{"id":85328,"date":"2020-06-15T01:42:33","date_gmt":"2020-06-14T23:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1"},"modified":"2020-06-15T01:42:33","modified_gmt":"2020-06-14T23:42:33","slug":"opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","title":{"rendered":"Ruutokeni tehnoloogia rakendamise kogemus kasutajate registreerimiseks ja autentimiseks s\u00fcsteemis (osa 1)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tere p\u00e4evast! Soovin jagada oma kogemust selle teema osas.<\/p>\n

R\u0443\u0442\u043e\u043a\u0435\u043d on riist- ja tarkvaralahendused autentimise, teabe kaitse ja digiallkirjastamise valdkonnas. Sisuliselt on see selline m\u00e4lupulk, mis suudab salvestada autentimisandmeid, mida kasutaja v\u00f5ib kasutada s\u00fcsteemi sisenemiseks. <\/p>\n

Antud n\u00e4ites kasutatakse R\u0443\u0442\u043e\u043a\u0435\u043d E\u0426\u041f 2.0. <\/p>\n

Selle R\u0443\u0442\u043e\u043aeni kasutamiseks on vajalik draiveri paigaldamine Windows'i s\u00fcsteemi.<\/a><\/noindex>.<\/p>\n

Windows'i puhul tagab ainult draiveri paigaldamine k\u00f5ik vajaliku, et operatsioonis\u00fcsteem tuvastaks teie R\u0443\u0442\u043e\u043a\u0435\u043d\u0438 ja sellega t\u00f6\u00f6tamine oleks v\u00f5imalik.<\/p>\n

<\/a><\/noindex> R\u0443\u0442\u043e\u043aeni saab kasutada erinevate meetoditega. Sellele v\u00f5ib ligi p\u00e4\u00e4seda rakenduse serveripoolsest osast v\u00f5i otse kliendipoolsest. Antud n\u00e4ites vaatleme R\u0443\u0442\u043e\u043aeni kasutamist rakenduse kliendipoolsest osast. <\/p>\n

Rakenduse kliendipool suhtleb R\u0443\u0442\u043e\u043aeni kaudu R\u0443\u0442\u043e\u043aeni pistikprogrammi. See on programm, mis tuleb igasse brauserisse eraldi installida. Windows'i puhul tuleb pistikprogramm lihtsalt alla laadida ja installida, mis asub sellel lingil<\/a><\/noindex>.<\/p>\n

N\u00fc\u00fcd saame R\u0443\u0442\u043e\u043aeni kasutada rakenduse kliendipoolsest osast.<\/p>\n

Antud n\u00e4ites vaatleme ideed, kuidas rakendada kasutaja autentimise algoritmi s\u00fcsteemis, kasutades v\u00e4ljakutse-vastus skeemi. <\/p>\n

Idee olemus on j\u00e4rgmine: <\/p>\n

    \n
  1. Klient saadab autentimissoovi serverisse.<\/li>\n
  2. Server saadab kliendi p\u00e4ringule vastuseks juhusliku stringi.<\/li>\n
  3. Klient t\u00e4iendab seda stringi juhuslike 32 bitidega.<\/li>\n
  4. Klient allkirjastab saadud stringi oma sertifikaadiga.<\/li>\n
  5. Klient saadab serverile saadud kooditud s\u00f5numi.<\/li>\n
  6. Server kontrollib allkirja, saades algse dekodeerimata s\u00f5numi.<\/li>\n
  7. Server eemaldab saadetud dekodeerimata s\u00f5numist viimased 32 bitti.<\/li>\n
  8. Server v\u00f5rdleb saadud tulemust sellega s\u00f5numiga, mis saadeti autentimissoovis.<\/li>\n
  9. Kui s\u00f5numid on samad, loetakse autentimine edukaks.<\/li>\n<\/ol>\n

    \n\u00dclaltoodud algoritmis on m\u00f5isted nagu sertifikaat. Antud n\u00e4ite raames tuleb m\u00f5ista teatud kr\u00fcptograafilist teooriat. Habr\u00e9 on olemas suurep\u00e4rane artikkel selle teema kohta<\/a><\/noindex>.<\/p>\n

    Selles n\u00e4ites kasutame as\u00fcmmeetrilisi kr\u00fcpteerimisalgoritme. As\u00fcmmeetriliste algoritmide rakendamiseks on vajalik omada v\u00f5tmepaari ja sertifikaati. <\/p>\n

    V\u00f5tmepaar koosneb kahest osast: privaatv\u00f5ti ja avalik v\u00f5ti. Privaatv\u00f5ti peab olema salajane, nagu tema nimi \u00fctleb. Kasutame seda teabe dekr\u00fcpteerimiseks. Avalikku v\u00f5tit saab jagada kellelegi. See v\u00f5ti on m\u00f5eldud andmete kr\u00fcpteerimiseks. Nii saab iga kasutaja andmeid kr\u00fcpteerida, kasutades avalikku v\u00f5tit, kuid ainult privaatv\u00f5tme omanik v\u00f5ib seda teavet dekr\u00fcpteerida. <\/p>\n

    Sertifikaat on digitaalne dokument, mis sisaldab teavet kasutaja kohta, kellele sertifikaat kuulub, samuti avalikku v\u00f5tit. Sertifikaadi omamine v\u00f5imaldab kasutajal mis tahes andmeid allkirjastada ja saata need serverisse, mis saab selle allkirja kontrollida ja andmed dekr\u00fcpteerida.<\/p>\n

    Et s\u00f5numit sertifikaadiga \u00f5igesti allkirjastada, tuleb see \u00f5igesti luua. Selleks luuakse k\u00f5igepealt Ruutokenis v\u00f5tmepaar ja seej\u00e4rel tuleb sertifikaat siduda selle v\u00f5tmepaari avaliku v\u00f5tmega. Sertifikaadil peab olema just see avalik v\u00f5ti, mis asub Ruutokenis, see on oluline. Kui me lihtsalt loome v\u00f5tmepaari ja sertifikaadi otse rakenduse kliendipoolel, siis kuidas saab server hiljem seda kr\u00fcpteeritud s\u00f5numit dekr\u00fcpteerida? Ta ei tea ju midagi ei v\u00f5tmepaarist ega sertifikaadist. <\/p>\n

    Kui s\u00fcgavamale minna, siis v\u00f5ib internetist leida huvitavat teavet. On olemas teatud t\u00f5endamis keskused, mida usaldame. Need t\u00f5endamis keskused saavad v\u00e4ljastada sertifikaate kasutajatele, nad installivad need sertifikaadid oma serveritesse. Kui klient \u00fchendub sellele serverile, n\u00e4eb ta seda sertifikaati ja n\u00e4eb, et see on v\u00e4lja antud t\u00f5endamis keskuse poolt, seega saab sellele serverile usaldada. T\u00e4iendavat teavet selle kohta, kuidas k\u00f5ike \u00f5igesti seadistada, on internetis samuti palju. N\u00e4iteks v\u00f5ib alustada sellest<\/a><\/noindex>.<\/p>\n

    Kui naasta meie \u00fclesande juurde, siis lahendus n\u00e4ib olevat ilmne. Peame kuidagi looma oma sertifitseerimiskeskuse. Aga enne seda tuleb selgeks teha, mille alusel sertifitseerimiskeskus peaks kasutajale sertifikaadi v\u00e4lja andma, kuna tal pole selle kohta mingeid andmeid. (N\u00e4iteks tema nimi, perekonnanimi jne.) On olemas asi, mida nimetatakse sertifikaadi taotlemiseks. Rohkem selle standardi kohta saab lugeda n\u00e4iteks vikipeediast. ru.wikipedia.org\/wiki\/PKCS<\/a><\/noindex>
    \nKasutame versiooni 1.7 \u2014 PKCS#10.<\/p>\n

    Kava sertifikaadi genereerimise algoritmi kirjeldamiseks RutuTokenil (algallikas \u2014 dokumentatsioon<\/a><\/noindex>):<\/p>\n

      \n
    1. Kliendis loome v\u00f5tmepaari ja salvestame selle RutuTokenile. (salvestamine toimub automaatselt)<\/li>\n
    2. Kliendis loome sertifikaadi taotluse.<\/li>\n
    3. Saadame selle taotluse serverisse.<\/li>\n
    4. Sertifikaadi taotluse saamisel serveris, v\u00e4ljastame sertifikaadi oma sertifitseerimiskeskuse kaudu.<\/li>\n
    5. Saadame selle sertifikaadi kliendile.<\/li>\n
    6. Kliendis salvestame sertifikaadi RutuTokenile.<\/li>\n
    7. Sertifikaat peab olema seotud selle v\u00f5tmepaariga, mis loodi esimeses etapis.<\/li>\n<\/ol>\n

      \nN\u00fc\u00fcd on selge, kuidas server saab kliendi allkirja dekodeerida, kuna see on ise selle sertifikaadi v\u00e4lja andnud. <\/p>\n

      J\u00e4rgmises osas vaatame \u00fcksikasjalikult, kuidas seadistada oma sertifitseerimiskeskust p\u00f5hjaliku avatud l\u00e4htekoodiga kr\u00fcptograafia teegiga openSSL.
      \n
      Allikas:       habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c! \u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441\u0432\u043e\u0438\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u043e \u0434\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u043c\u0435. \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u2014 \u044d\u0442\u043e \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0449\u0438\u0442\u044b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438. \u041f\u043e \u0441\u0443\u0442\u0438 \u044d\u0442\u043e \u0442\u0430\u043a\u0430\u044f \u0444\u043b\u0435\u0448\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0432 \u0441\u0435\u0431\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u042d\u0426\u041f 2.0. \u0414\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u044d\u0442\u0438\u043c \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85328","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47RutuTokeni tehnoloogia kasutamise kogemused kasutajate registreerimiseks ja autentimiseks s\u00fcsteemis (osa 1) | ProHoster","description":"Tere p\u00e4evast! Soovin jagada oma kogemust selle teema osas. RutuToken on riist- ja tarkvaralahendused autentimise, teabe kaitse ja elektroonilise allkirjastamise valdkonnas.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u044b\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u0434\u043b\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 (\u0447\u0430\u0441\u0442\u044c 1) | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c! \u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441\u0432\u043e\u0438\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u043e \u0434\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u043c\u0435. \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u2014 \u044d\u0442\u043e \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0449\u0438\u0442\u044b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-14T23:42:33+00:00","article:modified_time":"2020-06-14T23:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85328","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:39:25","updated":"2022-09-28 02:14:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85328","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=85328"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85328\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=85328"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=85328"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=85328"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}