Ukufinyelela kwe-VPN kwi-akhawunti yensizakalo: isitifiketi noma ukungena okwabiwe
Qhathanisa isitifiketi somshini nephasiwedi egciniwe yokufinyelela kwe-VPN ngaphandle kokuqashwa, bese ubeka umkhawulo wangempela wemvume kunqubomgomo esebenza ngemva kokungena.
Imiklamo emibili ihlanganisa cishe zonke izilungiselelo ze-VPN ezingagadiwe: ukungena komuntu okwabiwe okugcinwe kusikripthi, noma isitifiketi somshini esiboshelwe kumsingathi. Yehluleka ezindaweni ezihlukene, futhi lokho kubaluleke kakhulu kunesivinini sokusetha. Iphasiwedi egciniwe iyaphuka lapho umnikazi wayo eyishintsha noma ehamba; isitifiketi siyaphuka lapho siphelelwa yisikhathi noma lapho umsingathi wakhiwa kabusha ngaphandle kokhiye. Izimo ezintathu zinquma ukuthi iyiphi indlela yezindleko ongayithwala, futhi akukho mklamo olinganiselayo lutho kuze kube yilapho inqubomgomo yemvume yenza kanjalo.
Qala ngomsebenzi, hhayi nge-akhawunti
Umsebenzi uchaza umkhawulo: yiziphi izindawo, yiziphi izinsizakalo, yimaphi amahora, isikhathi esingakanani ingahlala isikhathi sokuxhumana. Indlela yethuneli iyingxenye yalowo mkhawulo kuphela. Isango linquma ukuthi isikhathi sokuxhumana sivunyelwe yini; insiza engemva kwayo inquma ukuthi isikhathi sokuxhumana singenzani. Bhala uhlu kuqala, nomnikazi oqanjiwe, ngoba yomibili imiklamo yobuqhwaga kufanele iwufeze.
Gcina ukuqinisekisa nokugunyaza kwehlukene ngesikhathi ubhala. Ukuqinisekisa kuphendula ukuthi ubani oxhumayo; ukugunyaza kuphendula ukuthi isikhathi sokuxhumana singafinyelela kuphi ngemva kwalokho. I-RADIUS ithwala ingxenye yesibili njengezici ezifana ne-Filter-Id, Framed-IP-Address, Session-Timeout ne-Class, futhi isango liyazixhuma lapho ukungena kuphumelela. Umklamo oguqula ukungena futhi ushiya ukugunyaza kunjalo awukalingiselanga lutho.
Ukungena komuntu okwabiwe: iphasiwedi iba umkhawulo
Ukwephinda usebenzise i-akhawunti yomuntu kuyindlela eshesha kakhulu futhi eguga kabi kakhulu. Ubufakazi buyiphasiwedi, ngakho-ke buphelela kusikripthi, kufayela lemvelo nasekuhlelweni kwesihleli, futhi ikhophi ngayinye idinga ukushintshwa. Lapho umnikazi eyishintsha ngoLwesihlanu, umsebenzi uhluleka ekusebenzeni okulandelayo futhi akekho obukayo.
I-MFA yilapho lo mklamo uvame ukuwa khona. Isikripthi asikwazi ukuphendula isicelo se-push, ngakho-ke i-akhawunti iyakhishwa kunqubomgomo, futhi yiyo kanye leyo akhawunti umhlaseli angayikhetha. Ukukhishwa, ukudlula kwezindawo ezithenjiwe kanye nokuxolelwa nge-akhawunti ngayinye kuyanda, futhi akukho kukho okubonakalayo kumuntu olandelayo ofunda izilungiselelo zomqashi.
Ukutholwa kwemvelaphi kungenye indlela yezindleko. Isikhathi sokuxhumana ngasinye kusilogange lesango sinegama lomsebenzisi elifanayo, ngakho-ke ukuvumelanisa kwasebusuku akukwazi ukwehlukaniswa nomsebenzi womuntu owabhala, futhi ukuhoxisa umsebenzi kusho ukuhoxisa lowo muntu.
Isitifiketi somshini: ubuqhwaga obuboshelwe kumsingathi
Isitifiketi sishintsha umbuzo kusuka kulokho i-akhawunti ekwaziyo kuya kulokho umsingathi ayikho. Nge-EAP-TLS iklayenti likhombisa isitifiketi futhi lifakazela ukuthi linakho ukhiye wangasese ohambisanayo; iseva yenqubomgomo ixhumanisa isihloko noma i-akhawunti yekhompyutha neqembu futhi isebenzisa inqubomgomo yalelo qembu. Akukho sikhuthazo, akukho mfihlo owabiwe ohleli kufayela lombhalo.
Umkhawulo ewudalayo mncane kunalokho abantu abakulindele. Isitifiketi siqinisekisa umsingathi, hhayi umsebenzi, futhi noma ubani onamalungelo e-root noma omlawuli wendawo angasebenzisa lowo khiye kulo mvo womsingathi. Gcina ukhiye lapho ipulatifomu iwuvikela khona: ungakwazi ukuphuma kusitore yesitifiketi se-Windows, kusekelwa i-TPM lapho iphrofayili ivuma khona, noma ifayela engu-0600 ephethwe yi-root ku-Linux. Ukuphulwa komsingathi ukuphulwa kobufakazi.
Ukuphela kwesikhathi kuwukwehluleka okuphindaphindayo. Isitifiketi esiphelelwa yisikhathi ngeSonto siyamisa umsebenzi ngeSonto, futhi isango livame ukubika iphutha elijwayelekile lokuqinisekisa esikhundleni sokusho usuku. Hlola izinsuku kumsingathi womsebenzi njengengxenye yencwadi yokusebenza:
openssl x509 -in client.pem -noout -subject -issuer -dates
ipsec listcertsUkuhoxisa kudinga indlela isango eliyihlolayo. OpenVPN lifunda i-CRL ngokukhetha i-crl-verify, futhi i-strongSwan incike ku-CRL noma i-OCSP kuye ngokuthi iphrofayili yokuxhumana yakhiwe kanjani. Uma kokubili kungaxhunyiwe, ukususa umsingathi kusho ukulinda isitifiketi siphelelwe yisikhathi.
Izimo ezintathu eziquma phakathi kwazo
Qhathanisa nepulatifomu onawo, hhayi nomklamo oyireferensi.
Isimo sokuqala: ingabe isango lingagunyaza ubuqhwaga bomshini? Uma lixhumanisa kuphela igama lomsebenzisi le-RADIUS nomsebenzisi wohlu lwemibhalo, isitifiketi siqinisekisa umsingathi bese sima ekugunyazeni. Isimo sesibili: ingabe umsebenzi udinga ukufinyelela kwinsiza ethwalwa yi-akhawunti yomsebenzisi kuphela, njengokwabiwa okuxhunyiwe noma ilayisense yesihlalo ngasinye? Khona-ke ubuqhwaga bomshini abukwazi ukuthatha indawo, futhi impendulo eqotho i-akhawunti yomsebenzisi eyingqayizivele enomgomo obekiwe. Isimo sesithathu: ubani ongashintsha ubufakazi ngaphandle komuntu osemjikelezweni? Ukubhaliswa okuzenzakalelayo kwenza izitifiketi zibe zishibhile ukuzigcina; iphasiwedi eyaziwa ngumuntu oyedwa ayikwenzi lokho.
| Constraint | Machine certificate | Dedicated user account with stored secret |
|---|---|---|
| Unattended login | Private key proof, no prompt | Only if the account is exempted from MFA |
| Resource expects a user identity | Works only when the resource accepts computer accounts | Matches the access a person would have |
| Rotation | Re-enrollment, often automated | Secret change plus redeploy of every copy |
| Revocation speed | Tied to CRL or OCSP refresh | Disable the account, immediate |
Funda ithebula njengohlu lwezindleko, hhayi njengokuhlelwa kwezigaba. Ikholomu yemfihlo egciniwe iyawina ngesivinini sokuhoxisa nasekuhambisaneni nezinsiza eziqonda kuphela ama-akhawunti omsebenzisi; ikholomu yesitifiketi iyawina ekushintsheni nasekungaphuli i-MFA ukuze isikripthi sisebenze.
Beka umkhawulo kunqubomgomo, ngemva kokuqinisekisa
Noma yibuphi ubuqhwaga obukhethayo, umkhawulo wemvume ungowenqubomgomo esebenza ngemva kokuqinisekisa. Ku-NPS izinqubomgomo zenethiwekhi zihlolwa ngokulandelana futhi inqubomgomo yokuqala ehambisana nazo zonke izimo isebenzisa izilungiselelo zayo, ngakho-ke inqubomgomo ebanzi ebekwe phezu kwencane inquma umphumela, kungakhathaliseki ukuthi iklayenti lethula ini. I-Microsoft ibhala imodeli yezimo nezilungiselelo ku-mhlahlandlela wenqubomgomo ye-NPS.
Nika umsebenzi iqembu lalo noma isimo senqubomgomo, esisekelwe entweni ethwalwa ubuqhwaga bomshini: ithempulethi yesitifiketi, isihlonzi sesiteshi esishayayo, noma ikheli elivela kuchibi olukhethiwe. Bese ubopha isikhathi sokuxhumana ngezici: i-Filter-Id yendima isango lakho eliyixhumanisayo, i-Session-Timeout emfushane ukuze umsebenzi obambekile uqinisekise kabusha esikhundleni sokugcina isikhathi sokuxhumana izinsuku eziningi, ne-Framed-IP-Address evela kuchibi olivikela nge-firewall ngaphesheya. Ukugunyazwa kohlelo lwesicelo kuhlala kwehlukile: ithuneli eliya kuseva yesizindalwazi akulona imvume yokufunda ithebula elingaphakathi kwayo.
Qinisekisa ukwenqatshwa, bese uhlela ukususa
Ukufinyelela okusebenzayo akufakazeli lutho ngemvume encane kakhulu. Esikhundleni salokho hlola ukwenqatshwa: xhuma ngobuqhwaga bomsebenzi bese ufinyelela indawo engaphandle kohlu, vula isikhathi sokuxhumana sesibili esikhathi esisodwa uma isango kufanele livume eyodwa kuphela, futhi uphinde ukungena ngemva kokuhoxisa ubufakazi.
Bese uqinisekisa leso sikhathi sokuxhumana ezindaweni ezimbili. Isilogange sesango sikhombisa ubuqhwaga obuqinisekisile; isilogange seseva yenqubomgomo sikhombisa ukuthi iyiphi inqubomgomo ehambisanayo nokuthi iziphi izici ezibuyisiwe. Ku-OpenVPN iseva irekhoda igama elivamile lesitifiketi, futhi i-ipsec statusall ku-strongSwan iphrinta ithuneli elisunguliwe kanye nobuqhwaga obusetshenziswayo. Uma amasilogange amabili engavumelani ngobuqhwaga, inqubomgomo ihambisana nento ehlukile kunalokho okucabangayo.
Ukususa kuyingxenye yomklamo, hhayi umjaho wokuhlanza. Bhala yonke into okufanele isuswe (isitifiketi noma i-akhawunti, ubulungu beqembu, inqubomgomo yenethiwekhi, umbhalo wochibi, umthetho we-firewall kokuhlosiwe) futhi uyisebenzise kanye ngesikhathi umsebenzi kuselula ukuwakhakha kabusha.
Uma uqala namuhla, sebenza ngalolu hlelo: bhala uhlu lwezinsiza, khetha ubuqhwaga ngezimo ezintathu, beka umkhawulo kunqubomgomo, futhi uzilolonge ekwenqatshweni okukodwa ngaphambi kokuba umsebenzi uqale ukusebenza.