Ukuhlolwa okubili kokungena akuzona izici ezimbili: VPN ne-RADIUS

Ukungeza i-backend yesibili yokuqinisekisa ku-VPN gateway kuzwakala njengokungeza isici sesibili. Ngokuvamile kunezela ukuhlolwa kwesibili, okuyinto ehlukile enezindlela zokwehluleka ezahlukene. Ukuthi kufanele kuphumelele kokubili, ukuthi ngakunye kufakazelani nokuthi kwenzekani lapho okukodwa kungatholakali kuyizinqumo ezintathu ezihlukene. Uma wenza iphutha, i-gateway iba nzima kakhulu embukisweni futhi ibe buthaka ngesikhathi sokuphazamiseka.

I-backend yesibili ifakazelani ngempela

Ukusesha kwe-akhawunti yendawo kufakazela ukuthi igama likhona kusizindalwazi nokuthi iphasiwedi yayihambisana nalo. Ukushintshana kwe-RADIUS kufakazela ukuthi iseva ye-RADIUS ibuyisele i-Access-Accept kuzimfanelo ezitholiwe. Akukho kwezitatimende ezimbili okhuluma ngohlobo lwesici, ngoba kokubili kuqinisekisa ulwazi. Futhi umhlahlandlela we-NIST wobunikazi bedijithali ubala izinhlobo ezahlukene zezici kanye neziqinisekisi zazo, hhayi amaseva noma iziphakamiso.

Kukhona umklamo osemthethweni lapho zombili izinhlelo zihlanganyela khona. Isevisi emaphakathi ingaqinisekisa umuntu ngenkathi i-gateway ihlola ngokuzimela ukuthi leyo akhawunti inelungelo lalo mhubhe. Lokho kugunyaza eceleni kokuqinisekisa, futhi ukukubiza ngezici ezimbili kuxuba ukuhlolwa kwenqubomgomo nobufakazi bokuba nakho.

I-RADIUS ingathwala isici sesibili sangempela lapho imi phambi kwento eqinisekisa esisodwa, njengokuvunywa kwe-push noma ithokheni yehadiwe. Isigaxa asisho ukuthi yiziphi iziqinisekisi umsebenzisi azethulile, ngakho funda inqubomgomo ye-backend, hhayi ilebula le-gateway.

I-AND, i-OR nesipele kuyimikhiqizo ehlukene

Ngaphambi kokuqhathanisa ukusetshenziswa, nquma ukuthi kokubili kusho ukuthini esimweni sakho. Inqubomgomo ye-AND idinga ukuthi yonke into eshiwo yokuhlola iphumelele, i-OR yamukela noma yikuphi okuphumelelayo, futhi isipele sizama okwesibili kuphela ngaphansi kwezimo zokwehluleka ezishiwo. Lezi zintathu ziziphatha ngokuhlukile ngesikhathi sokuphazamiseka, futhi ngokuvamile kunesisodwa kuphela esasiyisihloko sokubuyekeza.

Ukungeza amarekhodi amabili e-backend esikrinini sokucwangcisa akwembuli ukuthi iyiphi inqubomgomo umkhiqizo ayisebenzisayo. Amanye ama-gateway ahlanganisa ama-plugin ngokulandelana futhi ayeke ekwenqabeni kokuqala, okuyi-AND kuphela lapho wonke ama-plugin adingekayo. Amanye abheka i-akhawunti yendawo njengokushintsha, okuguqula ukuphazamiseka okuphakathi kube ukweqa. Impendulo ethembekile wukuhlolwa okuphikisayo okubhaliwe kwayo yonke indlela, okwenziwe kwi-build oyisebenzisayo.

Isipele sifanelwe ukusola okukhulu, ngoba sikhona ukuze kuqhubeke ukusebenza lapho into iphukile. Isipele esamukela iphasiwedi yendawo njalo lapho i-RADIUS ingafinyeleleki siguqule inqubomgomo ephakathi yaba umnyango wesibili obuthaka.

Ukuhlolwa okukabili kwe-OpenVPN yisimo esibonakalayo

I-OpenVPN yomphakathi 2.6 idinga isitifiketi sekhasimende kanye neskripthi se-auth-user-pass-verify esilungisiwe lapho kokubili kuvuliwe. Lokho yi-AND ebhaliwe phakathi kokuqinisekisa isitifiketi neskripthi semininingwane yokungena, futhi kuyizinto ezimbili zokuhlola ngempela. Nokho akuzona ngokuzenzakalela izinhlobo ezimbili zezici, ngoba iskripthi singase siqinisekise iphasiwedi kuphela.

Inhlanganisela futhi ishiya umbuzo wokuxhumana uvulekile. Isitifiketi ngokuvamile sikhomba idivayisi ngenkathi imininingwane yokungena ikhomba umuntu, futhi akukho lutho ekugelezeni okuzenzakalelayo okudinga ukuthi kokubili kubhekise kumuntu oyedwa. Nquma ukuthi yimaphi amabhangqa avunyelwe, bese uphoqelela lelo mephu ngaphakathi kweskripthi sokuqinisekisa noma esigabeni sokugunyaza esilandelayo.

Imodi yesitifiketi kuphela wukuhlolwa okukodwa, okusekelwa ukhiye ongase uvikelwe nge-PIN noma ungavikelwe. I-PIN iguqula leyo mininingwane yokungena ibe ulwazi kanye nokuba nakho kuphela uma ukhiye ungenakusetshenziswa ngaphandle kwayo. Ukushiya lowo khiye ungabhalwanga embozweni kudiski kunciphisa ingxenye yesibili ibe ilungelo lefayela.

Abakhiqizi bezinto bakha amapayipi abo, ngokuvamile imojuli ye-PAM noma i-plugin ye-RADIUS ngemva kwekhonsoli yewebhu. Ukuziphatha komphakathi kuyisibonelo sokuthi ukuhlolwa okukabili kubukeka kanjani, hhayi incazelo yokuthi idivayisi iyihlanganisa kanjani.

Hlola inhlanganisela ku-gateway yakho

Funda ukucwangciswa ngaphambi kokuthemba isifinyezo sekhonsoli. Imigqa enquma inqubomgomo imodi yesitifiketi, iskripthi semininingwane yokungena nokulandelana kwama-plugin.

grep -E 'verify-client-cert|auth-user-pass-verify|plugin' /etc/openvpn/server.conf
openssl x509 -in /etc/openvpn/pki/issued/client01.crt -noout -subject -serial
radtest alice 'wrong-password' 127.0.0.1 0 testing123

i-grep ikhombisa ukuthi isitifiketi siyadingeka yini nokuthi yisiphi iskripthi esigijima ngemva kwaso, futhi ukulandelana kubaluleke kakhulu kunalokho okuphakanyiswa amagama. I-dump yesitifiketi inikeza ubunikazi i-gateway ezobona, kuhlanganise ne-CN nenombolo yokulandelana edingekayo kumephu wokuxhumana. Ukuhlolwa kwe-RADIUS yisimo esiphikisayo: iphasiwedi engalungile kufanele inikeze i-Access-Reject, futhi elungile i-Access-Accept. Uma imininingwane yokungena enqatshiwe isanikeza isikhathi, iskripthi asikho neze endleleni yokuqinisekisa.

Bese ugijima isimo sokuphazamiseka kusibonelo selabhorethri: misa i-backend edingekayo futhi uxhume ngemininingwane evumelekile. Umphumela olindelekile wukwenqaba, futhi noma yini enye iyinqubomgomo yesipele okungekho owayibhalayo.

Bhala imfuneko njengezimo eziphikisayo

Imfuneko esebenzisekayo isho ubufakazi, ama-akhawunti avunyelwe ukubethula kanye nomphumela lapho umqinisekisi engekho. Iphinde ichaze ukubhangqa okuvunyelwe phakathi kobunikazi bedivayisi nobunikazi bomuntu. Lokho kunembe kakhulu kunezinto zomkhiqizo ku-oda lokuthenga, futhi kungahlolwa.

Ukwamukelwa kufanele kuhlanganise ukwenqaba okune: i-akhawunti yendawo engafaneleki, ubufakazi obudingekayo obungekho, isici sesibili esingavumelekile kanye ne-backend edingekayo engafinyeleleki. Ukwenqaba ngakunye kudinga umugqa welogi okwehlukanisa kwabanye, kungenjalo isigameko esilandelayo siqala ngokuqagela. Rekhoda ukuthi yisiphi isigaba esithathe isinqumo ngasinye, ngoba i-gateway, iseva ye-RADIUS kanye nohlu lwezincwadi zizosola omunye nomunye.

Phinda ugijime ukwenqaba okune ngemva kwanoma yikuphi ukushintsha kwe-plugin noma kwe-firmware. Kuyashibhile, futhi inqubomgomo ezivikelayo iyingxenye umhlaseli ayihlola kuqala.