FortiGate VPN MFA: ithokheni yasendaweni, i-RADIUS noma i-SAML?

Igetsheni, i-backend ye-RADIUS noma umhlinzeki we-SAML ngamunye angafakazela isici sesibili, futhi ngamunye wehluleka ngendlela ehlukile. Hlanganisa isevisi, iklayenti nendlela yokubuyisela.

Yonke idizayini ye-FortiGate VPN MFA iphendula umbuzo owodwa kuqala: ubani ofakazela isici sesibili? Igetsheni ngokwalo lingakwenza ngethokheni yasendaweni noma ngekhodi ethunyelwe nge-imeyili, i-backend ye-RADIUS ingayiphoqa bese ibuyisela inselele, noma umhlinzeki wobunikazi we-SAML angathatha wonke umkhosi kusiphequluli. Ngakunye kwalokhu kuveza ukulandelana kokungena okuhlukile, uphawu lokwehluleka oluhlukile kanye nenqubo yokubuyisela ehlukile, futhi ukukopisha ibhloko yomyalo phakathi kwazo kuveza ukuhlela okubonakala kukholakala futhi okungafakazeli muntu. Le yindatshana yomshini: okwenziwa yidizayini ngayinye ngesikhathi sokungena, nokuthi yehluleka kuphi.

Umkhosi wokungena unquma ukuthi ubani umnikazi wesici

Kumadizayini amabili okuqala, i-FortiGate iyihlangothi elithembayo. Iqoqa imininingwane yokufakazela, inquma ukuthi isici sesibili siyadingeka yini, futhi iyasifakazela endaweni noma ngokucela inselele. Kudizayini yesithathu igetsheni liyeka ukuba umfakazeli liphenduke isidluliseli: lidlulisela iklayenti kumhlinzeki wobunikazi, lamukele isimemezelo, futhi lihlanganise ubunikazi obumemezelwe nomsebenzisi neqembu. Kudizayini ye-RADIUS likhona phakathi, liqondisa ukushintshana kwesicelo nempendulo ne-backend ephethe inqubomgomo.

Lowo mehluko unquma ukuthi yibuphi ubufakazi ongabuqoqa. Uma igetsheni lifakazela, okokukhipha kokulungisa kwalo kukutshela ukuthi kwenzekeni. Uma umhlinzeki wobunikazi efakazela, igetsheni lazi kuphela ukuthi kufike isimemezelo, futhi impendulo yombuzo othi “ingabe i-MFA yayidingeka ngempela” isemarekhodini omhlinzeki, hhayi kumabhayela. Ukufunda irekhodi elingalungile kuyindlela evame kakhulu yokuxilonga ngokungalungile ukusatshalaliswa okusebenza ngendlela eyenzelwe ngayo. Isevisi ngokwayo ibeka umkhawulo emkhosini: I-FortiOS 7.6.3 isusa imodi yethaneli ye-SSL VPN isikhundla sithathelwe i-IPsec, kuyilapho imodi yewebhu iqhubeka njenge-Agentless VPN kumamodeli asekelwayo, ngakho umkhosi ofakazelwe kusevisi eyodwa awutholakali ngokuzenzakalela kwesinye.

Ukufakazela kwasendaweni: amathokheni namakhodi e-imeyili

Izici eziphethwe yi-FortiGate zinamathela entweni yomsebenzisi. I-FortiToken noma ukuhlanganiswa kwethokheni okubhaliwe kudinga ukubhaliswa, umkhosi wokufakazela osekelwayo, ilayisense lapho kusebenza khona, kanye nenqubo yokushintsha. Ikhodi ethunyelwe nge-imeyili idinga indlela ye-SMTP esebenzayo kanye nebhokisi le-imeyili umsebenzisi angalifinyelela ngaphambi kokuba ithaneli libekhona, okuwukuncika okungenasihlobo ne-cryptography futhi okuhlangene ngokuphelele nokuthi ubani angangena.

config user local
    edit "jdoe"
        set type password
        set two-factor fortitoken
        set fortitoken FTKMOB1234567890
    next
end

Ukulethwa kwe-imeyili kuyingxenye yokutholakala kokufakazela. Ibhokisi le-imeyili elifinyeleleka kuphela nge-VPN lakha umjikelezo ongeke uzixazululele muntu, futhi ukubambezeleka kokulethwa, isikhathi sokusebenza kwekhodi kanye nesikhathi sokuphela kokufakazela kude kuyimikhawulo emithathu ehlukene. Ukukhuphula okukodwa akulungisi ibhokisi le-imeyili elingafinyeleleki, futhi idizayini engakaze ihlole lo mjikelezo izowuthola ekusethweni kabusha kwephasiwedi kokuqala ngemuva kweholide.

Izimfuneko zokuqinisekisa nazo zikhona lapha, ngaphambi kokukhetha umkhiqizo. I-NIST SP 800-63B ibheka i-imeyili njengengamukeleki ekufakazeleni okungaphandle kwendlela, ngakho ukusatshalaliswa okuthi kuqinisekisa ukuhambisana akukwazi ukusebenzisa ikhodi ye-imeyili njengesici sesibili, noma ngabe ilula kangakanani. Ukuba khona kwesici kudivayisi akusona isitatimende sokuthi leso sici sihlangabezana nezinga elithile.

I-RADIUS: igetsheni liyabuza, i-backend iyanquma

Nge-RADIUS, i-FortiGate ithumela imininingwane yokufakazela ku-backend ephethe inqubomgomo yesici. Ukushintshana kungaba ukwamukela noma ukwenqaba okulula, noma kungabandakanya inselele okufanele iklayenti liyiphendule, okusho ukuthi isevisi ye-VPN neklayenti zombili kufanele zisekele leyo ndlela yenselele. I-backend ephoqa ukugunyazwa kwe-push kanye neklayenti elazi kuphela ukufaka ikhodi enezinombolo eziyisithupha kuphasiwedi ngeke bahlangane phakathi.

config user radius
    edit "corp-radius"
        set server "10.10.20.15"
        set secret ENCXXXXXXXX
        set secondary-server "10.10.20.16"
    next
end
diagnose test authserver radius corp-radius pap jdoe <password>

Hlola i-backend ngokuzimela ngaphambi kokusola ithaneli. Uma ukuhlolwa kwe-authserver kuphumelela kepha ukungena kwe-VPN kungaphumeleli, umehluko usekuphathweni kwenselele hhayi emininingwaneni yokufakazela, futhi ukulungisa kwedemoni yokufakazela yegitsheni kukubonisa lapho:

diagnose debug application fnbamd -1
diagnose debug enable

I-SAML: isiphequluli siyashiya igetsheni

Kudizayini ye-SAML, iklayenti lidluliselwa kumhlinzeki wobunikazi, lifakazela lapho, bese libuya nesimemezelo igetsheni elihlola ngokuhambisana nobudlelwano bokuthemba nokuhlelwa kwamaqembu. Igetsheni alikaze libone iphasiwedi noma isici sesibili, okuyintuthuko yezokuphepha kanye nobunkimbinkimbi bokusebenza ngasikhathi sinye: ukwehluleka manje kwenzeka kuseshini yesiphequluli umbhayela ongakwazi ukuyihlola.

Ukwamukela isimemezelo akufakazeli ukuthi umhlinzeki wayedinga i-MFA kulolo kungena. Inqubomgomo yomhlinzeki esebenza kwezinye izinhlelo zokusebenza hhayi kwezinye izoletha kanye ukungena okukucelile futhi inganiki siqinisekiso obukucabanga. Hlola inqubomgomo yomhlinzeki yalolu hlelo oluthile, futhi uhlole ukuthi izimemezelo zamaqembu ezihlanganisa namaqembu e-FortiGate zisahambisana ngemuva kwanoma yikuphi ukushintshwa kwamagama kuzinhlangothi zombili.

Ukusekelwa kweklayenti kubaluleke lapha ukudlula kwenye indawo. Amanye amaklayenti e-VPN aphatha ukudluliselwa kwesiphequluli ngokwemvelo, amanye avula isiphequluli sohlelo, futhi amaklayenti angenasikrini noma omugqa womyalo kungenzeka angakwazi ukuqedela lolu hlelo. Hlola ngeklayenti abasebenzisi abalisebenzisa ngempela, kumapulatifomu abawasebenzisa ngempela, ngaphambi kokushicilela iphrofayela.

Ukubuyisela kuyingxenye yomshini

Yonke idizayini engenhla inokuncika okungahluleka kumsebenzisi oyedwa ngesikhathi: ibhokisi le-imeyili elingafinyeleleki, ithokheni elahlekile, i-backend eyenqaba inselele, i-akhawunti yomhlinzeki wobunikazi evaliwe. Nquma manje ukuthi ubani angabuyisela ukufinyelela, ngayiphi inqubo esekelwayo, nangakuphi ukuqinisekisa komuntu ocela. I-akhawunti yomqondisi yasendaweni yesimo esiphuthumayo egcinwe ihlukile endleleni ye-VPN iyisilawuli; kuyilapho ukudlula okungachazwanga kokusebenzisa iphasiwedi kuphela kuyisigameko esilindele ukutholwa.

Bese uhlola ukungena okuthathu ngaphambi kokusatshalaliswa: okujwayelekile, isici esenqatshiwe noma esiphelelwe yisikhathi, kanye nokubuyiselwa kwesifakazeli esilahlekile okugunyaziwe. Rekhoda ukuthi ngakunye kuvela kuyiphi irekhodi. Yilowo rekhodi oguqula “i-MFA ivuliwe” kube idizayini umunye angayisebenzisa.

Izihloko ezihlobene