{"id":36872,"date":"2019-10-31T22:14:26","date_gmt":"2019-10-31T19:14:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/go-to-2fa-dvuhfaktornaya-autentifikatsiya-dlya-asa-ssl-vpn\/"},"modified":"2019-10-31T22:14:26","modified_gmt":"2019-10-31T19:14:26","slug":"go-to-2fa-dvuhfaktornaya-autentifikatsiya-dlya-asa-ssl-vpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/go-to-2fa-dvuhfaktornaya-autentifikatsiya-dlya-asa-ssl-vpn","title":{"rendered":"P\u0159ej\u00edt na 2FA (Dvoufaktorov\u00e1 autentizace pro ASA SSL VPN)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pot\u0159eba poskytnout vzd\u00e1len\u00fd p\u0159\u00edstup k podnikov\u00e9 prost\u0159ed\u00ed se objevuje \u010d\u00edm d\u00e1l \u010dast\u011bji, a to jak pro vlastn\u00ed u\u017eivatele, tak pro partnery, kte\u0159\u00ed pot\u0159ebuj\u00ed p\u0159\u00edstup k r\u016fzn\u00fdm server\u016fm ve va\u0161\u00ed organizaci.<\/p>\n

Pro tyto \u00fa\u010dely v\u011bt\u0161ina firem pou\u017e\u00edv\u00e1 technologii VPN, kter\u00e1 se osv\u011bd\u010dila jako spolehliv\u00fd zp\u016fsob ochrany p\u0159\u00edstupu k m\u00edstn\u00edm zdroj\u016fm spole\u010dnosti.<\/p>\n

Moje spole\u010dnost nen\u00ed v\u00fdjimkou a i my, jako mnoho dal\u0161\u00edch, tuto technologii vyu\u017e\u00edv\u00e1me. A jako mnoz\u00ed jin\u00ed pou\u017e\u00edv\u00e1me jako br\u00e1nu pro vzd\u00e1len\u00fd p\u0159\u00edstup Cisco ASA 55xx.<\/p>\n

Se zvy\u0161uj\u00edc\u00edm se po\u010dtem vzd\u00e1len\u00fdch u\u017eivatel\u016f se objevuje pot\u0159eba zjednodu\u0161it proces vyd\u00e1v\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f. Z\u00e1rove\u0148 je v\u0161ak nutn\u00e9 to ud\u011blat bez ob\u011bt\u00ed na bezpe\u010dnosti.<\/p>\n

Na\u0161li jsme \u0159e\u0161en\u00ed v zaveden\u00ed dvoufaktorov\u00e9 autentizace pro spojen\u00ed p\u0159es Cisco SSL VPN<\/a>, p\u0159i pou\u017eit\u00ed jednor\u00e1zov\u00fdch hesel. Tento p\u0159\u00edsp\u011bvek v\u00e1m uk\u00e1\u017ee, jak zorganizovat podobn\u00e9 \u0159e\u0161en\u00ed s minim\u00e1ln\u00edmi \u010dasov\u00fdmi n\u00e1roky a nulov\u00fdmi n\u00e1klady na pot\u0159ebn\u00fd software (za p\u0159edpokladu, \u017ee Cisco ASA je ji\u017e sou\u010d\u00e1st\u00ed va\u0161\u00ed infrastruktury).<\/p>\n

Trh p\u0159et\u00e9k\u00e1 hotov\u00fdmi \u0159e\u0161en\u00edmi pro generov\u00e1n\u00ed jednor\u00e1zov\u00fdch hesel, p\u0159i\u010dem\u017e nab\u00edz\u00ed mnoho variant jejich z\u00edsk\u00e1n\u00ed, a\u0165 u\u017e to je zas\u00edl\u00e1n\u00ed hesla prost\u0159ednictv\u00edm SMS, nebo pou\u017eit\u00ed token\u016f, a\u0165 u\u017e hardwarov\u00fdch, nebo softwarov\u00fdch (nap\u0159\u00edklad na mobiln\u00edm telefonu). Ale snaha o \u00fasporu a cht\u00edt u\u0161et\u0159it pen\u00edze pro sv\u00e9ho zam\u011bstnavatele, v podm\u00ednk\u00e1ch sou\u010dasn\u00e9 krize, m\u011b p\u0159im\u011bla naj\u00edt bezplatn\u00fd zp\u016fsob, jak realizovat slu\u017ebu pro generov\u00e1n\u00ed jednor\u00e1zov\u00fdch hesel. Ten, p\u0159esto\u017ee je zdarma, m\u00e1 m\u00e1lo co do \u010din\u011bn\u00ed s komer\u010dn\u00edmi \u0159e\u0161en\u00edmi (je t\u0159eba poznamenat, \u017ee tento produkt m\u00e1 i komer\u010dn\u00ed verzi, ale domluvili jsme se, \u017ee n\u00e1klady v pen\u011bz\u00edch budou nulov\u00e9).
\n<\/a><\/noindex>
\nTak\u017ee, co budeme pot\u0159ebovat:<\/p>\n

\u2014 Obraz Linuxu se zabudovan\u00fdm n\u00e1strojem \u2013 multiOTP, FreeRADIUS a nginx pro p\u0159\u00edstup k serveru p\u0159es web (http:\/\/download.multiotp.net\/ \u2013 pou\u017eil jsem hotov\u00fd obraz pro VMware)
\n \u2014 Server Active Directory
\n \u2014 Samotn\u00fd Cisco ASA (pro pohodl\u00ed pou\u017e\u00edv\u00e1m ASDM)
\n \u2014 Jak\u00fdkoli softwarov\u00fd token, kter\u00fd podporuje mechanismus TOTP (nap\u0159\u00edklad pou\u017e\u00edv\u00e1m Google Authenticator, ale i FreeOTP bude vyhovovat)<\/p>\n

Nejsem zde, abych se zab\u00fdval podrobnostmi o nasazen\u00ed obrazu. Na v\u00fdstupu z\u00edsk\u00e1te Debian Linux s ji\u017e nainstalovan\u00fdmi multiOTP a FreeRADIUS, nakonfigurovan\u00fdmi pro spolupr\u00e1ci a webov\u00fdm rozhran\u00edm pro spr\u00e1vu OTP.<\/p>\n

Krok 1. Spou\u0161t\u00edme syst\u00e9m a nastavujeme ho na svou s\u00ed\u0165<\/b>
\nVe v\u00fdchoz\u00edm nastaven\u00ed je syst\u00e9m dod\u00e1v\u00e1n s p\u0159ihla\u0161ovac\u00edmi \u00fadaji root root. Mysl\u00edm, \u017ee si ka\u017ed\u00fd uv\u011bdomil, \u017ee by bylo dobr\u00e9 zm\u011bnit heslo u\u017eivatele root po prvn\u00edm p\u0159ihl\u00e1\u0161en\u00ed. Tak\u00e9 je nutn\u00e9 zm\u011bnit nastaven\u00ed s\u00edt\u011b (ve v\u00fdchoz\u00edm stavu to je '192.168.1.44' se schr\u00e1nkou '192.168.1.1'). Pot\u00e9 m\u016f\u017eete syst\u00e9m restartovat.<\/p>\n

V Active Directory vytvo\u0159\u00edme u\u017eivatele otp<\/b>, se heslem MySuperPassword<\/b>.<\/p>\n

Krok 2. Nastavujeme p\u0159ipojen\u00ed a importujeme u\u017eivatele Active Directory<\/b>
\nK tomu budeme pot\u0159ebovat p\u0159\u00edstup do konzole a p\u0159\u00edmo soubor multiotp.php<\/b>, pomoc\u00ed kter\u00e9ho nastav\u00edme parametry p\u0159ipojen\u00ed k Active Directory.<\/p>\n

P\u0159ech\u00e1z\u00edme do adres\u00e1\u0159e \/usr\/local\/bin\/multiotp\/<\/i> a postupn\u011b provedeme n\u00e1sleduj\u00edc\u00ed p\u0159\u00edkazy:<\/p>\n

.\\\/multiotp.php -config default-request-prefix-pin=0<\/code><\/pre>\n
\nUr\u010duje, zda je vy\u017eadov\u00e1na dal\u0161\u00ed (trval\u00e1) PIN p\u0159i zad\u00e1v\u00e1n\u00ed jednor\u00e1zov\u00e9ho PIN (0 nebo 1)<\/p>\n
.\\\/multiotp.php -config default-request-ldap-pwd=0<\/code><\/pre>\n
\nUr\u010duje, zda je vy\u017eadov\u00e1no zad\u00e1n\u00ed dom\u00e9nov\u00e9ho hesla p\u0159i zad\u00e1v\u00e1n\u00ed jednor\u00e1zov\u00e9ho PIN (0 nebo 1)<\/p>\n
.\\\/multiotp.php -config ldap-server-type=1<\/code><\/pre>\n
\nUr\u010duje typ LDAP serveru (0 = b\u011b\u017en\u00fd LDAP server, v na\u0161em p\u0159\u00edpad\u011b 1 = Active Directory)<\/p>\n
.\/multiotp.php -config ldap-cn-identifier=\"sAMAccountName\"<\/code><\/pre>\n
\nUr\u010duje, v jak\u00e9m form\u00e1tu p\u0159edstavit jm\u00e9no u\u017eivatele (tato hodnota vr\u00e1t\u00ed pouze jm\u00e9no, bez dom\u00e9ny)<\/p>\n
.\/multiotp.php -config ldap-group-cn-identifier=\"sAMAccountName\"<\/code><\/pre>\n
\nTot\u00e9\u017e, pouze pro skupinu<\/p>\n
.\/multiotp.php -config ldap-group-attribute=\"memberOf\"<\/code><\/pre>\n
\nUr\u010duje metodu ur\u010den\u00ed p\u0159\u00edslu\u0161nosti u\u017eivatele ke skupin\u011b<\/p>\n
.\\\/multiotp.php -config ldap-ssl=1<\/code><\/pre>\n
\nZda pou\u017e\u00edt zabezpe\u010den\u00e9 p\u0159ipojen\u00ed k LDAP serveru (samoz\u0159ejm\u011b \u2014 ano!)<\/p>\n
.\\\/multiotp.php -config ldap-port=636<\/code><\/pre>\n
\nPort pro p\u0159ipojen\u00ed k LDAP serveru<\/p>\n
.\\\/multiotp.php -config ldap-domain-controllers=adSRV.domain.local<\/code><\/pre>\n
\nAdresa va\u0161eho serveru Active Directory<\/p>\n
.\/multiotp.php -config ldap-base-dn=\"CN=Users,DC=domain,DC=local\"<\/code><\/pre>\n
\nUd\u00e1v\u00e1me, odkud za\u010d\u00edt hledat u\u017eivatele v dom\u00e9n\u011b<\/p>\n
.\/multiotp.php -config ldap-bind-dn=\"otp@domain.local\"<\/code><\/pre>\n
\nUr\u010dujeme u\u017eivatele, kter\u00fd m\u00e1 pr\u00e1va vyhled\u00e1v\u00e1n\u00ed v Active Directory<\/p>\n
.\/multiotp.php -config ldap-server-password=\"MySuperPassword\"<\/code><\/pre>\n
\nUr\u010dujeme heslo u\u017eivatele pro p\u0159ipojen\u00ed k Active Directory<\/p>\n
.\\\/multiotp.php -config ldap-network-timeout=10<\/code><\/pre>\n
\nNastavujeme \u010dasov\u00fd limit pro p\u0159ipojen\u00ed k Active Directory<\/p>\n
.\\\/multiotp.php -config ldap-time-limit=30<\/code><\/pre>\n
\nNastavujeme \u010dasov\u00e9 omezen\u00ed pro operaci importu u\u017eivatel\u016f<\/p>\n
.\\\/multiotp.php -config ldap-activated=1<\/code><\/pre>\n
\nAktivujeme konfiguraci p\u0159ipojen\u00ed k Active Directory<\/p>\n
.\/multiotp.php -debug -display-log -ldap-users-sync<\/code><\/pre>\n
\nProv\u00e1d\u00edme import u\u017eivatel\u016f z Active Directory<\/p>\n
Krok 3. Generujeme QR k\u00f3d pro token<\/b>
\nJe to velmi jednoduch\u00e9. Otev\u0159ete webov\u00e9 rozhran\u00ed OTP serveru v prohl\u00ed\u017ee\u010di, p\u0159ihlaste se (nezapome\u0148te zm\u011bnit v\u00fdchoz\u00ed heslo pro administr\u00e1tora!) a klikn\u011bte na tla\u010d\u00edtko \u201ePrint\u201c:<\/p>\n
\"P\u0159ej\u00edt
\nV\u00fdsledkem t\u00e9to akce bude str\u00e1nka, kter\u00e1 obsahuje dva QR k\u00f3dy. Na prvn\u00ed z nich se klidn\u011b vyka\u0161lete (i kdy\u017e m\u00e1 l\u00e1kav\u00fd n\u00e1pis Google Authenticator \/ Authenticator \/ 2 Steps Authenticator) a znovu skenujte druh\u00fd k\u00f3d do softwarov\u00e9ho tokenu ve va\u0161em telefonu:<\/p>\n
\"P\u0159ej\u00edt
\n(Ano, \u00famysln\u011b jsem znehodnotil QR k\u00f3d, aby byl ne\u010diteln\u00fd).<\/p>\n
Po proveden\u00ed t\u011bchto krok\u016f se v\u00e1m v aplikaci ka\u017ed\u00fdch t\u0159icet sekund za\u010dne generovat \u0161estim\u00edstn\u00e9 heslo.<\/p>\n
Pro jistotu m\u016f\u017eete prov\u00e9st kontrolu ve stejn\u00e9m rozhran\u00ed:<\/p>\n
\"P\u0159ej\u00edt
\nZadejte u\u017eivatelsk\u00e9 jm\u00e9no a jedno\u010dasov\u00e9 heslo z aplikace ve va\u0161em telefonu. Z\u00edskali jste kladnou odpov\u011b\u010f? Pokra\u010dujeme d\u00e1l.<\/p>\n
Krok 4. Dola\u010fte a otestujte funk\u010dnost FreeRADIUS<\/b>
\nJak jsem zm\u00ednil v\u00fd\u0161e \u2014 multiOTP je ji\u017e nastaven pro pr\u00e1ci s FreeRADIUS, zb\u00fdv\u00e1 prov\u00e9st testy a p\u0159idat do konfigura\u010dn\u00edho souboru FreeRADIUS informace o na\u0161em VPN br\u00e1n\u011b.<\/p>\n
Vr\u00e1t\u00edme se do konzole serveru, do adres\u00e1\u0159e \/usr\/local\/bin\/multiotp\/<\/i>, zad\u00e1me:<\/p>\n
.\/multiotp.php -config debug=1\n.\/multiotp.php -config display-log=1<\/code><\/pre>\n
\n\u010c\u00edm\u017e zapneme podrobn\u011bj\u0161\u00ed logov\u00e1n\u00ed.<\/p>\n
V konfigura\u010dn\u00edm souboru klient\u016f FreeRADIUS (\/etc\/freeradius\/clinets.conf<\/i>) zakomentujeme v\u0161echny \u0159\u00e1dky, kter\u00e9 se t\u00fdkaj\u00ed localhost<\/b> a p\u0159id\u00e1me dva z\u00e1znamy:<\/p>\n
client localhost {\n        ipaddr = 127.0.0.1\n        secret          = testing321\n        require_message_authenticator = no\n}<\/code><\/pre>\n
\n \u2014 pro test<\/p>\n
client 192.168.1.254\/32 {\n        shortname =     CiscoASA\n        secret =        ConnectToRADIUSSecret\n}<\/code><\/pre>\n
\n \u2014 pro na\u0161i VPN br\u00e1nu.<\/p>\n
Restartujeme FreeRADIUS a pokus\u00edme se autorizovat:<\/p>\n
radtest username 100110 localhost 1812 testing321<\/code><\/pre>\n
\nkde u\u017eivatelsk\u00e9 jm\u00e9no <\/i>= u\u017eivatelsk\u00e9 jm\u00e9no, 100110 <\/i>= heslo vydan\u00e9 na\u0161\u00ed aplikac\u00ed v telefonu, localhost <\/i>= adresa RADIUS serveru, 1812 <\/i> \u2014 port RADIUS serveru, testing321 <\/i> \u2014 heslo klienta RADIUS serveru (kter\u00e9 jsme uvedli v konfiguraci).<\/p>\n
V\u00fdsledkem tohoto p\u0159\u00edkazu bude v\u00fdstup p\u0159ibli\u017en\u011b n\u00e1sleduj\u00edc\u00edho obsahu:<\/p>\n
Odes\u00edl\u00e1n\u00ed Access-Request s ID 44 na 127.0.0.1 port 1812\n        U\u017eivatelsk\u00e9 jm\u00e9no = \"username\"\n        U\u017eivatelsk\u00e9 heslo = \"100110\"\n        NAS-IP-Adresa = 127.0.1.1\n        NAS-Port = 1812\n        Ov\u011b\u0159ovatel zpr\u00e1vy = 0x00000000000000000000000000000000\nrad_recv: Access-Accept paket od hostitele 127.0.0.1 port 1812, id=44, d\u00e9lka=20<\/code><\/pre>\n
\nNyn\u00ed se mus\u00edme ujistit, \u017ee u\u017eivatel \u00fasp\u011b\u0161n\u011b pro\u0161el autentizac\u00ed. K tomu se pod\u00edv\u00e1me do protokolu samotn\u00e9ho multiotp:<\/p>\n
tail \/var\/log\/multiotp\/multiotp.log<\/code><\/pre>\n
\nA pokud tam bude posledn\u00ed z\u00e1znam:<\/p>\n
2016-09-01 08:58:17     notice  username  U\u017eivatel    OK: U\u017eivatel username se \u00fasp\u011b\u0161n\u011b p\u0159ihl\u00e1sil z 127.0.0.1\n2016-09-01 08:58:17     debug           Debug   Debug: 0 OK: Token byl p\u0159ijat z 127.0.0.1<\/code><\/pre>\n
\nPak v\u0161e prob\u011bhlo \u00fasp\u011b\u0161n\u011b a m\u016f\u017eeme prov\u00e9st<\/p>\n
Krok 5. Konfigurace Cisco ASA<\/b>
\nP\u0159edpokl\u00e1dejme, \u017ee ji\u017e m\u00e1me nastavenou skupinu a politiky pro p\u0159\u00edstup p\u0159es SLL VPN, nastaven\u00e9 v kombinaci s Active Directory, a mus\u00edme p\u0159idat dvoufaktorovou autentizaci pro tento profil.<\/p>\n
1.<\/strong> P\u0159id\u00e1v\u00e1me novou skupinu servery<\/a> AAA:<\/p>\n
\"P\u0159ej\u00edt
\n2.<\/strong> P\u0159id\u00e1v\u00e1me do skupiny n\u00e1\u0161 multiOTP server:<\/p>\n
\"P\u0159ej\u00edt
\n3.<\/strong> Opravit profil p\u0159ipojen\u00ed<\/b>, nastavujeme jako hlavn\u00ed server autentizace skupinu server\u016f Active Directory:<\/p>\n
\"P\u0159ej\u00edt
\n4.<\/strong> Na kart\u011b Advanced -> Authentification<\/b> tak\u00e9 vyb\u00edr\u00e1me skupinu server\u016f Active Directory:<\/p>\n
\"P\u0159ej\u00edt
\n5.<\/strong> Na kart\u011b Advanced -> Secondary<\/b> vyb\u00edr\u00e1me vytvo\u0159enou skupinu server\u016f, ve kter\u00e9 je uveden multiOTP server. Zaznamen\u00e1v\u00e1me, \u017ee Session username se d\u011bd\u00ed z prim\u00e1rn\u00ed skupiny server\u016f AAA:<\/p>\n
\"P\u0159ej\u00edt
\nPou\u017eijte nastaven\u00ed a<\/p>\n
Krok 6, posledn\u00ed krok<\/b>
\nOv\u011b\u0159ujeme, zda n\u00e1m funguje dvoufaktorov\u00e1 autentizace pro SLL VPN:<\/p>\n
\"P\u0159ej\u00edt
\nVua-la! P\u0159i p\u0159ipojen\u00ed pomoc\u00ed Cisco AnyConnect VPN Client bude tak\u00e9 vy\u017eadov\u00e1no druh\u00e9, jednor\u00e1zov\u00e9, heslo.<\/p>\n
Douf\u00e1m, \u017ee tento \u010dl\u00e1nek n\u011bkomu pom\u016f\u017ee a \u017ee n\u011bkoho p\u0159im\u011bje p\u0159em\u00fd\u0161let o tom, jak lze tento, bezplatn\u00fd<\/b> OTP server vyu\u017e\u00edt pro jin\u00e9 \u00fakoly. Pod\u011blte se v koment\u00e1\u0159\u00edch, pokud budete cht\u00edt.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u041f\u043e\u0442\u0440\u0435\u0431\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0432\u0441\u0435 \u0447\u0430\u0449\u0435 \u0438 \u0447\u0430\u0449\u0435, \u043d\u0435 \u0432\u0430\u0436\u043d\u043e, \u0431\u0443\u0434\u044c \u0442\u043e \u0441\u0432\u043e\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u043b\u0438 \u043f\u0430\u0440\u0442\u043d\u0435\u0440\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0442\u043e\u043c\u0443 \u0438\u043b\u0438 \u0438\u043d\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0432 \u0432\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0414\u043b\u044f \u044d\u0442\u0438\u0445 \u0446\u0435\u043b\u0435\u0439, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044e VPN, \u0437\u0430\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u0432\u0448\u0443\u044e \u0441\u0435\u0431\u044f, \u043a\u0430\u043a \u043d\u0430\u0434\u0435\u0436\u043d\u043e \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u041c\u043e\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043d\u0435 \u0441\u0442\u0430\u043b\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27626,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36872","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u0159ejd\u011bte na 2FA (Dvoufaktorov\u00e1 autentizace pro ASA SSL VPN) | ProHoster","description":"Pot\u0159eba poskytnout vzd\u00e1len\u00fd p\u0159\u00edstup k firemn\u00edmu prost\u0159ed\u00ed se objevuje st\u00e1le \u010dast\u011bji, bez ohledu na to, zda se jedn\u00e1 o vlastn\u00ed u\u017eivatele nebo partnery, kte\u0159\u00ed pot\u0159ebuj\u00ed p\u0159\u00edstup k tomu \u010di onomu serveru ve va\u0161\u00ed organizaci.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/go-to-2fa-dvuhfaktornaya-autentifikatsiya-dlya-asa-ssl-vpn","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Go to 2FA (\u0414\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0434\u043b\u044f ASA SSL VPN) | ProHoster","og:description":"\u041f\u043e\u0442\u0440\u0435\u0431\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0432\u0441\u0435 \u0447\u0430\u0449\u0435 \u0438 \u0447\u0430\u0449\u0435, \u043d\u0435 \u0432\u0430\u0436\u043d\u043e, \u0431\u0443\u0434\u044c \u0442\u043e \u0441\u0432\u043e\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u043b\u0438 \u043f\u0430\u0440\u0442\u043d\u0435\u0440\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0442\u043e\u043c\u0443 \u0438\u043b\u0438 \u0438\u043d\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0432 \u0432\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438..","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/go-to-2fa-dvuhfaktornaya-autentifikatsiya-dlya-asa-ssl-vpn","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:26+00:00","article:modified_time":"2019-10-31T19:14:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36872","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:05:56","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:37:23","updated":"2026-02-09 17:05:56","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36872","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=36872"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36872\/revisions"}],"predecessor-version":[{"id":158589,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36872\/revisions\/158589"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/27626"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=36872"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=36872"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=36872"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}