{"id":78242,"date":"2020-04-18T01:42:36","date_gmt":"2020-04-17T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa"},"modified":"2020-04-18T01:42:36","modified_gmt":"2020-04-17T23:42:36","slug":"realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","title":{"rendered":"Implementering af konceptet for h\u00f8jsikret fjernadgang","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Forts\u00e6ttende serien af artikler om emnet organisation <strong>Remote-Access VPN<\/strong> af adgang kan jeg ikke lade v\u00e6re med at dele en interessant erfaring med implementering af <strong>en h\u00f8jsikkerheds VPN-konfiguration<\/strong>. En udfordrende opgave blev givet af en kunde (der er opfindere i de russiske landsbyer), men Challenge Accepted og kreativt realiseret. Resultatet blev et interessant koncept med f\u00f8lgende karakteristika:<\/p>\n<p><\/p>\n<ol>\n<li>Flere beskyttelsesfaktorer mod \u00e6ndring af slutbrugerens enhed (strengt knyttet til brugeren);\n<ul>\n<li>Samsvarsvurdering af brugerens PC til den tildelte UDID for den godkendte PC i autentificeringsdatabasen; <\/li>\n<li>Med MFA, der bruger UDID fra certifikatet til sekund\u00e6r autentificering via Cisco DUO <em>(Kan integreres med alle SAML\/RADIUS-kompatible systemer)<\/em>; <\/li>\n<\/ul>\n<\/li>\n<li>Multifaktorautentificering: \n<ul>\n<li>Bruger certifikat med felttjek og sekund\u00e6r autentificering baseret p\u00e5 en af dem;<\/li>\n<li>Login (u\u00e6ndret, taget fra certifikatet) og adgangskode;<\/li>\n<\/ul>\n<\/li>\n<li>Vurdering af tilstanden for den tilsluttede v\u00e6rtsmaskine (Posture)<\/li>\n<\/ol>\n<p><\/p>\n<p><strong>Brugte komponenter i l\u00f8sningen:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Cisco ASA (VPN-gateway);<\/li>\n<li>Cisco ISE (Autentificering \/ Autorisation \/ Regnskab, Tilstandsvurdering, CA);<\/li>\n<li>Cisco DUO (Multifaktorautentificering) <em>(Kan integreres med alle SAML\/RADIUS-kompatible systemer)<\/em>;<\/li>\n<li>Cisco AnyConnect (Multifunktionsagent til station\u00e6re og mobile operativsystemer);<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p><strong>Lad os begynde med kundens krav:<\/strong><\/p>\n<p><\/p>\n<ol>\n<li>Brugeren skal have mulighed for at downloade AnyConnect-klienten fra VPN-gatewayen ved hj\u00e6lp af sin autentificering Login\/Adgangskode, og alle n\u00f8dvendige AnyConnect-moduler skal automatisk installeres i henhold til brugerens politik;<\/li>\n<li>Brugeren skal have mulighed for automatisk at f\u00e5 udstedt et certifikat (til et af scenarierne, det prim\u00e6re scenarie er manuel udstedelse og upload til PC), men jeg har implementeret automatisk udstedelse til demonstration (det er aldrig for sent at fjerne).<\/li>\n<li>Den prim\u00e6re autentificering skal finde sted i flere trin; f\u00f8rst sker autentificeringen af certifikatet med en analyse af de n\u00f8dvendige felter og deres v\u00e6rdier, derefter login\/adgangskode, men denne gang skal brugernavnet, der er angivet i certifikatets felt, inds\u00e6ttes i login-vinduet <strong>Subject Name (CN)<\/strong> uden mulighed for redigering.<\/li>\n<li>Det er n\u00f8dvendigt at sikre, at den enhed, der bruges til adgang, er den udleverede virksomhedslaptop til fjernadgang, og ikke noget andet. (Der er lavet flere varianter for at opfylde dette krav)<\/li>\n<li>Der skal udf\u00f8res en vurdering af tilslutningsenheden (p\u00e5 dette stadium af PC'en) med kontrol af en hel tabel med kundens krav (sammenfattende):\n<ul>\n<li>Filer og deres egenskaber;<\/li>\n<li>Registreringsposter;<\/li>\n<li>OS-opdateringer fra den leverede liste (senere integration af SCCM);<\/li>\n<li>Tilstedev\u00e6relse af antivirus af en bestemt producent og relevansen af signaturerne;<\/li>\n<li>Aktivitet af bestemte tjenester;<\/li>\n<li>Tilstedev\u00e6relse af bestemte installerede programmer;<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/p>\n<p>For det f\u00f8rste vil jeg anbefale, at vi ser en video demonstration af den opn\u00e5ede implementering p\u00e5 <strong>YouTube (5 minutter)<\/strong>.<\/p>\n<p>\n<center><div class=\"youtube-placeholder\" data-id=\"cBftD3KFK98\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/cBftD3KFK98\/hqdefault.jpg\" alt=\"Afspil video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>Nu vil jeg foresl\u00e5 at se p\u00e5 de detaljer ved implementeringen, der ikke blev d\u00e6kket i videoen.<\/p>\n<p><\/p>\n<p><strong>Lad os forberede AnyConnect-profilen:<\/strong><\/p>\n<p><\/p>\n<p>Eksemplet p\u00e5 oprettelse af en profil (i menuen i ASDM), jeg tidligere pr\u00e6senterede i min artikel om indstilling af <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing cluster<\/a><\/noindex>. Jeg vil nu gerne fremh\u00e6ve de muligheder, vi har brug for:<\/p>\n<p><\/p>\n<p>I profilen angiver vi VPN-gatewayen og navnet p\u00e5 profilen til forbindelse p\u00e5 den afsluttende klient:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementering af konceptet for h\u00f8jsikret fjernadgang\" src=\"\/wp-content\/uploads\/2020\/04\/45ff3cb1f7b592e102bd6e256ae26043.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Vi konfigurerer automatisk udstedelse af certifikater fra profilen ved at angive s\u00e6rligt certifikatparametrene, og bem\u00e6rk, at vi l\u00e6gger v\u00e6gt p\u00e5 feltet <strong>Initials (I)<\/strong>, hvor en specifik v\u00e6rdi er indtastet manuelt <strong>UDID<\/strong> af den testmaskine (Unik enhedsidentifikator, som Cisco AnyConnect-klienten genererer).<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementering af konceptet for h\u00f8jsikret fjernadgang\" src=\"\/wp-content\/uploads\/2020\/04\/89d4edb4f1b166eda75916286998a4bf.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Her vil jeg gerne tage et litter\u00e6rt sidespring, da denne artikel beskriver konceptet; for demonstrationsform\u00e5l er UDID indtastet for udstedelse af certifikat i feltet Initials for AnyConnect-profilen. Selvf\u00f8lgelig, i det virkelige liv, hvis du g\u00f8r det, vil alle klienter modtage certifikatet med den samme UDID i dette felt, og de vil ikke kunne fungere, da de har brug for UDID'en for deres specifikke PC. AnyConnect implementerer desv\u00e6rre ikke substitutionsanmodningen til certifikatfeltet UDID gennem milj\u00f8variablen, ligesom den g\u00f8r med variablen <strong>%USER%<\/strong>.<\/p>\n<p><\/p>\n<p>Det er v\u00e6rd at bem\u00e6rke, at kunden (af dette scenarie) oprindeligt planl\u00e6gger selv at udstede certifikater med den specificerede UDID manuelt til s\u00e5danne beskyttede PC'er, hvilket ikke er et problem for dem. Men for de fleste af os \u00f8nsker vi automatisering (for mig, i hvert fald =). <\/p>\n<p><\/p>\n<p>Her er, hvad jeg kan tilbyde i forhold til automatisering. Hvis det ikke er muligt at udstede et certifikat automatisk ved at dynamisk inds\u00e6tte UDID for AnyConnect, er der en anden m\u00e5de, som kr\u00e6ver lidt kreativ t\u00e6nkning og dygtige h\u00e6nder \u2013 jeg vil forklare konceptet. Lad os f\u00f8rst se p\u00e5, hvordan UDID dannes p\u00e5 forskellige operativsystemer af AnyConnect-agenten: <\/p>\n<p><\/p>\n<ul>\n<li><strong>Windows<\/strong> \u2014 SHA-256 hash af kombinationen af registreringsn\u00f8gle DigitalProductID og Machine SID<\/li>\n<li><strong>OSX<\/strong> \u2014 SHA-256 hash af PlatformUUID<\/li>\n<li><strong>Linux<\/strong> \u2014 SHA-256 hash af UUID p\u00e5 root partition.<\/li>\n<li><strong>Apple iOS<\/strong> \u2014 SHA-256 hash af PlatformUUID<\/li>\n<li><strong>Android<\/strong> \u2013 Se dokumentet om <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/security\/vpn_client\/anyconnect\/anyconnect40\/administration\/guide\/b_AnyConnect_Administrator_Guide_4-0\/b_AnyConnect_Administrator_Guide_4-0_chapter_01010.html#reference_C87ADD1C58F64EF8928D921323209AA6\">linket<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<p>Derfor laver vi et script til vores virksomheders Windows-operativsystemer, med dette script beregner vi UDID lokalt p\u00e5 basis af kendte input og laver en foresp\u00f8rgsel om udstedelse af certifikat ved at inds\u00e6tte denne UDID i det relevante felt; i \u00f8vrigt kan vi ogs\u00e5 bruge maskincertifikatet udstedt af AD (ved at tilf\u00f8je dobbelt autentificering med certifikat til schemaet. <strong>Multiple Certificate<\/strong>). <\/p>\n<p><\/p>\n<p><strong>Vi forbereder indstillingerne fra Cisco ASA:<\/strong><\/p>\n<p><\/p>\n<p>Vi opretter et TrustPoint for ISE CA serveren, som vil udstede certifikater til klienterne. Jeg vil ikke gennemg\u00e5 proceduren for import af Key-Chain, da det er beskrevet i min artikel om konfiguration. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing cluster<\/a><\/noindex>. <\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">crypto ca trustpoint ISE-CA\n enrollment terminal\n crl configure<\/code><\/pre>\n<p><\/p>\n<p>Vi konfigurerer distributionen i Tunnel-Group baseret p\u00e5 regler i overensstemmelse med felterne i certifikatet, som bruges til autentificering. Her konfigureres ogs\u00e5 AnyConnect-profilen, som vi har lavet i det foreg\u00e5ende trin. Jeg vil gerne bem\u00e6rke, at jeg bruger v\u00e6rdien <strong>SECUREBANK-RA<\/strong>, til at flytte brugere med et udstedt certifikat ind i tunnelgruppen <strong>SECURE-BANK-VPN<\/strong>, bem\u00e6rk at dette felt er indsat i foresp\u00f8rgslen om certifikat i AnyConnect-profilerne.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">tunnel-group-map enable rules\n!\ncrypto ca certificate map OU-Map 6\n subject-name attr ou eq securebank-ra\n!\nwebvpn\n anyconnect profiles SECUREBANK disk0:\/securebank.xml\n certificate-group-map OU-Map 6 SECURE-BANK-VPN\n!<\/code><\/pre>\n<p><\/p>\n<p>Vi konfigurerer autentificeringsserverne. I mit tilf\u00e6lde er det ISE til f\u00f8rste fase af autentificering og DUO (Radius Proxy) som MFA.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">! CISCO ISE\naaa-server ISE protocol radius\n authorize-only\n interim-accounting-update periodic 24\n dynamic-authorization\naaa-server ISE (inside) host 192.168.99.134\n key *****\n!\n! DUO RADIUS PROXY\naaa-server DUO protocol radius\naaa-server DUO (inside) host 192.168.99.136\n timeout 60\n key *****\n authentication-port 1812\n accounting-port 1813\n no mschapv2-capable\n!<\/code><\/pre>\n<p><\/p>\n<p>Vi opretter gruppepolitikker og tunnelgrupper samt deres st\u00f8ttekomponenter:<\/p>\n<p><\/p>\n<p>Tunnelgruppe <strong>DefaultWEBVPNGroup<\/strong> vil blive brugt prim\u00e6rt til at downloade AnyConnect VPN-klient og udstede brugerens certifikat ved hj\u00e6lp af SCEP-Proxy-funktionen p\u00e5 ASA, for dette har vi aktiveret de relevante indstillinger b\u00e5de p\u00e5 selve tunnelgruppen og p\u00e5 den tilknyttede gruppepolitik. <strong>AC-Download<\/strong>, s\u00e5vel som p\u00e5 den downloadede AnyConnect-profil (felter til certifikatudstedelse osv.). I denne gruppepolitik angiver vi ogs\u00e5 behovet for at downloade. <strong>ISE Posture Module<\/strong>.<\/p>\n<p><\/p>\n<p>Tunnelgruppe <strong>SECURE-BANK-VPN<\/strong> vil automatisk blive brugt af klienten ved autentificering med det udstedte certifikat fra det foreg\u00e5ende trin, da forbindelsen i overensstemmelse med Certificate Map vil blive tilknyttet netop denne tunnelgruppe. Jeg vil fort\u00e6lle om interessante muligheder her:<\/p>\n<p><\/p>\n<ul>\n<li><strong>secondary-authentication-server-group DUO<\/strong> # \u0417\u0430\u0434\u0430\u0435\u043c \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO (Radius Proxy)<\/li>\n<li><strong>username-from-certificate CN<\/strong> # \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0435 CN \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043b\u043e\u0433\u0438\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f<\/li>\n<li><strong>secondary-username-from-certificate I<\/strong> # \u0414\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u043d\u043e\u0435 \u0438 \u043f\u043e\u043b\u044f Initials (I) \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430.<\/li>\n<li><strong>pre-fill-username client<\/strong> # \u0434\u0435\u043b\u0430\u0435\u043c \u043f\u0440\u0435\u0434\u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u043e\u043a\u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f<\/li>\n<li><strong>secondary-pre-fill-username client hide use-common-password push<\/strong> # \u041f\u0440\u044f\u0447\u0435\u043c \u043e\u043a\u043d\u043e \u0432\u0432\u043e\u0434\u0430 \u043b\u043e\u0433\u0438\u043d\u0430\/\u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 DUO \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u043e\u043b\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u043c\u0435\u0442\u043e\u0434 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f (sms\/push\/phone) \u2013 \u0434\u043e\u043a\u0430 <noindex><a rel=\"nofollow\" href=\"https:\/\/duo.com\/docs\/ciscoasa-radius\">her<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">!\naccess-list posture-redirect extended permit tcp any host 72.163.1.80 \naccess-list posture-redirect extended deny ip any any\n!\naccess-list VPN-Filter extended permit ip any any\n!\nip local pool vpn-pool 192.168.100.33-192.168.100.63 mask 255.255.255.224\n!\ngroup-policy SECURE-BANK-VPN internal\ngroup-policy SECURE-BANK-VPN attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ngroup-policy AC-DOWNLOAD internal\ngroup-policy AC-DOWNLOAD attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n scep-forwarding-url value http:\/\/ise.ashes.cc:9090\/auth\/caservice\/pkiclient.exe\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ntunnel-group DefaultWEBVPNGroup general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n accounting-server-group ISE\n default-group-policy AC-DOWNLOAD\n scep-enrollment enable\ntunnel-group DefaultWEBVPNGroup webvpn-attributes\n authentication aaa certificate\n!\ntunnel-group SECURE-BANK-VPN type remote-access\ntunnel-group SECURE-BANK-VPN general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n secondary-authentication-server-group DUO\n accounting-server-group ISE\n default-group-policy SECURE-BANK-VPN\n username-from-certificate CN\n secondary-username-from-certificate I\ntunnel-group SECURE-BANK-VPN webvpn-attributes\n authentication aaa certificate\n pre-fill-username client\n secondary-pre-fill-username client hide use-common-password push\n group-alias SECURE-BANK-VPN enable\n dns-group ASHES-DNS\n!<\/code><\/pre>\n<p><\/p>\n<p><strong>Lad os g\u00e5 videre til ISE:<\/strong><\/p>\n<p><\/p>\n<p>Vi ops\u00e6tter en lokal bruger (det er muligt at bruge AD\/LDAP\/ODBC osv.), for nemheds skyld har jeg oprettet en lokal bruger direkte i ISE og angivet i feltet <strong>description<\/strong> <strong>UDID for PC'en<\/strong> fra hvilken han har adgang til VPN. Ved brug af lokal godkendelse i ISE vil jeg v\u00e6re begr\u00e6nset til \u00e9n enhed, da der ikke er mange felter, men i eksterne godkendelsesdatabaser vil jeg ikke have s\u00e5danne begr\u00e6nsninger.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementering af konceptet for h\u00f8jsikret fjernadgang\" src=\"\/wp-content\/uploads\/2020\/04\/ea73d4bab6c0872f7c3aef4ad1345b12.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Lad os se p\u00e5 autorisationspolitikken, den er opdelt i fire forbindelsesfaser:<\/p>\n<p><\/p>\n<ul>\n<li><strong>Trin 1<\/strong> \u2014 Politikken for download af AnyConnect-agenten og udstedelse af certifikat<\/li>\n<li><strong>Trin 2<\/strong> \u2014 Politikken for prim\u00e6r godkendelse Login (fra certifikatet)\/Kodeord + Certifikat med UDID-validering<\/li>\n<li><strong>Trin 3<\/strong> \u2014 Sekund\u00e6r godkendelse via Cisco DUO (MFA) med UDID som brugernavn + Statusvurdering<\/li>\n<li><strong>Trin 4<\/strong> \u2014 Endelig autorisation i tilstand:\n<ul>\n<li>Compliant;<\/li>\n<li>UDID-validering (fra certifikatet + tilknytning til login), <\/li>\n<li>Cisco DUO MFA;<\/li>\n<li>Login-godkendelse; <\/li>\n<li>Certifikat-godkendelse;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementering af konceptet for h\u00f8jsikret fjernadgang\" src=\"\/wp-content\/uploads\/2020\/04\/f0927091b896dc1e8b7fde35f9ff9211.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Lad os se p\u00e5 en interessant betingelse <strong>UUID_VALIDATED<\/strong>, den kontrollerer netop, om den godkendte bruger virkelig kommer fra en PC med det tilladte UDID, som er associeret i feltet <strong>Beskrivelse<\/strong> af kontoen, betingelserne ser s\u00e5ledes ud:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementering af konceptet for h\u00f8jsikret fjernadgang\" src=\"\/wp-content\/uploads\/2020\/04\/73952c705b376246f8b2fb9de883302b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Autoriseringsprofilen, der anvendes i faserne 1, 2 og 3, ser s\u00e5ledes ud:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementering af konceptet for h\u00f8jsikret fjernadgang\" src=\"\/wp-content\/uploads\/2020\/04\/4b1eb6688a5a42d74b587424b02624e1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Vi kan tjekke, hvordan UDID ankommer fra klienten AnyConnect ved at se p\u00e5 ISE-sessionens detaljer. I detaljerne ser vi, at AnyConnect via mekanismen <strong>ACIDEX<\/strong> sender ikke kun data om platformen, men ogs\u00e5 UDID'en for enheden som <strong>Cisco-AV-PAIR<\/strong>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementering af konceptet for h\u00f8jsikret fjernadgang\" src=\"\/wp-content\/uploads\/2020\/04\/34859d3b6a5edb448999eaec49c59669.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Lad os bem\u00e6rke det udstedte certifikat til brugeren og feltet <strong>Initials (I)<\/strong>, som bruges til at tage det som login til sekund\u00e6r MFA-godkendelse p\u00e5 Cisco DUO:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementering af konceptet for h\u00f8jsikret fjernadgang\" src=\"\/wp-content\/uploads\/2020\/04\/ac5928db33e5dbbb1bd7e2190da6d9fa.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>P\u00e5 DUO Radius Proxy-siden ser vi klart, hvordan anmodningen om godkendelse er, den g\u00e5r med brug af UDID som brugernavn:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementering af konceptet for h\u00f8jsikret fjernadgang\" src=\"\/wp-content\/uploads\/2020\/04\/791f5470115460dc4d920096e79dde0f.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Fra DUO-portalen ser vi en vellykket godkendelsesh\u00e6ndelse:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementering af konceptet for h\u00f8jsikret fjernadgang\" src=\"\/wp-content\/uploads\/2020\/04\/a31e31c57ad8b6e4ba021f3da7eedb7e.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Og i brugerens egenskaber har jeg angivet <strong>ALIAS<\/strong>, som jeg brugte til login, dette er i \u00f8vrigt UDID'en der er tilladt for login PC'en:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementering af konceptet for h\u00f8jsikret fjernadgang\" src=\"\/wp-content\/uploads\/2020\/04\/4035937749d1b85bad291aa4ec407352.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>Som resultat har vi opn\u00e5et:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Multifaktorgodkendelse af bruger og enhed;<\/li>\n<li>Beskyttelse mod enhedsforfalskning;<\/li>\n<li>Vurdering af enhedens status;<\/li>\n<li>Potentiale for at styrke kontrol med dom\u00e6nets maskincertifikat osv.;<\/li>\n<li>Omfattende beskyttelse af den remote arbejdsplads med automatisk implementerede sikkerhedsmoduler;<\/li>\n<\/ul>\n<p><\/p>\n<p>Links til artikler i serien Cisco VPN:<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">Implementering af ASA VPN Load-Balancing kluster<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493774\/\">Optimering af cloudtjenester i AnyConnect VPN tunnelen p\u00e5 Cisco ASA<\/a><\/noindex><\/li>\n<\/ul>\n<p>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/497618\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e); [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Implementering af konceptet for h\u00f8jsikker fjernadgang | ProHoster","description":"I forts\u00e6ttelse af serien af artikler om organisering af Remote-Access VPN-adgang, kan jeg ikke undlade at dele en interessant erfaring med implementeringen af en meget sikker VPN-konfiguration.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-17T23:42:36+00:00","article:modified_time":"2020-04-17T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:02:45","updated":"2022-09-29 00:42:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/78242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=78242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/78242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/78243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=78242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=78242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=78242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}