strongSwan EAP: ubunikazi be-IKE ngokumelene negama le-AAA elilindelekile

Iklayenti le-strongSwan EAP lingaqinisekisa amagama amabili eseva. I-remote.id ihlanganisa isango le-IKE kanti i-local.aaa_id ihlanganisa iseva le-EAP; akuzona inkambu eyodwa.

Ukuqinisekiswa kwe-EAP phezu kwe-IKEv2 kungadinga iklayenti ukuthi liqinisekise amagama amabili ahlukene eseva kuxhumano olulodwa. Isango eliqeda i-IKE lethula ubunikazi obulodwa, futhi ingxenye engemuva ye-EAP eqeda ukushintshana kwe-TLS yangaphakathi ingase ithule obunye. Ku-strongSwan lezi zihlala emabhlokini wokucushwa ahlukene, futhi ukubeka igama ebhlokini elingalungile kukhiqiza ukwehluleka okubonakala njengenkinga yesitifiketi. Ukufunda ukuthi yikuphi ukuqinisekisa okwehlulekile kukutshela ukuthi yiliphi ibhlokhi okufanele ulihlele.

Uxhumano olulodwa, ubunikazi beseva obubili

Ubunikazi bokuqala bungokweshintshana kwe-IKE. Iklayenti lishaya ikheli futhi lilindele ukuthi uhlangothi olulandelayo lufakazele ubunikazi obuthile, ngokuvamile igama elisestifiketini sesango.

Okwesibili ngokwe-EAP. Nge-PEAP noma i-TTLS, iklayenti lakha umhubhe we-TLS oya kuseva yokuqinisekisa ngaphakathi kwe-IKE SA, futhi leyo seva yangaphakathi yethula isitifiketi sayo. Lapho ingxenye engemuva iyisibungu esihlukile, igama layo lihluka kwelagceke lesango. Iklayenti elihlola kuphela igama lokuqala lamukela noma yini eshiwo yilesi sesibili. Futhi iklayenti elilungiselelwe ngegama elilodwa kuzo zombili izindawo liyahluleka ngokushesha lapho lezi ezimbili zihluka ngempela.

Womabili amagama avela ekucushweni komqhubi, hhayi esitifiketini esisusa iphutha. Ukubuza umqhubi ngemininingwane yokufakwa kushesha kunokuqagela amagama amabili okusingatha.

Yikuphi inkambu eyeyaluphi ungqimba

Ku-swanctl ikheli nobunikazi be-IKE kuyizilungiselelo ezihlukene, futhi ubunikazi be-EAP bungokwesithathu.

Ikheli elikude likhetha ukuthi amaphakethe aya kuphi, futhi ubunikazi obukude buchaza ukuthi uhlangothi olulandelayo kufanele lufakazele ini. Ukulindela kwe-EAP kubhalwa ngaphansi kwebhlokhi local, ngoba kuchaza ukushintshana kwe-EAP kwale klayenti hhayi ukuziphatha kwe-IKE kohlangothi olulandelayo. Yilesi sikhundla esifundwa kabi. Igama lisekucushweni kweklayenti ngenkathi lichaza iseva, futhi yingakho libonakala lisendaweni engalungile.

connections {
    office {
        remote_addrs = vpn.example.com
        local {
            auth = eap-peap
            aaa_id = auth.example.com
        }
        remote {
            auth = pubkey
            id = vpn.example.com
        }
    }
}

Lesi siqeshana akulona uxhumano oluphelele; izinto zokwethemba, izikhonzi zokungena nemigomo yokuxhumana kwezingane kusamele zibe khona. Ukulikopisha ngokwezwi nezwi kufayela elisebenzayo kungashintsha izilungiselelo osazidingayo.

Kungani i-aaa_id ihlala ngaphansi kwe-local

Ibhlokhi local ichaza okwenziwa yilolu hlangothi ngesikhathi sokuqinisekisa, okuhlanganisa indlela ezoyisebenzisa kanye nobunikazi obulindeleke kolunye uhlangothi yaleyo ndlela. Akukho okushoyo kuwo ukuthi iseva ye-AAA isebenza emshinini ofanayo.

Inani elizenzakalelayo lenza ugibe lubukhali. Lapho kungekho nani elicacile elisethiwe, ubunikazi be-AAA obulindelekile bulandela ubunikazi obukude, ngakho ukufakwa kwegama elilodwa kuyasebenza futhi kufihla umehluko. Inani elicacile libalulekile kuphela lapho ukufakwa kwe-EAP kuphela kwenye indawo ngempela. Ukulisetha egameni elihlukile ngaphandle kwesizathu leso kwakha ukwehluleka umqhubi angeke akwazi ukuphinda. Funda ukufakwa ngaphambi kokuqamba igama lesibili.

Gcina inani lifana nalokho okushiwo yisitifiketi sengxenye engemuva ngempela, kuhlanganise nesimo segama. Ichashazi ekugcineni noma uphawu lokubamba olungasibambi isibungu kwanele ukwenza ukuhlola kwehluleke.

Izimo zangaphambili ezingakwazi ukuveza ukwehlukaniswa

Iphrofayela ye-NetworkManager ayiyona into yokuxhumana yokucushwa efanayo ne-swanctl. Isengezo esingemuva sayo siveza iqoqo elincane lezilawuli zobunikazi, futhi ukuthi yiziphi ezikhona kuncike kunguqulo efakiwe.

Lokho kubalulekile lapho ukufakwa kudinga amagama amabili ngempela. Inkambu enelebuli yobunikazi beseva ingacushwa ungqimba olulodwa hhayi olunye, ngakho iphrofayela ingabonakala ilungile futhi yehluleke ukuhlola kwangaphakathi. Hlola ukuthi isengezo esifakiwe sisekela ini ngaphambi kokucabanga ukuthi iphrofayela ingaveza lolu hlelo. Uma ingenakho, ukukhetha kungokomqhubi: enye indlela yokuhlinzeka, noma umklamo obuyisiwe wobunikazi beseva. Ukwenza buthakathaka i-PEAP noma ukwamukela noma yiliphi igama kushintsha inqubomgomo yokuqinisekisa esikhundleni sokuyilungisa.

Enye indlela akuyona into okufanele iqanjwe kuklayenti. Cela uhlelo olusekwayo ngokubhaliwe, bese ugcina leyo mpendulo kanye nephrofayela.

Hlukanisa ukungafani kobunikazi nesitifiketi esiphelelwe yisikhathi

Ukungafani kwegama nesitifiketi esiphelelwe yisikhathi kungukwehluleka okuhlukene, futhi ilogi iyabahlukanisa. Funda umlayezo ngaphambi kokunquma ukuthi yikuphi inkambu okufanele uyishintshe.

swanctl --list-conns
swanctl --list-sas
journalctl -u strongswan -n 50 --no-pager

Ukusetha ubunikazi be-AAA obuhlosiwe akukuvuseleli isitifiketi futhi akusunguli ukwethemba kumkhiphi waso, futhi ukuvuselela isitifiketi akulungisi igama elilindelekile elingalungile. Funda ukuthi yikuphi ukuqinisekisa okwehlulekile ngaphambi kokuhlela enye inkambu yobunikazi. Bese uphinda ulayishe ukucushwa futhi uqinisekise ukuthi uxhumano olulayishiwe lubonisa inani olisethile, ngoba ifayela elihleliwe elingakaze lilayishwe alishintshi lutho. Bhala womabili amagama nezingqimba zawo kumanothi okufakwa.

Izihloko ezihlobene