{"id":38891,"date":"2019-10-31T22:26:35","date_gmt":"2019-10-31T19:26:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip\/"},"modified":"2019-10-31T22:26:35","modified_gmt":"2019-10-31T19:26:35","slug":"sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","title":{"rendered":"Zajedni\u010dko umre\u017eeno kori\u0161tenje kriptografskog tokena korisnicima na temelju usbip","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

S obzirom na promjene u zakonodavstvu vezanim uz povjerljive usluge (\"O elektroni\u010dkim povjerljivim uslugama\" Ukrajina), pojavila se potreba da nekoliko odjela koristi klju\u010deve smje\u0161tene na tokenima (trenutno je pitanje broja hardverskih klju\u010deva jo\u0161 otvoreno).<\/p>\n

Kao najisplativiji alat (besplatno) odmah je odabran usbip<\/a><\/noindex>. Poslu\u017eitelj na Ubintu 18.04 je po\u010deo raditi zahvaljuju\u0107i objavi Ukro\u0107ujemo USB\/IP<\/a><\/noindex> i uspje\u0161no je testiran na nekoliko USB flash memorija (iz nedostatka tokena u to vrijeme). Nisu otkriveni nikakvi posebni problemi, osim monopolskog vlasni\u0161tva (rezerviranja za korisnika) u to vrijeme. Jasno je da za organizaciju pristupa vi\u0161e korisnika (barem dvojici, za po\u010detak) treba podijeliti im pristup vremenski i natjerati ih da rade naizmjeni\u010dno.<\/p>\n

Pojavio se pitanje: Kako s najmanje napora osigurati da svima sve radi\u2026
\n<\/a><\/noindex><\/p>\n

Djelomi\u010dno hack<\/h1>\n

<\/p>\n

\"Zajedni\u010dko
\nOpcija 1<\/b>. Nekoliko pre\u010daca do bat datoteka, a to su
\na) Povezivanje pristupnog klju\u010da.
\nb) Svjesno isklju\u010divanje. <\/p>\n

To\u010dka «b<\/b>» je sporna, stoga je odlu\u010deno dati tri minute vremena za rad s klju\u010dem.<\/p>\n

Posebnost usbip klijenta je ta da nakon pokretanja ostaje aktivan u konzoli, bez prekidanja konzolne sesije, povezanost se mo\u017ee \"grubo\" prekinuti s strane klijenta, a i s strane poslu\u017eitelja.<\/p>\n

\n Evo \u0161to nam je dobro uspjelo:<\/p>\n

prvo: povezivanje on.bat<\/i><\/b> <\/p>\n

usbip -a 172.16.12.26 4-1\nmsg * \"Potpis\/token nije dostupan ili je zauzet\"<\/code><\/pre>\n
drugo: isklju\u010divanje off.bat<\/i><\/b><\/p>\n
ping 127.0.0.1 -n 180\ntaskkill \/IM usbip.exe \/F<\/code><\/pre>\n
\nne oslanjaju\u0107i se na savjesnost korisnika, skripte su spojene u token.bat<\/i><\/b><\/p>\n
on.bat | off.bat<\/code><\/pre>\n
\n\u0160to se dobije: svi datoteke su u jednoj mapi, pokretanje datotekom token.bat, ako je veza zatvorena korisniku, odmah se \u0161alje poruka o nedostupnosti klju\u010da, u suprotnom, samo nakon 180 pinga. Navedene linije koda mogu se opremiti «@ECHO OFF» te usmjeravanjem konzole na «> nul» da ne bi previ\u0161e \u0161okirale korisnika, ali za pokretanje testiranja nije nu\u017eno. Prvo 'testiranje' na USB memoriji pokazalo je da je sve predvidljivo-pouzdano-precizno. Tako\u0111er, sa strane poslu\u017eitelja nisu potrebne nikakve manipulacije.<\/p>\n
\"Zajedni\u010dko
\n
\nNaravno, prilikom rada direktno s tokenom, sve nije i\u0161lo kako se o\u010dekivalo: pri fizi\u010dkom povezivanju u upravitelju ure\u0111aja, token se registrira kao 2 ure\u0111aja (WUDF i pametna kartica), dok se mre\u017eno prikazuje samo kao WUDF (iako je za unos PIN-a to dovoljno).<\/p>\n
\"Zajedni\u010dko
\n
\nTako\u0111er se ispostavilo da nemilosrdni \u201etaskkill\u201c nije toliko strog, i zatvaranje veze na klijentu je problemati\u010dno, a \u010dak i ako to uspije, ne garantira zatvaranje na serveru.<\/p>\n
\u017drtvovati sve konzole na klijentu, drugi skript je poprimio oblik:<\/p>\n
ping 127.0.0.1 -n 180 > nul\ntaskkill \/IM usbip.exe \/F \/T > nul\nping 127.0.0.1 -n 10 > nul\ntaskkill \/IM conhost.exe \/F \/T > nul<\/code><\/pre>\n
\niako je njegova u\u010dinkovitost manja od 50%, po\u0161to je server tvrdoglavo nastavio smatrati vezu otvorenom.<\/p>\n
Problemi s povezivanjem doveli su do razmi\u0161ljanja o modernizaciji na serverskoj strani.<\/p>\n
Serverska komponenta<\/h1>\n
\n\u0160to je potrebno:<\/p>\n
    \n
  1. Isklju\u010diti neaktivne korisnike iz servisa.<\/li>\n
  2. Vidjeti tko trenutno koristi (ili jo\u0161 uvijek zauzima) token.<\/li>\n
  3. Vidjeti je li token povezan s ra\u010dunalom.<\/li>\n<\/ol>\n
    \nOva pitanja odlu\u010deno je rije\u0161iti putem crontab i apache servisa. Diskretnost ponovnog zapisivanja stanja rezultata monitoringa za to\u010dne to\u010dke 2 i 3 ukazuje na to da se datote\u010dni sustav mo\u017ee smjestiti na ramdrive. U \/etc\/fstab dodan je redak <\/p>\n
    tmpfs   \/ram_drive      tmpfs   defaults,nodev,size=64K         0       0\n<\/code><\/pre>\n
    \nU korijenu je stvorena mapa script s skriptama: odspajanje-povezivanje tokena usb_restart.sh <\/p>\n
    usbip unbind -b 1-2\nsleep 2\nusbip bind -b 1-2\nsleep 2\nusbip attach --remote=localhost --busid=1-2\nsleep 2\nusbip detach --port=00<\/code><\/pre>\n
    \ndobivanje popisa aktivnih ure\u0111aja usblist_id.sh<\/p>\n
    usbip list -r 127.0.0.1 | grep ':' | awk -F \":\" '{print $1}' | sed s\/' '\/\/g | grep -v \"^$\" > \/ram_drive\/usb_id.txt<\/code><\/pre>\n
    \ndobivanje popisa aktivnih IP adresa (uz daljnje dorade s prikazom identifikatora korisnika) usbip_client_ip.sh<\/p>\n
    netstat -an | grep :3240 | grep ESTABLISHED | awk '{print $5}' | cut -f1 -d\":\" > \/ram_drive\/usb_ip_cli.txt<\/code><\/pre>\n
    \nsam crontab izgleda ovako:<\/p>\n
    * \/5 * * * * \/!script\/usb_restart.sh > \/dev\/null 2>&1\n* * * * * ( sleep 30 ; \/!script\/usblist_id.sh > \/dev\/null)\n* * * * * (sleep 10 ; \/!script\/usbip_client_ip.sh > \/dev\/null)<\/code><\/pre>\n
    \nDakle, imamo: svaki 5 minuta se mo\u017ee spojiti novi korisnik, neovisno o tome tko je radio s tokenom. Do http servera putem simboli\u010dke veze povezana je mapa \/ramdrive u kojoj se \u010duvaju 2 tekstna datoteka koja prikazuje stanje servera usbip.<\/p>\n
    Sljede\u0107i dio: \u201eNe\u0161to ru\u017eno u ambala\u017ei\u201c<\/h1>\n
    \nII opcija.<\/b> Mali u\u017eitak korisnika s malo manje zastra\u0161uju\u0107im su\u010deljem. Zabrinut zbog razli\u010ditih verzija Windowsa s razli\u010ditim okvirima i pravima, manje problemati\u010dan pristup od Lazarus<\/a><\/noindex> nisam prona\u0161ao (naravno, preferiram C#, ali ne u ovom slu\u010daju). Mo\u017eete pokretati bat datoteke iz su\u010delja i u pozadini, smanjene, ali bez odgovaraju\u0107eg ispitivanja, osobno se dr\u017eim mi\u0161ljenja: treba vizualizirati kako bi se prikupila korisni\u010dka nezadovoljstva.<\/p>\n
    \"Zajedni\u010dko
    \n
    \nSu\u010deljem i programski dio rije\u0161ili su se sljede\u0107i zadaci:<\/p>\n
      \n
    1. Prikaz kako je token u ovom trenutku zauzet.<\/li>\n
    2. Pri prvom pokretanju prva konfiguracija s generiranjem \u201eispravnih\u201c bat datoteka koje realiziraju pokretanje i prekid rada s serverom tokena. Pri kasnijim pokretanjima implementacija \u201eservisnog\u201c na\u010dina uz lozinku.<\/li>\n
    3. Provjera veze s poslu\u017eiteljem, na temelju \u010dega se ispituje njegova zauzetost ili se prikazuje poruka o problemima. Pri ponovnom uspostavljanju veze program automatski po\u010dinje raditi u standardnom re\u017eimu.<\/li>\n<\/ol>\n
      \nRad s WEB poslu\u017eiteljem realiziran je sredstvima dodatnog alata fphttpclient.<\/p>\n
      \r\n        \"Pogledajte\r\n        
      <\/div>\r\n    <\/div><\/center>
      \n      ovdje \u0107e biti Link na trenutnu verziju klijenta<\/a><\/noindex><\/p>\n
      ima tako\u0111er i nastavak razmi\u0161ljanja o predmetu \u010dlanka, kao i djelomi\u010dno prvobitno odu\u0161evljenje proizvodom VirtualHere i njegovim karakteristikama\u2026
      \n
      Izvor:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
      \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u0443\u0433 ( \u00ab\u041f\u0440\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0441\u043b\u0443\u0433\u0438\u00bb \u0423\u043a\u0440\u0430\u0438\u043d\u0430), \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c \u043e\u0442\u0434\u0435\u043b\u0430\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u043a\u043b\u044e\u0447\u0430\u043c\u0438, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u043d\u0430 \u0442\u043e\u043a\u0435\u043d\u0430\u0445 (\u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442, \u0432\u043e\u043f\u0440\u043e\u0441 \u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0435\u0449\u0435 \u043e\u0442\u043a\u0440\u044b\u0442). \u041a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0441 \u043d\u0430\u0438\u043c\u0435\u043d\u044c\u0448\u0438\u043c\u0438 \u0437\u0430\u0442\u0440\u0430\u0442\u0430\u043c\u0438 (\u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e) \u0441\u0440\u0430\u0437\u0443 \u0432\u044b\u0431\u043e\u0440 \u043f\u0430\u043b \u043d\u0430 usbip. \u0421\u0435\u0440\u0432\u0435\u0440 \u043d\u0430 Ubintu 18.04 \u0437\u0430\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0423\u043a\u0440\u043e\u0449\u0430\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29176,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38891","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zajedni\u010dko mre\u017eno kori\u0161tenje kriptografskog tokena korisnicima na bazi usbip | ProHoster","description":"S obzirom na promjene u zakonodavstvu o povjereni\u010dkim uslugama (\u201eO elektroni\u010dkim povjereni\u010dkim uslugama\u201c Ukrajina), u tvrtki se pojavila potreba da nekoliko odjela radi s klju\u010devima koji se nalaze na.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u0441\u0435\u0442\u0435\u0432\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0442\u043e\u043a\u0435\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 usbip | ProHoster","og:description":"\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u0443\u0433 ( \u00ab\u041f\u0440\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0441\u043b\u0443\u0433\u0438\u00bb \u0423\u043a\u0440\u0430\u0438\u043d\u0430), \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c \u043e\u0442\u0434\u0435\u043b\u0430\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u043a\u043b\u044e\u0447\u0430\u043c\u0438, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:26:35+00:00","article:modified_time":"2019-10-31T19:26:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38891","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:51:37","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:00:28","updated":"2026-01-23 23:51:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/38891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=38891"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/38891\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/29176"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=38891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=38891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=38891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}