Tej lo lus zais yooj yooj yim tsis muaj kev nyab xeeb, thiab cov uas nyuaj tsis nco qab. Tias yog vim li cas lawv thiaj li feem ntau xaus rau ntawm daim ntawv nplaum hauv qab cov keyboard lossis ntawm lub monitor. Txhawm rau kom ntseeg tau tias cov passwords nyob hauv lub siab ntawm cov neeg siv "tsis nco qab" thiab kev ntseeg siab ntawm kev tiv thaiv tsis ploj, muaj ob qhov kev lees paub tseeb (2FA).

Vim yog kev sib koom ua ke ntawm tus kheej lub cuab yeej thiab paub nws tus lej PIN, tus PIN nws tus kheej tuaj yeem yooj yim dua thiab nco qab yooj yim dua. Qhov tsis zoo ntawm tus PIN ntev lossis randomness yog offset los ntawm qhov yuav tsum tau muaj lub cev thiab kev txwv rau tus PIN brute quab yuam.

Tsis tas li ntawd, nws tshwm sim hauv tsoomfwv cov koomhaum uas lawv xav kom txhua yam ua haujlwm raws li GOST. Qhov kev xaiv 2FA no rau kev nkag mus rau hauv Linux yuav raug tham. Kuv mam li pib ntawm qhov deb.

PAM modules

Pluggable Authentication Modules (PAM) yog cov qauv nrog tus qauv API thiab kev siv ntau yam kev lees paub tseeb hauv cov ntawv thov.
Tag nrho cov khoom siv hluav taws xob thiab cov ntawv thov uas tuaj yeem ua haujlwm nrog PAM tuaj tos lawv thiab tuaj yeem siv rau kev lees paub tus neeg siv.
Hauv kev xyaum, nws ua haujlwm zoo li no: tus ID nkag mus hais kom hu PAM, uas ua txhua yam kev kuaj xyuas tsim nyog siv cov modules teev nyob rau hauv cov ntaub ntawv teeb tsa thiab xa cov txiaj ntsig rov qab rau cov lus txib nkag.

librtpam

Cov qauv tsim los ntawm lub tuam txhab Aktiv ntxiv ob qhov kev lees paub ntawm cov neeg siv siv cov npav ntse lossis USB tokens siv cov yuam sij asymmetric raws li cov qauv tshiab ntawm kev siv nyiaj hauv tsev.

Cia peb saib lub hauv paus ntsiab lus ntawm nws txoj haujlwm:

Lub token khaws cov neeg siv daim ntawv pov thawj thiab nws tus yuam sij ntiag tug;
Daim ntawv pov thawj tau txais kev cawmdim nyob rau hauv tus neeg siv lub tsev directory raws li kev ntseeg siab.

Cov txheej txheem authentication tshwm sim raws li hauv qab no:

Rutoken tshawb nrhiav tus neeg siv daim ntawv pov thawj tus kheej.
Thov tus PIN token.
Cov ntaub ntawv Random kos npe rau ntawm tus yuam sij ntiag tug ncaj qha hauv Rutoken nti.
Cov txiaj ntsig tau kos npe raug txheeb xyuas siv tus yuam sij pej xeem los ntawm tus neeg siv daim ntawv pov thawj.
Lub module xa rov qab kos npe pov thawj tshwm sim rau daim ntawv thov hu.

Koj tuaj yeem txheeb xyuas tau siv GOST R 34.10-2012 cov yuam sij (ntev 256 lossis 512 cov khoom) lossis GOST R 34.10-2001 tsis tu ncua.

Koj tsis tas yuav txhawj xeeb txog kev ruaj ntseg ntawm cov yuam sij - lawv tau tsim ncaj qha hauv Rutoken thiab tsis txhob tso nws lub cim xeeb thaum ua haujlwm cryptographic.

Rutoken EDS 2.0 tau lees paub los ntawm FSB thiab FSTEC raws li NDV 4, yog li nws tuaj yeem siv rau hauv cov ntaub ntawv xov xwm uas ua cov ntaub ntawv tsis pub lwm tus paub.

Kev siv tswv yim

Yuav luag txhua niaj hnub Linux yuav ua, piv txwv li peb yuav siv xUbuntu 18.10.

1) Nruab cov pob khoom tsim nyog

sudo apt-get install libccid pcscd opensc
Yog tias koj xav ntxiv lub xauv lub desktop nrog lub screensaver, nruab lub pob ntxiv libpam-pkcs11.

2) Ntxiv PAM module nrog GOST kev txhawb nqa

Loading lub tsev qiv ntawv los ntawm https://download.rutoken.ru/Rutoken/PAM/
Luam cov ntsiab lus ntawm PAM nplaub tshev librtpam.so.1.0.0 mus rau lub kaw lus kaw lus
/usr/lib/ los yog /usr/lib/x86_64-linux-gnu/los yog /usr/lib64

3) Nruab lub pob nrog librtpkcs11ecp.so

Rub tawm thiab nruab DEB lossis RPM pob los ntawm qhov txuas: https://www.rutoken.ru/support/download/pkcs/

4) Txheeb xyuas tias Rutoken EDS 2.0 ua haujlwm hauv qhov system

Hauv lub davhlau ya nyob twg peb ua haujlwm
$ pkcs11-tool --module /usr/lib/librtpkcs11ecp.so -T
Yog koj pom kab Rutoken ECP <no label> - Nws txhais tau tias txhua yam yog OK.

5) Nyeem daim ntawv pov thawj

Tshawb xyuas tias lub cuab yeej muaj daim ntawv pov thawj
$ pkcs11-tool --module /usr/lib/librtpkcs11ecp.so -O
Yog tias tom qab kab:
Using slot 0 with a present token (0x0)

cov ntaub ntawv raug tso tawm hais txog cov yuam sij thiab daim ntawv pov thawj, koj yuav tsum tau nyeem daim ntawv pov thawj thiab khaws cia rau disk. Txhawm rau ua qhov no, khiav cov lus txib hauv qab no, qhov twg es tsis yog {id} koj yuav tsum hloov daim ntawv pov thawj ID uas koj pom hauv cov zis ntawm cov lus txib dhau los:
$ pkcs11-tool --module /usr/lib/librtpkcs11ecp.so -r -y cert --id {id} --output-file cert.crt
Yog tias cov ntaub ntawv cert.crt tau tsim, mus rau kauj ruam 6).
tsis muaj dab tsi, ces lub cuab yeej yog khoob. Hu rau koj tus thawj tswj hwm lossis tsim cov yuam sij thiab ntawv pov thawj koj tus kheej los ntawm kev ua raws cov kauj ruam tom ntej.

5.1) Tsim ib daim ntawv pov thawj xeem

Nco ntsoov! Cov txheej txheem piav qhia txog kev tsim cov yuam sij thiab daim ntawv pov thawj tsim nyog rau kev sim thiab tsis yog tsim los siv rau hauv hom kev sib ntaus sib tua. Txhawm rau ua qhov no, koj yuav tsum siv cov yuam sij thiab daim ntawv pov thawj uas tau muab los ntawm koj lub koom haum cov ntawv pov thawj ntseeg siab lossis cov cai lees paub lees paub.
PAM module yog tsim los tiv thaiv cov khoos phis tawj hauv zos thiab tsim los ua haujlwm hauv cov koom haum me. Txij li thaum muaj ob peb tus neeg siv, Tus Thawj Coj tuaj yeem saib xyuas qhov kev tshem tawm ntawm daim ntawv pov thawj thiab thaiv cov nyiaj manually, nrog rau lub sijhawm siv tau ntawm daim ntawv pov thawj. PAM module tseem tsis tau paub yuav ua li cas txheeb xyuas daim ntawv pov thawj siv CRLs thiab tsim cov saw hlau ntawm kev ntseeg siab.

Txoj kev yooj yim (ntawm browser)

Kom tau txais daim ntawv pov thawj xeem, siv web service "Rutoken Registration Center". Cov txheej txheem yuav siv sij hawm tsis tshaj 5 feeb.

Txoj kev geek (ntawm lub console thiab tejzaum nws compiler)

Txheeb xyuas OpenSC version
$ opensc-tool --version
Yog tias qhov version tsawg dua 0.20, ces hloov kho lossis tsim pkcs11-tool ceg nrog GOST-2012 kev txhawb nqa los ntawm peb GitHub (thaum lub sijhawm tshaj tawm ntawm tsab xov xwm no, tso tawm 0.20 tseem tsis tau tso tawm) lossis los ntawm tus tswv ceg ntawm lub ntsiab OpenSC project tsis muaj tom qab. ua 8cf1e6f

Tsim ib tug khub tseem ceeb nrog cov nram qab no tsis:
--key-type: GOSTR3410-2012-512:А (ГОСТ-2012 512 бит c парамсетом А), GOSTR3410-2012-256:A (ГОСТ-2012 256 бит с парамсетом A)

--id: object identifier (CKA_ID) raws li ob tug lej hex tus lej ntawm lub rooj ASCII. Siv cov lej ASCII nkaus xwb rau cov ntawv luam tawm, vim ... id yuav tsum tau dhau mus rau OpenSSL ua txoj hlua. Piv txwv li, ASCII code "3132" sib raug rau txoj hlua "12". Rau kev yooj yim, koj tuaj yeem siv Kev pabcuam online rau hloov cov hlua rau ASCII cov lej.

$ ./pkcs11-tool --module /usr/lib/librtpkcs11ecp.so --keypairgen --key-type GOSTR3410-2012-512:A -l --id 3132

Tom ntej no peb yuav tsim ib daim ntawv pov thawj. Ob txoj hauv kev yuav tau piav qhia hauv qab no: thawj zaug yog dhau ntawm CA (peb yuav siv CAs), qhov thib ob yog tus kheej kos npe. Txhawm rau ua qhov no, koj yuav tsum xub nruab thiab teeb tsa OpenSSL version 1.1 lossis tom qab ntawd los ua haujlwm nrog Rutoken los ntawm ib qho tshwj xeeb rtengine module siv phau ntawv Txhim kho thiab teeb tsa OpenSSL.
Piv txwv li: rau '--id 3132' hauv OpenSSL koj yuav tsum tau qhia "pkcs11:id=12".

Koj tuaj yeem siv cov kev pabcuam ntawm kev xeem CA, uas muaj ntau yam, piv txwv li, ntawm no, ntawm no и ntawm no, rau qhov no peb yuav tsim kev thov rau daim ntawv pov thawj

Lwm qhov kev xaiv yog muab rau hauv kev tub nkeeg thiab tsim tus kheej kos npe
$ openssl req -utf8 -new -keyform engine -key "pkcs11:id=12" -engine rtengine -out req.csr

Uploading daim ntawv pov thawj rau lub cuab yeej
$ openssl req -utf8 -x509 -keyform engine -key "pkcs11:id=12" -engine rtengine -out cert.cer

6) Sau npe daim ntawv pov thawj hauv qhov system

Xyuas kom koj daim ntawv pov thawj zoo li cov ntaub ntawv base64:

Yog tias koj daim ntawv pov thawj zoo li no:

ces koj yuav tsum tau hloov daim ntawv pov thawj los ntawm DER hom rau PEM hom (base64)

$ openssl x509 -in cert.crt -out cert.pem -inform DER -outform PEM
Peb rov xyuas dua tias txhua yam nyob rau hauv kev txiav txim tam sim no.

Ntxiv daim ntawv pov thawj rau cov npe ntawm daim ntawv pov thawj ntseeg tau
$ mkdir ~/.eid $ chmod 0755 ~/.eid $ cat cert.pem >> ~/.eid/authorized_certificates $ chmod 0644 ~/.eid/authorized_certificates
Cov kab kawg tiv thaiv cov npe ntawm daim ntawv pov thawj ntseeg tau los ntawm kev ua yuam kev lossis txhob txwm hloov los ntawm lwm tus neeg siv. Qhov no tiv thaiv ib tus neeg los ntawm kev ntxiv lawv daim ntawv pov thawj ntawm no thiab tuaj yeem nkag rau hauv sawv cev koj.

7) teeb tsa kev lees paub

Kev teeb tsa peb lub PAM module yog tus qauv tag nrho thiab ua tiav raws nraim li kev teeb tsa lwm cov modules. Tsim los ua ntaub ntawv /usr/share/pam-configs/rutoken-gost-pam muaj lub npe tag nrho ntawm lub module, txawm tias nws yog enabled los ntawm lub neej ntawd, qhov tseem ceeb ntawm lub module, thiab authentication tsis.
Lub authentication tsis muaj cov cai rau kev ua tiav ntawm kev ua haujlwm:

yuav tsum tau: Cov modules no yuav tsum rov qab tau cov lus teb zoo. Yog tias qhov tshwm sim ntawm kev hu xov tooj muaj cov lus teb tsis zoo, qhov no yuav ua rau muaj kev lees paub qhov yuam kev. Qhov kev thov yuav raug muab tso tseg, tab sis cov modules ntxiv yuav raug hu.
Requisite: Zoo ib yam li yuav tsum tau, tab sis tam sim ntawd ua tsis tiav authentication thiab ignores lwm modules.
txaus: Yog tias tsis muaj qhov xav tau lossis tsis txaus modules ua ntej xws li module xa rov qab qhov txiaj ntsig tsis zoo, ces lub module yuav rov qab tau cov lus teb zoo. Cov seem modules yuav raug ignored.
xaiv tau: Yog tias tsis muaj qhov yuav tsum tau ua modules ntawm pawg thiab tsis muaj ib qho ntawm cov modules txaus rov qab tau qhov txiaj ntsig zoo, ces tsawg kawg yog ib qho ntawm cov kev xaiv modules yuav tsum rov qab tau qhov txiaj ntsig zoo.

Cov ntaub ntawv tag nrho /usr/share/pam-configs/rutoken-gost-pam:
Name: Rutoken PAM GOST Default: yes Priority: 800 Auth-Type: Primary Auth: sufficient /usr/lib/librtpam.so.1.0.0 /usr/lib/librtpkcs11ecp.so

txuag cov ntaub ntawv, ces execute
$ sudo pam-auth-update
nyob rau hauv lub qhov rais uas tshwm, muab ib lub hnub qub nyob ib sab ntawm nws Rutoken PAM GOST thiab thawb OK

8) Tshawb xyuas cov kev teeb tsa

Txhawm rau nkag siab tias txhua yam tau teeb tsa, tab sis tib lub sijhawm tsis poob lub peev xwm nkag mus rau hauv qhov system, nkag mus rau cov lus txib
$ sudo login
Sau koj tus username. Txhua yam raug teeb tsa kom raug yog tias lub kaw lus xav tau tus lej PIN ntaus ntawv.

9) Kho lub computer kom raug thaiv thaum lub token raug rho tawm

suav nrog hauv pob libpam-pkcs11 suav nrog pkcs11_eventmgr, uas tso cai rau koj ua ntau yam haujlwm thaum PKCS#11 cov xwm txheej tshwm sim.
Rau qhov chaw pkcs11_eventmgr ua hauj lwm raws li ib tug configuration ntaub ntawv: /etc/pam_pkcs11/pkcs11_eventmgr.conf
Rau qhov sib txawv Linux kev faib tawm, cov lus txib uas ua rau tus account raug kaw thaum daim npav ntse lossis token raug tshem tawm yuav txawv. Cm. event card_remove.
Ib qho piv txwv configuration file yog qhia hauv qab no:

pkcs11_eventmgr
{
    # Запуск в бэкграунде
    daemon = true;
     
    # Настройка сообщений отладки
    debug = false;
 
    # Время опроса в секундах
    polling_time = 1;
 
    # Установка тайм-аута на удаление карты
    # По-умолчанию 0
    expire_time = 0;
 
    # Выбор pkcs11 библиотеки для работы с Рутокен
    pkcs11_module = usr/lib/librtpkcs11ecp.so;
 
    # Действия с картой
    # Карта вставлена:
    event card_insert {
        # Оставляем значения по умолчанию (ничего не происходит)
        on_error = ignore ;
 
        action = "/bin/false";
    }
 
    # Карта извлечена
    event card_remove {
        on_error = ignore;
         
        # Вызываем функцию блокировки экрана
        
        # Для GNOME 
        action = "dbus-send --type=method_call --dest=org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.Lock";
        
        # Для XFCE
        # action = "xflock4";
        
        # Для Astra Linux (FLY)
        # action = "fly-wmfunc FLYWM_LOCK";
    }
 
    # Карта долгое время извлечена
    event expire_time {
        # Оставляем значения по умолчанию (ничего не происходит)
        on_error = ignore;
 
        action = "/bin/false";
    }
}

Tom qab ntawd ntxiv daim ntawv thov pkcs11_eventmgr mus pib. Txhawm rau ua qhov no, kho cov ntaub ntawv .bash_profile:
$ nano /home/<имя_пользователя>/.bash_profile
Ntxiv cov kab pkcs11_eventmgr mus rau qhov kawg ntawm cov ntaub ntawv thiab reboot.

Cov kauj ruam piav qhia rau kev teeb tsa lub operating system tuaj yeem siv los ua cov lus qhia hauv txhua qhov niaj hnub Linux faib, suav nrog cov khoom siv hauv tsev.

xaus

Linux PCs tau dhau los ua neeg nyiam nyob hauv tsoomfwv Lavxias, thiab teeb tsa kev lees paub qhov tseeb ob qhov tseeb hauv OS no tsis yog ib txwm yooj yim. Peb yuav zoo siab los pab koj daws qhov "qhov teeb meem lo lus zais" nrog cov lus qhia no thiab ntseeg tau tias kev nkag mus rau koj lub PC tsis tas siv sijhawm ntau rau nws.

Tau qhov twg los: www.hab.com

Yuav siv PAM modules li cas rau kev lees paub hauv zos hauv Linux siv GOST-2012 yuam sij ntawm Rutoken