{"id":78242,"date":"2020-04-18T01:42:36","date_gmt":"2020-04-17T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa"},"modified":"2020-04-18T01:42:36","modified_gmt":"2020-04-17T23:42:36","slug":"realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","title":{"rendered":"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>J\u00e4tkame artiklite seeriat organisatsiooni teemal <strong>Remote-Access VPN<\/strong> juurdep\u00e4\u00e4sest ei saa ma mitte jagada huvitavat kogemust rakendamisest <strong>kaitsev\u00e4\u00e4rsest VPN konfiguratsioonist<\/strong>. \u00dcks tellija (Venemaa k\u00fclades leidub leiutajaid) viskas keerulise \u00fclesande, kuid Challenge Accepted ja loominguliselt teostatud. Tulemuseks sai huvitav kontseptsioon j\u00e4rgmiste omadustega:<\/p>\n<p><\/p>\n<ol>\n<li>Mitmed kaitsemeetmed, et v\u00e4ltida l\u00f5ppseadmestiku petmist (tihe sidumine kasutajaga);\n<ul>\n<li>Kasutaja PC vastavuse hindamine m\u00e4\u00e4ratud UDID lubatud PC-ga autentimisteabes; <\/li>\n<li>MFA-ga, mis kasutab sertifikaadist UDID-d teise autentimise jaoks Cisco DUO kaudu <em>(V\u00f5imalik on lisada iga SAML\/RADIUS \u00fchilduva variandi)<\/em>; <\/li>\n<\/ul>\n<\/li>\n<li>Mitme teguri autentimine: \n<ul>\n<li>Kasutaja sertifikaat koos v\u00e4ljade ja nende alusel teise autentimise kontrollimisega;<\/li>\n<li>Kasutajanimi (muutmatu, v\u00f5etud sertifikaadist) ja parool;<\/li>\n<\/ul>\n<\/li>\n<li>\u00dchendava hosti oleku hindamine (Posture)<\/li>\n<\/ol>\n<p><\/p>\n<p><strong>Kasutatavad lahenduse komponendid:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Cisco ASA (VPN v\u00e4rav);<\/li>\n<li>Cisco ISE (Autentimine \/ Autoriseerimine \/ Arvepidamine, Oleku hindamine, CA);<\/li>\n<li>Cisco DUO (Mitmekordne autentimine) <em>(V\u00f5imalik on lisada iga SAML\/RADIUS \u00fchilduva variandi)<\/em>;<\/li>\n<li>Cisco AnyConnect (Mugandatud agent lauaarvutitele ja mobiilsetele OS-idele);<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p><strong>Alustame klientide n\u00f5uetest:<\/strong><\/p>\n<p><\/p>\n<ol>\n<li>Kasutaja peab saama oma autentimise sisselogimise\/parooli abil alla laadida AnyConnecti kliendi VPN-l\u00fc\u00fcsist, k\u00f5ik vajalikud AnyConnecti moodulid peavad automaatselt olema installitud vastavalt kasutaja poliitikale;<\/li>\n<li>Kasutajal peaks olema v\u00f5imalus automaatseks sertifikaadi v\u00e4ljastamiseks (\u00fche stsenaariumi jaoks, p\u00f5hiline stsenaarium on k\u00e4sitsi v\u00e4ljastamine ja arvutisse laadimine), mina olen realiseerinud automaatse v\u00e4ljastamise demonstreerimiseks (hiljem eemaldamine pole kunagi hilja).<\/li>\n<li>P\u00f5hi autentimine peaks toimuma mitmes etapis, esmalt toimub sertifikaadi autentimine koos vajalike v\u00e4ljade ja nende v\u00e4\u00e4rtuste anal\u00fc\u00fcsiga, seej\u00e4rel sisselogimine\/parool, kuid seekord peab sisselogimise aknasse olema sisestatud kasutajanimi, mis on m\u00e4rgitud sertifikaadi v\u00e4ljal. <strong>Teema nimi (CN)<\/strong> ilma redigeerimisv\u00f5imaluseta.<\/li>\n<li>On oluline veenduda, et seade, millelt sisenetakse, on ettev\u00f5tte kaugt\u00f6\u00f6l kasutajale antud s\u00fclearvuti, mitte midagi muud. (On loodud mitu varianti selle n\u00f5ude t\u00e4itmiseks)<\/li>\n<li>Peab toimuma \u00fchendatud seadme (selle etapi juhul PC) seisundi hindamine, kontrollides tellija n\u00f5uete terviklikku tervet tabelit (\u00fcldistatult):\n<ul>\n<li>Failid ja nende omadused;<\/li>\n<li>Registrikirjed;<\/li>\n<li>Tarkvarauuendused etten\u00e4htud loendist (hiljem SCCM integratsioon);<\/li>\n<li>Teatud tootja viiruset\u00f5rje olemasolu ja allkirjade ajakohasus;<\/li>\n<li>Teatud teenuste aktiivsus;<\/li>\n<li>Teatud installitud programmide olemasolu;<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/p>\n<p>Alustuseks soovitan kindlasti vaadata videoesitlust saavutatud rakendusest <strong>Youtube'is (5 minutit)<\/strong>.<\/p>\n<p>\n<center><div class=\"youtube-placeholder\" data-id=\"cBftD3KFK98\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/cBftD3KFK98\/hqdefault.jpg\" alt=\"Vaata videot\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>N\u00fc\u00fcd soovitan arutada rakenduse detaile, mis videos kajastamata j\u00e4id.<\/p>\n<p><\/p>\n<p><strong>Valmistame ette AnyConnect'i profiili:<\/strong><\/p>\n<p><\/p>\n<p>Profiili loomise n\u00e4ide (ASDM men\u00fc\u00fcpunkti osas) on varem toodud minu artiklis <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing klastrist<\/a><\/noindex>. Praegu tahan eraldi m\u00e4rkida need valikud, mida meil vaja on:<\/p>\n<p><\/p>\n<p>Profiilis n\u00e4itame VPN-i v\u00e4ravat ja \u00fchenduse profiili nime l\u00f5ppkasutaja seadmes:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/45ff3cb1f7b592e102bd6e256ae26043.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Seame profiili automaatse sertifikaadi v\u00e4ljastamise parameetrid, p\u00f6\u00f6rates t\u00e4helepanu eelk\u00f5ige j\u00e4rgmisele <strong>Initsiaalid (I)<\/strong>, kus on k\u00e4sitsi sisestatud konkreetne v\u00e4\u00e4rtus <strong>UDID<\/strong> testmasina (Unikaalne seadme identifikaator, mille genereerib Cisco AnyConnect klient).<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/89d4edb4f1b166eda75916286998a4bf.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Siin soovin teha emotsionaalset k\u00f5rvalep\u00f5iget, kuna see artikkel kirjeldab kontseptsiooni. Demonstreerimise eesm\u00e4rgil on siin UDID sisestatud AnyConnect profiili Initsiaalide v\u00e4ljale. Loomulikult, kui te praktikas nii teete, saavad k\u00f5ik kliendid sertifikaadi sama UDID-iga, mis t\u00e4hendab, et nende jaoks ei toimi see, kuna nad vajavad UDID-d oma isikliku arvuti jaoks. Kahjuks ei toeta AnyConnect veel sertifikaadi probleemi UDID v\u00e4ljale asendust keskkonnamuutuja kaudu, nagu ta teeb n\u00e4iteks muutuja <strong>%USER%<\/strong>.<\/p>\n<p><\/p>\n<p>On tasub m\u00e4rkida, et tellija (antud stsenaariumi puhul) plaanib algselt sertifikaate iseseisvalt manuaalselt v\u00e4lja anda m\u00e4\u00e4ratud UDID-dega kaitstud arvutitele, mis ei ole tema jaoks probleem. Siiski, enamik meist soovib automatiseerimist (no v\u00e4hemalt mina k\u00fcll =)). <\/p>\n<p><\/p>\n<p>Ja siin on, mida ma automatiseerimise osas pakkuda saan. Kui automaatselt sertifikaati v\u00e4lja kirjutada, on AnyConnecti kaudu UDID-i d\u00fcnaamiline sisestamine praegu v\u00e4ljaspool v\u00f5imaluste piire, siis on ka teine meetod, mis vajab veidi loomingulist m\u00f5tlemist ja oskuslikke k\u00e4si \u2013 r\u00e4\u00e4gin kontseptsioonist. Alustuseks vaadakem, kuidas UDID erinevate operatsioonis\u00fcsteemide AnyConnecti agenti abil formuleeritakse: <\/p>\n<p><\/p>\n<ul>\n<li><strong>Windows<\/strong> \u2014 SHA-256 registri DigitalProductID ja Machine SID kombinatsiooni r\u00e4si<\/li>\n<li><strong>OSX<\/strong> \u2014 SHA-256 PlatformUUID r\u00e4si<\/li>\n<li><strong>Linux<\/strong> \u2014 SHA-256 l\u00e4htepartitsiooni UUID r\u00e4si.<\/li>\n<li><strong>Apple iOS<\/strong> \u2014 SHA-256 PlatformUUID r\u00e4si<\/li>\n<li><strong>Android<\/strong> \u2013 Vaata dokumenti <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/security\/vpn_client\/anyconnect\/anyconnect40\/administration\/guide\/b_AnyConnect_Administrator_Guide_4-0\/b_AnyConnect_Administrator_Guide_4-0_chapter_01010.html#reference_C87ADD1C58F64EF8928D921323209AA6\">lingi kaudu<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<p>Seet\u00f5ttu valmistame meie ettev\u00f5tte Windowsi operatsioonis\u00fcsteemide jaoks skripti, millega arvutame UDID-i teadaolevate sisendiandmete p\u00f5hjal ja koostame sertifikaadi v\u00e4ljastamise taotluse, sisestades vajalikku v\u00e4ljakusse selle UDID-i, muide, see t\u00f6\u00f6tab ka AD v\u00e4lja antud masina sertifikaadiga (lisades skeemile kahekordse autentimise sertifikaadi j\u00e4rgi <strong>Multiple Certificate<\/strong>). <\/p>\n<p><\/p>\n<p><strong>Seame Cisco ASA seadistused valmis:<\/strong><\/p>\n<p><\/p>\n<p>Loome TrustPoint'i ISE CA serverile, mis v\u00e4lja annab sertifikaadid klientidele. Key-Chaini impordi protseduuri ei k\u00e4sitle, n\u00e4ide on kirjas minu seadistamise artiklis. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing klastrist<\/a><\/noindex>. <\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">crypto ca trustpoint ISE-CA\n enrollment terminal\n crl configure<\/code><\/pre>\n<p><\/p>\n<p>Seame Tunnel-Group'i jagamise vastavalt sertifikaadile tehtud autentimise reeglitele. Samuti seadistame siin AnyConnect'i profiili, mille valmistasime eelmisel etapil. Tahan juhtida t\u00e4helepanu, et kasutan v\u00e4\u00e4rtust <strong>SECUREBANK-RA<\/strong>, et suunata kasutajad, kellel on antud sertifikaat, tunneli gruppi <strong>SECURE-BANK-VPN<\/strong>, m\u00e4rkige, et see v\u00e4li on mul m\u00e4\u00e4ratud AnyConnect'i profiili sertifikaadi taotlemise veerus.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">tunnel-group-map enable rules\n!\ncrypto ca certificate map OU-Map 6\n subject-name attr ou eq securebank-ra\n!\nwebvpn\n anyconnect profiles SECUREBANK disk0:\/securebank.xml\n certificate-group-map OU-Map 6 SECURE-BANK-VPN\n!<\/code><\/pre>\n<p><\/p>\n<p>Seame autoriseerimisserverid. Minu juhul on see ISE esimeses autentimise etapis ja DUO (Radius Proxy) kui MFA.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">! CISCO ISE\naaa-server ISE protokoll radius\n authorize-only\n interim-accounting-update perioodiliselt 24\n d\u00fcnaamiline-autasustamine\naaa-server ISE (sisev\u00f5rk) host 192.168.99.134\n v\u00f5ti *****\n!\n! DUO RADIUS PROXY\naaa-server DUO protokoll radius\naaa-server DUO (sisev\u00f5rk) host 192.168.99.136\n timeout 60\n v\u00f5ti *****\n autentimisport 1812\n arveldamisport 1813\n ei mschapv2-toetav\n!<\/code><\/pre>\n<p><\/p>\n<p>Loo grupipoliitika ja tunneligrupp koos nende abikomponendidega:<\/p>\n<p><\/p>\n<p>Tunneligrupp <strong>DefaultWEBVPNGroup<\/strong> kasutatakse peamiselt AnyConnect VPN kliendi allalaadimiseks ja kasutajate sertifikaadi v\u00e4ljastamiseks, kasutades SCEP-Proxy funktsiooni ASA-s, selle jaoks on aktiveeritud vastavad valikud nii tunneligruppis kui ka seostatavas grupipoliitikas <strong>AC-Download<\/strong>, samuti allalaaditaval AnyConnect profiilil (sertifikaadi v\u00e4ljastamise alad jne). Samuti m\u00e4\u00e4rame selles grupipoliitikas vajaduse allalaadimiseks <strong>ISE Posture Module<\/strong>.<\/p>\n<p><\/p>\n<p>Tunneligrupp <strong>SECURE-BANK-VPN<\/strong> kasutatakse automaatselt kliendi poolt autentimise ajal, mille sertifikaat oli v\u00e4ljastatud eelnevas etapis, kuna Sertifikaadi Kaarti j\u00e4rgides l\u00e4heb \u00fchendus just sellele tunneligruppile. R\u00e4\u00e4gin siit huvitavatest valikutest:<\/p>\n<p><\/p>\n<ul>\n<li><strong>secondary-authentication-server-group DUO<\/strong> # \u0417\u0430\u0434\u0430\u0435\u043c \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO (Radius Proxy)<\/li>\n<li><strong>username-from-certificate CN<\/strong> # \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0435 CN \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043b\u043e\u0433\u0438\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f<\/li>\n<li><strong>secondary-username-from-certificate I<\/strong> # \u0414\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u043d\u043e\u0435 \u0438 \u043f\u043e\u043b\u044f Initials (I) \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430.<\/li>\n<li><strong>pre-fill-username client<\/strong> # \u0434\u0435\u043b\u0430\u0435\u043c \u043f\u0440\u0435\u0434\u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u043e\u043a\u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f<\/li>\n<li><strong>secondary-pre-fill-username client hide use-common-password push<\/strong> # \u041f\u0440\u044f\u0447\u0435\u043c \u043e\u043a\u043d\u043e \u0432\u0432\u043e\u0434\u0430 \u043b\u043e\u0433\u0438\u043d\u0430\/\u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 DUO \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u043e\u043b\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u043c\u0435\u0442\u043e\u0434 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f (sms\/push\/phone) \u2013 \u0434\u043e\u043a\u0430 <noindex><a rel=\"nofollow\" href=\"https:\/\/duo.com\/docs\/ciscoasa-radius\">siin<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">!\naccess-list posture-redirect extended permit tcp any host 72.163.1.80 \naccess-list posture-redirect extended deny ip any any\n!\naccess-list VPN-Filter extended permit ip any any\n!\nip local pool vpn-pool 192.168.100.33-192.168.100.63 mask 255.255.255.224\n!\ngroup-policy SECURE-BANK-VPN internal\ngroup-policy SECURE-BANK-VPN attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ngroup-policy AC-DOWNLOAD internal\ngroup-policy AC-DOWNLOAD attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n scep-forwarding-url value http:\/\/ise.ashes.cc:9090\/auth\/caservice\/pkiclient.exe\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ntunnel-group DefaultWEBVPNGroup general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n accounting-server-group ISE\n default-group-policy AC-DOWNLOAD\n scep-enrollment enable\ntunnel-group DefaultWEBVPNGroup webvpn-attributes\n authentication aaa certificate\n!\ntunnel-group SECURE-BANK-VPN type remote-access\ntunnel-group SECURE-BANK-VPN general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n secondary-authentication-server-group DUO\n accounting-server-group ISE\n default-group-policy SECURE-BANK-VPN\n username-from-certificate CN\n secondary-username-from-certificate I\ntunnel-group SECURE-BANK-VPN webvpn-attributes\n authentication aaa certificate\n pre-fill-username client\n secondary-pre-fill-username client hide use-common-password push\n group-alias SECURE-BANK-VPN enable\n dns-group ASHES-DNS\n!<\/code><\/pre>\n<p><\/p>\n<p><strong>Edasi liikudes ISE juurde:<\/strong><\/p>\n<p><\/p>\n<p>Seadistame kohaliku kasutaja (v\u00f5ib kasutada ka AD\/LDAP\/ODBC jne), lihtsuse huvides l\u00f5in kohaliku kasutaja otse ISE-s ja m\u00e4\u00e4rasin v\u00e4lja. <strong>description<\/strong> <strong>PC UDID<\/strong> mille kaudu on tal lubatud VPN-i sisse logida. Kui ma kasutan ISE-s kohalikke autentimise meetodeid, olen ma piiratud ainult \u00fche seadmega, kuna v\u00e4ljade arv on piiratud, kuid kolmandate osapoolte autentimisdatal (nt AD) sellised piirangud puuduvad.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/ea73d4bab6c0872f7c3aef4ad1345b12.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Vaatame autoriseerimise poliitikat, see on jagatud neljaks \u00fchenduse etapiks:<\/p>\n<p><\/p>\n<ul>\n<li><strong>Etapp 1<\/strong> \u2014 Poliitika AnyConnecti agendi allalaadimiseks ja sertifikaadi v\u00e4ljastamiseks<\/li>\n<li><strong>Etapp 2<\/strong> \u2014 Esmane autentimine Logi sisse (sertifikaadist) \/ Parool + Sertifikaat UDID valideerimisega<\/li>\n<li><strong>Etapp 3<\/strong> \u2014 Teisene autentimine Cisco DUO (MFA) kaudu UDID kui kasutajanime + Oleku hindamine<\/li>\n<li><strong>Etapp 4<\/strong> \u2014 L\u00f5plik autoriseerimine seisundis:\n<ul>\n<li>Kohandatud;<\/li>\n<li>UDID valideerimisega (sertifikaadist + seondus logimisega), <\/li>\n<li>Cisco DUO MFA;<\/li>\n<li>Autentimine sisselogimise kaudu; <\/li>\n<li>Autentimine sertifikaadi kaudu;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/f0927091b896dc1e8b7fde35f9ff9211.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Vaatame huvitavat tingimust <strong>UUID_VALIDATED<\/strong>, see kontrollib, et autentitud kasutaja on t\u00f5epoolest tulnud seadmega, millel on lubatud UDID. <strong>Kirjeldus<\/strong> kasutajakonto, tingimused on j\u00e4rgmised:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/73952c705b376246f8b2fb9de883302b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Autoriseerimisprofiil, mida kasutatakse 1,2,3 etappidel, n\u00e4eb v\u00e4lja j\u00e4rgnev:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/4b1eb6688a5a42d74b587424b02624e1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Kontrollida, kuidas klient AnyConnect edastab UDID, saame vaadata ISE kliendi sessiooni \u00fcksikasju. \u00dcksikasjadest n\u00e4eme, et AnyConnect edastab l\u00e4bi mehhanismi <strong>ACIDEX<\/strong> , mitte ainult platvormi andmeid, vaid ka seadme UDID nagu <strong>Cisco-AV-PAIR<\/strong>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/34859d3b6a5edb448999eaec49c59669.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>P\u00f6\u00f6rame t\u00e4helepanu kasutajale v\u00e4ljastatud sertifikaadile ja v\u00e4ljale <strong>Initsiaalid (I)<\/strong>, mis kasutatakse selleks, et kasutada seda teise taseme MFA autentimiseks Cisco DUO:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/ac5928db33e5dbbb1bd7e2190da6d9fa.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>DUO Radius Proxyl n\u00e4eme logis selgelt, kuidas autentimissoov l\u00e4heb, see toimub UDID kasutamisega kasutajanime vormis:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/791f5470115460dc4d920096e79dde0f.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>DUO portaalilt n\u00e4eme edukat autentimist:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/a31e31c57ad8b6e4ba021f3da7eedb7e.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Ja kasutaja omadustes on mul seadistatud <strong>ALIAS<\/strong>, mida ma kasutasin sisselogimiseks, see ongi UDID, mis on lubatud PC sisselogimiseks:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Kaitsev\u00e4\u00e4rse kaugjuhtimise kontseptsiooni rakendamine\" src=\"\/wp-content\/uploads\/2020\/04\/4035937749d1b85bad291aa4ec407352.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>Tulemusena saime:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Kasutaja ja seadme mitmeastmelise autentimise;<\/li>\n<li>Kaitse kasutaja seadme petmise eest;<\/li>\n<li>Seadme oleku hindamine;<\/li>\n<li>Potentsiaal \u00e4riliseks tugevdamiseks domeeni masinsertifikaadiga jne;<\/li>\n<li>T\u00e4iteline lahendus kaugt\u00f6\u00f6koha kaitseks, millel on automaatselt juurutatavad turvamo Modulid;<\/li>\n<\/ul>\n<p><\/p>\n<p>Artiklite lingid Cisco VPN seerias:<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">ASA VPN koormuse tasakaalustamise klastrite juurutamine<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493774\/\">Pilveteenuste optimeerimine AnyConnect VPN tunnelis Cisco ASA-l<\/a><\/noindex><\/li>\n<\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/497618\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e); [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e);\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e);\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47K\u00f5rge kaitseastmega kaugt\u00f6\u00f6kontseptsiooni rakendamine | ProHoster","description":"J\u00e4tkates artiklite seeriat Remote-Access VPN juurimise teemal, ei saa ma mitte jagada huvitavat kogemust k\u00f5rgelt kaitstud VPN konfiguratsiooni juurutamisest. \u00dcks tellija andis mulle mittetriviaalset \u00fclesannet (ma \u00fctlen, et Venemaa k\u00fclades on fantaasiat), aga v\u00e4ljakutse vastu v\u00f5etud ja loominguliselt ellu viidud. Tulemuseks on huvitav kontseptsioon j\u00e4rgmiste omadustega: Mitmed kaitsefaktorid l\u00f5ppseadmeliidese asendamise vastu (rangelt seotuna kasutajaga);","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e);","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-17T23:42:36+00:00","article:modified_time":"2020-04-17T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:02:45","updated":"2022-09-29 00:42:25"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/78242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=78242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/78242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/78243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=78242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=78242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=78242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}