Kungani i-RADIUS ibona ikheli le-IP esikhundleni segama lomsebenzisi le-VPN

I-strongSwan ingafaka ubunikazi be-IKE ku-RADIUS User-Name ngaphambi kwanoma yikuphi ukushintshana kwe-EAP. Nquma ukuthi ubani ocela ubunikazi be-akhawunti, bese uhlobanisa umzamo owodwa.

Iklayenti le-Windows IKEv2 liyaxhuma, futhi isicelo se-RADIUS sifika nekheli endaweni okufanele kube khona igama le-akhawunti. Akukho okuhlulekile okwamanje, futhi yilokho okuyisici esididayo: isango libika ubunikazi iklayenti elibuveze kusendlalelo se-IKE. Igama lomsebenzisi elilindelwe yi-backend yakho lingase livele ekushintsheni kwe-EAP okwehlukile okungakenzeki. Nquma ukuthi ubani ozokucela ngaphambi kokushintsha i-akhawunti.

Ubunikazi obubili buhamba kuxhumano olulodwa

Amagama amabili angavela kuxhumano olulodwa. Ubunikazi be-IKE bakhomba uzakwethu ngesikhathi kusethwa ithumbu, futhi ipulagini ye-eap-radius ibikopisha ku-RADIUS User-Name ekuqaleni. Ubunikazi be-EAP buyinani elihlukile, elisetshenziselwa ukuqinisekisa umsebenzisi, futhi kungenzeka bungaze buthunyelwe uma kungekho ocela.

Yingakho ilogi ye-RADIUS ingabonisa ikheli ngenkathi i-akhawunti ikhona futhi iphasiwedi ilungile. I-backend ibuzwa ngosendlalelo olungalungile. Isici se-RADIUS siwumthuthi kuphela wegama elikhethiwe.

Cela isango licele ubunikazi be-EAP

Isethulo esisetshenziswayo esisodwa senza isango licele ubunikazi be-EAP ngaphambi kokunikezela ukuqinisekisa ku-RADIUS. Esigabeni sokuqinisekisa kude soxhumano, setha indlela ku-eap-radius futhi ucele ubunikazi be-EAP ngokusobala. Isiqephu esingezansi sisezingeni langaphakathi kwebhlokhi yoxhumano ekhona, hhayi efayeleni layo. Qinisekisa uxhumano kanye ne-backend yokuhlela ngaphambi kokukopisha isintaksi kolunye ukusetshenziswa.

remote {
    auth = eap-radius
    eap_id = %any
}

Ngalokho, i-backend ithola ubunikazi iklayenti elibuhlinzekayo ekushintsheni kwe-EAP esikhundleni sekheli le-IKE. Akukho okunye mayelana noxhumano okushintshayo.

Noma vumela i-RADIUS iqale ukushintshana kwe-EAP

Esinye isethulo sibeka isinyathelo sokuqala ohlangothini lwe-RADIUS. Ipulagini ingathumela uphawu lwe-EAP-Start esikhundleni sokulinda impendulo yokuqala yobunikazi, okuvumela iseva ukuhola ukushintshana. Lokhu kuwukuhlela kwezinga lepulagini, ngakho kuthinta zonke izixhumanisi ezisebenzisa ipulagini.

charon {
    plugins {
        eap-radius {
            eap_start = yes
        }
    }
}

Khetha isethulo esisodwa nomsebenzisi we-RADIUS esikhundleni sokuvula kokubili bese uthemba. Zichaza izindlela zokusebenza ezihlukile, futhi iseva elilindele ukuqala ngeke ngempela ikwazi ukubhekana nesango eliqala ingxoxo. Imibhalo yepulagini ichaza kokubili, kuhlanganise nokuthi yibuphi ubunikazi obuthwelwe isinyathelo ngasinye.

Landela umzamo owodwa kuwo womabili amalogi

Hlobanisa umzamo owodwa kuwo womabili amalogi. Bheka ubunikazi be-IKE, bese ubheka ukuthi ukushintshana kwe-EAP-Identity kuyenzeka yini, bese ubheka ukuthi isinyathelo sokuqinisekisa sithola liphi igama. I-backend enqaba ikheli ngaphambi kokushintshana kwe-EAP ingamisa inqubo ngaphambi kokuba ubunikazi obuhlosiwe bubonakale.

journalctl -u strongswan -f

Gcina ifomethi yegama lomsebenzisi eqondile elindelwe uhlelo lobunikazi, kuhlanganise isiqalo sesizinda. Ungalokothi uqambe i-akhawunti kusukela enanini elinjengekheli, futhi ungalokothi uvale ukuqinisekisa ukuze uhlangabezane nomthetho wenqubomgomo. Ubunikazi be-EAP yigama elimenyezelwe, futhi indlela kusamele ibufakazele. Bhala igama eliphumayo kurekhodi lokuhlola ukuze umzamo olandelayo uqale esimweni esaziwayo.

Uma ukugeleza okulungisiwe kufinyelela i-akhawunti efanele futhi kusenqatshwa, ubufakazi obulandelayo akubona ubunikazi, kodwa indlela ye-EAP nenqubomgomo ye-backend. Ukuphinda ukusethwa kabusha kwephasiwedi akukwazi ukulungisa inani elikhethwe kusendlalelo sephrothokholi esandulelayo.

Izihloko ezihlobene