{"id":36873,"date":"2019-10-31T22:14:26","date_gmt":"2019-10-31T19:14:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/server-dvuhfaktornoj-avtorizatsii-linotp\/"},"modified":"2019-10-31T22:14:26","modified_gmt":"2019-10-31T19:14:26","slug":"server-dvuhfaktornoj-avtorizatsii-linotp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/server-dvuhfaktornoj-avtorizatsii-linotp","title":{"rendered":"Server pro dvoufaktorovou autentizaci LinOTP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Server
\n
\nDnes bych se cht\u011bl pod\u011blit o to, jak nastav\u00edte server dvoufaktorov\u00e9 autentizace pro ochranu podnikov\u00e9 s\u00edt\u011b, webov\u00fdch str\u00e1nek, slu\u017eeb a SSH. Na serveru bude fungovat kombinace: LinOTP + FreeRadius. <\/p>\n

Pro\u010d ho pot\u0159ebujeme?
\nJe to zcela zdarma, pohodln\u00e9 \u0159e\u0161en\u00ed uvnit\u0159 va\u0161\u00ed s\u00edt\u011b, nez\u00e1visl\u00e9 na t\u0159et\u00edch stran\u00e1ch.<\/p>\n

Tato slu\u017eba je velmi pohodln\u00e1 a pom\u011brn\u011b p\u0159ehledn\u00e1 ve srovn\u00e1n\u00ed s jin\u00fdmi open-source produkty, a tak\u00e9 podporuje obrovsk\u00e9 mno\u017estv\u00ed funkc\u00ed a politik (nap\u0159\u00edklad login + heslo + (PIN + OTP token)). P\u0159es API se integruje se slu\u017ebami pro odes\u00edl\u00e1n\u00ed SMS (LinOTP Config->Provider Config->SMS Provider), generuje k\u00f3dy pro mobiln\u00ed aplikace jako Google Authenticator a mnoho dal\u0161\u00edho. Pova\u017euji ji za pohodln\u011bj\u0161\u00ed ne\u017e slu\u017ebu zva\u017eovanou v \u010dl\u00e1nku<\/a><\/noindex>.<\/p>\n

Tento server v\u00fdborn\u011b spolupracuje s Cisco ASA, OpenVPN serverem, Apache2 a prakticky se v\u0161\u00edm, co podporuje autentizaci p\u0159es RADIUS server (nap\u0159\u00edklad pro SSH v datov\u00e9m centru).<\/p>\n

Po\u017eadov\u00e1no:<\/p>\n

1 ) Debian 8 (jessie) \u2014 Povinn\u011b!<\/b> (zku\u0161ebn\u00ed instalace na Debian 9 je pops\u00e1na na konci \u010dl\u00e1nku)<\/p>\n

Za\u010d\u00e1tek:<\/p>\n

Nainstalujeme Debian 8.
\n<\/a><\/noindex>
\nP\u0159id\u00e1me repozit\u00e1\u0159 LinOTP:<\/p>\n

# echo 'deb http:\/\/www.linotp.org\/apt\/debian jessie linotp' > \/etc\/apt\/sources.list.d\/linotp.list<\/code><\/pre>\n
\nP\u0159id\u00e1me kl\u00ed\u010de:<\/p>\n
# gpg --search-keys 913DFF12F86258E5<\/code><\/pre>\n
\nN\u011bkdy p\u0159i \"\u010dist\u00e9\" instalaci, po proveden\u00ed t\u00e9to p\u0159\u00edkazu, Debian hl\u00e1s\u00ed: <\/p>\n
gpg: vytvo\u0159en adres\u00e1\u0159 `\/root\/.gnupg`\ngpg: vytvo\u0159en nov\u00fd konfigura\u010dn\u00ed soubor `\/root\/.gnupg\/gpg.conf`\ngpg: POZOR: parametry v `\/root\/.gnupg\/gpg.conf` nejsou p\u0159i tomto spu\u0161t\u011bn\u00ed aktivn\u00ed\ngpg: vytvo\u0159ena tabulka kl\u00ed\u010d\u016f `\/root\/.gnupg\/secring.gpg`\ngpg: vytvo\u0159ena tabulka kl\u00ed\u010d\u016f `\/root\/.gnupg\/pubring.gpg`\ngpg: nejsou ur\u010deny servery kl\u00ed\u010d\u016f (pou\u017eijte --keyserver)\ngpg: selh\u00e1n\u00ed p\u0159i vyhled\u00e1v\u00e1n\u00ed na serveru kl\u00ed\u010d\u016f: \u0161patn\u00e9 URI\n<\/code><\/pre>\n
\nTo je po\u010d\u00e1te\u010dn\u00ed nastaven\u00ed gnupg. Nic hrozn\u00e9ho. Sta\u010d\u00ed p\u0159\u00edkaz prov\u00e9st znovu.
\nNa ot\u00e1zku Debiana:<\/p>\n
gpg: hled\u00e1n\u00ed \"913DFF12F86258E5\" na hkp serveru keys.gnupg.net\n(1)\tLSE LinOTP2 Packaging \n\t  2048 bit RSA kl\u00ed\u010d F86258E5, vytvo\u0159en: 2010-05-10\nKl\u00ed\u010de 1-1 z 1 pro \"913DFF12F86258E5\". Zadejte \u010d\u00edslo, N) Dal\u0161\u00ed nebo Q) Konec><\/code><\/pre>\n
\nOdpov\u00edd\u00e1me: 1<\/p>\n
Dal\u0161\u00ed: <\/p>\n
# gpg --export 913DFF12F86258E5 | apt-key add -<\/code><\/pre>\n
<\/p>\n
# apt-get update<\/code><\/pre>\n
\nNainstalujeme mysql. V teorii je mo\u017en\u00e9 pou\u017e\u00edt jin\u00fd sql server, ale pro zjednodu\u0161en\u00ed pou\u017eiji ten, kter\u00fd je doporu\u010den pro LinOTP.<\/p>\n
(dal\u0161\u00ed informace, v\u010detn\u011b rekonstrukce datab\u00e1ze LinOTP, lze nal\u00e9zt v ofici\u00e1ln\u00ed dokumentaci k odkazu<\/a><\/noindex>. Tam tak\u00e9 najdete p\u0159\u00edkaz: dpkg-reconfigure linotp pro zm\u011bnu parametr\u016f, pokud jste ji\u017e nainstalovali mysql).<\/p>\n
# apt-get install mysql-server<\/code><\/pre>\n
<\/p>\n
# apt-get update<\/code><\/pre>\n
 (je\u0161t\u011b jednou zkontrolovat aktualizace neu\u0161kod\u00ed)
\nNainstalujeme LinOTP a dal\u0161\u00ed moduly:<\/p>\n
# apt-get install linotp<\/code><\/pre>\n
\nOdpov\u00edd\u00e1me na ot\u00e1zky instal\u00e1tora: 
\nPou\u017e\u00edt Apache2: ano
\nVymyslete heslo pro admin LinOTP: \u201eVa\u0161eHeslo\u201c
\nVygenerovat samostatn\u011b podepsan\u00fd certifik\u00e1t?: ano
\nPou\u017e\u00edt MySQL?: ano
\nKde se nach\u00e1z\u00ed datab\u00e1ze: localhost
\nVytv\u00e1\u0159\u00edme datab\u00e1zi LinOTP(jm\u00e9no datab\u00e1ze) na serveru: LinOTP2
\nVytv\u00e1\u0159\u00edme samostatn\u00e9ho u\u017eivatele pro datab\u00e1zi: LinOTP2
\nNastavujeme heslo u\u017eivateli: \u201eVa\u0161eHeslo\u201c
\nChcete nyn\u00ed vytvo\u0159it datab\u00e1zi? (n\u011bco jako \u201eJste si jisti, \u017ee chcete \u2026\u201c): ano
\nZad\u00e1v\u00e1me heslo root pro MySQL, kter\u00e9 bylo vytvo\u0159eno p\u0159i jeho instalaci: \u201eVa\u0161eHeslo\u201c
\nHotovo.<\/p>\n
(voliteln\u011b, nen\u00ed nutn\u00e9)<\/p>\n
# apt-get install linotp-adminclient-cli <\/code><\/pre>\n
\n(voliteln\u011b, nen\u00ed nutn\u00e9)<\/p>\n
# apt-get install libpam-linotp  <\/code><\/pre>\n
\nA tak je na\u0161e webov\u00e9 rozhran\u00ed LinOTP nyn\u00ed dostupn\u00e9 na adrese: <\/p>\n
"<b>https<\\\/b>: \\\\\\\/\\\\\\\/IP_serveru\\\\\\\/manage"<\/code><\/pre>\n
\nO nastaven\u00ed v webov\u00e9m rozhran\u00ed v\u00e1m pov\u00edm pozd\u011bji.<\/p>\n
A nyn\u00ed, nejd\u016fle\u017eit\u011bj\u0161\u00ed! Spou\u0161t\u00edme FreeRadius a spojujeme ho s LinOTP.<\/p>\n
Instalujeme FreeRadius a modul pro pr\u00e1ci s LinOTP<\/p>\n
# apt-get install freeradius linotp-freeradius-perl<\/code><\/pre>\n
\nz\u00e1lohujeme konfigurace klienta a Users radiusu.<\/p>\n
# mv \/etc\/freeradius\/clients.conf  \/etc\/freeradius\/clients.old<\/code><\/pre>\n
<\/p>\n
# mv \/etc\/freeradius\/users  \/etc\/freeradius\/users.old<\/code><\/pre>\n
\nVytv\u00e1\u0159\u00edme pr\u00e1zdn\u00fd soubor klienta:<\/p>\n
# touch \/etc\/freeradius\/clients.conf<\/code><\/pre>\n
\nUpravujeme n\u00e1\u0161 nov\u00fd konfigura\u010dn\u00ed soubor (z\u00e1lohovanou konfiguraci lze pou\u017e\u00edt jako p\u0159\u00edklad)<\/p>\n
# nano \/etc\/freeradius\/clients.conf<\/code><\/pre>\n
<\/p>\n
client 192.168.188.0\/24 {\nsecret  = passwd # heslo pro p\u0159ipojen\u00ed klient\u016f\n}<\/code><\/pre>\n
\nD\u00e1le vytv\u00e1\u0159\u00edme soubor u\u017eivatel\u016f:<\/p>\n
# touch \/etc\/freeradius\/users<\/code><\/pre>\n
\nUpravujeme soubor, aby radius v\u011bd\u011bl, \u017ee budeme pou\u017e\u00edvat perl pro autentizaci.<\/p>\n
# nano \/etc\/freeradius\/users<\/code><\/pre>\n
<\/p>\n
DEFAULT Auth-type := perl<\/code><\/pre>\n
\nD\u00e1le upravujeme soubor \/etc\/freeradius\/modules\/perl<\/p>\n
# nano \/etc\/freeradius\/modules\/perl<\/code><\/pre>\n
\nMus\u00edme uv\u00e9st cestu k perl skriptu linotp v parametru module: <\/p>\n
Perl { .......\n.........\nmodule = \/usr\/lib\/linotp\/radius_linotp.pm<\/code><\/pre>\n
\n\u2026..
\nD\u00e1le vytv\u00e1\u0159\u00edme soubor, ve kter\u00e9m \u0159\u00edk\u00e1me, z jak\u00e9ho (dom\u00e9ny, datab\u00e1ze nebo souboru) z\u00edskat data.<\/p>\n
# touch \/etc\/linotp2\/rlm_perl.ini<\/code><\/pre>\n
<\/p>\n
# nano \/etc\/linotp2\/rlm_perl.ini<\/code><\/pre>\n
<\/p>\n
URL=https:\/\/IP_va\u0161eho_LinOTP_serveru(192.168.X.X)\/validate\/simplecheck\nREALM=webusers1c\nRESCONF=LocalUser\nDebug=True\nSSL_CHECK=False<\/code><\/pre>\n
\nTady se na chv\u00edli zastav\u00edm, proto\u017ee je to d\u016fle\u017eit\u00e9:<\/p>\n
\u00dapln\u00fd popis souboru s koment\u00e1\u0159i:
\n#IP of the linotp server (IP \u0430\u0434\u0440\u0435\u0441 \u043d\u0430\u0448\u0435\u0433\u043e LinOTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430)
\nURL=https:\/\/172.17.14.103\/validate\/simplecheck
\n#\u041d\u0430\u0448\u0430 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u0434\u0438\u043c \u0432 \u0432\u0435\u0431 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 LinOTP.)
\nREALM=rearm1
\n#\u0418\u043c\u044f \u0433\u0440\u0443\u043f\u043f\u044b \u044e\u0437\u0432\u0435\u0440\u0435\u0439 \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0432 \u0432\u0435\u0431\u043c\u043e\u0440\u0434\u0435 LinOTP.
\nRESCONF=flat_file
\n#optional: comment out if everything seems to work fine
\nDebug=True
\n#optional: use this, if you have selfsigned certificates, otherwise comment out (SSL \u0435\u0441\u043b\u0438 \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u0435\u043c \u0441\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0438 \u0445\u043e\u0442\u0438\u043c \u0435\u0433\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c)
\nSSL_CHECK=False<\/p>\n
D\u00e1le vytvo\u0159\u00edme soubor \/etc\/freeradius\/sites-available\/linotp<\/p>\n
# touch \/etc\/freeradius\/sites-available\/linotp<\/code><\/pre>\n
<\/p>\n
# nano \/etc\/freeradius\/sites-available\/linotp<\/code><\/pre>\n
\nA zkop\u00edrujeme do n\u011bj konfiguraci (nic nemus\u00edme upravovat):<\/p>\n
authorize {\n#normalizuje neplatn\u00e9 po\u017eadavky klienta p\u0159ed p\u0159ed\u00e1n\u00edm dal\u0161\u00edm modul\u016fm (viz '\/etc\/freeradius\/modules\/preprocess')\npreprocess\n#  Pokud pou\u017e\u00edv\u00e1te v\u00edce typ\u016f dom\u00e9n, pravd\u011bpodobn\u011b\n#  budete cht\u00edt nastavit \"ignore_null = yes\" pro v\u0161echny z nich.\n#  Jinak, kdy\u017e prvn\u00ed styl dom\u00e9ny neodpov\u00edd\u00e1,\n#  dal\u0161\u00ed styly nebudou zkontrolov\u00e1ny.\n# umo\u017e\u0148uje seznam dom\u00e9n (viz '\/etc\/freeradius\/modules\/realm')\nIPASS\n#rozum\u00ed n\u011b\u010demu jako USER@REALM a m\u016f\u017ee rozli\u0161it komponenty (viz '\/etc\/freeradius\/modules\/realm')\nsuffix\n#rozum\u00ed USERREALM a m\u016f\u017ee rozli\u0161it komponenty (viz '\/etc\/freeradius\/modules\/realm')\nntdomain\n#  P\u0159e\u010dt\u011bte si soubor 'users', abyste se dozv\u011bd\u011bli o speci\u00e1ln\u00ed konfiguraci, kter\u00e1 by m\u011bla b\u00fdt pou\u017eita pro\n# ur\u010dit\u00e9 u\u017eivatele (viz '\/etc\/freeradius\/modules\/files')\nfiles\n# umo\u017e\u0148uje nechat autentifikaci vypr\u0161et (viz '\/etc\/freeradius\/modules\/expiration')\nexpiration\n# umo\u017e\u0148uje definovat platn\u00e9 \u010dasy slu\u017eby (viz '\/etc\/freeradius\/modules\/logintime')\nlogintime\n# Nem\u00e1me \u017e\u00e1dnou radius_shortname_map!\npap\n}\n# zde je vol\u00e1n linotp perl modul pro dal\u0161\u00ed zpracov\u00e1n\u00ed\nauthenticate {\nperl\n}<\/code><\/pre>\n
\nD\u00e1le vytvo\u0159\u00edme symbolick\u00fd odkaz:<\/p>\n
# ln -s ..\/sites-available\/linotp \/etc\/freeradius\/sites-enabled<\/code><\/pre>\n
\nOsobn\u011b zni\u010d\u00edm defaultn\u00ed Radius weby, ale pokud je pot\u0159ebujete, m\u016f\u017eete je bu\u010f upravit v jejich konfiguraci, nebo je vypnout.<\/p>\n
# rm \/etc\/freeradius\/sites-enabled\/default<\/code><\/pre>\n
<\/p>\n
# rm \/etc\/freeradius\/sites-enabled\/inner-tunnel<\/code><\/pre>\n
<\/p>\n
# service freeradius reload<\/code><\/pre>\n
\nNyn\u00ed se vra\u0165me k webov\u00e9mu rozhran\u00ed a pod\u00edvejme se na n\u011bj podrobn\u011bji:
\nV prav\u00e9m horn\u00edm rohu klikneme na LinOTP Config -> UserIdResolvers -> New
\nZvol\u00edme, co chceme: LDAP (AD win, LDAP samba), nebo SQL, nebo m\u00edstn\u00ed u\u017eivatele syst\u00e9mu Flatfile. <\/p>\n
Vypl\u0148ujeme po\u017eadovan\u00e1 pole.<\/p>\n
D\u00e1le vytvo\u0159\u00edme REALMS:
\nV prav\u00e9m horn\u00edm rohu klikneme na LinOTP Config -> Realms -> New. 
\na pojmenujeme n\u00e1\u0161 REALMS, a tak\u00e9 klikneme na d\u0159\u00edve vytvo\u0159en\u00fd UserIdResolvers.<\/p>\n
V\u0161echna tato data pot\u0159ebuje freeRadius v souboru \/etc\/linotp2\/rlm_perl.ini, o \u010dem\u017e jsem psal v\u00fd\u0161e, proto, pokud jste ho dosud neupravili, ud\u011blejte to te\u010f.<\/p>\n
Server je nastaven.<\/p>\n
Dopl\u0148uj\u00edc\u00ed informace:<\/p>\n
Nastaven\u00ed LinOTP na Debian 9<\/b>:<\/p>\n
Instalace: <\/p>\n
# echo 'deb http:\/\/linotp.org\/apt\/debian stretch linotp' > \/etc\/apt\/sources.list.d\/linotp.list <\/code><\/pre>\n
# apt-get install dirmngr<\/code><\/pre>\n
<\/p>\n
# apt-key adv --recv-keys 913DFF12F86258E5\n<\/code><\/pre>\n
# apt-get update<\/code><\/pre>\n
<\/p>\n
# apt-get install mysql-server<\/code><\/pre>\n
 (ve v\u00fdchoz\u00edm nastaven\u00ed, v Debian 9 mysql (mariaDB) nenab\u00edz\u00ed nastavit heslo pro roota, m\u016f\u017eete ho samoz\u0159ejm\u011b ponechat pr\u00e1zdn\u00e9, ale pokud \u010dtete zpr\u00e1vy, \u010dasto to vede k \"epick\u00fdm selh\u00e1n\u00edm\", proto to nastav\u00edme)<\/p>\n
# mysql -u root -p<\/code><\/pre>\n
use mysql;<\/code><\/pre>\n
UPDATE user SET Password = PASSWORD('tady_heslo') WHERE User = 'root';\n<\/code><\/pre>\n
exit<\/code><\/pre>\n
# apt-get install linotp<\/code><\/pre>\n
# apt-get install linotp-adminclient-cli<\/code><\/pre>\n
# apt-get install python-ldap<\/code><\/pre>\n
# apt install freeradius<\/code><\/pre>\n
# nano \/etc\/freeradius\/3.0\/sites-enabled\/linotp<\/code><\/pre>\n
Vkl\u00e1d\u00e1me k\u00f3d (poslal JuriM, za co\u017e mu d\u011bkujeme):<\/p>\n
server linotp {
\nlisten {
\n ipaddr = *
\n port = 1812
\n type = auth
\n}
\nlisten {
\n ipaddr = *
\n port = 1813
\n type = acct
\n}
\nauthorize { 
\n preprocess
\n update { 
\n &control:Auth-Type := Perl
\n } 
\n} 
\nauthenticate {
\n Auth-Type Perl {
\n perl
\n }
\n}
\naccounting {
\n unix
\n}
\n}<\/p><\/blockquote>\n
Upravujeme \/etc\/freeradius\/3.0\/mods-enabled\/perl<\/p>\n
perl {
\n filename = \/usr\/share\/linotp\/radius_linotp.pm
\n func_authenticate = authenticate
\n func_authorize = authorize
\n}<\/p><\/blockquote>\n
Bohu\u017eel v debian 9 knihovna radius_linotp.pm nen\u00ed dostupn\u00e1 v repozit\u00e1\u0159\u00edch, tak\u017ee ji vezmeme z githubu.<\/p>\n
# apt install git<\/code><\/pre>\n
# git clone https:\/\/github.com\/LinOTP\/linotp-auth-freeradius-perl<\/code><\/pre>\n
# cd linotp-auth-freeradius-perl\/<\/code><\/pre>\n
# cp radius_linotp.pm \/usr\/share\/linotp\/radius_linotp.pm<\/code><\/pre>\n
nyn\u00ed uprav\u00edme \/etc\/freeradius\/3.0\/clients.conf <\/p>\n
client servers {
\n ipaddr = 192.168.188.0\/24
\n secret = vasiheslo
\n}<\/p><\/blockquote>\n
nyn\u00ed uprav\u00edme nano \/etc\/linotp2\/rlm_perl.ini<\/p>\n
Vkl\u00e1d\u00e1me tam stejn\u00fd k\u00f3d, jak\u00fd jsme pou\u017eili p\u0159i instalaci na debian 8 (popisov\u00e1no v\u00fd\u0161e)<\/p>\n
teoreticky by to m\u011blo b\u00fdt v\u0161e. (zat\u00edm netestov\u00e1no)<\/p>\n
N\u00ed\u017ee uvedu n\u011bkolik odkaz\u016f na nastaven\u00ed syst\u00e9m\u016f, kter\u00e9 \u010dasto pot\u0159ebuj\u00ed chr\u00e1nit dvoufaktorovou autorizac\u00ed: 
\nNastaven\u00ed dvoufaktorov\u00e9 autentizace v Apache2<\/a><\/noindex><\/p>\n
Nastaven\u00ed s Cisco ASA<\/a><\/noindex>(tam se pou\u017e\u00edv\u00e1 jin\u00fd server generov\u00e1n\u00ed token\u016f, ale nastaven\u00ed samotn\u00e9 ASA z\u016fst\u00e1v\u00e1 stejn\u00e9).<\/p>\n
VPN s dvoufaktorovou autentizac\u00ed<\/a><\/noindex><\/p>\n
Nastaven\u00ed dvoufaktorov\u00e9 autentizace v ssh<\/a><\/noindex> (tam se tak\u00e9 pou\u017e\u00edv\u00e1 LinOTP) \u2014 d\u00edky autorovi. Tam lze tak\u00e9 nal\u00e9zt zaj\u00edmav\u00e9 informace o nastaven\u00ed politik LiOTP.<\/p>\n
Tak\u00e9 cms mnoha web\u016f podporuj\u00ed dvoufaktorovou autentizaci (pro WordPress m\u00e1 LinOTP dokonce sv\u016fj speci\u00e1ln\u00ed modul na github<\/a><\/noindex>), nap\u0159\u00edklad, pokud chcete na sv\u00e9m firemn\u00edm webu vytvo\u0159it chr\u00e1n\u011bnou sekci pro zam\u011bstnance spole\u010dnosti.
\nD\u016eLE\u017dIT\u00dd FAKT! Nepokl\u00e1dejte za\u0161krtnut\u00ed \"Google autenteficator\" pro pou\u017e\u00edv\u00e1n\u00ed Google authentik\u00e1toru! QR k\u00f3d se pak ned\u00e1 p\u0159e\u010d\u00edst... (zvl\u00e1\u0161tn\u00ed fakt)<\/p>\n
K naps\u00e1n\u00ed \u010dl\u00e1nku byly pou\u017eity informace z n\u00e1sleduj\u00edc\u00edch \u010dl\u00e1nk\u016f:
\nitnan.ru\/post.php?c=1&p=270571<\/a><\/noindex>
\nwww.digitalbears.net\/?p=469<\/a><\/noindex> <\/p>\n
D\u011bkujeme autor\u016fm.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0445\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f, \u043a\u0430\u043a \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0441\u0430\u0439\u0442\u043e\u0432, \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432,ssh. \u041d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441\u0432\u044f\u0437\u043a\u0430: LinOTP + FreeRadius. \u0417\u0430\u0447\u0435\u043c \u043e\u043d \u043d\u0430\u043c? \u042d\u0442\u043e \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u0435, \u0443\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435, \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0432\u043e\u0435\u0439 \u0441\u0435\u0442\u0438, \u043d\u0435 \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0435\u0435 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432. \u0414\u0430\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0432\u0435\u0441\u044c\u043c\u0430 \u0443\u0434\u043e\u0431\u0435\u043d, \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043d\u0430\u0433\u043b\u044f\u0434\u0435\u043d, \u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0438 \u043e\u0442 \u0434\u0440\u0443\u0433\u0438\u0445 \u043e\u043f\u0435\u043d\u0441\u043e\u0440\u0441 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u0430 \u0442\u0430\u043a \u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27627,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36873","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Server pro dvoufaktorovou autentizaci LinOTP | ProHoster","description":"Dnes se chci pod\u011blit o to, jak nastavit server.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/server-dvuhfaktornoj-avtorizatsii-linotp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0435\u0440\u0432\u0435\u0440 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 LinOTP | ProHoster","og:description":"\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0445\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f, \u043a\u0430\u043a \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/server-dvuhfaktornoj-avtorizatsii-linotp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:26+00:00","article:modified_time":"2019-10-31T19:14:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36873","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:08:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:37:23","updated":"2026-01-22 05:08:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36873","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=36873"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36873\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/27627"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=36873"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=36873"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=36873"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}