Isevisi ye-MFA yehle: thatha isinqumo ngokufinyelela kwe-VPN ngaphambi kokwehluleka

Ukufinyelela kwe-VPN kuyama, futhi isexwayiso sithi isevisi yesici sesibili ayifinyeleleki. Ukuthi ukhona yini umuntu osengaxhumana kuwumbuzo wenqubomgomo okwakufanele uphendulwe ngaphambi kokuphazamiseka, hhayi phakathi kwako. Isiqinisekisi esingatholakali akusona ubufakazi bokuthi isici sidlulile, futhi inselele enqatshiwe ayisona isigameko esifanayo nesenyelele engafinyeleleki. Umhlahlandlela ongezansi uguqula lowo mehluko ube umthetho obhaliwe ongawuhlola.

Isinyathelo 1: qamba imiphumela emithathu ngokwehlukana

Bhala izimo ezintathu futhi wenqabe ukuzihlanganisa: ukuqinisekiswa okuyisisekelo kwehlulekile, inselele yesici sesibili yenqatshiwe noma isiphelile isikhathi, futhi isevisi ye-MFA ayizange iphendule. Ngayinye inomnini ohlukile, umugqa wokubhala ohlukile kanye nempendulo efanele ehlukile. Umlayezo owodwa ojwayelekile wesikhathi esiphelile ufihla ukuthi ukusiphi isimo, futhi lokho kungacaci yikho okuguqula ukuphazamiseka kube impikiswano. Qamba izimo kumhlahlandlela ngaphambi kokuba uzidinge.

Ukwenqaba kusho ukuthi isiqinisekisi siphendule sathi cha, okuwumphumela wenqubomgomo hhayi inkinga yokutholakala. Umzamo ophelelwe yisikhathi usho ukuthi inselele yayikhona futhi akekho owuyiqedile ngesikhathi. Isevisi engafinyeleleki isho ukuthi umbuzo awuzange uphendulwe nhlobo. Eyesithathu kuphela ukuphazamiseka.

Isinyathelo 2: funda imodi yokwehluleka esetshenziswa yi-proxy ngempela

Thola isilungiselelo esilawula ukuziphatha uma isevisi ingafinyeleleki, futhi usifunde kusuka kusimo sokusebenza hhayi kusuka kuthempulethi. Ku-proxy ye-RADIUS yakwa-Duo, amanani e-failmode abhaliwe yi-safe ne-secure, lapho i-safe ivumela umzamo kuphela uma ukuqinisekiswa okuyisisekelo kuphumelela, futhi i-secure inqaba umzamo kuleso simo.

radtest alice '' 127.0.0.1 0 testing123
journalctl -u duo-authproxy -n 50 --no-pager

Igama elithi safe lichaza ukukhetha kokutholakala, hhayi isiqinisekiso sokuthi yonke iseshini eyamukelwe yayinesici sesibili esisha. Lowo musho ungowokubhalwa kwezingozi, ngoba yilokho kanye ukushintshana okwenziwa yisilungiselelo. Ungakwenzi kube umthetho jikelele kumhlinzeki omunye, ukuhlanganisa okunye noma imodi ye-proxy ehlukile; funda imibhalo yalowo mkhiqizo ngokulingana kwayo. Ukucushwa okukopishwe kusibonelo somthengisi ngaphandle kwalokhu kuqonda kuyisimanga esilindele ukuphazamiseka okulandelayo.

Yima uma kungekho osho ukuthi iyiphi imodi esebenzayo. Ingxenye esele yomhlahlandlela incike kuleyo mpendulo.

Isinyathelo 3: hlanganisa ukuphinda uzame nokugeleza

Qondanisa isikhathi sokuphela nokuziphatha kokuphinda uzame kwesango nokugeleza kokuqinisekisa okukushayelayo. Ukuphinda uzame okungahlanganisiwe kudala izicelo eziningi, kudida ukufaniswa kwemizamo futhi kushiye ilogi ingakwazi ukusho ukuthi imuphi umphumela ungowakuphi ukungena. Isikhathi eside kakhulu sokuphela akusona isakhiwo sokutholakala; ukulinda isikhathi eside kakhulu impendulo efanayo.

ss -lunp 'sport = :1812'
tail -n 50 /var/log/duo/authproxy.log

Isikhathi sokuphela sesicelo se-proxy ngokwayo siwumkhawulo ohlukile: isicelo sokuqinisekisa esikhishwayo futhi esingaqediwe sikhutshwa, futhi lokho kwala akusona ukuphazamiseka ongahlehla kukho. Thatha ukwala, inselele engaqediwe kanye nesevisi engafinyeleleki njengezinto ezintathu ezihlukile zokufaka etafuleni lakho lezinqumo. Bese wenza itafula licace: yisiphi isimo esivumayo, yisiphi isimo esibambayo futhi yisiphi isimo esikhuphukela kumuntu.

Uma izingxenye ezimbili zombili ziphinde zizame, qala ngokulungisa ubunikazi bokuphinda uzame. Izicelo eziphindwe kabili ziwuphawu lwabanikazi ababili, hhayi lwesevisi enensayo.

Isinyathelo 4: phatha ukufinyelela okuphuthumayo ngokwehlukana

Uma ukufinyelela okuphuthumayo kudingeka, kunikeze ububanzi bayo, ubunikazi, imvume kanye nomkhondo wokuhlola. Ukucisha i-MFA buthule kubo bonke abasebenzisi akusona inqubo yephutha; ukwehlisa amandla okuhlala njalo okunomcimbi onamathiselwe. Umnikazi wezokuphepha ugunyaza kusengaphambili umthetho wokungena, ukubonakala kanye nendlela yokukhuphuka.

grep -R failmode /etc/duo /etc/radiusclient 2>/dev/null
systemctl status duo-authproxy

Hlola yonke i-matrix endaweni engeyona yokukhiqiza: ukwehluleka okuyisisekelo, ukwenqaba ngamabomu, ukuphela kwesikhathi senzelele kanye nokungatholakali kwesevisi. Kokunye ngakunye, rekhoda umphumela wokufinyelela kanye nesizathu esibhaliwe. Ungadali ukuphazamiseka kwesimo sokukhiqiza ukuze uthole ukuziphatha okucushiwe, futhi ungahloli indlela yephutha okokuqala phakathi nomcimbi eyabhalelwa wona. Inqubo yokubuyisela engakaze isetshenziswe iwumbhalo, hhayi ukulawula.

Umhlahlandlela uphela lapho izimo ezintathu ziqanjwa, imodi yokwehluleka ifundwa kusuka kusistimu esebenzayo, ukuphinda uzame kunomnikazi oyedwa, futhi ukufinyelela okuphuthumayo kunokugunyazwa nokubuyekezwa kwayo. Ukuphoqelela okulindelekile kanye nendlela eyaziwayo yokubuyisela kuwumphumela ofanele ukubhalwa.