{"id":78242,"date":"2020-04-18T01:42:36","date_gmt":"2020-04-17T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa"},"modified":"2020-04-18T01:42:36","modified_gmt":"2020-04-17T23:42:36","slug":"realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","title":{"rendered":"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Pokra\u010dujeme v s\u00e9rii \u010dl\u00e1nk\u016f na t\u00e9ma organizace <strong>VPN pro vzd\u00e1len\u00fd p\u0159\u00edstup<\/strong> p\u0159\u00edstupu, mus\u00edm se pod\u011blit o zaj\u00edmav\u00e9 zku\u0161enosti s nasazen\u00edm <strong>vysoce zabezpe\u010den\u00e9 konfigurace VPN<\/strong>. Probl\u00e9m mi nab\u00eddl jeden klient (jsou tady fantazist\u00e9 v rusk\u00fdch vesnic\u00edch), ale v\u00fdzvu jsem p\u0159ijal a kreativn\u011b realizoval. V\u00fdsledkem je zaj\u00edmav\u00fd koncept s n\u00e1sleduj\u00edc\u00edmi charakteristikami:<\/p>\n<p><\/p>\n<ol>\n<li>N\u011bkolik faktor\u016f ochrany proti z\u00e1m\u011bn\u011b koncov\u00e9ho za\u0159\u00edzen\u00ed (s p\u0159\u00edsnou v\u00e1zanost\u00ed na u\u017eivatele);\n<ul>\n<li>Hodnocen\u00ed shody u\u017eivatelsk\u00e9ho PC s ur\u010den\u00fdm UDID povolen\u00e9ho PC v autentiza\u010dn\u00ed datab\u00e1zi; <\/li>\n<li>S MFA, pou\u017e\u00edvaj\u00edc\u00ed UDID PC ze certifik\u00e1tu pro sekund\u00e1rn\u00ed autentizaci p\u0159es Cisco DUO <em>(M\u016f\u017eete p\u0159ipojit jak\u00fdkoli SAML\/RADIUS kompatibiln\u00ed \u0159e\u0161en\u00ed)<\/em>; <\/li>\n<\/ul>\n<\/li>\n<li>V\u00edcefaktorovou autentizac\u00ed: \n<ul>\n<li>U\u017eivatelsk\u00fd certifik\u00e1t s kontrolou pol\u00ed a sekund\u00e1rn\u00ed autentizac\u00ed na jednom z nich;<\/li>\n<li>P\u0159ihla\u0161ovac\u00ed \u00fadaje (nem\u011bniteln\u00e9, p\u0159evzat\u00e9 z certifik\u00e1tu) a heslo;<\/li>\n<\/ul>\n<\/li>\n<li>Hodnocen\u00ed stavu p\u0159ipojen\u00e9ho hostitele (Posture)<\/li>\n<\/ol>\n<p><\/p>\n<p><strong>Pou\u017eit\u00e9 komponenty \u0159e\u0161en\u00ed:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Cisco ASA (VPN br\u00e1na);<\/li>\n<li>Cisco ISE (Autentizace \/ Autorizace \/ \u00da\u010dtov\u00e1n\u00ed, Hodnocen\u00ed stavu, CA);<\/li>\n<li>Cisco DUO (V\u00edcefaktorov\u00e1 autentizace) <em>(M\u016f\u017eete p\u0159ipojit jak\u00fdkoli SAML\/RADIUS kompatibiln\u00ed \u0159e\u0161en\u00ed)<\/em>;<\/li>\n<li>Cisco AnyConnect (V\u00edce\u00fa\u010delov\u00fd agent pro pracovn\u00ed stanice a mobiln\u00ed OS);<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p><strong>Za\u010dneme po\u017eadavky klienta:<\/strong><\/p>\n<p><\/p>\n<ol>\n<li>U\u017eivatel by m\u011bl m\u00edt mo\u017enost st\u00e1hnout klienta AnyConnect z VPN br\u00e1ny na z\u00e1klad\u011b sv\u00e9 autentizace P\u0159ihla\u0161ovac\u00edmi \u00fadaji\/Heslem, v\u0161echny pot\u0159ebn\u00e9 moduly AnyConnect by se m\u011bly automaticky nainstalovat podle politiky u\u017eivatele;<\/li>\n<li>U\u017eivatel by m\u011bl m\u00edt mo\u017enost automatick\u00e9 vyd\u00e1n\u00ed certifik\u00e1tu (pro jeden ze sc\u00e9n\u00e1\u0159\u016f, hlavn\u00ed sc\u00e9n\u00e1\u0159 v\u0161ak \u2013 ru\u010dn\u00ed vyd\u00e1n\u00ed a nahr\u00e1n\u00ed do PC), j\u00e1 jsem realizoval automatick\u00e9 vyd\u00e1n\u00ed pro demonstraci (nikdy nen\u00ed pozd\u011b odvolat).<\/li>\n<li>Hlavn\u00ed autentizace by m\u011bla prob\u00edhat ve n\u011bkolika kroc\u00edch, nejprve prob\u00edh\u00e1 autentizace certifik\u00e1tu s anal\u00fdzou pot\u0159ebn\u00fdch pol\u00ed a jejich hodnot, pot\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje\/heslo, tentokr\u00e1t by se v\u0161ak do p\u0159ihla\u0161ovac\u00edho okna m\u011blo automaticky vyplnit u\u017eivatelsk\u00e9 jm\u00e9no uveden\u00e9 v poli certifik\u00e1tu <strong>N\u00e1zev subjektu (CN)<\/strong> bez mo\u017enosti \u00fapravy.<\/li>\n<li>Je nutn\u00e9 zajistit, aby za\u0159\u00edzen\u00ed, ze kter\u00e9ho se p\u0159ihla\u0161uje, bylo firemn\u00ed notebook vydan\u00fd u\u017eivateli pro vzd\u00e1len\u00fd p\u0159\u00edstup, a ne n\u011bco jin\u00e9ho. (Bylo provedeno n\u011bkolik variant spln\u011bn\u00ed tohoto po\u017eadavku)<\/li>\n<li>Je nutn\u00e9 prov\u00e9st hodnocen\u00ed stavu p\u0159ipojen\u00e9ho za\u0159\u00edzen\u00ed (v tomto kroku po\u010d\u00edta\u010d) s kontrolou cel\u00e9ho obs\u00e1hl\u00e9ho seznamu po\u017eadavk\u016f objednatele (shrnut\u00ed):\n<ul>\n<li>Soubory a jejich vlastnosti;<\/li>\n<li>Z\u00e1znamy registru;<\/li>\n<li>Opravy OS z poskytnut\u00e9ho seznamu (v budoucnu integrace SCCM);<\/li>\n<li>P\u0159\u00edtomnost antiviru ur\u010dit\u00e9ho v\u00fdrobce a aktu\u00e1lnost podpis\u016f;<\/li>\n<li>Aktivita ur\u010dit\u00fdch slu\u017eeb;<\/li>\n<li>P\u0159\u00edtomnost ur\u010dit\u00fdch nainstalovan\u00fdch program\u016f;<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/p>\n<p>Nejprve doporu\u010duji povinn\u011b se pod\u00edvat na video demonstruj\u00edc\u00ed v\u00fdsledek realizace na <strong>YouTube (5 minut)<\/strong>.<\/p>\n<p>\n<center><div class=\"youtube-placeholder\" data-id=\"cBftD3KFK98\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/cBftD3KFK98\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>Nyn\u00ed navrhuji prozkoumat detaily realizace, kter\u00e9 nejsou ve videu pokryty.<\/p>\n<p><\/p>\n<p><strong>P\u0159iprav\u00edme profil AnyConnect:<\/strong><\/p>\n<p><\/p>\n<p>P\u0159\u00edklad vytvo\u0159en\u00ed profilu (v r\u00e1mci menu polo\u017eky v ASDM) jsem d\u0159\u00edve uv\u00e1d\u011bl ve sv\u00e9m \u010dl\u00e1nku o nastaven\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing clusteru<\/a><\/noindex>. Nyn\u00ed chci zvl\u00e1\u0161\u0165 zd\u016fraznit ty mo\u017enosti, kter\u00e9 budeme pot\u0159ebovat:<\/p>\n<p><\/p>\n<p>V profilu uvedeme br\u00e1nu VPN a n\u00e1zev profilu pro p\u0159ipojen\u00ed na koncov\u00e9m klientovi:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/45ff3cb1f7b592e102bd6e256ae26043.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Provedeme nastaven\u00ed automatick\u00e9ho vystaven\u00ed certifik\u00e1tu ze strany profilu, a to v\u010detn\u011b specifikace parametr\u016f certifik\u00e1tu, a jak je d\u016fle\u017eit\u00e9, zam\u011b\u0159\u00edme se na pole <strong>Initials (I)<\/strong>, kde je ru\u010dn\u011b zadan\u00e1 konkr\u00e9tn\u00ed hodnota <strong>UDID<\/strong> testovac\u00edho za\u0159\u00edzen\u00ed (Unik\u00e1tn\u00ed identifik\u00e1tor za\u0159\u00edzen\u00ed, kter\u00fd generuje klient Cisco AnyConnect).<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/89d4edb4f1b166eda75916286998a4bf.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Tady chci ud\u011blat liter\u00e1rn\u00ed odbo\u010dku, proto\u017ee tento \u010dl\u00e1nek popisuje koncept, pro demonstra\u010dn\u00ed \u00fa\u010dely je zde zadan\u00e9 UDID pro vystaven\u00ed certifik\u00e1tu v poli Initials profilu AnyConnect. Samoz\u0159ejm\u011b v re\u00e1ln\u00e9m \u017eivot\u011b, pokud to ud\u011bl\u00e1te, v\u0161ichni klienti obdr\u017e\u00ed certifik\u00e1t se stejn\u00fdm UDID v tomto poli a nic jim nepob\u011b\u017e\u00ed, proto\u017ee pot\u0159ebuj\u00ed UDID konkr\u00e9tn\u011b sv\u00e9ho po\u010d\u00edta\u010de. AnyConnect bohu\u017eel zat\u00edm neimplementuje substituci v profilu pro po\u017eadavek na certifik\u00e1t pomoc\u00ed prom\u011bnn\u00e9 prost\u0159ed\u00ed, tak jak to nap\u0159\u00edklad d\u011bl\u00e1 s prom\u011bnnou <strong>%USER%<\/strong>.<\/p>\n<p><\/p>\n<p>Je t\u0159eba poznamenat, \u017ee objednatel (tohoto sc\u00e9n\u00e1\u0159e) p\u016fvodn\u011b pl\u00e1nuje vyd\u00e1vat certifik\u00e1ty s dan\u00fdm UDID ru\u010dn\u011b na takov\u00fdch zabezpe\u010den\u00fdch PC, co\u017e pro n\u011bj nen\u00ed \u017e\u00e1dn\u00fd probl\u00e9m. Nicm\u00e9n\u011b pro v\u011bt\u0161inu z n\u00e1s bychom cht\u011bli automatizaci (no pro m\u011b ur\u010dit\u011b =). <\/p>\n<p><\/p>\n<p>A to je, co mohu nab\u00eddnout v oblasti automatizace. Pokud nelze certifik\u00e1t automaticky vydat AnyConnect s dynamick\u00fdm vlo\u017een\u00edm UDID, existuje i jin\u00fd zp\u016fsob, kter\u00fd si \u017e\u00e1d\u00e1 trochu kreativn\u00edho my\u0161len\u00ed a \u0161ikovn\u00fdch rukou \u2013 p\u0159edstav\u00edm v\u00e1m koncepci. Nejprve se pod\u00edvejme, jak se UDID vytv\u00e1\u0159\u00ed na r\u016fzn\u00fdch opera\u010dn\u00edch syst\u00e9mech prost\u0159ednictv\u00edm agenta AnyConnect: <\/p>\n<p><\/p>\n<ul>\n<li><strong>Windows<\/strong> \u2014 SHA-256 hash kombinace kl\u00ed\u010de registru DigitalProductID a Machine SID<\/li>\n<li><strong>OSX<\/strong> \u2014 SHA-256 hash PlatformUUID<\/li>\n<li><strong>Linux<\/strong> \u2014 SHA-256 hash UUID ko\u0159enov\u00e9 partition.<\/li>\n<li><strong>Apple iOS<\/strong> \u2014 SHA-256 hash PlatformUUID<\/li>\n<li><strong>Android<\/strong> \u2013 Viz dokument k <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/security\/vpn_client\/anyconnect\/anyconnect40\/administration\/guide\/b_AnyConnect_Administrator_Guide_4-0\/b_AnyConnect_Administrator_Guide_4-0_chapter_01010.html#reference_C87ADD1C58F64EF8928D921323209AA6\">odkazu<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<p>Podle toho vytvo\u0159\u00edme skript pro na\u0161e podnikov\u00e1 OS Windows, t\u00edmto skriptem m\u00edstn\u011b spo\u010d\u00edt\u00e1me UDID na z\u00e1klad\u011b zn\u00e1m\u00fdch vstupn\u00edch dat a vytvo\u0159\u00edme po\u017eadavek na vyd\u00e1n\u00ed certifik\u00e1tu t\u00edm, \u017ee tento UDID vlo\u017e\u00edme do pot\u0159ebn\u00e9ho pole, mimochodem lze to i s certifik\u00e1tem stroje vydan\u00fdm AD (p\u0159id\u00e1n\u00edm dvoj\u00ed autentizace pomoc\u00ed certifik\u00e1tu <strong>Multiple Certificate<\/strong>). <\/p>\n<p><\/p>\n<p><strong>P\u0159iprav\u00edme nastaven\u00ed ze strany Cisco ASA:<\/strong><\/p>\n<p><\/p>\n<p>Vytvo\u0159\u00edme TrustPoint pro ISE CA server, ten pr\u00e1v\u011b bude certifik\u00e1ty vyd\u00e1vat klient\u016fm. Proceduru importu Key-Chain nebudu rozeb\u00edrat, p\u0159\u00edklad je pops\u00e1n v m\u00e9m \u010dl\u00e1nku o nastaven\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing clusteru<\/a><\/noindex>. <\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">crypto ca trustpoint ISE-CA\n enrollment terminal\n crl configure<\/code><\/pre>\n<p><\/p>\n<p>Nastavujeme distribuci podle Tunnel-Group na z\u00e1klad\u011b pravidel odpov\u00eddaj\u00edc\u00edch pol\u00edm v certifik\u00e1tu, podle kter\u00e9ho prob\u00edh\u00e1 autentizace. Zde tak\u00e9 nastavujeme profil AnyConnect, kter\u00fd jsme vyrobili v p\u0159edchoz\u00edm kroku. Upozor\u0148uji, \u017ee pou\u017e\u00edv\u00e1m hodnotu <strong>SECUREBANK-RA<\/strong>, pro p\u0159i\u0159azen\u00ed u\u017eivatel\u016f s vydan\u00fdm certifik\u00e1tem do tunelov\u00e9 skupiny <strong>SECURE-BANK-VPN<\/strong>, pozor, \u017ee toto pole je u m\u011b vypln\u011bno v sekci \u017e\u00e1dosti o certifik\u00e1t profilu AnyConnect.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">tunnel-group-map enable rules\n!\ncrypto ca certificate map OU-Map 6\n subject-name attr ou eq securebank-ra\n!\nwebvpn\n anyconnect profiles SECUREBANK disk0:\/securebank.xml\n certificate-group-map OU-Map 6 SECURE-BANK-VPN\n!<\/code><\/pre>\n<p><\/p>\n<p>Nastavujeme autentiza\u010dn\u00ed servery. V m\u00e9m p\u0159\u00edpad\u011b je to ISE pro prvn\u00ed f\u00e1zi autentizace a DUO (Radius Proxy) jako MFA.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">! CISCO ISE\naaa-server ISE protocol radius\n authorize-only\n interim-accounting-update periodic 24\n dynamic-authorization\naaa-server ISE (inside) host 192.168.99.134\n key *****\n!\n! DUO RADIUS PROXY\naaa-server DUO protocol radius\naaa-server DUO (inside) host 192.168.99.136\n timeout 60\n key *****\n authentication-port 1812\n accounting-port 1813\n no mschapv2-capable\n!<\/code><\/pre>\n<p><\/p>\n<p>Vytv\u00e1\u0159\u00edme skupinov\u00e9 politiky a tunelov\u00e9 skupiny a jejich pomocn\u00e9 slo\u017eky:<\/p>\n<p><\/p>\n<p>Tunelov\u00e1 skupina <strong>DefaultWEBVPNGroup<\/strong> bude prim\u00e1rn\u011b pou\u017eita pro sta\u017een\u00ed klienta AnyConnect VPN a vyd\u00e1n\u00ed u\u017eivatelsk\u00e9ho certifik\u00e1tu pomoc\u00ed funkce SCEP-Proxy ASA, pro to m\u00e1me aktivovan\u00e9 odpov\u00eddaj\u00edc\u00ed mo\u017enosti jak na samotn\u00e9 tunelov\u00e9 skupin\u011b, tak na p\u0159idru\u017een\u00e9 skupinov\u00e9 politice <strong>AC-St\u00e1hnout<\/strong>, tak na stahovan\u00e9m profilu AnyConnect (pole vyd\u00e1n\u00ed certifik\u00e1tu atd.). Tak\u00e9 v t\u00e9to skupinov\u00e9 politice uv\u00e1d\u00edme nutnost sta\u017een\u00ed <strong>ISE Posture Module<\/strong>.<\/p>\n<p><\/p>\n<p>Tunelov\u00e1 skupina <strong>SECURE-BANK-VPN<\/strong> bude automaticky pou\u017e\u00edv\u00e1n klientem p\u0159i ov\u011b\u0159ov\u00e1n\u00ed s vydan\u00fdm certifik\u00e1tem v p\u0159edchoz\u00edm kroku, proto\u017ee podle Certificate Map p\u0159ipojen\u00ed spad\u00e1 pr\u00e1v\u011b na tuto tunelovou skupinu. Zde se pod\u00edv\u00e1m na zaj\u00edmav\u00e9 mo\u017enosti:<\/p>\n<p><\/p>\n<ul>\n<li><strong>secondary-authentication-server-group DUO<\/strong> # \u0417\u0430\u0434\u0430\u0435\u043c \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO (Radius Proxy)<\/li>\n<li><strong>username-from-certificate CN<\/strong> # \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0435 CN \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043b\u043e\u0433\u0438\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f<\/li>\n<li><strong>secondary-username-from-certificate I<\/strong> # \u0414\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u043d\u043e\u0435 \u0438 \u043f\u043e\u043b\u044f Initials (I) \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430.<\/li>\n<li><strong>pre-fill-username client<\/strong> # \u0434\u0435\u043b\u0430\u0435\u043c \u043f\u0440\u0435\u0434\u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u043e\u043a\u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f<\/li>\n<li><strong>secondary-pre-fill-username client hide use-common-password push<\/strong> # \u041f\u0440\u044f\u0447\u0435\u043c \u043e\u043a\u043d\u043e \u0432\u0432\u043e\u0434\u0430 \u043b\u043e\u0433\u0438\u043d\u0430\/\u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 DUO \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u043e\u043b\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u043c\u0435\u0442\u043e\u0434 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f (sms\/push\/phone) \u2013 \u0434\u043e\u043a\u0430 <noindex><a rel=\"nofollow\" href=\"https:\/\/duo.com\/docs\/ciscoasa-radius\">tady<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">!\naccess-list posture-redirect extended permit tcp any host 72.163.1.80 \naccess-list posture-redirect extended deny ip any any\n!\naccess-list VPN-Filter extended permit ip any any\n!\nip local pool vpn-pool 192.168.100.33-192.168.100.63 mask 255.255.255.224\n!\ngroup-policy SECURE-BANK-VPN internal\ngroup-policy SECURE-BANK-VPN attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ngroup-policy AC-DOWNLOAD internal\ngroup-policy AC-DOWNLOAD attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n scep-forwarding-url value http:\/\/ise.ashes.cc:9090\/auth\/caservice\/pkiclient.exe\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ntunnel-group DefaultWEBVPNGroup general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n accounting-server-group ISE\n default-group-policy AC-DOWNLOAD\n scep-enrollment enable\ntunnel-group DefaultWEBVPNGroup webvpn-attributes\n authentication aaa certificate\n!\ntunnel-group SECURE-BANK-VPN type remote-access\ntunnel-group SECURE-BANK-VPN general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n secondary-authentication-server-group DUO\n accounting-server-group ISE\n default-group-policy SECURE-BANK-VPN\n username-from-certificate CN\n secondary-username-from-certificate I\ntunnel-group SECURE-BANK-VPN webvpn-attributes\n authentication aaa certificate\n pre-fill-username client\n secondary-pre-fill-username client hide use-common-password push\n group-alias SECURE-BANK-VPN enable\n dns-group ASHES-DNS\n!<\/code><\/pre>\n<p><\/p>\n<p><strong>D\u00e1le p\u0159ech\u00e1z\u00edme k ISE:<\/strong><\/p>\n<p><\/p>\n<p>Nastavujeme m\u00edstn\u00edho u\u017eivatele (lze pou\u017e\u00edt i AD\/LDAP\/ODBC atd.), pro zjednodu\u0161en\u00ed jsem vytvo\u0159il m\u00edstn\u00edho u\u017eivatele p\u0159\u00edmo v ISE a p\u0159i\u0159adil ho do pole <strong>description<\/strong> <strong>UDID PC<\/strong> z n\u011bho\u017e mu je povolen p\u0159\u00edstup p\u0159es VPN. V p\u0159\u00edpad\u011b pou\u017eit\u00ed m\u00edstn\u00ed autentizace na ISE budu omezen pouze jedn\u00edm za\u0159\u00edzen\u00edm, proto\u017ee pol\u00ed nen\u00ed tolik, ale u extern\u00edch autentiza\u010dn\u00edch datab\u00e1z\u00ed nebudu m\u00edt takov\u00e1 omezen\u00ed.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/ea73d4bab6c0872f7c3aef4ad1345b12.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Pod\u00edv\u00e1me se na politiku autorizace, je rozd\u011blena do \u010dty\u0159 etap spojen\u00ed:<\/p>\n<p><\/p>\n<ul>\n<li><strong>F\u00e1ze 1<\/strong> \u2014 Politika pro stahov\u00e1n\u00ed agenta AnyConnect a vystaven\u00ed certifik\u00e1tu<\/li>\n<li><strong>F\u00e1ze 2<\/strong> \u2014 Politika prim\u00e1rn\u00ed autentizace P\u0159ihl\u00e1\u0161en\u00ed (z certifik\u00e1tu)\/Heslo + Certifik\u00e1t s validac\u00ed UDID<\/li>\n<li><strong>F\u00e1ze 3<\/strong> \u2014 Druh\u00e1 autentizace p\u0159es Cisco DUO (MFA) podle UDID jako jm\u00e9na u\u017eivatele + Hodnocen\u00ed stavu<\/li>\n<li><strong>F\u00e1ze 4<\/strong> \u2014 Kone\u010dn\u00e1 autorizace ve stavu:\n<ul>\n<li>Kompatibiln\u00ed;<\/li>\n<li>validac\u00ed UDID (z certifik\u00e1tu + vazba na p\u0159ihl\u00e1\u0161en\u00ed), <\/li>\n<li>Cisco DUO MFA;<\/li>\n<li>Autentizac\u00ed podle p\u0159ihl\u00e1\u0161en\u00ed; <\/li>\n<li>Autentizac\u00ed podle certifik\u00e1tu;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/f0927091b896dc1e8b7fde35f9ff9211.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Pod\u00edv\u00e1me se na zaj\u00edmavou podm\u00ednku <strong>UUID_VALIDATED<\/strong>, ta pr\u00e1v\u011b zaji\u0161\u0165uje, \u017ee autentizuj\u00edc\u00ed se u\u017eivatel skute\u010dn\u011b p\u0159i\u0161el z PC s povolen\u00fdm UDID asociovan\u00fdm v poli <strong>Popis<\/strong> u\u017eivatelsk\u00e9ho \u00fa\u010dtu, podm\u00ednka vypad\u00e1 takto:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/73952c705b376246f8b2fb9de883302b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Profil autorizace pou\u017e\u00edvan\u00fd v 1., 2., 3. etap\u011b vypad\u00e1 n\u00e1sledovn\u011b:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/4b1eb6688a5a42d74b587424b02624e1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Jak p\u0159esn\u011b n\u00e1m p\u0159ijde UDID od klienta AnyConnect, m\u016f\u017eeme zjistit pohledem na detaily relace klienta v ISE. V detailech uvid\u00edme, \u017ee AnyConnect p\u0159es mechanismus <strong>ACIDEX<\/strong> pos\u00edl\u00e1 nejen informace o platform\u011b, ale i UDID za\u0159\u00edzen\u00ed jako <strong>Cisco-AV-PAIR<\/strong>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/34859d3b6a5edb448999eaec49c59669.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Poznamenejme si vydan\u00fd certifik\u00e1t u\u017eivateli a pole <strong>Initials (I)<\/strong>, kter\u00e9 se pou\u017e\u00edv\u00e1 pro p\u0159ihl\u00e1\u0161en\u00ed p\u0159i sekund\u00e1rn\u00ed autentizaci MFA na Cisco DUO:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/ac5928db33e5dbbb1bd7e2190da6d9fa.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Na stran\u011b DUO Radius Proxy v logu jasn\u011b vid\u00edme, jak\u00fdm zp\u016fsobem prob\u00edh\u00e1 \u017e\u00e1dost o autentizaci, vyu\u017e\u00edv\u00e1 UDID jako u\u017eivatelsk\u00e9 jm\u00e9no:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/791f5470115460dc4d920096e79dde0f.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Na stran\u011b port\u00e1lu DUO vid\u00edme \u00fasp\u011b\u0161nou ud\u00e1lost autentizace:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/a31e31c57ad8b6e4ba021f3da7eedb7e.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A v vlastnostech u\u017eivatele m\u00e1m nastaveno <strong>ALIAS<\/strong>, kter\u00fd jsem pou\u017eil pro p\u0159ihl\u00e1\u0161en\u00ed, co\u017e je v podstat\u011b UDID povolen\u00e9ho PC pro p\u0159ihl\u00e1\u0161en\u00ed:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realizace koncepce vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/4035937749d1b85bad291aa4ec407352.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>V\u00fdsledkem m\u00e1me:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>V\u00edcefaktorovou autentizaci u\u017eivatele a za\u0159\u00edzen\u00ed;<\/li>\n<li>Ochranu proti podvr\u017een\u00ed za\u0159\u00edzen\u00ed u\u017eivatele;<\/li>\n<li>Hodnocen\u00ed stavu za\u0159\u00edzen\u00ed;<\/li>\n<li>Potenci\u00e1l pro zes\u00edlen\u00ed kontroly s certifik\u00e1tem stroje dom\u00e9ny atd.;<\/li>\n<li>Komplexn\u00ed ochrana vzd\u00e1len\u00e9ho pracovn\u00edho m\u00edsta s automaticky nasazovan\u00fdmi bezpe\u010dnostn\u00edmi moduly;<\/li>\n<\/ul>\n<p><\/p>\n<p>Odkazy na \u010dl\u00e1nky s\u00e9rie Cisco VPN:<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">Nasazen\u00ed clustera ASA VPN Load-Balancing<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493774\/\">Optimalizace cloudov\u00fdch slu\u017eeb v tunelu AnyConnect VPN na Cisco ASA<\/a><\/noindex><\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/497618\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e); [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Realizace konceptu vysoce zabezpe\u010den\u00e9ho vzd\u00e1len\u00e9ho p\u0159\u00edstupu | ProHoster","description":"Pokra\u010duji v s\u00e9rii \u010dl\u00e1nk\u016f na t\u00e9ma organizace p\u0159\u00edstupu k Remote-Access VPN a nemohu se nepochlubit zaj\u00edmavou zku\u0161enost\u00ed s nasazen\u00edm vysoce zabezpe\u010den\u00e9 konfigurace VPN.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-17T23:42:36+00:00","article:modified_time":"2020-04-17T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:02:45","updated":"2022-09-29 00:42:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/78242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=78242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/78242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/78243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=78242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=78242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=78242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}