{"id":78242,"date":"2020-04-18T01:42:36","date_gmt":"2020-04-17T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa"},"modified":"2020-04-18T01:42:36","modified_gmt":"2020-04-17T23:42:36","slug":"realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","title":{"rendered":"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Folytatva a szervez\u00e9si t\u00e9m\u00e1ban \u00edrt cikkek sorozat\u00e1t <strong>Remote-Access VPN<\/strong> hozz\u00e1f\u00e9r\u00e9sr\u0151l nem tudok nem megosztani egy \u00e9rdekes tapasztalatot a telep\u00edt\u00e9sr\u0151l <strong>magas biztons\u00e1g\u00fa VPN konfigur\u00e1ci\u00f3r\u00f3l<\/strong>. Egy \u00e9rdekes feladatot dobott nekem az egyik megrendel\u0151 (vannak kreat\u00edv emberek az orosz falvakban), de elv\u00e1llaltam a kih\u00edv\u00e1st \u00e9s kreat\u00edvan megval\u00f3s\u00edtottam. Ennek eredm\u00e9nyek\u00e9nt egy \u00e9rdekes koncepci\u00f3 sz\u00fcletett a k\u00f6vetkez\u0151 jellemz\u0151kkel:<\/p>\n<p><\/p>\n<ol>\n<li>T\u00f6bb v\u00e9delmi t\u00e9nyez\u0151 a v\u00e9gberendez\u00e9s hamis\u00edt\u00e1s\u00e1nak megakad\u00e1lyoz\u00e1s\u00e1ra (szigor\u00fa felhaszn\u00e1l\u00f3i k\u00f6t\u0151d\u00e9ssel);\n<ul>\n<li>A felhaszn\u00e1l\u00f3 PC-j\u00e9nek megfelel\u0151s\u00e9ge az enged\u00e9lyezett PC UDID-j\u00e1hoz az autentik\u00e1l\u00e1si adatb\u00e1zisban; <\/li>\n<li>MFA-val, amely a m\u00e1sodik autentik\u00e1ci\u00f3hoz a tan\u00fas\u00edtv\u00e1nyb\u00f3l sz\u00e1rmaz\u00f3 PC UDID-t haszn\u00e1lja a Cisco DUO-n kereszt\u00fcl <em>(B\u00e1rmilyen SAML\/RADIUS-kompatibilis megold\u00e1s is csatlakoztathat\u00f3)<\/em>; <\/li>\n<\/ul>\n<\/li>\n<li>T\u00f6bbfaktoros autentik\u00e1ci\u00f3val: \n<ul>\n<li>Felhaszn\u00e1l\u00f3i tan\u00fas\u00edtv\u00e1ny mez\u0151inek ellen\u0151rz\u00e9s\u00e9vel \u00e9s az egyik\u00fck alapj\u00e1n v\u00e9gzett m\u00e1sodik autentik\u00e1ci\u00f3val;<\/li>\n<li>Felhaszn\u00e1l\u00f3n\u00e9v (nem m\u00f3dos\u00edthat\u00f3, a tan\u00fas\u00edtv\u00e1nyb\u00f3l kinyert) \u00e9s jelsz\u00f3;<\/li>\n<\/ul>\n<\/li>\n<li>A csatlakoz\u00f3 host \u00e1llapot\u00e1nak \u00e9rt\u00e9kel\u00e9s\u00e9vel (Posture)<\/li>\n<\/ol>\n<p><\/p>\n<p><strong>A megold\u00e1sban haszn\u00e1lt \u00f6sszetev\u0151k:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Cisco ASA (VPN \u00e1tj\u00e1r\u00f3);<\/li>\n<li>Cisco ISE (Autentik\u00e1ci\u00f3 \/ Enged\u00e9lyez\u00e9s \/ Sz\u00e1ml\u00e1z\u00e1s, \u00c1llapot\u00e9rt\u00e9kel\u00e9s, CA);<\/li>\n<li>Cisco DUO (T\u00f6bbfaktoros autentik\u00e1ci\u00f3) <em>(B\u00e1rmilyen SAML\/RADIUS-kompatibilis megold\u00e1s is csatlakoztathat\u00f3)<\/em>;<\/li>\n<li>Cisco AnyConnect (T\u00f6bbc\u00e9l\u00fa \u00fcgyn\u00f6k munka\u00e1llom\u00e1sokhoz \u00e9s mobil oper\u00e1ci\u00f3s rendszerekhez);<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p><strong>Kezdj\u00fck a megrendel\u0151 k\u00f6vetelm\u00e9nyeivel:<\/strong><\/p>\n<p><\/p>\n<ol>\n<li>A felhaszn\u00e1l\u00f3nak a bel\u00e9p\u00e9si azonos\u00edt\u00f3\/jelsz\u00f3 alapj\u00e1n lehet\u0151s\u00e9get kell adnia arra, hogy let\u00f6ltse az AnyConnect klienst a VPN \u00e1tj\u00e1r\u00f3r\u00f3l, minden sz\u00fcks\u00e9ges AnyConnect modult automatikusan telep\u00edteni kell a felhaszn\u00e1l\u00f3 politik\u00e1j\u00e1nak megfelel\u0151en;<\/li>\n<li>A felhaszn\u00e1l\u00f3nak lehet\u0151s\u00e9get kell biztos\u00edtani a tan\u00fas\u00edtv\u00e1ny automatikus kiad\u00e1s\u00e1ra (az egyik forgat\u00f3k\u00f6nyvhez, a f\u0151 forgat\u00f3k\u00f6nyv pedig a k\u00e9zi kiad\u00e1s \u00e9s a PC-re val\u00f3 felt\u00f6lt\u00e9s), \u00e9n viszont demonstr\u00e1ci\u00f3 c\u00e9lj\u00e1b\u00f3l automatikus kiad\u00e1st val\u00f3s\u00edtottam meg (soha nem k\u00e9s\u0151 elt\u00e1vol\u00edtani).<\/li>\n<li>A f\u0151 autentik\u00e1ci\u00f3nak t\u00f6bb l\u00e9p\u00e9sben kell zajlania, el\u0151sz\u00f6r a tan\u00fas\u00edtv\u00e1ny autentik\u00e1ci\u00f3ja t\u00f6rt\u00e9nik a sz\u00fcks\u00e9ges mez\u0151k \u00e9s azok \u00e9rt\u00e9keinek elemz\u00e9s\u00e9vel, majd a felhaszn\u00e1l\u00f3n\u00e9v\/jelsz\u00f3 k\u00f6vetkezik, de ez\u00fattal a bejelentkez\u00e9si ablakban a tan\u00fas\u00edtv\u00e1ny mez\u0151j\u00e9ben megadott felhaszn\u00e1l\u00f3nevet kell megjelen\u00edteni <strong>Subject Name (CN)<\/strong> szerkeszt\u00e9si lehet\u0151s\u00e9g n\u00e9lk\u00fcl.<\/li>\n<li>Biztos\u00edtani kell, hogy az a k\u00e9sz\u00fcl\u00e9k, ahonnan a bejelentkez\u00e9s t\u00f6rt\u00e9nik, az a v\u00e1llalat \u00e1ltal kiadott laptop legyen, amely a felhaszn\u00e1l\u00f3nak t\u00e1voli hozz\u00e1f\u00e9r\u00e9st biztos\u00edt, \u00e9s nem egy\u00e9b eszk\u00f6z (t\u00f6bb megold\u00e1s k\u00e9sz\u00fclt ennek a k\u00f6vetelm\u00e9nynek a teljes\u00edt\u00e9s\u00e9re)<\/li>\n<li>A device condition assessment (at this stage the PC) must be conducted, verifying a comprehensive checklist of the client's requirements (in summary):\n<ul>\n<li>Files and their attributes;<\/li>\n<li>Registry entries;<\/li>\n<li>OS patches from the provided list (subsequent integration with SCCM);<\/li>\n<li>Presence of antivirus from a specific vendor and the relevance of signatures;<\/li>\n<li>Activity of specific services;<\/li>\n<li>Presence of specific installed programs;<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/p>\n<p>To begin, I suggest we mandatory watch a video demonstration of the resulting implementation on <strong>YouTube (5 minutes)<\/strong>.<\/p>\n<p>\n<center><div class=\"youtube-placeholder\" data-id=\"cBftD3KFK98\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/cBftD3KFK98\/hqdefault.jpg\" alt=\"Vide\u00f3 lej\u00e1tsz\u00e1sa\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>Now, I suggest we consider the implementation details not covered in the video.<\/p>\n<p><\/p>\n<p><strong>Let's prepare the AnyConnect profile:<\/strong><\/p>\n<p><\/p>\n<p>I previously provided an example of creating a profile (in terms of the menu item in ASDM) in my article on setting up <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing cluster.<\/a><\/noindex>Now, I want to specifically highlight the options we will need:<\/p>\n<p><\/p>\n<p>In the profile, we will specify the VPN gateway and the profile name for the client connection:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.\" src=\"\/wp-content\/uploads\/2020\/04\/45ff3cb1f7b592e102bd6e256ae26043.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>We will configure automatic certificate issuance from the profile, specifying, in particular, the certificate parameters, and notably, we will focus on the field <strong>Initials (I)<\/strong>, where a specific value has been manually entered <strong>UDID<\/strong> of the test machine (Unique Device Identifier, generated by the Cisco AnyConnect client).<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.\" src=\"\/wp-content\/uploads\/2020\/04\/89d4edb4f1b166eda75916286998a4bf.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Here, I want to make a lyrical digression, as this article describes the concept. For demonstration purposes, the UDID is entered for certificate issuance in the Initials field of the AnyConnect profile. In real life, if you do this, all clients will receive the certificate with the same UDID in this field, and nothing will work for them, since they need the UDID specific to their PCs. Unfortunately, AnyConnect does not yet implement profile substitution for the certificate request in the UDID field through an environment variable, as it does with the variable <strong>%USER%<\/strong>.<\/p>\n<p><\/p>\n<p>It is worth noting that the client (in this scenario) initially plans to issue certificates with the specified UDID manually for such Protected PCs, which is not a problem for them. However, for most of us, automation is desirable (well, at least for me =). <\/p>\n<p><\/p>\n<p>\u00c9s itt van, amit az automatiz\u00e1l\u00e1s ter\u00e9n fel tudok aj\u00e1nlani. Ha a tan\u00fas\u00edtv\u00e1nyt automatikusan, az AnyConnect alkalmaz\u00e1s dinamikusan behelyettes\u00edtve az UDID-t, akkor van egy m\u00e1sik m\u00f3dszer is, ami ig\u00e9nyel egy kis kreat\u00edv gondolkod\u00e1st \u00e9s \u00fcgyes kezeket \u2013 elmondom a koncepci\u00f3t. El\u0151sz\u00f6r n\u00e9zz\u00fck meg, hogyan k\u00e9pz\u0151dik az UDID k\u00fcl\u00f6nb\u00f6z\u0151 oper\u00e1ci\u00f3s rendszereken az AnyConnect \u00fcgyn\u00f6k \u00e1ltal: <\/p>\n<p><\/p>\n<ul>\n<li><strong>Windows<\/strong> \u2014 SHA-256 kombin\u00e1ci\u00f3s hash a DigitalProductID rendszerregisztr\u00e1ci\u00f3s kulcs \u00e9s a Machine SID alapj\u00e1n<\/li>\n<li><strong>OSX<\/strong> \u2014 SHA-256 hash a PlatformUUID alapj\u00e1n<\/li>\n<li><strong>Linux<\/strong> \u2014 SHA-256 hash a root part\u00edci\u00f3 UUID alapj\u00e1n.<\/li>\n<li><strong>Apple iOS<\/strong> \u2014 SHA-256 hash a PlatformUUID alapj\u00e1n<\/li>\n<li><strong>Android<\/strong> \u2013 N\u00e9zd meg a dokumentumot a <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/security\/vpn_client\/anyconnect\/anyconnect40\/administration\/guide\/b_AnyConnect_Administrator_Guide_4-0\/b_AnyConnect_Administrator_Guide_4-0_chapter_01010.html#reference_C87ADD1C58F64EF8928D921323209AA6\">linkre kattintva<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<p>Ennek megfelel\u0151en k\u00e9sz\u00edt\u00fcnk egy scriptet a v\u00e1llalati Windows OS-ekhez, ezzel a scriptel helyben sz\u00e1moljuk ki az UDID-t a megadott bemenetek alapj\u00e1n, \u00e9s k\u00e9relmet k\u00e9sz\u00edt\u00fcnk a tan\u00fas\u00edtv\u00e1ny kiad\u00e1s\u00e1ra az UDID-t a megfelel\u0151 mez\u0151be be\u00edrva, egy\u00e9bk\u00e9nt a g\u00e9pi tan\u00fas\u00edtv\u00e1ny is haszn\u00e1lhat\u00f3, amit az AD adott (dupla hiteles\u00edt\u00e9st is hozz\u00e1adva a tan\u00fas\u00edtv\u00e1ny alapj\u00e1n <strong>T\u00f6bb Tan\u00fas\u00edtv\u00e1ny<\/strong>). <\/p>\n<p><\/p>\n<p><strong>K\u00e9sz\u00edts\u00fck el a Cisco ASA oldali be\u00e1ll\u00edt\u00e1sokat:<\/strong><\/p>\n<p><\/p>\n<p>Hozzunk l\u00e9tre egy TrustPoint-ot az ISE CA szerverhez, ez fogja kiadni a tan\u00fas\u00edtv\u00e1nyokat az \u00fcgyfeleknek. A Key-Chain import\u00e1l\u00e1s elj\u00e1r\u00e1s\u00e1t nem fogom t\u00e1rgyalni, a p\u00e9lda le van \u00edrva a be\u00e1ll\u00edt\u00e1sokra vonatkoz\u00f3 cikkemben. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing cluster.<\/a><\/noindex>. <\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">crypto ca trustpoint ISE-CA\n enrollment terminal\n crl configure<\/code><\/pre>\n<p><\/p>\n<p>Be\u00e1ll\u00edtjuk a Tunnel-Group eloszt\u00e1s\u00e1t a tan\u00fas\u00edtv\u00e1nyban szerepl\u0151 mez\u0151k alapj\u00e1n t\u00f6rt\u00e9n\u0151 hiteles\u00edt\u00e9si szab\u00e1lyok szerint. Itt ker\u00fcl be\u00e1ll\u00edt\u00e1sra az AnyConnect profil is, amit az el\u0151z\u0151 l\u00e9p\u00e9sben k\u00e9sz\u00edtett\u00fcnk. Felh\u00edvom a figyelmet, hogy az \u00e9rt\u00e9ket haszn\u00e1lom <strong>SECUREBANK-RA<\/strong>, a kiadott tan\u00fas\u00edtv\u00e1nnyal rendelkez\u0151 felhaszn\u00e1l\u00f3k \u00e1tvitel\u00e9re a tunnel csoportba. <strong>SECURE-BANK-VPN<\/strong>, k\u00e9rlek, vedd \u00e9szre, hogy ez a mez\u0151 n\u00e1lam a k\u00e9r\u00e9s mez\u0151j\u00e9ben van felt\u00fcntetve az AnyConnect profiln\u00e1l.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">tunnel-group-map enable rules\n!\ncrypto ca certificate map OU-Map 6\n subject-name attr ou eq securebank-ra\n!\nwebvpn\n anyconnect profiles SECUREBANK disk0:\/securebank.xml\n certificate-group-map OU-Map 6 SECURE-BANK-VPN\n!<\/code><\/pre>\n<p><\/p>\n<p>Be\u00e1ll\u00edtjuk a hiteles\u00edt\u00e9si szervereket. Az \u00e9n esetemben ez ISE az els\u0151 hiteles\u00edt\u00e9si szakaszhoz, \u00e9s a DUO (Radius Proxy) mint MFA.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">! CISCO ISE\naaa-server ISE protocol radius\n authorize-only\n interim-accounting-update periodic 24\n dynamic-authorization\naaa-server ISE (inside) host 192.168.99.134\n key *****\n!\n! DUO RADIUS PROXY\naaa-server DUO protocol radius\naaa-server DUO (inside) host 192.168.99.136\n timeout 60\n key *****\n authentication-port 1812\n accounting-port 1813\n no mschapv2-capable\n!<\/code><\/pre>\n<p><\/p>\n<p>Csoportos politik\u00e1k \u00e9s tunnel csoportok, valamint kieg\u00e9sz\u00edt\u0151 komponenseik l\u00e9trehoz\u00e1sa:<\/p>\n<p><\/p>\n<p>Tunnel csoport <strong>DefaultWEBVPNGroup<\/strong> Els\u0151dlegesen az AnyConnect VPN kliens let\u00f6lt\u00e9s\u00e9re \u00e9s a felhaszn\u00e1l\u00f3i tan\u00fas\u00edtv\u00e1ny kiad\u00e1s\u00e1ra fogj\u00e1k haszn\u00e1lni a ASA SCEP-Proxy funkci\u00f3j\u00e1val. Ehhez az ehhez sz\u00fcks\u00e9ges opci\u00f3k aktiv\u00e1lva vannak mind a tunneling csoportban, mind az ahhoz t\u00e1rs\u00edtott csoportos szab\u00e1lyzatban. <strong>AC-Download<\/strong>, valamint az AnyConnect let\u00f6lt\u00e9si profilj\u00e1n (tan\u00fas\u00edtv\u00e1nykiad\u00e1si mez\u0151k stb.). Ezen a csoportos szab\u00e1lyzaton bel\u00fcl jelezz\u00fck, hogy sz\u00fcks\u00e9ges a let\u00f6lt\u00e9s. <strong>ISE Posture Module<\/strong>.<\/p>\n<p><\/p>\n<p>Tunnel csoport <strong>SECURE-BANK-VPN<\/strong> automatikusan haszn\u00e1lva lesz a kliens \u00e1ltal, amikor a kor\u00e1bban kiadott tan\u00fas\u00edtv\u00e1nnyal t\u00f6rt\u00e9nik az azonos\u00edt\u00e1s, mivel a tan\u00fas\u00edtv\u00e1nyt\u00e9rk\u00e9p szerint a kapcsolat pontosan erre a tunneling csoportra \u00e9p\u00fcl. K\u00fcl\u00f6nb\u00f6z\u0151 izgalmas opci\u00f3kr\u00f3l fogok itt besz\u00e9lni:<\/p>\n<p><\/p>\n<ul>\n<li><strong>secondary-authentication-server-group DUO<\/strong> # \u0417\u0430\u0434\u0430\u0435\u043c \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO (Radius Proxy)<\/li>\n<li><strong>username-from-certificate CN<\/strong> # \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0435 CN \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043b\u043e\u0433\u0438\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f<\/li>\n<li><strong>secondary-username-from-certificate I<\/strong> # \u0414\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u043d\u043e\u0435 \u0438 \u043f\u043e\u043b\u044f Initials (I) \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430.<\/li>\n<li><strong>pre-fill-username client<\/strong> # \u0434\u0435\u043b\u0430\u0435\u043c \u043f\u0440\u0435\u0434\u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u043e\u043a\u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f<\/li>\n<li><strong>secondary-pre-fill-username client hide use-common-password push<\/strong> # \u041f\u0440\u044f\u0447\u0435\u043c \u043e\u043a\u043d\u043e \u0432\u0432\u043e\u0434\u0430 \u043b\u043e\u0433\u0438\u043d\u0430\/\u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 DUO \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u043e\u043b\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u043c\u0435\u0442\u043e\u0434 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f (sms\/push\/phone) \u2013 \u0434\u043e\u043a\u0430 <noindex><a rel=\"nofollow\" href=\"https:\/\/duo.com\/docs\/ciscoasa-radius\">itt<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">!\naccess-list posture-redirect extended permit tcp any host 72.163.1.80 \naccess-list posture-redirect extended deny ip any any\n!\naccess-list VPN-Filter extended permit ip any any\n!\nip local pool vpn-pool 192.168.100.33-192.168.100.63 mask 255.255.255.224\n!\ngroup-policy SECURE-BANK-VPN internal\ngroup-policy SECURE-BANK-VPN attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ngroup-policy AC-DOWNLOAD internal\ngroup-policy AC-DOWNLOAD attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n scep-forwarding-url value http:\/\/ise.ashes.cc:9090\/auth\/caservice\/pkiclient.exe\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ntunnel-group DefaultWEBVPNGroup general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n accounting-server-group ISE\n default-group-policy AC-DOWNLOAD\n scep-enrollment enable\ntunnel-group DefaultWEBVPNGroup webvpn-attributes\n authentication aaa certificate\n!\ntunnel-group SECURE-BANK-VPN type remote-access\ntunnel-group SECURE-BANK-VPN general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n secondary-authentication-server-group DUO\n accounting-server-group ISE\n default-group-policy SECURE-BANK-VPN\n username-from-certificate CN\n secondary-username-from-certificate I\ntunnel-group SECURE-BANK-VPN webvpn-attributes\n authentication aaa certificate\n pre-fill-username client\n secondary-pre-fill-username client hide use-common-password push\n group-alias SECURE-BANK-VPN enable\n dns-group ASHES-DNS\n!<\/code><\/pre>\n<p><\/p>\n<p><strong>Tov\u00e1bb l\u00e9p\u00fcnk az ISE-hez:<\/strong><\/p>\n<p><\/p>\n<p>Be\u00e1ll\u00edtjuk a helyi felhaszn\u00e1l\u00f3t (haszn\u00e1lhat\u00f3 AD\/LDAP\/ODBC stb. is), egyszer\u0171s\u00e9g kedv\u00e9\u00e9rt \u00e9n a legjobb megold\u00e1st v\u00e1lasztottam a helyi felhaszn\u00e1l\u00f3 l\u00e9trehoz\u00e1s\u00e1val az ISE-ben, \u00e9s az al\u00e1bbi mez\u0151ben \u00e1ll\u00edtottam be: <strong>le\u00edr\u00e1s<\/strong> <strong>PC UDID<\/strong> amelyr\u0151l enged\u00e9lyezve van a VPN-hez val\u00f3 hozz\u00e1f\u00e9r\u00e9s. Ha az ISE-n helyi hiteles\u00edt\u00e9st haszn\u00e1lok, akkor csak egy eszk\u00f6zre leszek korl\u00e1tozva, mivel nem sok mez\u0151 \u00e1ll rendelkez\u00e9semre, de harmadik f\u00e9l \u00e1ltal biztos\u00edtott hiteles\u00edt\u00e9si adatb\u00e1zisok eset\u00e9n nem lesznek ilyen korl\u00e1toz\u00e1sok.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.\" src=\"\/wp-content\/uploads\/2020\/04\/ea73d4bab6c0872f7c3aef4ad1345b12.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>N\u00e9zz\u00fck meg a hiteles\u00edt\u00e9si politik\u00e1t, amely n\u00e9gy l\u00e9p\u00e9sre oszlik:<\/p>\n<p><\/p>\n<ul>\n<li><strong>1. l\u00e9p\u00e9s<\/strong> \u2014 Politika az AnyConnect \u00fcgyn\u00f6k let\u00f6lt\u00e9s\u00e9re \u00e9s a tan\u00fas\u00edtv\u00e1ny kiad\u00e1s\u00e1ra<\/li>\n<li><strong>2. l\u00e9p\u00e9s<\/strong> \u2014 Els\u0151dleges hiteles\u00edt\u00e9si politika: Bejelentkez\u00e9s (tan\u00fas\u00edtv\u00e1ny alapj\u00e1n)\/Jelsz\u00f3 + UDID \u00e9rv\u00e9nyes\u00edt\u00e9s\u00e9vel<\/li>\n<li><strong>3. l\u00e9p\u00e9s<\/strong> \u2014 M\u00e1sodlagos hiteles\u00edt\u00e9s a Cisco DUO (MFA) r\u00e9v\u00e9n, UDID mint felhaszn\u00e1l\u00f3n\u00e9v + \u00c1llapot\u00e9rt\u00e9kel\u00e9s<\/li>\n<li><strong>4. l\u00e9p\u00e9s<\/strong> \u2014 V\u00e9gs\u0151 hiteles\u00edt\u00e9s \u00e1llapota:\n<ul>\n<li>Megfelel\u0151;<\/li>\n<li>UDID \u00e9rv\u00e9nyes\u00edt\u00e9se (tan\u00fas\u00edtv\u00e1nyb\u00f3l + bejelentkez\u00e9shez val\u00f3 hozz\u00e1rendel\u00e9s), <\/li>\n<li>Cisco DUO MFA;<\/li>\n<li>Bejelentkez\u00e9s szerinti hiteles\u00edt\u00e9s; <\/li>\n<li>Tan\u00fas\u00edtv\u00e1ny szerinti hiteles\u00edt\u00e9s;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.\" src=\"\/wp-content\/uploads\/2020\/04\/f0927091b896dc1e8b7fde35f9ff9211.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>N\u00e9zz\u00fck meg az \u00e9rdekes felt\u00e9telt <strong>UUID_VALIDATED<\/strong>, amely pontosan ellen\u0151rzi, hogy a hiteles\u00edt\u00e9sre v\u00e1r\u00f3 felhaszn\u00e1l\u00f3 t\u00e9nyleg egy enged\u00e9lyezett UDID-del rendelkez\u0151 PC-r\u0151l \u00e9rkezett a mez\u0151 szerint <strong>Le\u00edr\u00e1s<\/strong> a felhaszn\u00e1l\u00f3i fi\u00f3kj\u00e1ban, a felt\u00e9tel a k\u00f6vetkez\u0151k\u00e9ppen n\u00e9z ki:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.\" src=\"\/wp-content\/uploads\/2020\/04\/73952c705b376246f8b2fb9de883302b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A 1., 2. \u00e9s 3. l\u00e9p\u00e9sekn\u00e9l haszn\u00e1lt hiteles\u00edt\u00e9si profil a k\u00f6vetkez\u0151k\u00e9ppen n\u00e9z ki:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.\" src=\"\/wp-content\/uploads\/2020\/04\/4b1eb6688a5a42d74b587424b02624e1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Megvizsg\u00e1lhatjuk, hogy pontosan hogyan \u00e9rkezik a UDID a AnyConnect klienst\u0151l, ha megn\u00e9zz\u00fck az ISE klienssession r\u00e9szleteit. A r\u00e9szletekben l\u00e1tni fogjuk, hogy az AnyConnect az <strong>ACIDEX<\/strong> mechanizmuson kereszt\u00fcl nemcsak a platform adatait k\u00fcldi, hanem a k\u00e9sz\u00fcl\u00e9k UDID-j\u00e1t is mint <strong>Cisco-AV-PAIR<\/strong>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.\" src=\"\/wp-content\/uploads\/2020\/04\/34859d3b6a5edb448999eaec49c59669.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Figyelj\u00fck meg a felhaszn\u00e1l\u00f3nak kiadott tan\u00fas\u00edtv\u00e1nyt \u00e9s a mez\u0151t <strong>Initials (I)<\/strong>, amely arra szolg\u00e1l, hogy ezt haszn\u00e1ljuk a Cisco DUO m\u00e1sodlagos hiteles\u00edt\u00e9si MFA bejelentkez\u00e9sk\u00e9nt:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.\" src=\"\/wp-content\/uploads\/2020\/04\/ac5928db33e5dbbb1bd7e2190da6d9fa.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A DUO Radius Proxy oldal\u00e1n a napl\u00f3ban vil\u00e1gosan l\u00e1tjuk, hogy hogyan t\u00f6rt\u00e9nik a hiteles\u00edt\u00e9si k\u00e9r\u00e9s, amely UDID-t haszn\u00e1l felhaszn\u00e1l\u00f3n\u00e9vk\u00e9nt:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.\" src=\"\/wp-content\/uploads\/2020\/04\/791f5470115460dc4d920096e79dde0f.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A DUO port\u00e1l oldal\u00e1r\u00f3l egy sikeres hiteles\u00edt\u00e9si esem\u00e9nyt l\u00e1tunk:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.\" src=\"\/wp-content\/uploads\/2020\/04\/a31e31c57ad8b6e4ba021f3da7eedb7e.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A felhaszn\u00e1l\u00f3 tulajdons\u00e1gaiban l\u00e1tom, hogy van be\u00e1ll\u00edtva <strong>ALIAS<\/strong>, amelyet a bejelentkez\u00e9shez haszn\u00e1ltam, r\u00e1ad\u00e1sul ez a j\u00f3v\u00e1hagyott UDID a bejelentkez\u00e9si PC-hez:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"A magas biztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa.\" src=\"\/wp-content\/uploads\/2020\/04\/4035937749d1b85bad291aa4ec407352.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>Ennek eredm\u00e9nyek\u00e9ppen megkaptuk:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>A felhaszn\u00e1l\u00f3 \u00e9s az eszk\u00f6z t\u00f6bbl\u00e9pcs\u0151s hiteles\u00edt\u00e9se;<\/li>\n<li>A felhaszn\u00e1l\u00f3i eszk\u00f6z hamis\u00edt\u00e1s\u00e1nak v\u00e9delme;<\/li>\n<li>Az eszk\u00f6z \u00e1llapot\u00e1nak \u00e9rt\u00e9kel\u00e9se;<\/li>\n<li>Lehet\u0151s\u00e9g a domain g\u00e9pi tan\u00fas\u00edtv\u00e1ny\u00e1nak \u00e9s egyebeknek a meger\u0151s\u00edt\u00e9s\u00e9re;<\/li>\n<li>Teljes k\u00f6r\u0171 v\u00e9delem a t\u00e1voli munkahely sz\u00e1m\u00e1ra automatikusan telep\u00edthet\u0151 biztons\u00e1gi modulokkal;<\/li>\n<\/ul>\n<p><\/p>\n<p>Cikkek a Cisco VPN sorozatr\u00f3l:<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">ASA VPN Load-Balancing klaszter telep\u00edt\u00e9se<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493774\/\">Felh\u0151szolg\u00e1ltat\u00e1sok optimaliz\u00e1l\u00e1sa AnyConnect VPN alag\u00faton a Cisco ASA-n<\/a><\/noindex><\/li>\n<\/ul>\n<p>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/497618\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e); [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47A nagybiztons\u00e1g\u00fa t\u00e1voli hozz\u00e1f\u00e9r\u00e9s megval\u00f3s\u00edt\u00e1sa | ProHoster","description":"A Remote-Access VPN hozz\u00e1f\u00e9r\u00e9s megszervez\u00e9se t\u00e9mak\u00f6r\u00e9ben folytatva a cikkek sorozat\u00e1t, nem tudom nem megosztani az \u00e9rdekes tapasztalataimat a nagybiztons\u00e1g\u00fa VPN konfigur\u00e1ci\u00f3 telep\u00edt\u00e9s\u00e9r\u0151l.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-17T23:42:36+00:00","article:modified_time":"2020-04-17T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:02:45","updated":"2022-09-29 00:42:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/78242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=78242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/78242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/78243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=78242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=78242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=78242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}