Ukuthutha i-backend yokufakazela i-VPN ngaphandle kokusebenzisa ama-hash amadala futhi
Ukuhambisa ubunikazi be-VPN ukusika, hhayi ikhophi: hlela uchungechunge lokufakazela, hambisa iqembu lokuhlola, hlola izinguquko zezinkomba futhi uhlele ukubuyiswa okungeke kukhanseleke ngokusetha kabusha.
Amagama abasebenzisi avela kuhlu lwemibhalo olusha, ukuthutha kumenyezelwa kuphelile, futhi ukungena kusahluleka. Isango lisadinga indlela yokufakazela esekelwayo kanye nomphumela wemvume olungile, futhi akukho kukho kokubili okuvela kuhlu olumanje lunezimali. Ukuthutha i-backend ukusika okunomjikelezo wokuphila, hhayi umsebenzi wokukopisha. Isibonakaliso esingezansi yisona esivamise ukudalula umehluko.
Isibonakaliso: ama-akhawunti akhona, amaseshini awekho
Uhlu olusha lunalo lonke igama lomsebenzisi, ukubopha kokuhlola kuyaphumelela, futhi iklayenti le-VPN lisabuyisela ukwehluleka kokufakazela. Leyo nhlanganisela isho ukuthi ubunikazi bukhona, kodwa indlela yokuqinisekisa esetshenziswa isango ayifinyeleli kubo, noma ifinyelela ngendlela engeke ikwazi ukuyifeza. Kokubili ukucushwa, futhi lezi zinkinga ezihlukene.
Okokuqala izintambo: isango likhomba i-backend engaphenduli, lisebenzisa imfihlo yokwabelana okunye ukuhlangothi okungalindeli, noma licela isici isevisi entsha engasibuyiseli. Okwesibili kwezokubhala ngemfihlo: indlela idinga imfihlo yasekuqaleni, futhi isitoreji esisha sigcina i-hash yayo kuphela. Umbhalo wephutha ubukeka ufana kuzo zombili izimo, yingakho lezi zimbili zithathwa njengenkinga eyodwa.
Ukuhlukanisa lezo zimbili ngaphambi kokuthinta ama-akhawunti konga iviki. Enye iwumbuzo wokuhamba nokwethemba, enye isinqumo sokuthi kusethwe kabusha izinkomba, futhi ukuzihlanganisa kukhiqiza izinguquko okungekho osezingenela kuzo.
Hlela uchungechunge ngaphambi kokuhambisa noma ubani
Bhala izinto eziyisithupha kuhlelo ngalunye lweklayenti: indlela yokufakazela yangaphandle, noma iyiphi indlela yangaphakathi, ubunikazi besiphakamiso obulindelwe yiklayenti, isixhumanisi phakathi kwesango ne-backend, isici isango esihlobanisa nokuba yilungu leqembu, nenqubomgomo yezinsiza evelayo. Ukuzifunda ngokulandelana kubonisa ukuthi yikuphi ukuxhumana okungenaye umnikazi. Into ngayinye inomthwali womthwalo, futhi ukusika kuyahluleka lapho kungekho ohlolile.
| Link | Question it answers |
|---|---|
| Client profile | Which method and server name does the client use? |
| Inner method | Is there a second authentication step? |
| Server identity | Which certificate or name must the client accept? |
| Gateway to backend | Which protocol, port and shared secret? |
| Attribute mapping | Which returned value becomes group membership? |
| Resource policy | What the resulting session may reach |
Ukungena okujwayelekile kuhlu lwemibhalo akudluli cishe lutho kulolo chungechunge. Kufakazela ukuthi i-akhawunti ikhona nokuthi iphasiwedi iyasebenza, okuyiyo ingxenye engakaze ibe nokungabaza.
Ama-hash awahambi phakathi kwezindlela
Ukuhambelana kwezinkomba kufanele kuhlolwe kanye, ngaphambi kokuba noma yiliphi iqembu lihambe. I-FreeRADIUS ichaza ukuhlukaniswa ngokucacile: ukuhlolwa kwe-CHAP okwenziwa isiphakamiso ngokwaso kudinga iphasiwedi yangempela, futhi i-MS-CHAP yamukela leyo phasiwedi noma izinto ze-NT ezifanele. I-hash eyenzelwe enye injongo ayihambisani nanoma yisiphi isimo, kungakhathaliseki ukuthi inamandla kangakanani.
Umehluko usendleleni yokuthi ubani obala ubufakazi. Indlela eqinisekisa ngokuhlobana nohlu lwemibhalo ivumela uhlu lwemibhalo ukuba luhlole lokho olukwaziyo. Indlela eqinisekisa ngokubala kabusha impendulo yenselelo idinga imfihlo uqobo, ngoba isiphakamiso kufanele senze ukubala okufanayo.
Lapho izinto zingekho, izinketho ezithembekile ukusetha kabusha okusekelwayo, ukubhalisa kabusha, isevisi yokuqinisekisa yangaphandle noma ukushintsha indlela. Ukuthunyelwa kwesikhashana kwamaphasiwedi angabuyiseka akukho kulolo hlu. Kwakha isitoreji sezinkomba ngombhalo ocacile ngesonto elinesiphithiphithi esikhulu kunazo zonke kuphrojekthi, futhi ngokuvamile lihlala ngemuva kokuthutha.
Iqembu lokuhlola, bese izinguquko zomjikelezo wokuphila
Hambisa iqembu elincane lobunikazi obugunyaziwe neklayenti langempela, futhi uhlole izinto ezine: ukungena okusha, izinkomba ezingalungile ngamabomu, izinsiza iseshini engazifinyelela, nezinsiza okungafanele izifinyelele. Hlola futhi ubunikazi besiphakamiso obamukelwe yiklayenti, ngoba ukungafani kwegama lesitifiketi akubonakali kuze kube umuntu ufunda ilogi yeklayenti.
Bese uzijwayeza izinguquko okuncike kuzo ukusatshalaliswa ngempela. Shintsha iphasiwedi, vuselela noma ubhalise kabusha isitifiketi, futhi ususe ukufinyelela ku-akhawunti eyodwa yokuhlola. Ngemuva kwalokho ngakunye, qinisekisa ukuthi yimuphi umqinisekisi ophethe umzamo, ngoba iseshini eyadalwa ngaphambi kokusika ingaqhubeka isebenza futhi ayifakazeli lutho ngokungena okulandelayo.
Hlukanisa ukulethwa kwephrofayela ekushintsheni kobunikazi. Iqembu ngalinye lidinga iphrofayela eliyihlosile, isimo sezinkomba noma ukubhaliswa kwayo, isevisi yokufakazela okufanele iyisebenzise, nomuntu wokuxhumana wosekelo, futhi akukho kulezi rekhodi okufanele kube nemfihlo.
Uma indlela endala nentsha zikhona ndawonye, zibeke emkhawulweni wosuku lokuphela. Ukuhlehla okuzenzakalelayo kungavumela i-akhawunti ukuba ingene ngezinkomba ezindala ngemuva kokuba umnikazi omusha esuse ukufinyelela, futhi lokho ukuhlehla kwezokuphepha okuzifihle njengokutholakala.
Ukubuyisela emuva akukwazi ukubuyisa izinkomba
Ukuphendula ukusika kushiya uhlu lwemibhalo lunjalo njengoba lunjalo manje. Iphasiwedi esethwe kabusha ihlala isethwe kabusha, isitifiketi esikhanseliwe sihlala sikhanseliwe, futhi ifomethi yezinkomba eshintiwe ihlala ishintiwe. Lezi izehlakalo kuhlu lwemibhalo, futhi isango alikaze libe umthombo wazo. Ukubuyisa kufanele kuchazwe ngomcimbi ngamunye, futhi akukho kukho okungathembela ekwakhiweni kabusha kwemfihlo kusuka ku-hash engahambisani.
Gcina indlela yokuphatha engasebenzisi ukuxhumana okuthuthwayo. Lapho ukufakazela okusha kwehluleka, misa iqembu futhi usebenzise indlela yalo yokubuyisa ebhalisiwe, esikhundleni sokwenza buthaka ukufakazela kubo bonke ukuze kugcinwe usuku olunqunyiwe.
Ngemuva kokuba amaqembu embiwe, susa izinkomba, amaphrofayela nobudlelwano bokwethemba bakudala be-backend ngabaphathi bazo. Qinisekisa ukuthi indlela endala ayisavumeli abasebenzisi ukungena, futhi gcina ukuhlela kobunikazi kuya kunqubomgomo okungenayo imfihlo okusadingeka kusekelo. Ukuthutha kuphela lapho umjikelezo wokuphila omusha usebenza futhi kungekho osangena ngendlela endala, hhayi lapho uhlu lwama-akhawunti lubukeka luphelele.