Ikhodi yethokheni, ikhadi elihlakaniphile noma ukhiye we-FIDO: i-VPN yamukela ini
Ifobhu yekhodi, ikhadi elihlakaniphile kanye nokhiye we-FIDO konke kubizwa ngamathokheni ezingxenyekazi. Zibamba iqhaza emigeleweni ehlukene, futhi kunye kuphela kuzo eligcina ukhiye wesitifiketi.
Amadivaysi amathathu anesixhumi esifanayo nendandatho yokhiye efanayo abamba iqhaza ekushintshisaneni okuthathu okungahlobene. Elilodwa likhombisa ikhodi ehlolwa iseva, elinye lisayina ngokhiye ongaphumi kudivaysi, kanti elesithathu ligunyaza ukungena kwesiphequluli ngomgudu walo siqu. Ngakho umbuzo wokuthi i-VPN kufanele isebenzise izitifiketi noma amathokheni ezingxenyekazi uqhathanisa ifomethi nekilasi ledivaysi. Impendulo incike ekutheni yikuphi kokuthathu okwathengwa ngempela.
Shono ubufakazi ngaphambi kwedivaysi
Ithokheni yekhodi yesikhathi esisodwa ikhiqiza inani eliqinisekiswa yisevisi yokuqinisekisa ngendlela yayo. I-VPN ingafinyelela kuleyo sevisi nge-RADIUS noma ngumnikezeli wobunikazi womfelandawonye, futhi ithokheni akudingeki neze igcine noma yini engokomhubhe uqobo. Elikufakazayo ukuthi umuntu uphethe idivaysi ekhiqiza ikhodi. Akufakazi lutho mayelana nomshini okutayiphiwe kuwo ikhodi.
Ithokheni yesitayela sekhadi elihlakaniphile igcina ukhiye oyimfihlo futhi yenza umsebenzi wokusayina lapho iceliwe, yileyo ndlela ubunikazi besitifiketi buqinisekiswa ngaphandle kokukhipha ukhiye. Isitifiketi esiseduze kwaso siyingxenyekazi yomphakathi, futhi ukunikeza leso sitifiketi kuyisenzo esihluke ngokuphelele ekunikeleni ukhiye.
Ukhiye we-FIDO ukhuluma umgudu wesithathu futhi. Ukungena ngesiphequluli kungawusebenzisa kumnikezeli wobunikazi, kodwa ukuphumelela kuleyo webhusayithi akusho ukuthi ukhiye ofanayo uzovela ngobuso bekhadi elihlakaniphile lekhasimende le-VPN.
Amanye amadivaysi asebenzisa izinhlelo zokusebenza ezimbalwa kulezi ngokuhambisana, futhi imibhalo yomkhiqizi ibala izimo ngokwehlukana ngenxa yalokho. Lokho akubona ubufakazi bokuthi wonke ukhiye emakethe usekela zonke izimo.
Ingxenyekazi ivikela ukhiye, hhayi inqubomgomo
I-PIN kudivaysi elinesitifiketi ngokuvamile igunyaza ukusetshenziswa kwasekhaya kokhiye, futhi akusiyo iphasiwedi ehlolwa uhlelo lwama-akhawunti e-VPN. Imihlahlandlela efana ne-imihlahlandlela ye-NIST mayelana neziqinisekisi ibiza lokho kufaka kwasekhaya ngokuthi yimfihlo yokwenza kusebenze, ehlukile kusiqinisekisi uqobo. Isiqiniseko sivela kulo lonke umklamo, hhayi enanini lezicelo esikrinini.
Ukubhalisa, ukuvuselela nokususa kuhlala kumnikazi wobunikazi kungakhathalekile. Othile usanquma ukuthi ubani angabhalisa, uhlanganisa ubufakazi nomuntu ofanele, futhi wenza ukushintshwa kwenzeke lapho idivaysi ilahleka. Ukuthenga ukhiye omusha akukuhoxisi okudala.
Chaza umkhosi wokungena ngaphambi kokukhetha ingxenyekazi: ingabe umsebenzisi uthayipha ikhodi, uvula ukhiye wokusayina, noma ugunyaza isicelo sesiphequluli? Yonke impendulo isho ikhasimende elihlukile, ukulungiselelwa kwesango okuhlukile kanye nombhalo ohlukile wetafula losizo.
Imigudu ihluka kuphi empeleni
Ithokheni yekhodi yiyo elula kakhulu ukusabalalisa futhi ibuthakathaka kakhulu ekumeleni ikhasi lokukopisha elikholekayo, ngoba ikhodi etayiphiwe ingadluliswa ngesikhathi sangempela. Ukhiye onesitifiketi umelana nalolo hlobo lokuhlasela futhi kubiza kakhulu ukuwuphatha, ngoba ukukhipha nokuhoxisa kuba yingxenye yesevisi. Ukhiye we-FIDO uhamba nokungena kwewebhu futhi uncike ngokuphelele ekutheni umnikezeli wobunikazi uyawusekela yini kulesi sicelo.
Izindawo ezixubile zivamile, futhi aziphuthi ngokuzenzakalela: isitifiketi somhubhe kanye nethokheni yekhodi yekhonsoli yokuphatha kuwukwahlukanisa okuhambisanayo, inqobo nje uma zombili zibhaliswe kubunikazi obufanayo. Okwephukayo ukwahlukanisa okungabhalwanga muntu, lapho itafula losizo lingakwazi ukusho ukuthi yisiphi isici umsebenzisi angenaso.
Yenza isinqumo sibe sobala
Bhala umkhosi njengokulandelana kwezinyathelo umsebenzisi wangempela azenzayo, bese uhlola ukuthi ikhasimende, isango nomnikezeli wobunikazi bonke bayakusekela lokho kulandelana. Ukungafani kuvame ukuvela esinyathelweni sokugcina, lapho ikhasimende lingakwazi neze ukukhuluma nedivaysi.
Bese uqinisekisa ukuthi kwenzekani lapho idivaysi ilahleka noma isitifiketi siphelelwa yisikhathi. Uma leyo mpendulo ingabhalwanga, ukusatshalaliswa kunesikhala esizotholakala ngoMsombuluko ekuseni.
pkcs11-tool --list-slots
pkcs11-tool --list-objects --type cert