Ukuxhumanisa i-RADIUS ne-OpenVPN: i-plugin noma i-hook yeskripthi?

I-plugin isanconywa emicu emidala kunamabhilidi amanje, futhi iyahluleka lapho ilayishwa kuseva ekhishwe izolo. Lokhu akulona iphutha lokuhlela elingalungiswa ngomzila. I-plugin ne-hook yeskripthi zixazulula inkinga efanayo ezigabeni ezahlukene, futhi ukusuka kwelinye uye kwelinye kushintsha okufanele kufakwe, okusebenza ngamalungelo eseva, nokuthi ukungena okuhlulekile kukutshelani ngempela.

Inganekwane: i-plugin iyindlela esekelwayo

I-plugin iyinto eyabelwe elayishwa kwinqubo ye-OpenVPN, ngakho kufanele ihambisane ne-interface leyo nqubo eyivezayo. Amabhilidi ayashintsha, ukupakisha kuyashintsha, futhi umtapo wolwazi okhishwe nge-interface endala wenqaba ukulayishwa. Akukho lutho ekuhlelweni kweseva okungavala lelo gebe, yingakho iseluleko esithi "faka nje i-radiusplugin" siphetha ngeseva engaqali.

I-hook yeskripthi yona ima ngaphandle kwenqubo. OpenVPN isebenzisa uhlelo, ilunikeza ubufakazi bese ifunda isinqumo. Ukwehlukaniswa kwalokho yikho okwenza ikwazi ukudlula ezikhwameni, futhi futhi kuyenza ibe umthwalo wakho ngendlela i-plugin engakaze ibe nayo.

Ayikho indlela ephephile ngakumbi ngokwakheka kwayo. Enye isebenzisa ikhodi yangaphandle ngaphakathi kwedemon; enye isebenzisa ikhodi yakho eceleni kwayo ibambe ubufakazi esandleni. Umbuzo ofanele ukuthi yikuphi kwalaba bungozi ababili ongakwazi ukubphatha ngempela.

I-plugin yayihlanganisa ini

I-plugin yayinefayela layo lokuhlela eline-host ye-RADIUS, imfihlo eyabiwe, inani lokuzama futhi nomkhawulo wesikhathi, futhi ukuhlelwa kweseva kwakubhekisela kulo ngomugqa owodwa. Ukuphathwa kobufakazi kwahlala ngaphakathi kwenqubo yeseva, okusho ukuthi iphasiwedi ayizange yeqe umngcele wenqubo okwakufanele umphathi uwuvikele.

Inani kwakuwukuhlangana. Konke ukukhushulwa kwe-OpenVPN kwakusongela i-interface engahambisani, futhi konke ukusatshalaliswa okwakha kabusha iphakethe kwakusongela ukukhiqiza umtapo wolwazi ongasahambisani. Lapho lokho kwenzeka, ukwehluleka kukhulu futhi kwenzeka ngokushesha, futhi yiwona kuphela umusa walesi sakhiwo.

Uma i-plugin enjalo isalayishwa kubhilidi lakho, ingase ibe indawo encane yokusebenza. Qinisekisa i-interface eyakhelwe yona, ihlale iboshelwe kubhilidi oluhlolile, futhi ubheke noma yikuphi ukukhushulwa njengoshintsho oludinga ukuhlolwa okuphelele kokungena, hhayi ukubuyekezwa kwephakethe okujwayelekile.

I-hook yeskripthi ithemba ini ngempela

I-hook ihlelwa nge-auth-user-pass-verify kanye nendlela yokuletha: okuguquguqukayo kwemvelo noma ifayela lesikhashana. Ngendlela yemvelo, i-OpenVPN idinga i-script-security 3, izinga elibhaliwe elivumela ukuveza iphasiwedi kuma-skripthi. Lelo zinga liwukuncipha ngamabomu kokujwayelekile, futhi kufanele kuthathwe njengemvume enezizathu ezinamathiselwe.

Konke okuthintwa iskripthi kuzuza lelo themba. Kufanele kube ngaphansi kobunikazi be-root, kungabhaleki yiqembu noma abanye, kubhekiselwe kuyo ngomzila ophelele, futhi kungabi nandawo lapho inani elingathenjwa lifinyelela khona i-shell. Beka yonke into eguquguqukayo kuma-quotes, nqaba izinhlamvu ezingalindelekile, futhi ungakhi umyalo osuka kugama lomsebenzisi elinikeziwe. Iskripthi esisebenza njenge-root kuwo wonke umzamo wokungena sifanele ukubuyekezwa kanye ngenxa yalezo zici ezine.

ls -l /usr/local/sbin/radius-auth.sh
stat -c '%U %a' /usr/local/sbin/radius-auth.sh

Indlela yokuletha ngefayela igwema inkinga yefa lemvelo futhi inikeza iskripthi ubufakazi ngefayela lesikhashana elinezimvume ezingavinjelwe. Uma iklayenti lakho likusekela, ngokuvamile iyona ndlela engcono yokuzenzakalela, nakuba yengeza enye into okufanele ihlanzwe lapho kwehluleka.

Amakhodi okuphuma anquma ukuthi uzohluleka ngokuvulekile yini

Isimo sokuphuma seskripthi yisinqumo: uziro uyamukela, okungeyona uziro kuyala. Iphethini edala izinkinga iyiskripthi se-shell esamukela kuphela lapho impendulo ye-RADIUS inophawu oluthile lokwamukela futhi ibuyisela ukwehluleka kukho konke okunye, ngoba lokho kuhlanganisa izehlakalo ezintathu ezihlukene zibe yimpendulo eyodwa. Iphasiwedi engalungile, iseva engafinyeleleki kanye nempendulo ekhubazekile konke kuba ukunqatshwa okufanayo.

Hlukanisa lezo zimo kuskripthi nakuba i-hook ingabuyisela kuphela ukwamukela noma ukwala. Bhala umphumela we-backend ngokwehlukile, xwayisa ngezikhathi zokuphela namaphutha okuthutha, futhi wenze kucace ekuqapheni lapho ukuqinisekiswa kwehluleka ngenxa yokuthi isevisi iphelile hhayi ngenxa yokuthi abasebenzisi bathayipha okungalungile.

Imikhuba emibili igcina okunye kunengqondo. Uma i-RADIUS iyisiphathimandla, kufanele kube yiyo kuphela indawo lapho iphasiwedi ihlolwa khona, ngoba ithebula lomthunzi lidala izimpendulo ezimbili embuzweni owodwa futhi eyesibili iyindawo yokuhlasela okungekho oyiqaphayo. Futhi khumbula ukuthi i-hook ibizwa futhi kuwo wonke umzamo, ngakho iskripthi esihamba kancane neklayenti elingapheli isineke siba isikhulisi sokuqagela iphasiwedi ngaphandle uma wengeza ukubambezeleka noma inqubomgomo ohlangothini lwe-RADIUS.

Ulahlekelwa ini lapho isitifiketi sinyamalala

Ukusetshenziswa okuningi kwalolu hlobo kucisha ngokuphelele ukuhlolwa kwesitifiketi seklayenti, kushiye igama lomsebenzisi nephasiwedi njengesimangalo sonke seklayenti. Okunyamalalayo ngalokho kulungiselelwa ubunikazi obusekelwe kusitifiketi. Umzila uhlala ukhodiwe, kodwa into eyodwa eqamba iklayenti yisinqumo se-RADIUS. Noma yini engaphansi eyayithemba isihloko sesitifiketi manje kufanele ithembe igama lomsebenzisi.

Gcina ukuvikelwa komzila wokulawula ukuze ozakwethu ongaqinisekisiwe angakwazi ukuhlola noma ukukhipha isandla, futhi usebenzisa i-username-as-common-name lapho ukuhlelwa komsebenzisi ngamunye kuncike egameni elijwayelekile. Amasango aphethwe ngokuvamile akuxazulula lokhu ngendlela ehlukile, aqeda ukuqinisekiswa kwesitifiketi esangweni olukhuluma i-EAP-TLS ne-RADIUS, futhi kuleso simo akukho kulezi ziqondiso zeseva ezisebenza. Kopisha imodeli ebhalwe yipulatifomu yakho siqu, hhayi eyomkhiqizo womakhelwane. Iziqondiso ezibalulekile zihluke ngokwanele ukuthi ukuzixuba kukhiqize ukuhlelwa okuhlaziywayo bese kungaqinisekisi muntu.