{"id":85328,"date":"2020-06-15T01:42:33","date_gmt":"2020-06-14T23:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1"},"modified":"2020-06-15T01:42:33","modified_gmt":"2020-06-14T23:42:33","slug":"opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","title":{"rendered":"Ruutokeni tehnoloogia kasutamise kogemus registreerimisel ja kasutajate autentimisel s\u00fcsteemis (osa 1)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tere! Soovin jagada oma kogemust selle teema osas.<\/p>\n

RUTOKEN on riistvaralised ja tarkvaralised lahendused autentimise, teabe kaitse ja digitaalse allkirja vallas. Tegelikult on see selline m\u00e4lupulk, mis suudab hoida autentimisandmeid, mida kasutaja kasutab s\u00fcsteemi sisenemiseks. <\/p>\n

Selles n\u00e4ites kasutatakse RUTOKEN EDS 2.0. <\/p>\n

Selle RUTOKENiga t\u00f6\u00f6ks on vajalik installeerida draiver Windowsis<\/a><\/noindex>.<\/p>\n

Windowsis tagab \u00fcheainsa draiveri installeerimine k\u00f5ik vajaliku, et operatsioonis\u00fcsteem n\u00e4eks teie RUTOKENi ja saaks sellega t\u00f6\u00f6tada.<\/p>\n

<\/a><\/noindex> RUTOKENiga saab suhelda erinevate viisidega. Seda saab kasutada rakenduse serveripoolsest osast, kuid ka otse kliendipoolsest. Selles n\u00e4ites k\u00e4sitletakse suhtlemist RUTOKENiga rakenduse kliendipoolsest osast. <\/p>\n

Rakenduse kliendipool suhtleb RUTOKENiga l\u00e4bi RUTOKENi pistikprogrammi. See on programm, mis installeeritakse eraldi iga brauseri jaoks. Windowsis peate lihtsalt alla laadima ja installima pistikprogrammi, mis asub sellel lingil<\/a><\/noindex>.<\/p>\n

N\u00fc\u00fcd saame suhelda RUTTokeniga rakenduse kliendiosas.<\/p>\n

Antud n\u00e4ites k\u00e4sitletakse kasutaja autoriseerimisalgoritmi rakendamise ideed, kasutades v\u00e4ljakutse-vastus skeemi. <\/p>\n

Idee seisneb j\u00e4rgnevates punktides: <\/p>\n

    \n
  1. Kliendi poolel saadetakse autoriseerimistaotlus serverile.<\/li>\n
  2. Server vastab kliendi taotlusele juhusliku stringiga.<\/li>\n
  3. Kliendi pool t\u00e4iendab seda stringi juhuslike 32 bitidega.<\/li>\n
  4. Kliendil tuleb saadud string allkirjastada oma sertifikaadiga.<\/li>\n
  5. Kliendi pool saadab serverile saadud kodeeritud s\u00f5numi.<\/li>\n
  6. Server kontrollib allkiri, saades tagasi algse kodeerimata s\u00f5numi.<\/li>\n
  7. Server eraldab saadud kodeerimata s\u00f5numist viimased 32 bitti.<\/li>\n
  8. Server v\u00f5rdleb saadud tulemust algse autoriseerimistaotluses saadetud s\u00f5numiga.<\/li>\n
  9. Kui s\u00f5numid on v\u00f5rdsed, loetakse autoriseerimine edukaks.<\/li>\n<\/ol>\n

    \n\u00dclaltoodud algoritmis on m\u00f5isted nagu sertifikaat. K\u00e4esolevas n\u00e4ites on vajalik m\u00f5ista teatud kr\u00fcptograafia teooriat. Habr\u00e9 on olemas suurep\u00e4rane artikel selle teema kohta<\/a><\/noindex>.<\/p>\n

    Selles n\u00e4ites kasutame as\u00fcmmeetrilisi kr\u00fcptimise algoritme. As\u00fcmmeetriliste algoritmide rakendamiseks on vajalik omada v\u00f5tmepaari ja sertifikaati. <\/p>\n

    V\u00f5tmepaar koosneb kahest osast: privaatsest v\u00f5tmeta ja avalikust v\u00f5tmeta. Privaatsed v\u00f5tmed, nagu nimi viitab, peavad olema salajased. Me kasutame seda teabe dekr\u00fcpteerimiseks. Avalikku v\u00f5tme saab jagada igasuguste inimestega. Selle v\u00f5tme abil \u0161ifreeritakse andmed. Seega saavad k\u00f5ik kasutajad andmeid \u0161ifreerida, kasutades avalikku v\u00f5tme, kuid ainult privaatsuse omanik saab neid andmeid dekr\u00fcpteerida. <\/p>\n

    Sertifikaat on elektrooniline dokument, mis sisaldab teavet sertifikaadi omaniku kohta ja samuti avalikku v\u00f5tmeta. Sertifikaadiga saab kasutaja allkirjastada mis tahes andmeid ja saata need serverisse, mis saab kontrollida sellist allkirja ja dekr\u00fcpteerida andmed.<\/p>\n

    Sertifikaadi \u00f5igeks allkirjastamiseks tuleb see \u00f5igesti luua. Selleks luuakse RutoKenis esmalt v\u00f5tmepaar ja seej\u00e4rel peab sertifikaat olema seotud selle v\u00f5tmepaari avaliku v\u00f5tmega. Sertifikaat peab sisaldama just seda avalikku v\u00f5tmega, mis asub RutoKenis, mis on oluline. Kui me lihtsalt loome v\u00f5tmepaari ja sertifikaadi otse kliendiosa rakenduses, siis kuidas suudab server p\u00e4rast \u0161ifreeritud s\u00f5numit lahti m\u00f5testada? Sest ta ei tea midagi ei v\u00f5tmepaari ega sertifikaadi kohta. <\/p>\n

    Kui sukelduda s\u00fcgavamale sellesse teema, v\u00f5ib leida huvitavat teavet internetist. Eksisteerivad teatavad tunnustuskeskused, kellele me eelnevalt usaldame. Need tunnustuskeskused saavad v\u00e4lja anda sertifikaate kasutajatele, kes paigutavad need sertifikaadid oma serverisse. P\u00e4rast seda, kui klient p\u00f6\u00f6rdub selle serveri poole, n\u00e4eb ta seda sama sertifikaati ja m\u00e4rgib, et see on v\u00e4lja antud tunnustuskeskuse poolt, seega on sellele serverile v\u00f5imalik usaldada. Detailse teabe saamiseks selle \u00f5igeks seadistamiseks on internetis ka palju teavet. N\u00e4iteks v\u00f5ib alustada sellest<\/a><\/noindex>.<\/p>\n

    Kui naasta meie \u00fclesande juurde, siis lahendus n\u00e4ib olevat ilmne. Tuleb leida viis, kuidas luua oma sertifitseerimiskeskus. Kuid enne seda on vaja selgitada, millise alusel sertifitseerimiskeskus peaks kasutajale sertifikaati v\u00e4ljastama, kuna ta ei tea temast midagi. (N\u00e4iteks tema ees- ja perekonnanimi jms.) On olemas asi, mida nimetatakse sertifikaaditaotluseks. T\u00e4iendavateks detailideks selle standardi kohta v\u00f5id vaadata n\u00e4iteks vikipeediast ru.wikipedia.org\/wiki\/PKCS<\/a><\/noindex>
    \nKasutame versiooni 1.7 \u2014 PKCS#10.<\/p>\n

    Kuna kirjeldame sertifikaadi moodustamise algoritmi RUTokenil (algallikas \u2014 dokumentatsioon<\/a><\/noindex>):<\/p>\n

      \n
    1. Loo kliendi poolel v\u00f5tmepaar ja salvesta see RUTokenisse. (salvestamine toimub automaatselt)<\/li>\n
    2. Kliendi poolel loo sertifikaaditaotlus.<\/li>\n
    3. Saada see taotlus serverisse.<\/li>\n
    4. Serveris sertifikaadi taotluse saamisel v\u00e4ljastame sertifikaadi oma sertifitseerimiskeskuse kaudu.<\/li>\n
    5. Saada see sertifikaat kliendile.<\/li>\n
    6. Salvesta sertifikaat kliendi RUTokenisse.<\/li>\n
    7. Sertifikaat peab olema seotud selle v\u00f5tmepaariga, mis loodi esimeses etapis.<\/li>\n<\/ol>\n

      \nN\u00fc\u00fcd on selge, kuidas server saab kliendi allkirja de\u0161ifreerida, kuna see on ise v\u00e4lja andnud sertifikaadi. <\/p>\n

      J\u00e4rgmises osas arutame p\u00f5hjalikult, kuidas seadistada oma sertifitseerimiskeskust avatud l\u00e4htekoodiga kr\u00fcptograafilise teegiga openSSL.
      \n
      Allikas:       habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c! \u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441\u0432\u043e\u0438\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u043e \u0434\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u043c\u0435. \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u2014 \u044d\u0442\u043e \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0449\u0438\u0442\u044b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438. \u041f\u043e \u0441\u0443\u0442\u0438 \u044d\u0442\u043e \u0442\u0430\u043a\u0430\u044f \u0444\u043b\u0435\u0448\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0432 \u0441\u0435\u0431\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u042d\u0426\u041f 2.0. \u0414\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u044d\u0442\u0438\u043c \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85328","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u0443\u0442\u043e\u043aeni tehnoloogia kasutamise kogemus kasutajate registreerimiseks ja autoriseerimiseks s\u00fcsteemis (osa 1) | ProHoster","description":"Tere p\u00e4evast! Soovin jagada oma kogemust sellel teemal. R\u0443\u0442\u043e\u043a\u0435\u043d on riist- ja tarkvaralahendused autentimise, teabe kaitse ja \u00e4rakirjastamise valdkonnas. Tegelikult on see nagu m\u00e4lupulk, mis suudab hoida autentimisandmeid, mida kasutaja kasutab s\u00fcsteemi sisenemiseks. Antud n\u00e4ites kasutatakse R\u0443\u0442\u043e\u043a\u0435\u043d \u042d\u0426\u041f 2.0. Selle R\u0443\u0442\u043e\u043aeni kasutamiseks","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u044b\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u0434\u043b\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 (\u0447\u0430\u0441\u0442\u044c 1) | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c! \u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441\u0432\u043e\u0438\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u043e \u0434\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u043c\u0435. \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u2014 \u044d\u0442\u043e \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0449\u0438\u0442\u044b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438. \u041f\u043e \u0441\u0443\u0442\u0438 \u044d\u0442\u043e \u0442\u0430\u043a\u0430\u044f \u0444\u043b\u0435\u0448\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0432 \u0441\u0435\u0431\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u042d\u0426\u041f 2.0. \u0414\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u044d\u0442\u0438\u043c \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u043e\u043c","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-14T23:42:33+00:00","article:modified_time":"2020-06-14T23:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85328","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:39:25","updated":"2022-09-28 02:14:43"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85328","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=85328"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85328\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=85328"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=85328"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=85328"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}