Ukwenqatshwa kwe-RADIUS uma kuqhathaniswa nokungaphenduli: ukungena kwasekhaya kusebenza nini

Ukugcina i-akhawunti yasekhaya yezimo eziphuthumayo akukuyenza ibe ithuba lesibili kukho konke ukungena okwenqatshiwe. Kumodeli ye-AAA ye-Cisco IOS ne-IOS XE, leyo database ibuzwa kuphela lapho indlela yangaphambilini ihluleka ngendlela ethile, futhi iseva ye-RADIUS ephendula ngokwenqatsha ayizange yehluleke ngale ndlela. I-akhawunti yasekhaya ihlanganisa indlela engafinyeleleki, hhayi leyo enqatshiwe. Ukukholelwa okuphambene nalokhu kuguqula isinqumo senqubomgomo sibe ukufuna iphutha leseva elingekho.

Kungani uhlu lwezindlela lubukeka njengesitebhisi

Umugqa ofana nawo aaa authentication login default group radius local ufundwa kusukela kwesobunxele kuye kwesokudla, futhi iningi labantu ufundwa ngokuthi zama i-RADIUS, bese uzama i-database yasekhaya. Isakhiwo somusho simema lokho kufunda ngoba uhlu luwukulandelana. Incazelo incane kakhulu: uhlu lusho izindlela zokuqinisekisa, futhi umthetho wokusuka kwenye uye kwelandelayo uncike kumphumela wendlela yangaphambilini, hhayi ekunikezeni umsebenzisi elinye ithuba.

Indlela ebuyisela iphutha kanye nendlela ebuyisela ukwehluleka kuholela emiphumeleni ehlukene lapha. Ukwenqatshwa kuyimpendulo, ngoba iseva yacubungula imininingwane yokungena futhi yathi cha, futhi uhlu luyama lapho. Iseva engafinyeleleki, isicelo esiphelelwe yisikhathi noma impendulo engaqinisekiswanga yicalo elivumela indlela elandelayo ukuthi isebenze, futhi kuphela lapho ukuphathwa kwezinkinga kwepulatifomu kulungiselelwe ngale ndlela. Yingakho iseluleko sakudala sokwengeza i-local sisebenza ngesikhathi sokuphazamiseka futhi asenzi lutho ngamaphasiwedi angalungile. Funda uhlu esikhundleni salokho njengemibuzo emibili: iyiphi indlela ephendulayo, nokuthi yini ipulatifomu eyibheka njengempendulo.

Hlukanisa uhlu lwezindlela eqenjini laseva

Uhlu lwezindlela luyisendlalelo esisodwa futhi iqembu laseva lungenye. Igama elingukhiye i-group radius libiza iqembu okukulo ukuhleleka kwangaphakathi, ukuphinda uzame, izikhathi zokulinda kanye nokutholwa kweseva efile kungelokweqembu, kuyilapho indlela yasekhaya iyisendlalelo esingaphezulu kwayo. Ngakho ukuhlela noma yini ngaphakathi kweqembu akukwazi ukuguqula ukwenqatshwa kube indlela yokuphuma. Qinisekisa ukuthi isevisi ibhekisa kuluphi uhlu ngempela ngaphambi kokushintsha noma yisiphi sezendlalelo ezimbili.

Phrinta ukulungiselelwa kwe-AAA futhi ufunde uhlu isevisi ekhomba kulo, hhayi inani elizenzakalelayo okhumbula ukuthi walibhala. Kwenze kusuka kudivayisi isevisi egcina kuyo ngempela.

show running-config | section aaa
show radius server-group RAD-GRP
show aaa servers

Ithebula laseva libika isimo kanye nezibali zayo yonke ingxenye, okukutshela ukuthi igethiwayi ifinyelele iseva ngesikhathi somzamo yini. Iseva emakwe njengesebenzayo enesibali sezicelo esikhulayo ibiphendula, ngakho ukungena okwehlulekile kuyisinqumo hhayi inkinga yokuxhumana.

Funda impendulo ngaphambi kwerekhodi

Ikhodi yempendulo ibiza umphumela futhi isikisela isinyathelo sayo esilandelayo. I-Access-Reject isho ukuthi i-backend yathatha isinqumo, ngakho ubufakazi obuwusizo inqubomgomo ehanbisana kanye nesimo se-akhawunti esingemuva kwayo. Access-Challenge isho ukuthi ukushintshana kufuna esinye isinyathelo esisekelwayo njengesici sesibili, futhi indlela yokuphuma yasekhaya ingeqa buthule into edingwa inqubomgomo.

Phinda wenze umzamo owodwa nge-akhawunti yokuhlola emisiwe ukuze impendulo kanye nokurekhodwa kwe-backend kuqhathaniswe ngesigxivizo sesikhathi esifanayo. Sebenzisa imininingwane yokungena ovunyelwe ukuyenza ihluleke.

test aaa group RAD-GRP svc-ops 'LabPass!24' legacy
debug radius authentication

Ingxenye yeklayenti ye-RADIUS engekho noma engaziwa iyimbangela evamile yesikhathi sokulinda buthule, ngoba iseva ithola isicelo, ayitholi incazelo yeklayenti ehambisanayo futhi iyilahla ngaphandle kokuphendula. Ukungafani kwemfihlo eyabiwe nakho ngokuvamile kubukeka njengesikhathi sokulinda, ngoba impendulo yehluleka ukuqinisekiswa futhi iyalahlwa. Akukho kulokhu okubukeka njenge-Access-Reject, futhi akukho okulungiswa ngokwengeza i-akhawunti yasekhaya. Hlola incazelo yeklayenti kanye nemfihlo kuzo zombili izinhlangothi ngaphambi kokuthinta uhlu lwezindlela.

Kungani i-akhawunti yasekhaya ingakaze ifakazele lutho

I-akhawunti emi ngemuva kweqembu ohlwini ifakazela kuphela ukuthi othile wahlela ukuphazamiseka. Ayisho lutho mayelana nokuthi uhlelo luyasebenza yini, ngoba icala eliyihlolayo yicalo okungekho muntu olicikichayo: iseva yayeka ukuphendula. Ukungena kwasekhaya okungakaze kufinyelelwe kukho ekusebenzeni okuvamile kungathwala iphasiwedi ephelelwe yisikhathi noma isimo esikhiyiwe izinyanga eziningi ngaphandle kokuthi othile aqaphele.

Ukufinyelela kwezimo eziphuthumayo kuyisinqumo somklamo, hhayi umphumela oseceleni wokulungiselelwa. Yinike i-akhawunti yayo elinganiselwe, umnini wayo kanye nenqubo yokubuyisela ebhaliwe, futhi ufake ukushintshwa kwemfihlo eyabiwe kuleyo nqubo. Ukugcina iphasiwedi yasekhaya enegama elifanayo kuwo wonke umsebenzisi ophakathi kuyiphethini ebuyisela buthule ukufinyelela obucabanga ukuthi ukususile.

Ukuhlola okubalulekile kuyenziwa ngamabomu, futhi kuzophazamisa ukungena ngenkathi kusebenza. Yingakho kungena efasiteleni elihleliwe lapho isinyathelo sokubuyisela sibhalwe kuqala.

Hlola indlela yokuphuma ngesikhathi sefasitela lesondlo

Hlela ukuhlola ukuze ungasoze ususe indlela yokugcina yokungena. Qinisekisa indlela yokuphatha ezimele kuqala, bese ukufinyelela okuvamile okuvunyelwe, bese ukwenqatshwa ngamabomu, bese ukuziphatha kokuphazamiseka okuvunyelwe. Lezi zimo ezine zinemiphumela elindelekile ehlukene, futhi ukuzihlanganisa kube ukuhlola okukodwa yindlela abantu abazivalela ngayo ngaphandle kwedivayisi abasayidingayo.

Gijimisa ukuhlola ngakunye kusuka kuseshini yekhonsoli noma endleleni engaphandle kwebhendi, ukuze iphutha lingakwazi ukuvala iseshini osebenza kuyo. Ikhonsoli iyona ndlela yodwa enganciki engxenyeni ehlolwayo.

show aaa servers
show running-config | include aaa authentication
test aaa group RAD-GRP svc-ops 'LabPass!24' legacy

Ngemuva kwalokho, buyisela ukulungiselelwa kwangaphambilini futhi uqinisekise ukuthi izibali ziyanyakaza futhi ekungeneni kwangempela okulandelayo. Uma ukwenqatshwa ngamabomu kukhiqiza ukungena kwasekhaya esikhundleni sokwenqatshwa, khona-ke uhlu noma ukuphathwa kwezinkinga akusikho obukholelwa kukho, futhi lokho kutholakala kubaluleke kakhulu kunokuphazamiseka okuqale ngakho. Bhala umphumela kurekhodi loshintsho eduze kwamagama e-akhawunti kanye nosuku lokuhlola.