{"id":78242,"date":"2020-04-18T01:42:36","date_gmt":"2020-04-17T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa"},"modified":"2020-04-18T01:42:36","modified_gmt":"2020-04-17T23:42:36","slug":"realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","title":{"rendered":"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>J\u00e4tkame artiklite seeriat sellel teemal <strong>Remote-Access VPN<\/strong> juurdep\u00e4\u00e4su kohta ei saa ma mitte jagada huvitavat kogemust juurutamisest <strong>k\u00f5rge turvalisusega VPN konfiguratsioonist<\/strong>. \u00dcks kliendilt saadud mittetriviaalne \u00fclesanne (on t\u00f5eliselt leidlikke inimesi Venemaa k\u00fclades), aga Challenge Accepted ning loominguliselt teostatud. Tulemusena saime huvitava kontsepti j\u00e4rgmiste omadustega:<\/p>\n<p><\/p>\n<ol>\n<li>Mitu kaitsemeetodit l\u00f5ppseadmestiku petmise vastu (tugeva sidumisega kasutajaga);\n<ul>\n<li>Kasutaja PC vastavuse hindamine m\u00e4\u00e4ratud UDID lubatud PC-le autentimisbaasis; <\/li>\n<li>Kasutades MFA-d, mis kasutab UDID-d sertifikaadist teise autentimise l\u00e4biviimiseks Cisco DUOs <em>(Saab integreerida iga SAML\/RADIUS \u00fchilduva);<\/em>; <\/li>\n<\/ul>\n<\/li>\n<li>Mitme teguri autentimine: \n<ul>\n<li>Kasutaja sertifikaat koos v\u00e4ljade kontrollimise ja \u00fche neist teise autentimisega;<\/li>\n<li>Logi (muutumatuna, sertifikaadist saadud) ja parool;<\/li>\n<\/ul>\n<\/li>\n<li>\u00dchenduvate hostide oleku hindamine (Posture)<\/li>\n<\/ol>\n<p><\/p>\n<p><strong>Kasutatavad lahenduse komponendid:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Cisco ASA (VPN l\u00fckke- ja vastuv\u00f5tja);<\/li>\n<li>Cisco ISE (Autentimine \/ Autoriseerimine \/ Raamatupidamine, Oleku hindamine, CA);<\/li>\n<li>Cisco DUO (Mitme teguri autentimine) <em>(Saab integreerida iga SAML\/RADIUS \u00fchilduva);<\/em>;<\/li>\n<li>Cisco AnyConnect (Mitmeotstarbeline agent t\u00f6\u00f6jaamadele ja mobiilsetele operatsioonis\u00fcsteemidele);<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p><strong>Alustame kliendi n\u00f5uetest:<\/strong><\/p>\n<p><\/p>\n<ol>\n<li>Kasutaja peab saama oma autentimise Logi\/Parool j\u00e4rgi alla laadida AnyConnect kliendi VPN l\u00fckke- ja vastuv\u00f5tjalt, k\u00f5ik vajalikud AnyConnect moodulid peavad olema automaatselt installitud vastavalt kasutaja poliitikale;<\/li>\n<li>Kasutajal peab olema v\u00f5imalus automaatselt sertifikaadi v\u00e4ljastamiseks (\u00fche stsenaariumi jaoks, peamine stsenaarium on k\u00e4sitsi v\u00e4ljastamine ja laadimine PC-le), mina teostasin automaatse v\u00e4ljastamise demonstreerimiseks (hiljem ei ole kunagi hilja eemaldada).<\/li>\n<li>Peamine autentimine peaks toimuma mitmes etapis, k\u00f5igepealt toimub sertifikaadi autentimine vajalike v\u00e4li- ja v\u00e4\u00e4rtushindamisega, seej\u00e4rel logi\/parool, kuid seekord peab logimisaknas olema automaatselt kasutajanimi, mis on m\u00e4\u00e4ratud sertifikaadi v\u00e4ljal <strong>Subject Name (CN)<\/strong> ilma redigeerimisv\u00f5imaluseta.<\/li>\n<li>On vajalik veenduda, et seade, millelt sisse logitakse, on v\u00e4lja antud kasutajale kaugjuurdep\u00e4\u00e4suks ettev\u00f5tte s\u00fclearvuti, mitte midagi muud. (Seda n\u00f5uet on rahuldamiseks tehtud mitu varianti)<\/li>\n<li>Peab olema hindamine \u00fchenduvate seadmete seisundist (selle etapi PC) koos kliendi n\u00f5uete ulatusliku tabeliga (kokkuv\u00f5tlikult):\n<ul>\n<li>Failid ja nende omadused;<\/li>\n<li>Registri kirjed;<\/li>\n<li>OS-i plaastrid esitatud loendist (hiljem SCCM integreerimine);<\/li>\n<li>Teatud tootja viiruset\u00f5rje olemasolu ja allkirjade ajakohasus;<\/li>\n<li>Teatud teenuste aktiivsus;<\/li>\n<li>Teatud installitud programmide olemasolu;<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/p>\n<p>Esiteks soovitan kindlasti vaadata video demonstreerimist valminud rakendusele, <strong>Youtube'is (5 minutit)<\/strong>.<\/p>\n<p>\n<center><div class=\"youtube-placeholder\" data-id=\"cBftD3KFK98\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/cBftD3KFK98\/hqdefault.jpg\" alt=\"M\u00e4ngi videot\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>N\u00fc\u00fcd soovitan vaadata rakenduse detaile, mida videos ei kajastatud.<\/p>\n<p><\/p>\n<p><strong>Valmistame ette AnyConnecti profiili:<\/strong><\/p>\n<p><\/p>\n<p>Profiili loomise n\u00e4ide (ASDM men\u00fc\u00fcpunkti plaanis) olen varem kirjeldanud oma artiklis, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing klastrist.<\/a><\/noindex>Praegu tahan eraldi r\u00f5hutada neid valikuid, mis meile vajalikud on:<\/p>\n<p><\/p>\n<p>Profiilis n\u00e4itame VPN-i v\u00e4ravat ja profiili nime \u00fchendamiseks l\u00f5pp-kliendis:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/45ff3cb1f7b592e102bd6e256ae26043.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Teostame sertifikaadi automaatse v\u00e4ljaandmise seadistused profili poolt, n\u00e4idates sealhulgas sertifikaadi parameetreid ning sellele t\u00e4helepanu p\u00f6\u00f6rates vaatame v\u00e4lja <strong>Initials (I)<\/strong>, kuhu on k\u00e4sitsi sisestatud konkreetne v\u00e4\u00e4rtus <strong>UDID<\/strong> katsemasina (seade ainulaadne identifikaator, mille genereerib Cisco AnyConnecti klient).<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/89d4edb4f1b166eda75916286998a4bf.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Siin tahan teha l\u00fchi\u00fclevaate, kuna see artikkel kirjeldab kontseptsiooni, demonstreerimise eesm\u00e4rkide jaoks on siin UDID sisestatud AnyConnecti profiili Initials v\u00e4ljale sertifikaadi v\u00e4ljaandmiseks. Loomulikult, kui te seda reaalses elus teete, saavad k\u00f5ik kliendid sama UDID, ja ei toimi, kuna neile on vajalik oma PC konkreetne UDID. Kahjuks ei rakenda AnyConnect hetkel keskkonnamuutuja kaudu sertifikaadi p\u00e4ringut UDID v\u00e4lja vahetamist nagu nad n\u00e4iteks teevad muutuja <strong>%USER%<\/strong>.<\/p>\n<p><\/p>\n<p>Oluline on m\u00e4rkida, et tellija (selle stsenaariumi puhul) plaanib algselt iseseisvalt v\u00e4lja anda sertifikaate m\u00e4\u00e4ratud UDID-ga k\u00e4sitsi sellistele kaitstud PC-dele, mis ei ole tema jaoks probleem. Kuid enamiku jaoks meist soovime automatiseerimist (minu jaoks kindlasti=) ). <\/p>\n<p><\/p>\n<p>Ja mida ma automaatika osas pakkuda saan. Kui AnyConnect'is sertifikaati automaatselt v\u00e4lja kirjutada ei ole v\u00f5imalik, kasutades UDID-d d\u00fcnaamiliselt, siis on veel \u00fcks viis, mis n\u00f5uab veidi loomingulist m\u00f5tlemist ja oskuslikke k\u00e4si \u2013 r\u00e4\u00e4gin konceptist. Alustuseks vaatame, kuidas UDID-d erinevatel operatsioonis\u00fcsteemidel AnyConnect'i agente abil genereeritakse: <\/p>\n<p><\/p>\n<ul>\n<li><strong>Windows<\/strong> \u2014 SHA-256 Hash registry key DigitalProductID ja Machine SID kombinatsioonist<\/li>\n<li><strong>OSX<\/strong> \u2014 SHA-256 Hash PlatformUUID-st<\/li>\n<li><strong>Linux<\/strong> \u2014 SHA-256 Hash UUID root-partitsioonist.<\/li>\n<li><strong>Apple iOS<\/strong> \u2014 SHA-256 Hash PlatformUUID-st<\/li>\n<li><strong>Android<\/strong> \u2013 Vaata dokumenti <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/security\/vpn_client\/anyconnect\/anyconnect40\/administration\/guide\/b_AnyConnect_Administrator_Guide_4-0\/b_AnyConnect_Administrator_Guide_4-0_chapter_01010.html#reference_C87ADD1C58F64EF8928D921323209AA6\">lingil<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<p>Seega koostame skripti meie korporatiivsete Windows operatsioonis\u00fcsteemide jaoks, millega arvutame UDID-d kohalike sisendite p\u00f5hjal ja vormistame sertifikaadi taotluse, sisestades vajalikku v\u00e4ljasse selle UDID, muide, saab ka masinate sertifikaati, mille on andnud AD (lisades skeemile topeltautentimise sertifikaadi kaudu <strong>Multiple Certificate<\/strong>). <\/p>\n<p><\/p>\n<p><strong>Valmistame ette seadistused Cisco ASA poolt:<\/strong><\/p>\n<p><\/p>\n<p>Loome TrustPoint ISE CA serverile, just tema v\u00e4ljastab sertifikaate klientidele. Key-Chain'i importimise protseduuri ei k\u00e4sitle, n\u00e4ide on kirjas minu seadistuse artiklis <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing klastrist.<\/a><\/noindex>. <\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">crypto ca trustpoint ISE-CA\n enrollment terminal\n crl configure<\/code><\/pre>\n<p><\/p>\n<p>Seame Tunnel-Group'i jaotuse seoses autentimise reeglitega, mis p\u00f5hinevad sertifikaadi v\u00e4ljadega. Samuti seadistame siin AnyConnect'i profiili, mille me eelmisel etapil l\u00f5ime. Joonistan t\u00e4helepanu sellele, et kasutan v\u00e4\u00e4rtust <strong>SECUREBANK-RA<\/strong>, sertifikaadiga kasutajate \u00fcleviimiseks tunneligruppi <strong>SECURE-BANK-VPN<\/strong>, palun pange t\u00e4hele, et see v\u00e4li on minu AnyConnect'i profiili sertifikaadi taotluse veerus.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">tunnel-group-map enable rules\n!\ncrypto ca certificate map OU-Map 6\n subject-name attr ou eq securebank-ra\n!\nwebvpn\n anyconnect profiles SECUREBANK disk0:\/securebank.xml\n certificate-group-map OU-Map 6 SECURE-BANK-VPN\n!<\/code><\/pre>\n<p><\/p>\n<p>Seame autentimise serverid. Minu puhul on see ISE esimese autentimise etapi jaoks ja DUO (Radius Proxy) kui MFA.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">! CISCO ISE\naaa-server ISE protocol radius\n authorize-only\n interim-accounting-update periodic 24\n dynamic-authorization\naaa-server ISE (inside) host 192.168.99.134\n key *****\n!\n! DUO RADIUS PROXY\naaa-server DUO protocol radius\naaa-server DUO (inside) host 192.168.99.136\n timeout 60\n key *****\n authentication-port 1812\n accounting-port 1813\n no mschapv2-capable\n!<\/code><\/pre>\n<p><\/p>\n<p>Loome grupipoliitika ja tunneligrupid ning nende abikomponendid:<\/p>\n<p><\/p>\n<p>Tunneligrupp <strong>DefaultWEBVPNGroup<\/strong> kasutatakse peamiselt AnyConnect VPN kliendi allalaadimiseks ja kasutaja sertifikaadi v\u00e4ljastamiseks, kasutades ASA SCEP-Proxy funktsiooni. Selleks on meil aktiveeritud vastavad valikud nii tunneligrupis kui ka seotud grupipoliitikas. <strong>AC-Download<\/strong>, samuti AnyConnecti allalaaditavas profiilis (sertifikaadi v\u00e4ljastamise v\u00e4ljad jne). Samuti m\u00e4\u00e4rame selles grupipoliitikas allalaadimise vajaduse. <strong>ISE Posture Module<\/strong>.<\/p>\n<p><\/p>\n<p>Tunneligrupp <strong>SECURE-BANK-VPN<\/strong> kasutatakse automaatselt kliendi poolt autentimise k\u00e4igus v\u00e4ljastatud sertifikaadi alusel eelneval etapil, kuna Sertifikaadi Kaardiga vastavuses langeb \u00fchendus just sellele tunneligruppile. R\u00e4\u00e4gin siit huvitavatest valikutest:<\/p>\n<p><\/p>\n<ul>\n<li><strong>secondary-authentication-server-group DUO<\/strong> # \u0417\u0430\u0434\u0430\u0435\u043c \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO (Radius Proxy)<\/li>\n<li><strong>username-from-certificate CN<\/strong> # \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0435 CN \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043b\u043e\u0433\u0438\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f<\/li>\n<li><strong>secondary-username-from-certificate I<\/strong> # \u0414\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u043d\u043e\u0435 \u0438 \u043f\u043e\u043b\u044f Initials (I) \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430.<\/li>\n<li><strong>pre-fill-username client<\/strong> # \u0434\u0435\u043b\u0430\u0435\u043c \u043f\u0440\u0435\u0434\u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u043e\u043a\u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f<\/li>\n<li><strong>secondary-pre-fill-username client hide use-common-password push<\/strong> # \u041f\u0440\u044f\u0447\u0435\u043c \u043e\u043a\u043d\u043e \u0432\u0432\u043e\u0434\u0430 \u043b\u043e\u0433\u0438\u043d\u0430\/\u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 DUO \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u043e\u043b\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u043c\u0435\u0442\u043e\u0434 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f (sms\/push\/phone) \u2013 \u0434\u043e\u043a\u0430 <noindex><a rel=\"nofollow\" href=\"https:\/\/duo.com\/docs\/ciscoasa-radius\">siit<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">!\naccess-list posture-redirect extended permit tcp any host 72.163.1.80 \naccess-list posture-redirect extended deny ip any any\n!\naccess-list VPN-Filter extended permit ip any any\n!\nip local pool vpn-pool 192.168.100.33-192.168.100.63 mask 255.255.255.224\n!\ngroup-policy SECURE-BANK-VPN internal\ngroup-policy SECURE-BANK-VPN attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ngroup-policy AC-DOWNLOAD internal\ngroup-policy AC-DOWNLOAD attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n scep-forwarding-url value http:\/\/ise.ashes.cc:9090\/auth\/caservice\/pkiclient.exe\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ntunnel-group DefaultWEBVPNGroup general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n accounting-server-group ISE\n default-group-policy AC-DOWNLOAD\n scep-enrollment enable\ntunnel-group DefaultWEBVPNGroup webvpn-attributes\n authentication aaa certificate\n!\ntunnel-group SECURE-BANK-VPN type remote-access\ntunnel-group SECURE-BANK-VPN general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n secondary-authentication-server-group DUO\n accounting-server-group ISE\n default-group-policy SECURE-BANK-VPN\n username-from-certificate CN\n secondary-username-from-certificate I\ntunnel-group SECURE-BANK-VPN webvpn-attributes\n authentication aaa certificate\n pre-fill-username client\n secondary-pre-fill-username client hide use-common-password push\n group-alias SECURE-BANK-VPN enable\n dns-group ASHES-DNS\n!<\/code><\/pre>\n<p><\/p>\n<p><strong>J\u00e4tkame ISE-ga:<\/strong><\/p>\n<p><\/p>\n<p>Seame \u00fcles kohaliku kasutaja (kasutada saab ka AD\/LDAP\/ODBC jne), lihtsuse huvides tegin ma kohaliku kasutaja otse ISE-s ja m\u00e4\u00e4rasin v\u00e4lja <strong>kirjeldus<\/strong> <strong>PC UDID<\/strong> mille kaudu on tal lubatud VPN-i siseneda. Kui ISE-s kasutatakse kohalikku autentimist, piirduksin ainult \u00fche seadmega, kuna v\u00e4ljal ei ole nii palju kohti, kuid kolmandate osapoolte autentimisbaasides ei oleks mul selliseid piiranguid.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/ea73d4bab6c0872f7c3aef4ad1345b12.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Vaadakem autoriseerimise poliitikat, see jaguneb neljaks \u00fchenduse etapiks:<\/p>\n<p><\/p>\n<ul>\n<li><strong>Etapp 1<\/strong> \u2014 Poliitika AnyConnecti agendi allalaadimiseks ja sertifikaadi v\u00e4ljastamiseks<\/li>\n<li><strong>Etapp 2<\/strong> \u2014 Esmase autentimise poliitika Kasutajanimi (sertifikaadist)\/Parool + Sertifikaat UDID valideerimisega<\/li>\n<li><strong>Etapp 3<\/strong> \u2014 Teise valmisoleku autentimine Cisco DUO (MFA) kaudu, kasutades UDID-d kasutajanime ja oleku hindamist<\/li>\n<li><strong>Etapp 4<\/strong> \u2014 L\u00f5plik autoriseerimine olekus:\n<ul>\n<li>Vastav;<\/li>\n<li>UDID valideerimisega (sertifikaadist + logimise seondamine), <\/li>\n<li>Cisco DUO MFA;<\/li>\n<li>Logimise autentimine; <\/li>\n<li>Sertifikaadi autentimine;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/f0927091b896dc1e8b7fde35f9ff9211.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Vaadakem huvitavat tingimust <strong>UUID_VALIDATED<\/strong>, see vaatab, et autentimise alustanud kasutaja tuleb t\u00f5epoolest arvutist, millel on lubatud UDID seondatud v\u00e4ljaga <strong>Kirjeldus<\/strong> kasutajakontole, tingimus n\u00e4eb v\u00e4lja j\u00e4rgmiselt:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/73952c705b376246f8b2fb9de883302b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Autoriseerimisprofiil, mida kasutatakse etappides 1, 2 ja 3, n\u00e4eb v\u00e4lja j\u00e4rgmine:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/4b1eb6688a5a42d74b587424b02624e1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Kuidas t\u00e4pselt UDID klient AnyConnectilt meieni j\u00f5uab, saab vaadata ISE kliendi seansi detailidelt. Detailides n\u00e4eme, et AnyConnect saadab teabe kaudu <strong>ACIDEX<\/strong> \u00fctleb mitte ainult platvormi andmeid, vaid ka seadme UDID-d kui <strong>Cisco-AV-PAIR<\/strong>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/34859d3b6a5edb448999eaec49c59669.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>J\u00e4tame t\u00e4helepanu v\u00e4lja antud kasutaja sertifikaadile ja v\u00e4ljale <strong>Initials (I)<\/strong>, mida kasutatakse kasutajanime saamiseks teise taseme autentimiseks MFA-l Cisco DUO:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/ac5928db33e5dbbb1bd7e2190da6d9fa.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>DUO Radius Proxy poolel n\u00e4eme logis selgelt, kuidas p\u00e4ring autentimist k\u00e4sitletakse, see toimub UDID kasutajanime kasutamisel:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/791f5470115460dc4d920096e79dde0f.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>DUO portaali k\u00fcljest n\u00e4eme \u00f5nnestunud autentimise s\u00fcndmust:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/a31e31c57ad8b6e4ba021f3da7eedb7e.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Ja kasutaja omadustes on mul seadistatud <strong>ALIAS<\/strong>, mida ma kasutasin logimise jaoks, see on UDID lubatud logiva arvuti jaoks:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"K\u00f5rge turvalisusega kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/4035937749d1b85bad291aa4ec407352.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>Tulemuseks on:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Kasutaja ja seadme mitmeastmeline autentimine;<\/li>\n<li>Kaitse kasutaja seadme valevahetuse eest;<\/li>\n<li>Seadme oleku hindamine;<\/li>\n<li>Potentsiaal domeeni masina sertifikaadi kontrolli tugevdamiseks jne;<\/li>\n<li>Kaupade kompleksne kaitse kaug t\u00f6\u00f6kohtadele automaatselt juurutatavate turvamoodulitega;<\/li>\n<\/ul>\n<p><\/p>\n<p>Artiklite lingid Cisco VPN seeriasse:<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">ASA VPN Load-Balancing klastrite juurutamine<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493774\/\">Pilveteenuste optimeerimine AnyConnect VPN tunnelis Cisco ASA peal<\/a><\/noindex><\/li>\n<\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/497618\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e); [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 K\u00f5rgelt kaitstud kaugjuurdep\u00e4\u00e4su kontseptsiooni rakendamine | ProHoster","description":"J\u00e4tkates Remote-Access VPN juurutamise teema artiklite seeriat, ei saa ma jagamata j\u00e4tta huvitavat kogemust k\u00f5rgelt kaitstud VPN konfiguratsiooni juurutamisel.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-17T23:42:36+00:00","article:modified_time":"2020-04-17T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:02:45","updated":"2022-09-29 00:42:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/78242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=78242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/78242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/78243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=78242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=78242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=78242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}