Ukuqinisekiswa kwe-LDAP kwe-OpenVPN kuyasebenza kodwa ukuhlolwa kweqembu kuyahluleka: yikuphi okufanele kubhekwe

Izicoco ziyadlula, ithunge luyakhuphuka, bese umkhawulo wehluleka ngomlayezo mayelana neqembu hhayi mayelana nephasiwedi. Le nhlanganisela ibeka iphutha engxenyeni yesibili yomsebenzi wokungezwa kwe-LDAP: ukubophezela nokuhlolwa kwephasiwedi kuphumelele, futhi isinqumo sobulungu esilandelayo asiphumelelanga. Izingxenye zombili zifunda kubhlokhi yokuhlela efanayo, yingakho ukulungisa endaweni eyodwa kungashiya enye ingathintekile. Qala emugqeni welogi oveza isinyathelo, hhayi ku-akhawunti oyihlola ngengozi.

Thatha ukunqatshwa njengempendulo yegunya

Ukungezwa kwenza ukubophezela kwensizakalo, kufune i-akhawunti, kuqinisekise iphasiwedi enikeziwe bese kubuza ukuthi leyo akhawunti ingeyeqembu elivunyelwe yini. Lezi yizenzo ezine ezihlukene, futhi eyedwa yokugcina imayelana namaqembu. Ngakho ukunqatshwa okufika ngemva kokubophezela okuphumelelayo akusho lutho mayelana nephasiwedi, ngisho nalapho iklayenti libonisa iphutha lokuhlola elijwayelekile. Ukukhuphula izinga lelogi lokungezwa ngaphambi kokushintsha ukuhlela yikho okwehlukanisa lezo zine kokuphumayo.

Funa ukuhlolwa kweqembu uqobo. Lapho kungekho mbuzo weqembu ovelayo nhlobo, ibhlokhi yegunya ayifinyelelwanga, lokho ngokuvamile kusho ukuthi umyalelo utholakala ngaphandle kwebhlokhi okuyiyo ephetheyo noma inketho edingekayo ayikho. Lapho umbuzo uvela futhi ungbuyiseli lutho, indawo yokugcina noma isihlungi siphendula umbuzo ohlukile kunalowo obuwuqonde.

Nquma ukuthi ubulungu buhlala esihlungini noma kubhlokhi yeqembu

Kunezimo ezimbili ezisekelwayo, futhi ukuzihlanganisa yikho okwenza ukuhlela okusebenzayo kuyeke ukusebenza. Eyokuqala iphusha ubulungu ekufuneni umsebenzisi ngokucela isibaluli entweni yomsebenzisi; eyesibili ishiya ukufuna umsebenzisi njengoba kunjalo futhi ivumele ukungezwa ukuthi kufune into yeqembu ngemva kwalokho. Khetha eyodwa ekusetshenzisweni ngakunye bese ubhala phansi ukuthi ukhethe ephikisayo.

<Authorization>
    BaseDN       "OU=People,DC=example,DC=org"
    SearchFilter "(&(sAMAccountName=%u)(memberOf=CN=VPN Access,OU=Groups,DC=example,DC=org))"
    RequireGroup false
</Authorization>

Kuleso simo isihlungi sinquma konke, ngakho RequireGroup kufanele kube false, uma kungenjalo ukungezwa kuyofuna into yeqembu isihlungi esingakaze sikhulume ngayo. Isibaluli esisihlungini kufanele sibe khona entweni yomsebenzisi futhi sigcwaliswe, okungaqinisekisiwe uma amaqembu esezingeni elingaphakathi komunye nomunye.

Esinye isimo sigcina ukufuna kulula futhi sengeza ukufunwa kweqembu ngemva kwakho. Into yeqembu ibizwa ngokucacile, futhi ukungezwa kuqhathanisa umsebenzisi namalungu uhlu lwemibhalo olubuyisela wona. Akukho okushintshayo esihlungini somsebenzisi, okwenza lesi simo kube lula ukusicwaninga lapho iqembu liphethwe elinye ithimba.

<Authorization>
    BaseDN       "OU=People,DC=example,DC=org"
    SearchFilter "(sAMAccountName=%u)"
    RequireGroup true
    Group        "CN=VPN Access,OU=Groups,DC=example,DC=org"
</Authorization>

Indawo engabonakali yabiwe: ukuqhathanisa ubulungu okulula akukwandisi amaqembu angena komunye nomunye, ngakho i-akhawunti okufinyelela kwayo kufika ngeqembu lomzali iyahluleka ngenkathi ikhonsoli isabonisa ubulungu. I-Active Directory iveza member eqenjini, ezinye izakhiwo zisebenzisa uniqueMember, futhi ukukhomba isibaluli esingalungile kubuyisela umphumela ongenalutho esikhundleni sephutha.

Khetha indawo yokugcina ephethe into yeqembu

I-URL inquma ukuthi ukungezwa kubuza kuphi uhlu lwemibhalo, futhi isilawuli sesizinda esisechwebeni 389 siphendula umongo waso wamagama kuphela. Ikhathalogi yomhlaba wonke esechwebeni 3268 iphendula ihlathi lonke, ifundeka kuphela futhi inesethi yezibaluli engaphelele. Lapho ama-akhawunti ekwesinye isizinda neqembu le-VPN likwesinye, umbuzo wesizinda esisodwa ungathola umsebenzisi futhi usaphuthelwe ubulungu. Lesi yisimo lapho ukuhambisa i-URL echwebeni lekhathalogi kuxazulula ukunqatshwa, futhi futhi yisimo lapho abantu benza khona isiphakamiso esibanzi kakhulu.

Isethi yezibaluli engaphelele yiwo umngcele: isibaluli uhlu lwemibhalo olungenaso asikwazi ukuhlungwa ngaso, ngakho ukushintsha okufanayo kungenza ukusetshenziswa okukodwa kusebenze kanti okunye kubuyisele lutho. Qinisekisa ukuthi indawo yokugcina ibuyisela ini ngempela kumsebenzisi neqembu langempela ngaphambi kokubhala kabusha ibhlokhi. Izikhombisi ne-TLS kuyizinto ezihlukene futhi, ngoba isikhombisi kufanele silandelwe futhi indawo yokugcina edinga i-TLS idinga amafayela okuthembela ahambisanayo.

Gcina isimo se-akhawunti nobubanzi bokufuna ezindaweni zazo

Isibonakaliso sokungasebenzi singesihlungi, hhayi esihlolweni seqembu. Ku-Active Directory iyibhithi yesibili ye-userAccountControl, futhi ngaphandle kwaleso simo i-akhawunti engasebenzi enephasiwedi esebenzayo iyaziqinisekisa bese yehluleka esinyathelweni seqembu, okubonakala njengephutha legunya. Ububanzi bokufuna bungobuka-DN yesisekelo, ngoba ukuqala emsukeni wesizinda kuhamba kancane futhi kungahambisana nezinto ezingaphandle kweyunithi yenhlangano obufuna ukuyihlanganisa.

Gcina namalungelo e-akhawunti yokubophezela encane. Amalungelo Ohlu lwemibhalo abanzi ashintsha isihlungi esilungiswe kabi sibe umbuzo ophumelelayo futhi afihla iphutha kuze kube umuntu uhlola i-akhawunti. Shintsha ubulungu kuhlu lwemibhalo uqobo, hhayi ohlwini lwezihluzo lwendawo, ukuze ukukhubaza i-akhawunti kwanele ukususa ukufinyelela. Uma elinye ithimba liphethe iqembu, vumelanani ngesibaluli abasicgwalisa ngaphambi kokubhala isihlungi phezu kwakho.

Fakazela umphumela ngama-akhawunti amathathu

Gijimisa ukuhlela kubantu abathathu: ilungu elivunyelwe, i-akhawunti esebenzayo engaphandle kweqembu, kanye ne-akhawunti ekhutshaziwe. Uma bobathathu benqatshwa, ukubophezela noma umbuzo weqembu kuyaphuka; uma bobathathu bamukelwa, akukho simo seqembu esisetshenziswayo nhlobo. Umphumela oxubile yiwo kuphela oqinisekisa ukuthi ukuhlela kuhlukanisa izimo okubalulekile kuwe.

Funda izimpendulo ezintathu ezifanayo ngqo kuhlu lwemibhalo ngaphambi kokusola ukungezwa. Umbuzo wokuqala ubonisa isibaluli seqembu isihlungi esincike kuso, futhi owesibili ubonisa inani lokulawulwa kwe-akhawunti. Faka i-DN yakho yesisekelo, i-akhawunti nendawo yokugcina:

ldapsearch -H ldap://dc01.example.org:3268 -x -D "[email protected]" -W -b "DC=example,DC=org" "(sAMAccountName=alice)" memberOf
ldapsearch -H ldap://dc01.example.org:3268 -x -D "[email protected]" -W -b "DC=example,DC=org" "(sAMAccountName=bob)" userAccountControl

Umsebenzisi okuthi memberOf yakhe ibuye ingenalutho iyiqiniso lohlu lwemibhalo, hhayi iphutha lokungezwa, futhi i-akhawunti eqhubeka nokuziqinisekisa ngemva kokukhubazwa isho ukuthi isihlungi asinakho isimo sokulawula i-akhawunti. Lungisa lobo bufakazi kuqala, bese uphinda ugijimise isivivinyo sama-akhawunti amathathu. Gcina umugqa welogi owaveza isinyathelo esihlulekile eduze noshintsho lokuhlela, ukuze umuntu olandelayo ahlukanise igunya nokuqinisekiswa ngaphandle kokuphinda ukufuna.