I-RouterOS OpenVPN ne-NPS: setha i-user-auth-method, hhayi i-auth

Ku-RouterOS, i-auth ikhetha i-digest yethuneli kuyilapho i-user-auth-method inquma ukuthi isicelo se-RADIUS sihlolwa kanjani. Hlanganisa eyesibili nomgomo we-NPS.

I-RouterOS ingafinyelela i-NPS ngokungena nge-OpenVPN futhi isenqatshwa, futhi imbangela evamile yizilungiselelo ezimbili amagama azo zombili azwakala njengokuqinisekisa. Esisodwa sikhetha i-digest yezobuchwepheshe yethuneli; esinye sinquma ukuthi imininingwane yomsebenzisi yethulwa kanjani ku-RADIUS. Ukushintsha i-digest ngeke kuguqule isicelo se-PAP sibe yi-MS-CHAPv2, noma ngabe isevisi iqala kabusha kangaki. Uhlu lokuhlola ngezansi luhlukanisa lezi zimbili, bese lilandela ukungena okukodwa okuhlulekile kumgomo we-NPS owawahlulela.

Isinyathelo 1: funda zombili izilungiselelo ngaphambi kokushintsha noma isiphi

Phrinta ukucushwa kweseva ye-OpenVPN okusebenzayo kurutha eliqeda ithuneli, hhayi kusuka kukhophi yokulondoloza noma okuthunyelwe kwenkundla okukopishiwe. Izinkambu ezimbili ezinendaba nawe zivame ukuba kumenyu eyodwa futhi zifundwa njengokungathi ziyizinye izindlela. Azinjalo: esisodwa sikhuluma ngesiteshi sedatha, esinye ngokushintshana kwemininingwane yokuqinisekisa.

/interface ovpn-server server print
/interface ovpn-server server export

Inkambu ye-auth ibala ama-digest afana ne-sha1 ne-sha256 futhi ilawula i-HMAC eqinisekisa amaphakethe ethuneli. Inkambu ye-user-auth-method ikhetha i-pap noma i-mschap2 futhi inquma ukuthi irutha lethula kanjani imininingwane yomsebenzisi ku-RADIUS. Ukushintsha kwe-digest akukwazi ukushintsha indlela yokuziphatha yesibili, yingakho ukunqatshwa okufanayo kusinda ngemuva kwakho konke ukulungiswa kweyokuqala.

Yima lapha uma ukukhishwa kwakho kungayivezi neze i-user-auth-method. Izakhiwo ezindala ze-RouterOS zingase zingayinikezi kuseva ye-OpenVPN, futhi ukulungiswa kungokwakukhishwa ongakusekela, hhayi umyalo okopishwe kwelisha.

Isinyathelo 2: thola umgomo owalinqaba ngempela ukungena

Ohlangothini lwe-NPS, isicelo sokuxhuma sihlolwa ngokwemigomo yenethiwekhi, futhi indlela yokuqinisekisa eshiwo kumgomo ohambisanayo kufanele ibe ngenye lezo iklayenti elazinikeza ngempela. Hlanganisa ukungena okukodwa okuhlulekile ngokwesikhathi nomsebenzisi esikhundleni sokufunda inani lesifinyezo. Ilogi yezokuphepha ibhala izicelo ezivunyelwe nezinqatshiwe ngekhodi yesizathu, okukutshela okuningi kakhulu kunomugqa wephutha ojwayelekile werutha.

Get-WinEvent -LogName Security -MaxEvents 200 |
  Where-Object { $_.Id -in 6272,6273 } |
  Format-List TimeCreated,Id,Message

Funda izinto ezintathu kumcimbi: igama lomgomo ohambisanayo, indlela yokuqinisekisa nekhodi yesizathu. Umgomo odinga i-MS-CHAPv2 unqaba isicelo se-PAP ngisho nomakhiya efanele, futhi umgomo odinga i-akhawunti yesizinda unqaba eyendawo. Umlando weklayenti le-RADIUS kufanele futhi uhambisane nekheli lomthombo lerutha, ngaphandle kwalokho isicelo siyalahlwa ngaphambi kokubonisana nanoma yimuphi umgomo. Akukho kulokhu okuvelayo kulogi ye-OpenVPN.

Yima lapha uma isicelo singafiki neze ku-NPS. Leyo yinkinga yemfihlo eyabiwe, ikheli leklayenti noma i-UDP 1812, futhi ukushintsha izindlela zokuqinisekisa ngeke kuyilungise.

Isinyathelo 3: shintsha indlela eyodwa, ezinhlangothini zombili

Uma umklamo ogunyaziwe uyi-MS-CHAPv2, yisethe kurutha futhi uqinisekise ukuthi umgomo ohambisanayo uyayamukela. Shintsha uhlangothi olulodwa, hlola futhi, bese ushintsha olunye; ukushintsha zombili ngesikhathi esisodwa kukushiya ungakwazi ukusho ukuthi yiluphi olwalubalulekile.

/interface ovpn-server server set user-auth-method=mschap2
/interface ovpn-server server print
/log print where topics~"radius"

Ungavuli zonke izindlela ezibuthakathaka ku-NPS ukuze iphutha linyamalale. Ingemuva kufanele libe nento indlela ekhethiwe engayiqinisekisa: i-MS-CHAPv2 idinga ukufinyelela kwiphasiwedi noma esizindeni, futhi umgomo awukwazi ukuqamba leyo nto. Ukwandisa umgomo kwandisa nokuthi umhlaseli angazama ini kuleyo akhawunti. Bhala indlela, igama lomgomo nereferensi yoshintsho ndawonye, ukuze umuntu olandelayo azuze isinqumo hhayi ukuqagela.

Shiya ukuqinisekiswa kwesitifiketi sethuneli kunjalo njengoba kwakunjalo. Indlela yemininingwane yokuqinisekisa ayithathi indawo yobuwena beseva, futhi ukwehlisa izahluko ze-TLS ukuze isivivinyo sidlule kushintsha inkinga eyodwa ngenye embi kakhulu.

Isinyathelo 4: hlola ukungena okuthathu nemvume eyodwa

Hlola umsebenzisi ovunyelwe, iphasiwedi engalungile nomsebenzisi okhishwe ngaphandle, ngamunye kuseshini entsha. Eyokuqala ifakazela indlela, eyesibili ifakazela ukuthi ukuhlola kwemininingwane yokuqinisekisa kungokoqobo, eyesithathu ifakazela ukuthi umgomo usabakhipha ngaphandle labo okufanele bakhiphe. Iseshini egciniwe ingafihla zontathu, ngakho nxepha phakathi kwemizamo.

/log print where topics~"ovpn"
/radius monitor 0

Impumelelo yokuqinisekisa ayisiyo isiphetho sohlu lokuhlola. Hlola ikheli iklayenti elilitholile kanye nezinsiza lelo kheli elingafinyelela kuzo, ngoba umsebenzisi angase aqinisekise ngendlela efanele futhi asewele echibini elingalungile. Uma ikheli elinikeziwe lingalungile, inkinga isekucushweni noma kuzimiso zempendulo ye-RADIUS, hhayi endleleni. Qinisekisa kokubili ngaphambi kokuvala ithikithi.

Uhlu lokuhlola luphelela lapho isilungiselelo serutha nomgomo we-NPS busho indlela efanayo, umsebenzisi ovunyelwe exhuma ngeseshini entsha, iphasiwedi engalungile inqatshwa, umsebenzisi okhishwe ngaphandle usahlala ekhishiwe, futhi ikheli elinikeziwe lihambisana nechibi okuhlosiwe. Noma yini encane kunalokho ishiya ukungena okulandelayo enhlanhleni.

Izihloko ezihlobene