Ukufinyelela ku-VPN ngaphandle kwamalungelo e-desktop ekude: izango ezine ezihlukene

Umsebenzisi uxhuma ku-VPN, uvula ukwabelana ngefayela kanye nohlelo lwangaphakathi, bese umzamo we-RDP ubuyisela «i-akhawunti yomsebenzisi ayigunyaziwe ukungena kude». Akukho okungalungile mayelana nomhubhe kulo mlayezo. Izango ezine ezizimele zimi phakathi kwe-akhawunti ye-VPN ne-desktop esebenzisanayo, futhi iwukuphela kwazo eyakukhiqiza. Abantu ngokuvamile baphendula ngokungeza i-akhawunti ku-Administrators, okunikeza okuningi kakhulu kune-desktop futhi akulungisi isango uma inqubomgomo yeqembu iyenqaba. Nakhu okwenziwa yilungelo ngalinye ngempela, nokuthi ungashintsha kanjani kuphela lelo elinqabayo.

Izango ezine ngokulandelana okungaguquki

Isango kuqala linquma ukuthi ubunikazi bungakha umhubhe noma cha: inqubomgomo ye-RADIUS, umbandela weqembu, ukuhlolwa kwesitifiketi, imvume ye-Access Server. Bese ukuhamba nokuvikeleka kwezindonga kunquma ukuthi iphakethe elivela echibini lomhubhe lifinyelela isilaleli se-TCP 3389 sendawo. Bese ukuxhawana kwe-NLA kwekhasimende kuqinisekisa i-akhawunti endaweni. Kuphela ngemva kwalezi zintathu lapho isiphathimandla sezokuphepha sasendaweni sihlola ukuthi i-akhawunti inelungelo lokungena elidingwa yiseshini yekude esebenzisanayo.

Njengoba ukulandelana kungaguquki, isango ngalinye lifihla lawo angemuva kwalo. Umhubhe ohlulekile awusho lutho ngokuhamba; imbobo evinjiwe ayisho lutho ngelungelo lokungena; ukuhlolwa kwembobo okuphumelele akusho lutho ngokwamukelwa. Yingakho «i-VPN iyasebenza kodwa i-RDP ayisebenzi» kuyinkinga eyodwa kodwa umngcele phakathi kwezango ezimbili kulezi, futhi yingakho umbhalo wephutha uyindlela esheshayo yokwazi ukuthi uhlangabezane naluphi.

Ilungelo elinqaba iseshini ngempela

Ukungena ku-desktop ekude kudinga ilungelo lomsebenzisi Vumela ukungena ngezinsizakalo ze-Desktop Ekude, okungu-SeRemoteInteractiveLogonRight. Lihlolwa ekungeneni, hhayi ekwakheni umhubhe, yingakho i-akhawunti ingazulazula kunethiwekhi amahora amaningi futhi namanje yenqatshwe i-desktop. Ingxoxo eyikhombisayo ingaphansi kweziNqubomgomo Zasendaweni, Ukwabiwa Kwamalungelo Omsebenzisi, futhi okulingana kwesizinda kuseku-GPO.

Ubulungu obuzenzakalelayo buncike endimeni yomshini: iziteshi zokusebenza namaseva angamalungu zinikeza i-Administrators ne-Remote Desktop Users, kuyilapho isilawuli sesizinda sinikeza i-Administrators kuphela. Leli qiniso elilodwa lichaza iningi lokudideka, ngoba i-akhawunti efanayo iyaphumelela kuseva yamafayela futhi yehluleke ku-DC. Ilungelo lokwenqaba linqoba ilungelo lokuvumela elihambisanayo kungakhathaliseki ubulungu beqembu, ngakho i-akhawunti evunyelwe futhi enqatshiwe ngesikhathi esisodwa iyenqatshwa. Iqembu elikhulu lokwenqaba lingabamba umphathi ongezwe ngomusa.

Funda inqubomgomo esebenzayo, hhayi ingxoxo yasendaweni

Inqubomgomo yasendaweni ishintshwa yinoma yikuphi i-GPO yesizinda echaza ilungelo elifanayo, ngakho i-snap-in yasendaweni ingabonisa uhlu olubonakala lulungile kuyilapho isimo esisebenzayo sihlukile. Thumela ngaphandle lokho umshini okusebenzisayo ngempela, bese usesha ilungelo futhi ufunde ama-SID esikhundleni samagama abonisiwe:

secedit /export /cfg C:\temp\secpol.cfg
Select-String -Path C:\temp\secpol.cfg -Pattern SeRemoteInteractiveLogonRight
gpresult /scope computer /v

Kulokho okuphumayo, *S-1-5-32-544 yi-Administrators futhi *S-1-5-32-555 yi-Remote Desktop Users.

Uma kungekho nhlangothi ezimbili ezivelayo, akekho ngaphandle komnikazi wenqubomgomo ongavula i-desktop, noma yini ephakanyiswa ingxoxo yasendaweni yeziSebenzisi namaQembu. Bese i-gpresult isho i-GPO eyanqoba, futhi yiyo into okufanele uyihlele; ukushintsha inqubomgomo yasendaweni kumshini oxhumene nesizinda kuwukuhlola, hhayi ukulungisa.

Nikeza ilungelo elincane kakhulu elifanele

Impendulo evamile iqembu le-Remote Desktop Users endaweni. Lithwala ilungelo ngokuzenzakalela, lincane kakhulu kune-Administrators, futhi lihlukanisa «ungavula i-desktop» ku-«ungaphatha iseva». Lapho inqubomgomo yabela kabusha ilungelo ngokusobala, engeza iqembu noma i-akhawunti kuleyo nqubomgomo esikhundleni sokwengeza iqembu okungekho muntu owayelihlosile njengokulawula ukufinyelela.

Add-LocalGroupMember -Group "Remote Desktop Users" -Member "CORP\a.user"

Hlola uhlu lokwenqaba ngaphambi kokwengeza noma yini. Uma ilungelo lokwenqaba lisho iqembu eliqukethe umsebenzisi, ushintsho olulungile ukususa i-akhawunti kulelo qembu noma ukunciphisa ukwenqaba, hhayi ukungeza imvume yesibili kwenye indawo. Bhala ukuthi yiliphi ilungelo futhi kuphi olishintshile, ngoba ukuvuselelwa kwe-GPO kamuva kuzobuyisela isimo sangaphambili buthule futhi ithikithi lizovuleka futhi ngalo mlayezo.

Hlukanisa indlela yenethiwekhi njengesinqumo esihlukile

Iqembu le-VPN akudingeki lifinyelele yonke imbobo. Uma iqembu lidinga uhlelo hhayi i-desktop, umthetho wokuvikela onqunyelwe echibini lomhubhe nasembotsheni yohlelo wenza leyo nqubomgomo isebenze, kuyilapho ilungelo lokungena lihlala lingathintekile.

Get-NetFirewallRule -DisplayGroup "Remote Desktop"
Test-NetConnection -ComputerName 10.20.0.50 -Port 3389

Ukucushwa kwe-OpenVPN kwekhasimende ngalinye kanye nezimvume zeqembu le-Access Server kungakhawulela iziqalo zendawo ngomoya ofanayo; akukho kuzo okunikeza ilungelo lokungena ku-Windows, futhi ilungelo lokungena alikwazi ukuvula imbobo. Zigcine emafasiteleni okushintsha ahlukene, ngoba umthetho wembobo nelungelo kugunyazwa abantu abahlukene.

Qinisekisa ngokulandelana okufanayo nokokusebenza kwezango: ingabe i-akhawunti ingakha umhubhe, ingabe iseshini ifinyelela isilaleli, ingabe ikhasimende liqinisekisa, futhi ingabe i-akhawunti inelungelo. I-ping ehlulekayo kuyilapho ukuhlolwa kwembobo kuphumelela iwudonga oluphendula i-ICMP ngendlela ehlukile, hhayi ubufakazi bokuthi i-RDP ivinjiwe. Incwadi ka-Microsoft yereferensi yelungelo lokungena ibala okuzenzakalelayo ngokwendima yomshini kanye nomthetho wokuthi ukwenqaba kunqoba imvume.