{"id":36535,"date":"2019-10-31T22:12:11","date_gmt":"2019-10-31T19:12:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\/"},"modified":"2019-10-31T22:12:11","modified_gmt":"2019-10-31T19:12:11","slug":"kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","title":{"rendered":"Kuidas kasutada PAM-mooduleid Linuxis kohaliku autentimise jaoks GOST-2012 v\u00f5tmetega RUTOKEN-il","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Kuidas kasutada PAM-mooduleid Linuxis kohaliku autentimise jaoks GOST-2012 v\u00f5tmetega RUTOKEN-il\" src=\"\/wp-content\/uploads\/2019\/07\/e6656d4db027ab2705550726d5ab1908.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLihtsad paroolid ei kaitse ja keerulisi on v\u00f5imatu meeles pidada. Seet\u00f5ttu satuvad need sageli klaviatuuri alla v\u00f5i k\u00f5rvale postitatud sticky note'ile. Et paroolid j\u00e4\u00e4ksid \u201eunustavate\u201d kasutajate m\u00e4llu ning kaitse usaldusv\u00e4\u00e4rsus ei v\u00e4heneks, on olemas kahefaktoriline autentimine (2FA).<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>S\u00f5ltuvalt seadme omamisest ja PIN-koodi teadmisest v\u00f5ib ise PIN-kood olla lihtsam ja kergem meeles pidada. L\u00fchikese v\u00f5i juhusliku PIN-koodi puudused kompenseerivad f\u00fc\u00fcsilise omamise n\u00f5uded ja piirangud PIN-koodi proovimisele. <\/p>\n<p>Lisaks on riigiasutustes sageli soov, et k\u00f5ik toimiks vastavalt riiklikele standarditele. Sellest kahekordse autentimise variandist Linuxi sisenemisel juttu tuleb. Alustan kaugemalt.<\/p>\n<h1>PAM-moodulid<\/h1>\n<p>\nPlug-in autentimise moodulid (Pluggable Authentication Modules, PAM) on moodulid standardse API ja erinevate autentimismehhanismide rakendustega rakendustes. <br \/>\nK\u00f5ik t\u00f6\u00f6riistad ja rakendused, mis oskavad PAM-iga t\u00f6\u00f6tada, v\u00f5tavad need kasutusele ja saavad neid kasutada kasutaja autentimiseks.<br \/>\nT\u00f6\u00f6s on see umbes nii: k\u00e4sk login p\u00f6\u00f6rdub PAM-i poole, mis sooritab k\u00f5ik vajalikud kontrollid konfigureerimisfailis m\u00e4\u00e4ratud moodulite abil ja tagastab tulemuse tagasi k\u00e4skudele login.<\/p>\n<h2>librtpam<\/h2>\n<p>\nEttev\u00f5tte Aktiiv v\u00e4lja t\u00f6\u00f6tatud moodul lisab kahefaktorilise autentimise kasutajatele nutikaartide v\u00f5i USB-tokenitega, kasutades as\u00fcmmeetrilisi v\u00f5tmeid viimaste kodumaiste kr\u00fcptograafia standardite kohaselt. <\/p>\n<p>Vaatleme selle t\u00f6\u00f6p\u00f5him\u00f5tet:<\/p>\n<ul>\n<li>tokenil on talletatud kasutaja sertifikaat ja tema privaatv\u00f5ti;<\/li>\n<li>sertifikaat on salvestatud kasutaja kodukatalooge kui usaldusv\u00e4\u00e4rne.<\/li>\n<\/ul>\n<p>Autentimise protsess toimub j\u00e4rgmiselt:<\/p>\n<ol>\n<li>R\u00fctokenil otsitakse kasutaja isiklikku sertifikaati.<\/li>\n<li>K\u00fcside tokeni PIN-koodi.<\/li>\n<li>Juhtub, et juhuslikke andmeid allkirjastatakse privaatv\u00f5tmega otse R\u00fctokeni kiibis.<\/li>\n<li>Saadud allkiri kontrollitakse kasutaja sertifikaadi avaliku v\u00f5tmega.<\/li>\n<li>Moodul tagastab kutsuvatele rakendustele allkirja kontrollimise tulemuse.<\/li>\n<\/ol>\n<p>Saate autentida vastavalt GOST R 34.10-2012 v\u00f5tmetele (pikkusega 256 v\u00f5i 512 bitti) v\u00f5i aegunud GOST R 34.10-2001. <\/p>\n<p>V\u00f5tmete turvalisuse p\u00e4rast ei pea muretsema \u2013 need genereeritakse otse R\u0443\u0442\u043e\u043a\u0435\u043dis ja ei lahku kunagi oma m\u00e4lust kr\u00fcptograafiliste operatsioonide ajal.<\/p>\n<p><img decoding=\"async\" alt=\"Kuidas kasutada PAM-mooduleid Linuxis kohaliku autentimise jaoks GOST-2012 v\u00f5tmetega RUTOKEN-il\" src=\"\/wp-content\/uploads\/2019\/07\/61047962c9aee308d69553201e05203d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nR\u0443\u0442\u043e\u043a\u0435\u043d \u042d\u0426\u041f 2.0 on sertifitseeritud FSB ja FSTEK poolt vastavalt N\u0414\u0412 4, mist\u00f5ttu v\u00f5ib seda kasutada teabe s\u00fcsteemides, mis t\u00f6\u00f6tlevad konfidentsiaalset teavet. <\/p>\n<h2>Praktiline kasutamine<\/h2>\n<p>\nPeaaegu iga kaasaegne Linux sobib, n\u00e4itena kasutame xUbuntu 18.10.<\/p>\n<h3>1) Paigaldame vajalikud paketid<\/h3>\n<p>\n<code>sudo apt-get install libccid pcscd opensc<\/code><br \/>\nKui soovite lisada t\u00f6\u00f6laua lukustamise ekraanile, paigaldage t\u00e4iendavalt paket <code>libpam-pkcs11<\/code>.<\/p>\n<h3>2) Lisage PAM-moodul GOSTide toega<\/h3>\n<p>\nLaadige raamatukogu <noindex><a rel=\"nofollow\" href=\"https:\/\/download.rutoken.ru\/Rutoken\/PAM\/\">https:\/\/download.rutoken.ru\/Rutoken\/PAM\/<\/a><\/noindex><br \/>\nKopeerige PAM-i kausta librtpam.so.1.0.0 sisu s\u00fcsteemi kausta<br \/>\n<code>\/usr\/lib\/<\/code> v\u00f5i <code>\/usr\/lib\/x86_64-linux-gnu\/<\/code>v\u00f5i <code>\/usr\/lib64<\/code><\/p>\n<h3>3) Paigaldage paket librtpkcs11ecp.so<\/h3>\n<p>\nLaadige alla ja paigaldage DEB- v\u00f5i RPM-paket aadressilt: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rutoken.ru\/support\/download\/pkcs\/\">https:\/\/www.rutoken.ru\/support\/download\/pkcs\/<\/a><\/noindex><\/p>\n<h3>4) Kontrollige, kas R\u0443\u0442\u043e\u043a\u0435\u043d \u042d\u0426\u041f 2.0 t\u00f6\u00f6tab s\u00fcsteemis<\/h3>\n<p>\nTerminalis k\u00e4ivitage<br \/>\n<code>$ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -T<\/code><br \/>\nKui n\u00e4ete rida <code>Rutoken ECP<\/code> \u2013 t\u00e4hendab, et k\u00f5ik on korras.<\/p>\n<h3>5) Loe v\u00e4lja sertifikaat<\/h3>\n<p>\nKontrollige, et seadmel on sertifikaat<br \/>\n<code>$ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -O<\/code><br \/>\nKui p\u00e4rast rida:<br \/>\n<code>Using slot 0 with a present token (0x0)<\/code><\/p>\n<ul>\n<li><b>kuvatakse teave<\/b> v\u00f5tmete ja sertifikaatide kohta, on vajalik sertifikaadi lugemine ja selle salvestamine kettale. Selleks k\u00e4ivitage j\u00e4rgmine k\u00e4sk, kus {id} tuleb asendada sertifikaadi ID-ga, mille n\u00e4gite eelmise k\u00e4su v\u00e4ljundis:<br \/>\n<code>$ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -r -y cert --id {id} --output-file cert.crt<\/code><br \/>\n Kui fail cert.crt on loodud, liigume 6. punkti juurde.<\/li>\n<li><b>ei ole midagi<\/b>, siis on seade t\u00fchi. Palun p\u00f6\u00f6rduge administraatori poole v\u00f5i looge v\u00f5tmed ja sertifikaat ise, j\u00e4rgides j\u00e4rgmist punkti.<\/li>\n<\/ul>\n<h4>5.1) Looge testsertifikaat<\/h4>\n<p><\/p>\n<blockquote><p>T\u00e4helepanu! Kirjeldatud v\u00f5tmete ja sertifikaatide loomise meetodid sobivad testimiseks ja ei ole m\u00f5eldud kasutamiseks reaalsetes tingimustes. Selleks tuleb kasutada sertifikaate ja v\u00f5tmeid, mille on v\u00e4lja andnud usaldusv\u00e4\u00e4rne sertifitseerimiskeskus teie organisatsioonis v\u00f5i akrediteeritud isikutuvastus keskus.<br \/>\nPAM-moodul on loodud kaitsma kohalikke arvuteid ja eeldab t\u00f6\u00f6d v\u00e4ikestes organisatsioonides. Kuna kasutajaid on v\u00e4he, saab administraator ise j\u00e4lgida sertifikaatide tagasiv\u00f5tmist ja k\u00e4sitsi blokeerida kontosid, samuti sertifikaatide kehtivusaja j\u00e4lgimist. PAM-moodul ei oska veel kontrollida sertifikaate CRLi kaudu ega luua usaldusasutuste ahelaid.<\/p><\/blockquote>\n<h4>Lihtne tee (brauseri kaudu)<\/h4>\n<p>\nTestsertifikaadi saamiseks kasutage <noindex><a rel=\"nofollow\" href=\"https:\/\/ra.rutoken.ru\/\">veebiteenust \"Rutoken registreerimiskeskus\"<\/a><\/noindex>. Protsess v\u00f5tab aega mitte rohkem kui 5 minutit.<\/p>\n<h4>Gikide tee (kokkuv\u00f5tte ja ehk ka kompilaatori kaudu)<\/h4>\n<p>\n<b>Kontrollige OpenSC versiooni <\/b><br \/>\n<code>$ opensc-tool --version<\/code><br \/>\nKui versioon on v\u00e4iksem kui 0.20, siis uuendage v\u00f5i koostage <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/AktivCo\/OpenSC\/tree\/gostr3410-2012\/\">pkcs11-tool haru, mis toetab GOST-2012<\/a><\/noindex> meie GitHubist (artikli avaldamise ajal pole v\u00e4ljalasket 0.20 veel ilmunud) v\u00f5i OpenSC-i p\u00f5hiprojekti master-harust hiljemalt <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OpenSC\/OpenSC\/tree\/8cf1e6f769b36bdcadc3958574305b90e88c816d\">commit 8cf1e6f<\/a><\/noindex><\/p>\n<p>Generame v\u00f5tme paari j\u00e4rgmiste parameetritega:<br \/>\n<code>--key-type: GOSTR3410-2012-512:A (GOST-2012 512 bitti parameetriga A), GOSTR3410-2012-256:A (GOST-2012 256 bitti parameetriga A)<\/code><\/p>\n<p><code>--id: <\/code> objekti identifikaator (CKA_ID) kujul kahekohalised numbrid hex formaadis ASCII tabelist. Kasutage ainult ASCII-koodide tr\u00fckitud m\u00e4rke, kuna id tuleb edastada OpenSSL-ile stringina. N\u00e4iteks ASCII-koodile \"3132\" vastab string \"12\". <b> Mugavuse huvides v\u00f5ib kasutada <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rapidtables.com\/convert\/number\/ascii-to-hex.html\">veebiteenust stringi konvertimiseks ASCII-koodideks<\/a><\/noindex><\/b>.<\/p>\n<p><code>$ .\/pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so --keypairgen --key-type GOSTR3410-2012-512:A -l --id 3132<\/code><\/p>\n<p>J\u00e4rgmisena hakkame looma sertifikaati. Allpool on kirjeldatud kahte teed: esimene l\u00e4bi CA (kasutame test CA-sid), teine \u2013 isesignitud. Selleks tuleb esmalt paigaldada ja konfigureerida OpenSSL versioon 1.1 v\u00f5i uuem Rutokeni jaoks, kasutades erimoodulit rtengine, j\u00e4rgides juhendit <noindex><a rel=\"nofollow\" href=\"https:\/\/dev.rutoken.ru\/display\/PUB\/%D0%A3%D1%81%D1%82%D0%B0%D0%BD%D0%BE%D0%B2%D0%BA%D0%B0+%D0%B8+%D0%BD%D0%B0%D1%81%D1%82%D1%80%D0%BE%D0%B9%D0%BA%D0%B0+OpenSSL\">OpenSSL-i paigaldamine ja seadistamine<\/a><\/noindex>.<br \/>\nN\u00e4iteks: \"-<code>-id 3132<\/code>\u2019 OpenSSL-is tuleb m\u00e4rkida &#171;<code>pkcs11:id=12<\/code>&#171;. <\/p>\n<p>V\u00f5ite kasutada test CA teenuseid, mida on palju, n\u00e4iteks <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cryptopro.ru\/solutions\/test-ca\">siin on<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"http:\/\/testcert.infotecs.ru\/\">siin on <\/a><\/noindex>ja <noindex><a rel=\"nofollow\" href=\"http:\/\/soft.lissi.ru\/services\/test_ca\/\">siin on<\/a><\/noindex>, selleks loome sertifikaadi taotluse<\/p>\n<p>Teine v\u00f5imalus on lihtsalt laiskus ja luua isesignitud<br \/>\n<code>$ openssl req -utf8 <b>-new<\/b> -keyform engine -key \"pkcs11:id=12\" -engine rtengine -out req.csr<\/code><\/p>\n<p>Laadige sertifikaat seadmesse<br \/>\n<code>$ openssl req -utf8 <b>-x509<\/b> -keyform engine -key \"pkcs11:id=12\" -engine rtengine -out cert.cer<\/code><\/p>\n<h3>6) Registreerige sertifikaat s\u00fcsteemis<\/h3>\n<p>\nVeenduge, et teie sertifikaat n\u00e4eks v\u00e4lja nagu base64 fail:<\/p>\n<p><img decoding=\"async\" alt=\"Kuidas kasutada PAM-mooduleid Linuxis kohaliku autentimise jaoks GOST-2012 v\u00f5tmetega RUTOKEN-il\" src=\"\/wp-content\/uploads\/2019\/07\/83a7e25541041d02365141e682bd4635.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKui teie sertifikaat n\u00e4eb v\u00e4lja nii:<\/p>\n<p><img decoding=\"async\" alt=\"Kuidas kasutada PAM-mooduleid Linuxis kohaliku autentimise jaoks GOST-2012 v\u00f5tmetega RUTOKEN-il\" src=\"\/wp-content\/uploads\/2019\/07\/f385e4e288a49acfb2c54be4c24749e7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nsiis peate konvertima sertifikaadi DER-formaadist PEM-formaati (base64)<\/p>\n<p><code>$ openssl x509 -in cert.crt -out cert.pem -inform DER -outform PEM<\/code><br \/>\nKontrollime uuesti, et n\u00fc\u00fcd on k\u00f5ik korras.<\/p>\n<p>Lisame sertifikaadi usaldussertifikaatide loetellu<br \/>\n<code>$ mkdir ~\/.eid<br \/>\n$ chmod 0755 ~\/.eid<br \/>\n$ cat cert.pem &gt;&gt; ~\/.eid\/authorized_certificates<br \/>\n$ chmod 0644 ~\/.eid\/authorized_certificates<\/code><br \/>\nViimane rida kaitseb usaldussertifikaatide loetelu teiste kasutajate juhuslike v\u00f5i tahtlike muudatuste eest. See v\u00e4listab olukorra, kus keegi lisab siia oma sertifikaadi ja suudab teie nimel sisse logida.<\/p>\n<h3>7) Seame \u00fcles autentimise <\/h3>\n<p>\nMeie PAM mooduli seadistamine on t\u00e4iesti tavaline ja toimub t\u00e4pselt nagu teiste moodulite seadistamine. Loome faili <code>\/usr\/share\/pam-configs\/rutoken-gost-pam<\/code> , mis sisaldab mooduli t\u00e4isnime, kas see on vaikes\u00e4tetega lubatud, mooduli prioriteeti ja autentimise parameetreid.<br \/>\nAutentimise parameetrites on n\u00f5uded operatsiooni edule:<\/p>\n<ul>\n<li>required (n\u00f5utav): sellised moodulid peavad tagastama positiivse vastuse. Kui mooduli v\u00e4ljakutse tulemus sisaldab negatiivset vastust, toob see kaasa autentimise vea. P\u00e4ring katab \u00e4ra, kuid teised moodulid kutsutakse \u00fcles.<\/li>\n<li>requisite (vajalik): sarnane required\u2019iga, kuid viib kohe autentimise eba\u00f5nnestumiseni ja ignoreerib \u00fclej\u00e4\u00e4nud mooduleid.<\/li>\n<li>sufficient (piisav): kui enne sellist moodulit ei ole \u00fchtegi required v\u00f5i sufficient moodulit tagastanud negatiivset tulemust, tagastab moodul positiivse vastuse. \u00dclej\u00e4\u00e4nud mooduleid j\u00e4etakse t\u00e4helepanuta.<\/li>\n<li>optional (valikuline): kui virnas ei ole mooduleid required ja \u00fckski sufficient moodulitest ei ole tagastanud positiivset tulemust, peab v\u00e4hemalt \u00fcks optional moodulitest tagastama positiivse vastuse.<\/li>\n<\/ul>\n<p>\nFaili t\u00e4ielik sisu <code>\/usr\/share\/pam-configs\/rutoken-gost-pam<\/code>:<br \/>\n<code>Nimi: Rutoken PAM GOST<br \/>\nVaikimisi: jah<br \/>\nPrioriteet: 800<br \/>\nAuth-T\u00fc\u00fcp: Peamine<br \/>\nAuth: piisav \/usr\/lib\/librtpam.so.1.0.0 \/usr\/lib\/librtpkcs11ecp.so<\/code><\/p>\n<p><img decoding=\"async\" alt=\"Kuidas kasutada PAM-mooduleid Linuxis kohaliku autentimise jaoks GOST-2012 v\u00f5tmetega RUTOKEN-il\" src=\"\/wp-content\/uploads\/2019\/07\/804bd960918413e2134617b2ce31f0af.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nsalvesta fail, seej\u00e4rel k\u00e4ivita<br \/>\n<code>$ sudo pam-auth-update<\/code><br \/>\navatud aknas pane t\u00e4heke <b>Rutoken PAM GOST<\/b> ja vajutame <b>OK<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Kuidas kasutada PAM-mooduleid Linuxis kohaliku autentimise jaoks GOST-2012 v\u00f5tmetega RUTOKEN-il\" src=\"\/wp-content\/uploads\/2019\/07\/2fb2e020c943ef3a22f09985a939a1c9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>8) Kontrollime seadistust <\/h3>\n<p>\nKuna kogu on seadistatud, kuid samas ei kaota v\u00f5imalust s\u00fcsteemi sisenemiseks, sisestage k\u00e4sk<br \/>\n<code>$ sudo login<\/code><br \/>\nSisestage kasutajanimi. K\u00f5ik on \u00f5igesti seadistatud, kui s\u00fcsteem n\u00f5uab seadme PIN-koodi.<\/p>\n<p><img decoding=\"async\" alt=\"Kuidas kasutada PAM-mooduleid Linuxis kohaliku autentimise jaoks GOST-2012 v\u00f5tmetega RUTOKEN-il\" src=\"\/wp-content\/uploads\/2019\/07\/2501ca77a0c881ebb9fe588031a2c8ef.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>9) Seame \u00fcles arvuti lukustamise tokeni eemaldamisel<\/h3>\n<p>\nPaketi koosseisus <code>libpam-pkcs11<\/code> on utiliit <code>pkcs11_eventmgr,<\/code> mis v\u00f5imaldab t\u00e4ita erinevaid toiminguid PKCS#11 s\u00fcndmuste tekkimisel.<br \/>\nSeadistamiseks <code>pkcs11_eventmgr<\/code> teenindab konfiguratsioonifail: <code>\/etc\/pam_pkcs11\/pkcs11_eventmgr.conf<\/code><br \/>\n<i>Erinevates Linuxi distributsioonides on k\u00e4sk, mis kutsub esile konto lukustamise nutikaardi v\u00f5i tokeni eemaldamisel, erinev. Vaata. <code>event card_remove<\/code>.<\/i><br \/>\nKonfiguratsioonifaili n\u00e4idis on toodud allpool:<\/p>\n<pre><code class=\"xml\">pkcs11_eventmgr\n{\n    # K\u00e4ivitamine taustal\n    daemon = true;\n     \n    # S\u00fcsteemiteate seadistamine\n    debug = false;\n \n    # K\u00fcsimise aeg sekundites\n    polling_time = 1;\n \n    # Aegumise ajastamise seade kaardi eemaldamiseks\n    # Vaikimisi 0\n    expire_time = 0;\n \n    # Paigaldage pkcs11 teek RUT Tokeniga t\u00f6\u00f6tamiseks\n    pkcs11_module = usr\/lib\/librtpkcs11ecp.so;\n \n    # Tegevused kaardiga\n    # Kaart on sisestatud:\n    event card_insert {\n        # J\u00e4tame vaikeseaded (mitte midagi ei toimu)\n        on_error = ignore ;\n \n        action = \"\/bin\/false\";\n    }\n \n    # Kaart on eemaldatud\n    event card_remove {\n        on_error = ignore;\n         \n        # K\u00e4ivitage ekraani lukustamise funktsioon\n        \n        # GNOME jaoks\n        action = \"dbus-send --type=method_call --dest=org.gnome.ScreenSaver \/org\/gnome\/ScreenSaver org.gnome.ScreenSaver.Lock\";\n        \n        # XFCE jaoks\n        # action = \"xflock4\";\n        \n        # Astra Linuxi (FLY) jaoks\n        # action = \"fly-wmfunc FLYWM_LOCK\";\n    }\n \n    # Kaart on pikka aega eemaldatud\n    event expire_time {\n        # J\u00e4tame vaikeseaded (mitte midagi ei toimu)\n        on_error = ignore;\n \n        action = \"\/bin\/false\";\n    }\n}<\/code><\/pre>\n<p>P\u00e4rast seda lisage rakendus <code>pkcs11_eventmgr<\/code> automaatsesse k\u00e4ivitamisse. Selleks redigeerige faili .bash_profile:<br \/>\n<code>$ nano \/home\/\/.bash_profile<\/code><br \/>\nLisage faili l\u00f5pus rida pkcs11_eventmgr ja taask\u00e4ivitage arvuti.<\/p>\n<p><b>Kirjeldatud seadistamisetapid operatsioonis\u00fcsteemi jaoks v\u00f5ivad olla juhendiks igas kaasaegses Linuxi jaotuses, sealhulgas kohalikud. <\/b><\/p>\n<p><img decoding=\"async\" alt=\"Kuidas kasutada PAM-mooduleid Linuxis kohaliku autentimise jaoks GOST-2012 v\u00f5tmetega RUTOKEN-il\" src=\"\/wp-content\/uploads\/2019\/07\/ec235d0d0d50e23fbf09d4849d1fdd11.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Kokkuv\u00f5te <\/h2>\n<p>\nLinuxi PC-d Venemaa riigisektoris muutuvad j\u00e4rjest populaarsemaks, kuid usaldusv\u00e4\u00e4rse kahefaasilise autentimise seadistamine selles ops\u00fcsteemis ei ole alati lihtne. Meie juhend aitab lahendada \"paroolide probleemi\" ja usaldusv\u00e4\u00e4rselt kaitsta juurdep\u00e4\u00e4su PC-le, kulutades sellele mitte liiga palju aega.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/aktiv-company\/blog\/461199\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0441\u0442\u044b\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u043d\u0435 \u0437\u0430\u0449\u0438\u0449\u0430\u044e\u0442, \u0430 \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u043e\u043c\u043d\u0438\u0442\u044c. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u043d\u0438 \u0442\u0430\u043a \u0447\u0430\u0441\u0442\u043e \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0441\u0442\u0438\u043a\u0435\u0440\u0435 \u043f\u043e\u0434 \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u043e\u0439 \u0438\u043b\u0438 \u043d\u0430 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0435. \u0427\u0442\u043e\u0431\u044b \u043f\u0430\u0440\u043e\u043b\u0438 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0433\u043e\u043b\u043e\u0432\u0430\u0445 \u201c\u0437\u0430\u0431\u044b\u0432\u0447\u0438\u0432\u044b\u0445\u201d \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0435 \u0442\u0435\u0440\u044f\u043b\u0430\u0441\u044c \u2013 \u0435\u0441\u0442\u044c \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f (2\u0424\u0410). \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u044e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0438 \u0437\u043d\u0430\u043d\u0438\u044f \u0435\u0433\u043e PIN-\u043a\u043e\u0434\u0430, \u0441\u0430\u043c PIN-\u043a\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435 \u0438 \u043b\u0435\u0433\u0447\u0435 \u0434\u043b\u044f \u0437\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27347,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36535","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PAM-\u043c\u043e\u0434\u0443\u043b\u0438 \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Linux \u043f\u043e \u043a\u043b\u044e\u0447\u0430\u043c \u0413\u041e\u0421\u0422-2012 \u043d\u0430 \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:12:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:12:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kuidas kasutada PAM-mooduleid kohaliku autentimise jaoks Linuxis GOST-2012 v\u00f5tmete p\u00f5hjal RUT Tokenil | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PAM-\u043c\u043e\u0434\u0443\u043b\u0438 \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Linux \u043f\u043e \u043a\u043b\u044e\u0447\u0430\u043c \u0413\u041e\u0421\u0422-2012 \u043d\u0430 \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u0435 | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:12:11+00:00","article:modified_time":"2019-10-31T19:12:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36535","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 03:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:43:32","updated":"2026-01-22 03:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=36535"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36535\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/27347"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=36535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=36535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=36535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}