Isitifiketi se-VPN asivikeli ingxenye ye-LDAP

Ukungena nge-VPN okuhlola ubufakazi ngokumelene nencwadi yezikhombo kuhlanganisa ukuxhumana okubili okwehlukene kwenethiwekhi. Ukuxhumana komsebenzisi nesango kuvikelwe isitifiketi se-VPN uqobo kanye nokuhlelwa kwephrothokholi. Ukuxhumana kwesango nencwadi yezikhombo iseshini enye enezilungiselelo zayo ze-TLS, isitolo sayo sokwethemba kanye nezindlela zayo zokwehluleka. Akukho lutho kokokuqala okuqinisekisa lutho ngokwesibili.

Lokho kungalingani yikho okuyindlela engemuva kokungena okubonakala kubethelwe kodwa kusathumela iphasiwedi ye-bind obala.

Ukuxhumana okubili, izinqumo ezimbili zokwethemba

Iseshini yangaphandle yilokho umsebenzisi akubonayo: isitifiketi esiboshelwe egameni lomsingathi we-VPN, esiqinisekiswe yiklayenti, esithwala ukushintshana kokugunyazwa. Iseshini yangaphakathi ingeyeklayenti lencwadi yezikhombo ngaphakathi kwesango, elivula ukuxhumana kwalo futhi lixoxe nge-TLS noma cha. Uhlangothi ngalunye luqinisekisa ozoxoxa naye, lisebenzisa impahla evela kwelinye ifayela lokuhlela. Ingxenye yangaphakathi ehlelwe kabi ihlala ingabonakali ohlangothini lomsebenzisi, ngoba ingxenye yangaphandle isebenza ngqo njengoba bekuhloswe.

Yingakho ukwehluleka kuthule kunokuba kube msindo. Isango elingakaze lihlole isitifiketi sencwadi yezikhombo lisagunyaza abasebenzisi ngendlela efanele; limane libagunyaza ngesiteshi esingasihlolisisanga.

I-StartTLS ne-LDAPS, ezikhethwe ngamabomu

I-StartTLS ivuleka njenge-LDAP evamile futhi ikhuphuke endaweni, ngokwejwayelekile embobeni 389. I-LDAPS iqala i-TLS nokuxhumana, ngokwejwayelekile ku-636. Zombili zisemthethweni futhi i-adaptha kufanele ihambisane nalokho okunikezwa yincwadi yezikhombo. Ukufuna i-StartTLS kuhlukile ekuzameni kwayo nokuqhubeka lapho ukukhuphuka kwehluleka, futhi kuleyo mehluko ncamashi iphasiwedi ye-bind ingaphuma. Hlela imodi eqinile, futhi ungavumeli indlela yokubuyela emuva engavikelwe ye-bind enephasiwedi.

ldapsearch -H ldap://dc1.corp.example -ZZ -x -D "CN=VPN Bind,OU=Service Accounts,DC=corp,DC=example" -W -b "DC=corp,DC=example" "(sAMAccountName=example-user)" dn

-ZZ inketho iyona ndaba yonke: umbuzo wehluleka esikhundleni sokuqhubeka buthule ngaphandle kokukhuphuka. Amagama nama-akhawunti kulowo mugqa ayizibonelo. Imibhalo ye-TLS ye-OpenLDAP ihlanganisa izilungiselelo zokwethemba ezingemuva.

Yisiphi isitolo sokwethemba esifundwa yiklayenti le-LDAP?

Umtapo weklayenti we-OpenLDAP ufunda ukuhlelwa kwawo kokwethemba, kungaba kusuka kufayela lesistimu noma kusuka kusilungiselelo esithile se-plugin. Umyalelo we-CA we-VPN usebenza kubalingani be-VPN futhi awusona ubufakazi bokuthi umtapo we-LDAP ufunda ifayela elifanayo. Sebenzisa igama lomsingathi lencwadi yezikhombo elihlanganiswa ngempela yisitifiketi, kanye nochungechunge lokukhipha umtapo owethembayo. Ku-Active Directory, sebenzisa isitifiketi sesevisi yencwadi yezikhombo ngokusetshenziswa okulungile kokugunyazwa kweseva esikhundleni sokuqagela kusuka egameni lokubonisa.

Yonke indawo yokushintsha lapho kwehluleka kufanele ihlangabezane nenqubomgomo yobunikazi efanayo. Indawo lapho okokuqala kuqinisekisiwe khona kodwa okwesibili kungaqinisekiswanga imbi kakhulu kunaleyo engenakho ukushintsha, ngoba indlela ebuthaka itholakala kuphela ngesikhathi sokuphazamiseka.

I-akhawunti ye-bind ihlala iyinkinga ehlukile

Ukuvikela ukuthutha akwehlisi lokho i-akhawunti ye-bind engakwenza. Ububanzi bokusesha encwadini yezikhombo, ukugunyazwa kwamaqembu kanye namalungelo e-akhawunti yesevisi yizinqumo ezihlukene, futhi i-akhawunti ye-bind ebanzi ihlala ibanzi ngemva kokuvulwa kwe-TLS. Sebenzisa i-akhawunti yesevisi ebincane kakhulu kanye nesisekelo sokusesha esidingwa ukuhlanganiswa, futhi rekhoda indawo yokugcina, imodi ye-TLS, umnikazi wokwethemba kanye nenqubo yokuvuselela kanye nokuhlelwa kwe-VPN.

Lapho kuvela ukungafani kwesitifiketi, sebenzisa isitifiketi noma uchungechunge olulungile. Ukucisha ukuqinisekisa kuguqula ukungafani okubonakalayo kube okungabonakali futhi kushiye ubudlelwano besibili bokwethemba bungahlolwanga.

Ukuxhumana okubili, abanikazi ababili, izinsuku ezimbili zokuvuselela. Ukuzigcina zihlukene emibhalweni yikho okugcina ukungena kuthembekile.