{"id":36873,"date":"2019-10-31T22:14:26","date_gmt":"2019-10-31T19:14:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/server-dvuhfaktornoj-avtorizatsii-linotp\/"},"modified":"2019-10-31T22:14:26","modified_gmt":"2019-10-31T19:14:26","slug":"server-dvuhfaktornoj-avtorizatsii-linotp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/server-dvuhfaktornoj-avtorizatsii-linotp","title":{"rendered":"LinOTP k\u00e9tfaktoros hiteles\u00edt\u0151 szerver","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"LinOTP
\n
\nMa szeretn\u00e9m megosztani, hogyan \u00e1ll\u00edtsuk be a k\u00e9tfaktoros hiteles\u00edt\u00e9si szervert a v\u00e1llalati h\u00e1l\u00f3zat, weboldalak, szolg\u00e1ltat\u00e1sok \u00e9s SSH v\u00e9delm\u00e9re. A szerveren a LinOTP + FreeRadius kombin\u00e1ci\u00f3ja fog m\u0171k\u00f6dni. <\/p>\n

Mi\u00e9rt van sz\u00fcks\u00e9g r\u00e1?
\nEz egy teljesen ingyenes, k\u00e9nyelmes megold\u00e1s, amely a saj\u00e1t h\u00e1l\u00f3zat\u00e1n bel\u00fcl m\u0171k\u00f6dik, nem f\u00fcgg harmadik f\u00e9l szolg\u00e1ltat\u00f3it\u00f3l.<\/p>\n

Ez a szolg\u00e1ltat\u00e1s nagyon k\u00e9nyelmes, szeml\u00e9letes a t\u00f6bbi ny\u00edlt forr\u00e1sk\u00f3d\u00fa term\u00e9khez k\u00e9pest, \u00e9s t\u00e1mogat egy hatalmas funkci\u00f3- \u00e9s politika mennyis\u00e9get (p\u00e9ld\u00e1ul login + jelsz\u00f3 + (PIN + OTPToken)). API-n kereszt\u00fcl integr\u00e1lhat\u00f3 SMS k\u00fcld\u0151 szolg\u00e1ltat\u00e1sokkal (LinOTP Config->Provider Config->SMS Provider), gener\u00e1l k\u00f3dokat a Google Authenticator t\u00edpus\u00fa mobilalkalmaz\u00e1sokhoz \u00e9s m\u00e9g sok egy\u00e9bhez. V\u00e9lem\u00e9nyem szerint ez k\u00e9nyelmesebb, mint a vizsg\u00e1lt szolg\u00e1ltat\u00e1s. a Spotify d\u00f6nt\u00e9shozatali m\u00f3dszertan\u00e1r\u00f3l. Egyre t\u00f6bb felhaszn\u00e1l\u00f3 prefer\u00e1lja a zenehallgat\u00e1st mobilon a streaming szolg\u00e1ltat\u00e1sban, de a c\u00e9gn\u00e9l t\u00falnyom\u00f3r\u00e9szt webprogramoz\u00f3k dolgoznak. A Spotify elemezte ezt a helyzetet, \u00e9s \u00fagy d\u00f6nt\u00f6tt, hogy t\u00f6bb mobilfejleszt\u0151t vesz fel, valamint \u00e1tnevezi a webes szakembereket \u00faj ir\u00e1nyba:<\/a><\/noindex>.<\/p>\n

Ez a szerver remek\u00fcl m\u0171k\u00f6dik Cisco ASA-val, OpenVPN szerverrel, Apache2-vel, \u00e9s gyakorlatilag mindennel, ami t\u00e1mogatja a RADIUS szerveren kereszt\u00fcli hiteles\u00edt\u00e9st (p\u00e9ld\u00e1ul SSH sz\u00e1m\u00e1ra a datacenterben).<\/p>\n

Sz\u00fcks\u00e9ges:<\/p>\n

1 ) Debian 8 (jessie) \u2014 K\u00f6telez\u0151!<\/b> (a Debian 9-r\u0151l sz\u00f3l\u00f3 pr\u00f3baverzi\u00f3 telep\u00edt\u00e9se a cikk v\u00e9g\u00e9n tal\u00e1lhat\u00f3)<\/p>\n

Kezd\u00e9s:<\/p>\n

Telep\u00edts\u00fck a Debian 8-at.
\n<\/a><\/noindex>
\nHozz\u00e1adjuk a LinOTP t\u00e1rol\u00f3t:<\/p>\n

# echo 'deb http:\/\/www.linotp.org\/apt\/debian jessie linotp' > \/etc\/apt\/sources.list.d\/linotp.list<\/code><\/pre>\n
\nHozz\u00e1adjuk a kulcsokat:<\/p>\n
# gpg --search-keys 913DFF12F86258E5<\/code><\/pre>\n
\nN\u00e9ha 'tiszta' telep\u00edt\u00e9sn\u00e9l, miut\u00e1n ezt a parancsot v\u00e9grehajtottuk, a Debian ezt adja: <\/p>\n
gpg: l\u00e9trehozva a m\u0171veleti k\u00f6nyvt\u00e1r `\\\/root\\\/.gnupg'\\ngpg: \u00faj be\u00e1ll\u00edt\u00e1si f\u00e1jl l\u00e9trehozva `\\\/root\\\/.gnupg\\\/gpg.conf'\\ngpg: FIGYELEM: a `\\\/root\\\/.gnupg\\\/gpg.conf' f\u00e1jlban l\u00e9v\u0151 be\u00e1ll\u00edt\u00e1sok m\u00e9g nem akt\u00edvak ezen a futtat\u00e1son\\ngpg: kulcsrendszert\u00e1bla l\u00e9trehozva `\\\/root\\\/.gnupg\\\/secring.gpg'\\ngpg: kulcsrendszert\u00e1bla l\u00e9trehozva `\\\/root\\\/.gnupg\\\/pubring.gpg'\\ngpg: nem megadva kulcservers (haszn\u00e1ljon --keyserver)\\ngpg: hiba a kulcsservers keres\u00e9sekor: hib\u00e1s URI\n<\/code><\/pre>\n
\nEz a gnupg kezdeti be\u00e1ll\u00edt\u00e1sa. Nincs semmi vesz\u00e9lyes. Csak futtassa a parancsot m\u00e9g egyszer.
\nA Debian k\u00e9rd\u00e9s\u00e9re:<\/p>\n
gpg: keres\u00e9s \"913DFF12F86258E5\" a hkp kulcsszerveren keys.gnupg.net\\n(1)\\tLSE LinOTP2 csomagol\u00e1s <linotp2@lsexperts.de>\\n\\t  2048 bites RSA kulcs F86258E5, l\u00e9trehozva: 2010-05-10\\nKulcsok 1-1 az 1-hez \"913DFF12F86258E5\". K\u00e9rj\u00fck, adja meg a sz\u00e1mokat, N) K\u00f6vetkez\u0151 vagy Q) Kil\u00e9p\u00e9s><\/code><\/pre>\n
\nV\u00e1laszolunk: 1<\/p>\n
Tov\u00e1bb: <\/p>\n
# gpg --export 913DFF12F86258E5 | apt-key add -<\/code><\/pre>\n
<\/p>\n
# apt-get update<\/code><\/pre>\n
\nTelep\u00edts\u00fck a MySQL-t. Elm\u00e9letileg m\u00e1s SQL szerver is haszn\u00e1lhat\u00f3, de a k\u00f6nnyebb kezel\u00e9s \u00e9rdek\u00e9ben \u00e9n ezt fogom haszn\u00e1lni, mint a LinOTP aj\u00e1nlott megold\u00e1s\u00e1t.<\/p>\n
(tov\u00e1bbi inform\u00e1ci\u00f3k, bele\u00e9rtve a LinOTP adatb\u00e1zis\u00e1nak \u00fajrakonfigur\u00e1l\u00e1s\u00e1t, a hivatalos dokument\u00e1ci\u00f3ban tal\u00e1lhat\u00f3k a linkre kattintva<\/a><\/noindex>. Az ott tal\u00e1lhat\u00f3 parancs: dpkg-reconfigure linotp a param\u00e9terek m\u00f3dos\u00edt\u00e1s\u00e1hoz, ha m\u00e1r telep\u00edtette a MySQL-t).<\/p>\n
# apt-get install mysql-server<\/code><\/pre>\n
<\/p>\n
# apt-get update<\/code><\/pre>\n
 (m\u00e9g egyszer ellen\u0151rizni a friss\u00edt\u00e9seket nem \u00e1rt)
\nTelep\u00edts\u00fck a LinOTP-t \u00e9s a kieg\u00e9sz\u00edt\u0151 modulokat:<\/p>\n
# apt-get install linotp<\/code><\/pre>\n
\nV\u00e1laszoljunk a telep\u00edt\u0151 k\u00e9rd\u00e9seire: 
\nHaszn\u00e1lni Apache2-t: igen
\nTal\u00e1ljon ki egy jelsz\u00f3t az admin LinOTP-hoz: \u201eAz\u00d6nJelszava\u201d
\n\u00d6njel\u00f6lt tan\u00fas\u00edtv\u00e1ny gener\u00e1l\u00e1sa?: igen
\nHaszn\u00e1ljuk a MySQL-t?: igen
\nA szem\u00e9lyi adatb\u00e1zis helye: localhost
\nL\u00e9trehozzuk a LinOTP adatb\u00e1zist (adatb\u00e1zis neve) a szerveren: LinOTP2
\nL\u00e9trehozunk egy k\u00fcl\u00f6n felhaszn\u00e1l\u00f3t az adatb\u00e1zis sz\u00e1m\u00e1ra: LinOTP2
\nJelsz\u00f3t adunk a felhaszn\u00e1l\u00f3nak: \u201eATeJelszavad\u201d
\nHozzunk l\u00e9tre most egy adatb\u00e1zist? (valami hasonl\u00f3 mint \u201eBiztos benne, hogy szeretn\u00e9\u2026\u201c): igen
\nBe\u00edrjuk a MySQL root jelsz\u00f3t, amelyet az install\u00e1l\u00e1skor hoztunk l\u00e9tre: \u201eATeJelszavad\u201d
\nK\u00e9sz.<\/p>\n
(opcion\u00e1lis, nem sz\u00fcks\u00e9ges hozz\u00e1adni)<\/p>\n
# apt-get install linotp-adminclient-cli <\/code><\/pre>\n
\n(opcion\u00e1lis, nem sz\u00fcks\u00e9ges hozz\u00e1adni)<\/p>\n
# apt-get install libpam-linotp  <\/code><\/pre>\n
\n\u00cdgy a Linotp webes fel\u00fclet most el\u00e9rhet\u0151 a c\u00edmen: <\/p>\n
"<b>https<\\\/b>: \\\\\\\/\\\\\\\/IP_szerver\\\\\\\/manage"<\/code><\/pre>\n
\nA webes fel\u00fcleten tal\u00e1lhat\u00f3 be\u00e1ll\u00edt\u00e1sokr\u00f3l k\u00e9s\u0151bb fogok besz\u00e9lni.<\/p>\n
Most, a legfontosabb! Aktiv\u00e1ljuk a FreeRadius-t \u00e9s \u00f6sszekapcsoljuk a LinOTP-val.<\/p>\n
Telep\u00edtj\u00fck a FreeRadius-t \u00e9s a LinOTP modulj\u00e1t<\/p>\n
# apt-get install freeradius linotp-freeradius-perl<\/code><\/pre>\n
\nBiztons\u00e1gi ment\u00e9st k\u00e9sz\u00edt\u00fcnk a radius kliens \u00e9s felhaszn\u00e1l\u00f3k konfigur\u00e1ci\u00f3j\u00e1r\u00f3l.<\/p>\n
# mv \/etc\/freeradius\/clients.conf  \/etc\/freeradius\/clients.old<\/code><\/pre>\n
<\/p>\n
# mv \/etc\/freeradius\/users  \/etc\/freeradius\/users.old<\/code><\/pre>\n
\nL\u00e9trehozunk egy \u00fcres kliens f\u00e1jlt:<\/p>\n
# touch \/etc\/freeradius\/clients.conf<\/code><\/pre>\n
\nM\u00f3dos\u00edtjuk az \u00faj konfigur\u00e1ci\u00f3s f\u00e1jlunkat (a biztons\u00e1gi m\u00e1solatot mint p\u00e9ld\u00e1t haszn\u00e1lhatjuk)<\/p>\n
# nano \/etc\/freeradius\/clients.conf<\/code><\/pre>\n
<\/p>\n
client 192.168.188.0\/24 {\nsecret  = passwd # a kliens csatlakoz\u00e1si jelszava\n}<\/code><\/pre>\n
\nEzut\u00e1n l\u00e9trehozunk egy felhaszn\u00e1l\u00f3i f\u00e1jlt:<\/p>\n
# touch \/etc\/freeradius\/users<\/code><\/pre>\n
\nM\u00f3dos\u00edtjuk a f\u00e1jlt, mondva a radius-nak, hogy a perl-t fogjuk haszn\u00e1lni az azonos\u00edt\u00e1shoz.<\/p>\n
# nano \/etc\/freeradius\/users<\/code><\/pre>\n
<\/p>\n
DEFAULT Auth-type := perl<\/code><\/pre>\n
\nEzut\u00e1n m\u00f3dos\u00edtjuk a f\u00e1jlt \/etc\/freeradius\/modules\/perl<\/p>\n
# nano \/etc\/freeradius\/modules\/perl<\/code><\/pre>\n
\nMeg kell adnunk a linotp perl szkript \u00fatvonal\u00e1t a modul param\u00e9ter\u00e9ben: <\/p>\n
Perl { .......\n.........\nmodule = \/usr\/lib\/linotp\/radius_linotp.pm<\/code><\/pre>\n
\n\u2026..
\nEzut\u00e1n l\u00e9trehozunk egy f\u00e1jlt, amelyben megmondjuk, hogy honnan (domain-b\u00f3l, adatb\u00e1zisb\u00f3l vagy f\u00e1jlb\u00f3l) vegy\u00fck az adatokat.<\/p>\n
# touch \/etc\/linotp2\/rlm_perl.ini<\/code><\/pre>\n
<\/p>\n
# nano \/etc\/linotp2\/rlm_perl.ini<\/code><\/pre>\n
<\/p>\n
URL=https:\/\/IP_a_LinOTP_szerveredhez(192.168.X.X)\/validate\/simplecheck\nREALM=webusers1c\nRESCONF=LocalUser\nDebug=True\nSSL_CHECK=False<\/code><\/pre>\n
\nItt kicsit r\u00e9szletesebben meg\u00e1llok, mivel ez fontos:<\/p>\n
A f\u00e1jl teljes le\u00edr\u00e1sa megjegyz\u00e9sekkel:
\n#IP of the linotp server (IP \u0430\u0434\u0440\u0435\u0441 \u043d\u0430\u0448\u0435\u0433\u043e LinOTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430)
\nURL=https:\/\/172.17.14.103\/validate\/simplecheck
\n#\u041d\u0430\u0448\u0430 \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u0434\u0438\u043c \u0432 \u0432\u0435\u0431 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 LinOTP.)
\nREALM=rearm1
\n#\u0418\u043c\u044f \u0433\u0440\u0443\u043f\u043f\u044b \u044e\u0437\u0432\u0435\u0440\u0435\u0439 \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f \u0432 \u0432\u0435\u0431\u043c\u043e\u0440\u0434\u0435 LinOTP.
\nRESCONF=flat_file
\n#optional: comment out if everything seems to work fine
\nDebug=True
\n#optional: use this, if you have selfsigned certificates, otherwise comment out (SSL \u0435\u0441\u043b\u0438 \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u0435\u043c \u0441\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0438 \u0445\u043e\u0442\u0438\u043c \u0435\u0433\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c)
\nSSL_CHECK=False<\/p>\n
Ezut\u00e1n l\u00e9trehozunk egy f\u00e1jlt \/etc\/freeradius\/sites-available\/linotp<\/p>\n
# touch \/etc\/freeradius\/sites-available\/linotp<\/code><\/pre>\n
<\/p>\n
# nano \/etc\/freeradius\/sites-available\/linotp<\/code><\/pre>\n
\n\u00c9s bem\u00e1soljuk a konfigur\u00e1ci\u00f3t (nem kell m\u00f3dos\u00edtani semmit):<\/p>\n
authorize {\n#normalizes maleformed client request before handed on to other modules (see '\/etc\/freeradius\/modules\/preprocess')\npreprocess\n#  If you are using multiple kinds of realms, you probably\n#  want to set \"ignore_null = yes\" for all of them.\n#  Otherwise, when the first style of realm doesn't match,\n#  the other styles won't be checked.\n#allows a list of realms (see '\/etc\/freeradius\/modules\/realm')\nIPASS\n#understands something like USER@REALM and can tell the components apart (see '\/etc\/freeradius\/modules\/realm')\nsuffix\n#understands USERREALM and can tell the components apart (see '\/etc\/freeradius\/modules\/realm')\nntdomain\n#  Read the 'users' file to learn about special configuration which should be applied for\n# certain users (see '\/etc\/freeradius\/modules\/files')\nfiles\n# allows to let authentication to expire (see '\/etc\/freeradius\/modules\/expiration')\nexpiration\n# allows to define valid service-times (see '\/etc\/freeradius\/modules\/logintime')\nlogintime\n# We got no radius_shortname_map!\npap\n}\n#here the linotp perl module is called for further processing\nauthenticate {\nperl\n}<\/code><\/pre>\n
\nEzut\u00e1n l\u00e9trehozunk egy szimbolikus linket:<\/p>\n
# ln -s ..\/sites-available\/linotp \/etc\/freeradius\/sites-enabled<\/code><\/pre>\n
\nSzem\u00e9ly szerint meg\u00f6letem az alap\u00e9rtelmezett Radius weboldalakat, de ha sz\u00fcks\u00e9ged van r\u00e1juk, szerkesztheted a konfigur\u00e1ci\u00f3jukat, vagy letilthatod \u0151ket.<\/p>\n
# rm \/etc\/freeradius\/sites-enabled\/default<\/code><\/pre>\n
<\/p>\n
# rm \/etc\/freeradius\/sites-enabled\/inner-tunnel<\/code><\/pre>\n
<\/p>\n
# service freeradius reload<\/code><\/pre>\n
\nMost t\u00e9rj\u00fcnk vissza a webfel\u00fclethez, \u00e9s n\u00e9zz\u00fck meg kicsit alaposabban:
\nA jobb fels\u0151 sarokban kattintsunk a LinOTP Config \u2192 UserIdResolvers \u2192 \u00daj gombra.
\nV\u00e1lasszuk ki, amit szeretn\u00e9nk: LDAP (AD Windows, LDAP Samba), vagy SQL, vagy lok\u00e1lis felhaszn\u00e1l\u00f3k a Flatfile rendszerben. <\/p>\n
T\u00f6lts\u00fck ki a sz\u00fcks\u00e9ges mez\u0151ket.<\/p>\n
Ezut\u00e1n hozzunk l\u00e9tre REALM-eket:
\nA jobb fels\u0151 sarokban kattintsunk a LinOTP Config \u2192 Realms \u2192 \u00daj gombra. 
\n\u00c9s adjunk nevet a REALM-nek, valamint kattintsunk a kor\u00e1bban l\u00e9trehozott UserIdResolvers-ra.<\/p>\n
Mindezek az adatok sz\u00fcks\u00e9gesek a FreeRadius sz\u00e1m\u00e1ra a \/etc\/linotp2\/rlm_perl.ini f\u00e1jlban, ahogy azt fentebb eml\u00edtettem, teh\u00e1t ha nem szerkesztetted m\u00e9g, tedd meg most.<\/p>\n
Az \u00f6sszes szerver be van \u00e1ll\u00edtva.<\/p>\n
Kieg\u00e9sz\u00edt\u00e9s:<\/p>\n
LinOTP konfigur\u00e1l\u00e1sa Debian 9 alatt<\/b>:<\/p>\n
Telep\u00edt\u00e9s: <\/p>\n
# echo 'deb http:\/\/linotp.org\/apt\/debian stretch linotp' > \/etc\/apt\/sources.list.d\/linotp.list <\/code><\/pre>\n
# apt-get install dirmngr<\/code><\/pre>\n
<\/p>\n
# apt-key adv --recv-keys 913DFF12F86258E5\n<\/code><\/pre>\n
# apt-get update<\/code><\/pre>\n
<\/p>\n
# apt-get install mysql-server<\/code><\/pre>\n
 (alap\u00e9rtelmez\u00e9s szerint Debian 9 alatt a mysql (MariaDB) nem k\u00edn\u00e1l meg root jelsz\u00f3 megad\u00e1s\u00e1t, term\u00e9szetesen hagyhatod \u00fcresen, de ha olvasod a h\u00edreket, ez nagyon gyakran \"epikus kudarcokhoz\" vezet, ez\u00e9rt ink\u00e1bb be\u00e1ll\u00edtjuk.)<\/p>\n
# mysql -u root -p<\/code><\/pre>\n
use mysql;<\/code><\/pre>\n
UPDATE user SET Password = PASSWORD('itt_jelsz\u00f3') WHERE User = 'root';\n<\/code><\/pre>\n
exit<\/code><\/pre>\n
# apt-get install linotp<\/code><\/pre>\n
# apt-get install linotp-adminclient-cli<\/code><\/pre>\n
# apt-get install python-ldap<\/code><\/pre>\n
# apt install freeradius<\/code><\/pre>\n
# nano \/etc\/freeradius\/3.0\/sites-enabled\/linotp<\/code><\/pre>\n
Illessze be a k\u00f3dot (JuriM k\u00fcldte, k\u00f6sz\u00f6net \u00e9rte!):<\/p>\n
server linotp {
\nlisten {
\n ipaddr = *
\n port = 1812
\n type = auth
\n}
\nlisten {
\n ipaddr = *
\n port = 1813
\n type = acct
\n}
\nauthorize { 
\n preprocess
\n update { 
\n &control:Auth-Type := Perl
\n } 
\n} 
\nauthenticate {
\n Auth-Type Perl {
\n perl
\n }
\n}
\naccounting {
\n unix
\n}
\n}<\/p><\/blockquote>\n
Szerkeszti a \/etc\/freeradius\/3.0\/mods-enabled\/perl f\u00e1jlt.<\/p>\n
perl {
\n filename = \/usr\/share\/linotp\/radius_linotp.pm
\n func_authenticate = authenticate
\n func_authorize = authorize
\n}<\/p><\/blockquote>\n
Sajnos Debian 9 alatt a radius_linotp.pm k\u00f6nyvt\u00e1r nem telep\u00edthet\u0151 a t\u00e1rol\u00f3kb\u00f3l, ez\u00e9rt a GitHubr\u00f3l fogjuk beszerezni.<\/p>\n
# apt install git<\/code><\/pre>\n
# git clone https:\/\/github.com\/LinOTP\/linotp-auth-freeradius-perl<\/code><\/pre>\n
# cd linotp-auth-freeradius-perl\/<\/code><\/pre>\n
# cp radius_linotp.pm \/usr\/share\/linotp\/radius_linotp.pm<\/code><\/pre>\n
Most m\u00f3dos\u00edtjuk a \/etc\/freeradius\/3.0\/clients.conf f\u00e1jlt. <\/p>\n
client servers {
\n ipaddr = 192.168.188.0\/24
\n secret = a_te_jelszavad
\n}<\/p><\/blockquote>\n
Most m\u00f3dos\u00edtjuk a nano \/etc\/linotp2\/rlm_perl.ini f\u00e1jlt.<\/p>\n
Illessze be oda ugyanazt a k\u00f3dot, mint amikor a Debian 8-ra telep\u00edtett\u00fck (ahogy fentebb le\u00edrtuk).<\/p>\n
Alapvet\u0151en ennyi. (m\u00e9g nem tesztelt\u00fck)<\/p>\n
Al\u00e1bb hagyok n\u00e9h\u00e1ny linket a rendszerek konfigur\u00e1l\u00e1s\u00e1hoz, amelyeket gyakran kell kett\u0151s hiteles\u00edt\u00e9ssel v\u00e9deni: 
\nKett\u0151s hiteles\u00edt\u00e9s be\u00e1ll\u00edt\u00e1sa az Apache2<\/a><\/noindex><\/p>\n
K\u00e9tszint\u0171 hiteles\u00edt\u00e9s Cisco ASA-val<\/a><\/noindex>(ott egy m\u00e1sik token gener\u00e1l\u00f3 szerver haszn\u00e1lj\u00e1k, de a ASA be\u00e1ll\u00edt\u00e1sok ugyanazok).<\/p>\n
VPN kett\u0151s hiteles\u00edt\u00e9ssel<\/a><\/noindex><\/p>\n
Be\u00e1ll\u00edt\u00e1s kett\u0151s hiteles\u00edt\u00e9s ssh-ban<\/a><\/noindex> (ott is LinOTP-t haszn\u00e1lnak) \u2013 k\u00f6sz\u00f6net a szerz\u0151nek. Ott \u00e9rdekes dolgokat tal\u00e1lhatsz a LiOTP politik\u00e1k be\u00e1ll\u00edt\u00e1s\u00e1r\u00f3l.<\/p>\n
Sz\u00e1mos weboldal CMS rendszere is t\u00e1mogatja a kett\u0151s hiteles\u00edt\u00e9st (A WordPresshez a LinOTP-nek m\u00e9g van egy saj\u00e1t modulja a github<\/a><\/noindex>), p\u00e9ld\u00e1ul, ha v\u00e9dett szakaszt szeretn\u00e9l l\u00e9trehozni a v\u00e1llalati webhelyeden a munkav\u00e1llal\u00f3k sz\u00e1m\u00e1ra.
\nFONTOS T\u00c9NY! NE jel\u00f6lje be a \u201eGoogle autentik\u00e1tor\u201d opci\u00f3t a Google autentik\u00e1tor haszn\u00e1lat\u00e1hoz! A QR-k\u00f3d akkor nem olvashat\u00f3... (furcsa t\u00e9ny)<\/p>\n
A cikk \u00edr\u00e1s\u00e1hoz a k\u00f6vetkez\u0151 cikkek inform\u00e1ci\u00f3it haszn\u00e1ltam fel:
\nitnan.hu\/post.php?c=1&p=270571<\/a><\/noindex>
\nwww.digitalbears.net\/?p=469<\/a><\/noindex> <\/p>\n
K\u00f6sz\u00f6n\u00f6m a szerz\u0151knek.
\n
Forr\u00e1s: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0445\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f, \u043a\u0430\u043a \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0441\u0430\u0439\u0442\u043e\u0432, \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432,ssh. \u041d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441\u0432\u044f\u0437\u043a\u0430: LinOTP + FreeRadius. \u0417\u0430\u0447\u0435\u043c \u043e\u043d \u043d\u0430\u043c? \u042d\u0442\u043e \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u043e\u0435, \u0443\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435, \u0432\u043d\u0443\u0442\u0440\u0438 \u0441\u0432\u043e\u0435\u0439 \u0441\u0435\u0442\u0438, \u043d\u0435 \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0435\u0435 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432. \u0414\u0430\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0432\u0435\u0441\u044c\u043c\u0430 \u0443\u0434\u043e\u0431\u0435\u043d, \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043d\u0430\u0433\u043b\u044f\u0434\u0435\u043d, \u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0438 \u043e\u0442 \u0434\u0440\u0443\u0433\u0438\u0445 \u043e\u043f\u0435\u043d\u0441\u043e\u0440\u0441 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432, \u0430 \u0442\u0430\u043a \u0436\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27627,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36873","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A LinOTP k\u00e9tfaktoros azonos\u00edt\u00f3 szerver | ProHoster","description":"Ma szeretn\u00e9k megosztani, hogyan lehet be\u00e1ll\u00edtani a szervert.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/server-dvuhfaktornoj-avtorizatsii-linotp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0435\u0440\u0432\u0435\u0440 \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 LinOTP | ProHoster","og:description":"\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044f \u0445\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f, \u043a\u0430\u043a \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440.","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/server-dvuhfaktornoj-avtorizatsii-linotp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:14:26+00:00","article:modified_time":"2019-10-31T19:14:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36873","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:08:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:37:23","updated":"2026-01-22 05:08:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/36873","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=36873"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/36873\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/27627"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=36873"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=36873"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=36873"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}