Ukungena ku-VPN kuyama ngemuva kwe-Access-Challenge ye-RADIUS

Iphasiwedi yakho ilungile, ukungena ku-VPN kusahluleka, futhi kungenzeka ukuthi iseva ye-RADIUS yenze ngqo lokho eyayikutshelwe. Isango cishe lamukele i-Access-Challenge, alibonisanga lutho olusizayo, labe seliphelelwa yisikhathi noma lathatha leyo mpendulo njengokwenqatshwa. Ngasohlangothini lweklayenti kubonakala njengemininingwane yokungena engalungile noma umhubhe ophukile. Imbangela ivamise ukuba phakathi nengxoxo okungekho muntu oyibambile.

Ukungena okukodwa, ukushintsha okubili kwe-RADIUS

Lapho ingxenye engemuva ifuna isici sesibili, ayiphenduli isicelo sokuqala ngokwamukela noma ngokwenqaba. Iphendula ngekhodi 11 futhi ilinda impendulo elandelayo yomsebenzisi, okumele isango liyibuyisele esicelweni esilandelayo. Leso sicelo esilandelayo siyingxenye yengxoxo yokuqinisekisa efanayo, hhayi umzamo omusha wokungena.

Ekuhlelweni okusebenzayo umsebenzisi ubona isicelo sesibili: iphasiwedi kuqala, bese kuba yikhodi esetshenziswa kanye, noma isicelo esisodwa esihlanganisiwe uma umqhubi ekubhalile. Ekuhlelweni okuphukile isicelo sesibili asikaze sivele futhi ukungena kumane kuhluleke.

Yilokho okubonakalayo okufanele kulandelelwe, futhi kulula ukukuqinisekisa ngasohlangothini lweklayenti kuphela: uma iklayenti le-VPN licela imfihlo eyodwa ngqo bese lenqaba iphasiwedi oyaziyo ukuthi ivumelekile, ukushintsha cishe kuphelele esivivinyweni.

Isivivinyo sithwala ini ngempela

Incazelo ye-RADIUS ichaza ikhodi 11 esigabeni 4.4 futhi ivumela izici ezimbili ezibalulekile lapha. I-Reply-Message igcina umbhalo owenzelwe umsebenzisi, futhi i-State igcina inani elingacacile iseva efuna ukulibuyisela. I-NAS akufanele ihumushe i-State, kufanele nje iyibuyise ingashintshiwe.

Isicelo esilandelayo sisebenzisa i-Identifier entsha ne-Request Authenticator entsha, futhi kumele sithwale inani elifanayo le-State kanye nempendulo yomsebenzisi. Iseva ilixhumanisa nesivivinyo esilindile ngale-State, yingakho isango elenza kabusha noma elilahla lesi sici lingeke liqedele lo mkhuba. I-response authenticator kuyo yonke impendulo nayo kumele iqinisekiswe, kungenjalo i-NAS kufanele ilahle iphakethe.

Isigaba 4.4 sengeza imininingwane echaza iningi lokuhluleka okuthule: i-NAS engakwazi ukusekela izivivinyo ithatha i-Access-Challenge njengokwenqatshwa. Uma isevisi ye-VPN yesango lakho indala kunalokho kusekelwa noma iyakushiya, isicelo sengxenye engemuva sesici sesibili siba «ukuqinisekisa kuhlulekile» ngokushesha ngaphandle kwesicelo.

Isicelo esixhumene silahleka kuphi

Umsolwa wokuqala akumina mininingwane yokungena, umzila wesicelo. Ingosi ebonisa inkambu ye-OTP yokungena kuwebhu ayikwenzi lokho ngokuzenzakalela kusevisi ye-VPN, futhi amanye amasango adlulisa isivivinyo kuphela kumaklayenti amemezela lelo khono. Zama i-akhawunti efanayo kuzo zombili izindawo zokungena; uma ingosi isebenza kodwa i-VPN ingasebenzi, ubheka ukudluliswa, hhayi ithokheni.

Isimo sokufaka iwumsolwa wesibili. Ukuhlanganisa iphasiwedi nekhodi ngaphandle kwesihlukanisi esibhalwe umthengisi, noma ukuvumela imininingwane egciniwe ukuthi iphinde idlale ikhodi endala, kuhluleka ngendlela ebukeka ifana ncamashi nephasiwedi engalungile. Sebenzisa isicelo esihlukile noma isimo esihlanganisiwe esibhalwe umqhubi, futhi ungaze uqambe isihlukanisi sakho.

Iziphambeko eziqondene nomklamo zikhona, kodwa uhlu lwezinguqulo ezilungisiwe zangonyaka odlule alusona isiqondiso sokuthunyelwa kwamanje. Funda amanothi okukhishwa kwesofthiwe oyisebenzisayo ngempela, futhi gcina isigaba sokushintsha esibonakele njengobufakazi bakho.

Landelela umzamo owodwa kusukela ekuqaleni kuze kube sekupheleni

Khipha kabusha kanye, ngokuxazulula amaphutha ohlangothini lweseva kuvuliwe, futhi gcina yonke enye isethi ingaphandle kwewindi lokubamba:

$ sudo radsniff -i eth0 -x -f 'udp port 1812'
$ sudo freeradius -X
$ radtest alice 'password' 127.0.0.1 0 testing123

Emphumeleni funa ukuma kwengxoxo hhayi umugqa owodwa. I-Access-Request yokuqala ene-Identifier 3, i-Access-Challenge ethwala i-State, bese kuba i-Access-Request yesibili ene-Identifier 4 ephinda leyo State futhi ihlanganisa impendulo yomsebenzisi. Uma isicelo sesibili singekho, isango alizange lilandele. Uma sifika singenayo i-State, iseva ayikwazi ukusixhumanisa nesivivinyo esilindile futhi ngokuvamile iyasinqaba.

Uma wabelana ngomkhondo, fihla imininingwane yokungena, amathokheni kanye nedatha yobunikazi engadingeki, futhi xhumanisa izehlakalo zomzamo owodwa esikhundleni sokuhlanganisa ukuphindaphinda okuvela kumathebhu amaningi esiphequluli. Izimpawu zesikhathi zingumngane wakho lapha; isivivinyo esifika ngemuva kokuba iklayenti linikelele sibonakala njengokwenqatshwa kumsebenzisi nanjengempendulo enensayo kusigcini.

Isimo sokugcina osifunayo ingxoxo eqediwe negunyaziwe, ilandelwa ukufinyelela kwesevisi obekuhlosiwe. Impendulo efika isuka kuseva ye-RADIUS ifakaza okuncane kakhulu kunalokho.