Ukuthi ukungena ku-VPN kufinyelela kanjani ku-RADIUS nakumhlinzeki wakho wobunikazi
Landela ukungena ku-VPN kusuka kuklayenti kuya esicelweni se-RADIUS segesi, umhlinzeki wobunikazi ongemuva kwaso kanye nenqubomgomo esetshenziswa ngemva kokwamukelwa.
Ngesonto eledlule umsebenzisi wakwazi ukungena ku-VPN futhi wagcina esenethiwekhi lapho kungenasixazululo khona. Iklayenti lathi ixhunyiwe, ilogi yegesi yathi Access-Accept, futhi ithimba lobunikazi lathi i-akhawunti ilungile. Ukungena kwasekusebenzile; igunya elingemuva kwakho alisebenzanga. Lapho ukungena ku-VPN kwehluleka, ngihamba indlela isicelo esiyihambayo ngempela — iklayenti, igesi, iseva ye-RADIUS, umhlinzeki wobunikazi — futhi ngima esinyathelweni sokuqala impendulo yaso engavumelani nesilandelayo.
Iklayenti alikhulumi nge-RADIUS neze
Noma yini uhlelo lokusebenza kukhompyutha ephathwayo eluyikhombisayo, isinyathelo saso sokuqala iphrothokholi ye-VPN: IKEv2, OpenVPN, WireGuard noma iklayenti elisekelwe ku-TLS. I-RADIUS ayiveli kulokho kushintshana. Iklayenti liziqinisekisa egesini ngesitifiketi, igama lomsebenzisi nephasiwedi, noma indlela ye-EAP ethwalwa ngaphakathi kokusethwa kwethumbu.
Lokho kubalulekile lapho ufunda amalogi, ngoba iphutha elijwayelekile lokuqinisekisa umsebenzisi alibonayo lenziwa yigesi ngemva kokuba isikhulume nenye into. Uma iklayenti lingafinyeleli neze egesini, asikho isicelo se-RADIUS okufanele silungiswe, futhi ihora elichithwe kuseva ye-RADIUS liyalahleka. Qinisekisa ukuthi ithumbu lavuka noma cha ngaphambi kokuthinta ingemuva.
Igesi iyiklayenti le-RADIUS
Uma ukusethwa kwethumbu kufinyelela endaweni lapho kufanele kubhekwe khona ubufakazi, igesi iba iseva yokufinyelela kunethiwekhi. Yakha i-Access-Request: User-Name, iphasiwedi noma umthwalo we-EAP, i-NAS-IP-Address noma i-NAS-Identifier, kanye ne-Message-Authenticator lapho indlela iyidinga. Isicelo siya ku-UDP 1812 ngokuzenzakalela, futhi ukubalwa kwezimali kuya ku-1813. Ukusetshenziswa okudala kusasebenzisa u-1645 no-1646, ngakho umthetho we-firewall obhalelwe ipheya elilodwa uchaza ukwehluleka okuningi okuthule.
Izinhlangothi zombili zabelana ngemfihlo, futhi lokho akuwona ubufakazi bomsebenzisi. Iyasayina ukushintshana, futhi yonke impendulo iqinisekiswa ngayo. Setha imfihlo ngokuhlukile ezinhlangothini zombili futhi iseva ayiphenduli ngemfihlo embi — iyalahla isicelo noma impendulo yehluleka ukuqinisekisa, ngakho igesi ibika ukuphela kwesikhathi. Imfihlo engalungile nesiseva esifile kubonakala kufana kusuka egesini, ngakho ngivivinya leso sinyathelo ngethuluzi leklayenti ngaphambi kokusola uhlu lwamafayela.
Iphrothokholi incane futhi indala — RFC 2865 ichaza ukushintshana kokuqinisekisa — kodwa izimfanelo eziyithwalayo ziyisisekelo inqubomgomo eminingi ye-VPN eyakhiwe phezu kwaso.
# ask the RADIUS server directly, from the gateway host
radtest alice 'test-password' 127.0.0.1 0 testing123
# watch the exchange the gateway actually sends
tcpdump -ni any -c 20 'udp port 1812'Iseva ye-RADIUS ingase ibe yingaphambili yomhlinzeki wobunikazi kuphela
Abantu bakhuluma nge-RADIUS nomhlinzeki wobunikazi sengathi yibhokisi elilodwa. Kaningi akunjalo. Iseva ye-RADIUS ithola i-Access-Request bese icela enye into ngaphambi kokuphendula — i-Active Directory nge-LDAP noma i-Kerberos, ifayela lomsebenzisi lendawo noma insiza yangaphandle. I-FreeRADIUS enemojuli ye-LDAP noma i-krb5, i-Windows NPS ne-Cisco ISE zonke zimi kulesi sikhundla.
Umehluko unquma ukuthi ubheke kuphi. Iphasiwedi enqatshiwe iyimpendulo yomhlinzeki wobunikazi edluliswa yi-RADIUS. Ukuphela kwesikhathi ngokuvamile ingxenye ye-RADIUS-kuya-kuhlu lwamafayela: i-akhawunti ye-bind ephelelwe yisikhathi, uhlu lwamafayela olungafinyeleleki, noma isicelo esiqondiswe engemuva elingalungile. Uma igama lomsebenzisi linencazelo yesizinda, iseva ingahamba ngayo, futhi i-akhawunti efanayo ethunyelwe njenge-CORP\alice [email protected] ingawela ezindaweni ezahlukene. Ku-Windows NPS, ilogi ye-Security ibhala u-6272 lapho kunikezwa no-6273 lapho kunqatshwa, okutshela ukuthi isinqumo savela ku-NPS noma cha.
Funda ukwehluleka esinyathelweni esikukhiqizile
Umlayezo owodwa wokungakwazi ukuxhuma uhlanganisa ukwehluleka okune okuhlukene. Ngaphambi kokushintsha noma yini, hlanganisa uphawu nesinyathelo esilukhiqizile.
| What you see | Where it comes from | First check |
|---|---|---|
| Gateway timeout, no reply | Shared secret mismatch, UDP 1812 blocked, unknown NAS, wrong server address | tcpdump at the gateway; radtest from the gateway host |
| Immediate reject | Credentials, account state, domain suffix, RADIUS policy | NPS 6273 or the FreeRADIUS auth log; test the account directly |
| Repeated challenge or MFA loop | Access-Challenge state not returned, or a token that expired mid-flow | Client prompt timing and the State attribute in debug output |
| Accept, then no access | Authorization attributes unmapped, wrong pool, route or ACL policy | Gateway policy and the attributes in the Access-Accept |
Umugqa wokugcina yiwona ohambisa abantu eqenjini elingalungile. I-Access-Accept isho ukuthi ubufakazi bamukelwe; akusho ukuthi igesi ibeke umsebenzisi echibini elilungile noma yacindezela imizila. Izimfanelo zeqembu zibalulekile kuphela uma inqubomgomo yegesi izifunda. Ngike ngabona ukungena okulungile kuwela echibini lezivakashi ngoba ukubanjwa kwemephu yamaqembu kwakusethwe ohlangothini lwe-RADIUS kwimfanelo ehlukile kunaleya ehlolwa yigesi.
Landela ukungena okukodwa kusuka ekuqaleni kuze kube sekupheleni
Khetha i-akhawunti yokuhlola eyodwa negesi elilodwa, bese ubuka umzamo ofanayo ezindaweni ezine. Qala ukusebenza kokulungisa ohlangothini lwe-RADIUS — i-freeradius -X iphrinta isicelo kanye namojuli ngamunye ewuthintayo — landela ilogi yokuqinisekisa yegesi, futhi usebenzise i-tcpdump kokushintshana kwe-UDP. Xhuma kanye bese ufunda imikhondo emine ngokulandelana.
Lokho ofuna ukukubona ukuvumelana: igesi libuze ngomsebenzisi obumlindele, iseva ye-RADIUS yakhetha ingemuva obulilindele, lelo ngemuva labuyisela isinqumo, futhi izimfanelo ezisempendulweni zihambisana nenqubomgomo esetshenziswa yigesi. Indawo yokuqala lapho imikhondo ingavumelani khona umugqa wakho wephutha. Uma impendulo ingayithwali imfanelo yeqembu, inkinga isehlangothini lwe-RADIUS, hhayi kuphrofayela ye-VPN; uma imfanelo ikhona futhi igesi ilinganakala, inqubomgomo yegesi iyinkinga.
Inothi lokuphepha ngesikhathi ukhona lapho. Imfihlo eyabiwe ivikela ukushintshana, kodwa ayibethela imfihlo izimfanelo eziningi. Uma igesi neseva ye-RADIUS zisezigabeni ezahlukene, beka leso sinyathelo ku-RADIUS nge-TLS noma ngendlela yangasese. Ithumbu lomsebenzisi elibethelwe alisho lutho ngokuxhumana nengemuva.
Ngaphambi kokuvala ithikithi, qinisekisa izinto ezine. Igesi iyafinyelela iseva ye-RADIUS embobeni esetshelwe yona ngempela. Imfihlo eyabiwe iyafana ezinhlangothini zombili. Iseva ye-RADIUS ixazulula uhlobo oluqondile lwegama lomsebenzisi elithunyelwa yigesi. Ukwamukelwa kuthwala izimfanelo ezidingwa inqubomgomo yegesi. Uma zozine zilungile, ukungena okusahlulekayo kuyinkinga yenqubomgomo yegesi, hhayi yokuqinisekisa.