa futhi i-firewall evele iyithemba. Ikheli elingaphandle kwalelo banga liguqula ushintsho lwenqubomgomo lube iphrojekthi yokuhamba kwendlela, futhi i-VPN izokhuphuka kuyilapho kungekho lutho ngemuva kwayo olungaphendula. Uma kukhona imithetho yokufinyelela ngekheli ngayinye, engeza ikheli elingaguquki kuyo kusoshintsho olufanayo.

Nquma ukuthi isikhathi sesibili esikhathi esisodwa kufanele senze ini. Ukwabela ikheli elilodwa kabili akukona ukuphatha idivayisi, futhi ukungqubuzana okuvelayo kubonakala njengokuxhumana okunqamukayo kuzo zombili izikhathi. Noma khipha ubunikazi obuhlukile kudivayisi ngayinye, noma ukwabiwa okuhlukile, noma phoqa ukwenzeka ngasikhathi sinye ngokuhlola okusekelwayo, njenge-Simultaneous-Use, esikhundleni sokuthemba ukuthi iklayenti ngeke lixhume futhi ngaphambi kokuphela kwesikhathi esidala.

Imizila yokubuya ifanele ukunakwa okufanayo nokwabiwa. Isango lidinga umzila oya echibini, amarowutha angaphakathi adinga umzila obuyela esangweni, futhi ikheli elingaguquki lizuzwa womabili. Iklayenti elilodwa elisebenzayo ngenkathi zonke ezinye zehluleka ngokuvamile kusho ukuthi umzila wechibi ukhona kodwa umzila womsingathi wekheli elibekelwe eceleni awukho.

Hlola impendulo ngaphambi kokuthemba ukubekelwa eceleni

Hlola uhlangothi lwe-AAA nohlangothi lwesikhathi ngokwahlukana, ngoba bahluleka ngezizathu ezahlukene. radtest yendawo ibonisa lokho iseva ekubuyisela kukhawunti ngaphandle kokufaka isango, futhi umugqa kufayela labasebenzisi ubonisa lokho iseva okufanele ikuhambise. Bese uxhuma iklayenti futhi uqhathanise ikheli elilitholile nesici esisempendulweni.

Authenticated member: survey-tablet-17
Reply attribute:      Framed-IP-Address = 172.28.4.77

survey-tablet-17  Cleartext-Password := "REPLACE_ME"
                  Framed-IP-Address = 172.28.4.77

radtest survey-tablet-17 REPLACE_ME 127.0.0.1 0 testing123

I-Access-Accept engenaso isici isho ukuthi iseva ayizange ihambise umugqa noma isici asizange sisetshenziswe kulo msebenzisi. I-Access-Accept enaso isici kanye neklayenti elisathola ikheli lechibi kusho ukuthi isango layishaya indiva. I-Access-Reject ikubuyisela emininingwaneni yokungena noma kunqubomgomo yeqembu, futhi akukho kule miphumela okufanele kuxazululwe ngokuhlela i-adaptha yeklayenti.

Phinda ukuhlola ngemva kokuxhuma kabusha nangemva kokungena kwesibili kusuka kudivayisi enye. Ukubekelwa eceleni okubamba isikhathi sokuqala kuphela kuwukungqubuzana kwechibi okulindele ukwenzeka, futhi kushibhile ukukuthola manje kunokuthola ngesikhathi sokucwaninga.

Khetha umnikazi oyedwa futhi umbhale phansi

Uma isango lisebenzisa amakheli ahlanganisiwe ngokuthembekile, vumela i-RADIUS ibe nomnikazi wokwabiwa futhi ususe noma yikuphi ukuhlelwa okungaguquki kwakhawunti efanayo. Uma kungenjalo, vumela isango libe naye futhi ususe isici empendulweni, ukuze imithombo emibili ingeke ingavumelani. Ukugcina kokubili ngoba ngakunye kucishe kusebenze kuqinisekisa isikhathi esizayo esinekheli elingalungile futhi ngaphandle kwesizathu esicacile.

Bhala umnikazi okhethiwe, ikheli elibekelwe eceleni kanye nechibi elivela kulo kurekhodi yekhawunti. Umuntu olandelayo owengeza idivayisi uzokwazi ukubona ukuthi ikheli liyinqubomgomo ye-AAA noma ukuhlelwa kwesango ngaphambi kokushintsha noma yikuphi kwalokho.