Izexwayiso zokungena ku-VPN akuzona izexwayiso zokugqekeza: qaphela isikhathi sokuxhumana
Ukungena okungajwayelekile kuyisizathu sokubuyekezwa, hhayi isinqumo. Xhuma irekhodi lokuqinisekisa nesikhathi sokuxhumana, bese uxhuma nalokho okuthintwa yiso, ngaphambi kokukubiza ukugqekeza.
Isixwayiso se-VPN esikhala ngenxa yezwe elisha sibonakala sinquma, futhi ngokuvamile asinjalo. Ukuqinisekisa kusho ukuthi umzamo wamukelwe; isikhathi sokuxhumana sisho ukuthi ukuphi ukuxhumana okwawuthwala; amarekhodi ezinsiza asho ukuthi kwenzekeni ngaphakathi kwalokho kuxhumana. Ngakunye kuphendula umbuzo ohlukile. Umthetho ohlanganisa kokuthathu ukhiqiza amathikithi angamashumi amathathu ngoMsombuluko futhi uphuthelwe icala langempela ngoLwesihlanu.
Ikheli langaphandle umbuzo, hhayi impendulo
Ukuhamba, izinkampani zocingo eziphuma kwelinye izwe, i-proxy yewebhu yebhizinisi kanye nechibi le-NAT lezinga lomhlinzeki elabelwe kabusha konke kuhambisa umthombo obonakalayo ngaphandle kokuhambisa umhlaseli. Irekhodi lokungena likhombisa ukuthi ukuxhumana kwangena kuphi kunethiwekhi, hhayi ukuthi ngubani owayephethe idivayisi.
Ukwehluleka okuphambene kubi kakhulu ngoba kuthule. Iphasiwedi eyebiwe esetshenziswe edolobheni lomsebenzisi uqobo ikhiqiza ukungena okuhambisana nakho konke ukungena kwangaphambili ekuhlolweni kwezwe.
Ukuthatha indawo njengesinqumo kunendleko elinganisekayo. Ama-laptop ahambayo akhiqiza ukugeleza okungaguquki kokubuyekeza, ababuyekezi bafunda ukuwavala ngaphandle kokuwafunda, futhi umkhuba uhlala kuze kufike icala langempela emgqeni ofanayo.
Izinhlobo ezintathu zamarekhodi ziphendula imibuzo emithathu ehlukile
Qala kulokho imikhiqizo esetshenzisiwe ekhipha ngempela, hhayi kulokho incwajana yomkhiqizo isikisela ukuthi ingakhipha. Isinqumo sokuqinisekisa sisho ubunikazi obufunwayo, indlela nomphumela. Umjikelezo wempilo yesikhathi sokuxhumana usho ukuxhumana, isango kanye nekheli elinikeziwe, kusukela ekuqaleni kuze kuyofika ekumeni.
| Record | Question it answers | What it cannot prove |
|---|---|---|
| Authentication decision | Which identity was accepted or rejected, by which method, at what time | That the person operating the device was the account owner |
| Session lifecycle | Which connection, gateway and assigned address were active, and for how long | What the session did with that access |
| Resource event | Which read, write or denied operation a service observed | Which human behind the session triggered it |
| Policy change | Whether an administrator altered the rule that governs the access | Whether the change was reviewed or intended |
Iseli elingenalutho iyigeja ekuqoqweni, hhayi ukukhululwa. Uma izehlakalo zezinsiza zingafiki neze, ukungabikho kokufunda okusolisayo kusho ukuthi ipayipi alinakho okuzokubika, futhi idashibhodi ethule ichaza ipayipi hhayi inethiwekhi. Bhala ukuthi yikuphi ukusetshenziswa okukhiqiza ngempela amarekhodi angaki ngaphambi kokuthembisa umthetho oncike kuwo, futhi usho umnikazi wakho konke ukugeleza okungekho.
Imininingwane yokubalwa kwezimali yindawo lapho izikhathi zokuxhumana ziba nokuhlolwa khona. Ukubalwa kwe-RADIUS njengoba kuchazwe ku-RFC 2866 kuthwala izibuyekezo zokuqala, zokuma nezaphakathi ezixhunywe nesikhombisi sesikhathi sokuxhumana, ngakho isikhathi sokuxhumana esinokuqala kodwa esingenakho ukuma siyigeja ongayisho esikhundleni semfihlo.
Xhuma esikhathini sokuxhumana, hhayi egameni lomsebenzisi
I-akhawunti eyodwa ibamba izikhathi zokuxhumana eziningi ngesikhathi esisodwa ngokusemthethweni: i-laptop, ucingo, umshini waselabhorethri oshiywe uxhunyiwe ubusuku bonke. Ukuxhuma zonke izehlakalo zalelo gama lomsebenzisi kuncibilikisa amadivayisi amathathu abe yindaba eyodwa bese kufunda inhlanganisela njengokwephulwa. Namakheli anikeziwe ayasetshenziswa kabusha, ngakho ukuxhumanisa okuqhubeka nokufanisa nekheli ngemva kokuphela kwesikhathi sokuxhumana kudonsa idivayisi yenyanga edlule esigamekweni sanamuhla. Gcina ukhiye wesikhathi sokuxhumana eceleni kwekheli futhi ukhawulele ukufaniswa esikhathini esasetshenziswa ngempela isikhathi sokuxhumana.
Lapho ukuhumusha kususa umthombo wangempela ngaphambi kokuthi insiza iwubone, sebenzisa ubunikazi obusala kulo umngcele, njengesihloko se-TLS esihlanganyelwayo noma isimemezelo sokungena kokukodwa. Ukuqamba ukuxhumana okukodwa-ku-kodwa phakathi kwekheli nomuntu kuyiphutha elifanayo elinezinyathelo ezengeziwe.
Isixwayiso esingenaye umnikazi yidashibhodi
Wonke umthetho udinga isimo, izincazelo ezingenabungozi ezikuqhamukayo, ubufakazi okufanele buqoqwe kanye nomuntu owenzayo. Umsebenzi wokuphatha owenqatshwe ngokuphindaphindiwe, ukuqhuma kwamaphasiwedi ahlulekile kanye nomqoqi othule yizigameko ezintathu ezihlukile ezinamawashi amathathu ahlukile.
Isaziso akukona ukuvimbela, futhi uhlu lokusabalalisa alikhawuleli lutho. Ukushintsha isikhathi sokuxhumana esiphilayo kudinga ingxenye ekwazi ukukwenza, kungaba isango elidedelayo ukuxhumana noma umhlinzeki wobunikazi ohoxisa isikhathi sokuxhumana. Ukugeleza okuphelelwe yisikhathi namarekhodi okuma angekho nakho kungaphansi kombhalo womthetho, ngoba umqoqi ongathumanga lutho usuku lonke ubonakala edashibhodini njengenethiwekhi ethule ngqo. Umehluko ubonakala kuphela epayipini ngokwalo.
Hlola indlela yokuqoqa ngaphambi kokuthemba iviki elithule
Fakazela ipayipi kusukela ekuqaleni kuze kuyofika ekugcineni ngaphambi kokulungisa umthetho owodwa. Imiyalo engezansi iqinisekisa ukuthi izilaleli zokuqinisekisa nokubalwa kwezimali ziyasebenza, ukuthi imininingwane yokuhlola iyenqatshwa ngesizathu esifanele nokuthi izehlakalo zesikhathi sokuxhumana zisafika:
ss -uanp | grep -E ':(1812|1813)\b' radtest alice 'not-the-password' 127.0.0.1 0 testing123 journalctl -u openvpn-server@server --since '-30 min' | grep -c 'Peer Connection Initiated' timedatectl | grep -E 'System clock|synchronized'
I-Access-Reject evela ekuhlolweni ifakazela ukuthi isicelo safinyelela iseva nokuthi imfihlo eyabiwe yafanisa, futhi yilokho okushiwo abantu abakweqayo. Ukuphela kwesikhathi esikhundleni salokho kukhombisa imfihlo, isilaleli noma isihlungi esingaphambili kwaso, futhi zonke izexwayiso ezingezansi azinakufakazelwa kuze kulungiswe lokho.
Isimo sewashi sibalulekile ngoba amafasitela okuhlobana acabanga ukuvumelana. Isango eliphambuka ngamaminithi ambalwa lenza ukuxhumanisa kwesikhathi sokuxhumana okuhlanzekile kubonakale kungenakwenzeka, futhi ababuyekezi banxephezela ngokwandisa ifasitela kuze kuyeke ukuxhumanisa ukuhlukanisa. Hlola ukuphambuka ngaphambi kokuhlela umthetho.
Bese udlulisa umthetho owodwa ekuhlolweni okungenabungozi: khiqiza ukungena kusuka kukheli elingalindelekile, qinisekisa ukuthi isixwayiso sikhala, qinisekisa ukuthi ophendulayo angakhipha isikhathi sokuxhumana kanye nezehlakalo zezinsiza zaso, futhi uqinisekise ukuthi ithikithi lithwala isikhombisi sesikhathi sokuxhumana. Umthetho okhiqiza indaba ehlangene uyaphasa. Umthetho okhiqiza inqwaba yemigqa yelogi useyidashibhodi. Rekhoda umphumela eceleni komthetho ukuze ukubuyekezwa okulandelayo kuqale ngobufakazi hhayi ngomqondo.