{"id":36535,"date":"2019-10-31T22:12:11","date_gmt":"2019-10-31T19:12:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\/"},"modified":"2019-10-31T22:12:11","modified_gmt":"2019-10-31T19:12:11","slug":"kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","title":{"rendered":"Cum s\u0103 folose\u0219ti modulele PAM pentru autentificarea local\u0103 \u00een Linux cu chei GOST-2012 pe Rutoken.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Cum s\u0103 folose\u0219ti modulele PAM pentru autentificarea local\u0103 \u00een Linux cu chei GOST-2012 pe Rutoken.\" src=\"\/wp-content\/uploads\/2019\/07\/e6656d4db027ab2705550726d5ab1908.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nParolele simple nu protejeaz\u0103, iar cele complexe sunt imposibil de re\u021binut. Din acest motiv, ele ajung adesea pe un autocolant sub tastatur\u0103 sau pe monitor. Pentru ca parolele s\u0103 r\u0103m\u00e2n\u0103 \u00een min\u021bile utilizatorilor \u201euitu\u021bi\u201d \u0219i fiabilitatea securit\u0103\u021bii s\u0103 nu fie pierdut\u0103, exist\u0103 autentificarea \u00een doi pa\u0219i (2FA).<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Datorit\u0103 combina\u021biei \u00eentre factorul de de\u021binere a dispozitivului \u0219i cunoa\u0219terea codului PIN, codul PIN poate fi mai simplu \u0219i mai u\u0219or de re\u021binut. Deficien\u021bele \u00een lungimea sau aleatorietatea codului PIN sunt compensate de cerin\u021ba de de\u021binere fizic\u0103 \u0219i de restric\u021biile la \u00eencerc\u0103rile de ghicire a codului PIN. <\/p>\n<p>\u00cen plus, \u00een institu\u021biile guvernamentale apare uneori dorin\u021ba ca totul s\u0103 func\u021bioneze conform standardelor na\u021bionale. Despre o astfel de variant\u0103 a 2FA pentru a accesa Linux vom discuta. \u00cencepem de la distan\u021b\u0103.<\/p>\n<h1>Module PAM<\/h1>\n<p>\nModulele de autentificare pluggable (Pluggable Authentication Modules, PAM) sunt module cu o API standard \u0219i implement\u0103ri ale diferitelor mecanisme de autentificare \u00een aplica\u021bii. <br \/>\nToate utilitarele \u0219i aplica\u021biile care pot lucra cu PAM le detecteaz\u0103 \u0219i le pot folosi pentru autentificarea utilizatorului.<br \/>\n\u00cen practic\u0103, func\u021bioneaz\u0103 cam a\u0219a: comanda login se adreseaz\u0103 la PAM, care efectueaz\u0103 toate verific\u0103rile necesare folosind modulele specificate \u00een fi\u0219ierul de configurare \u0219i returneaz\u0103 rezultatul \u00eenapoi comenzii login.<\/p>\n<h2>librtpam<\/h2>\n<p>\nModulul dezvoltat de compania \u201eActiv\u201d adaug\u0103 autentificarea \u00een doi pa\u0219i a utilizatorilor prin smartcarduri sau tokenuri USB, folosind chei asimetrice conform celor mai recente standarde de criptografie na\u021bional\u0103. <\/p>\n<p>S\u0103 examin\u0103m principiul de func\u021bionare al acestuia:<\/p>\n<ul>\n<li>pe token este stocat certificatul utilizatorului \u0219i cheia sa privat\u0103;<\/li>\n<li>certificatul este salvat \u00een directorul personal al utilizatorului ca fiind de \u00eencredere.<\/li>\n<\/ul>\n<p>Procesul de autentificare se desf\u0103\u0219oar\u0103 dup\u0103 cum urmeaz\u0103:<\/p>\n<ol>\n<li>Pe Rutoken se caut\u0103 certificatul personal al utilizatorului.<\/li>\n<li>Se solicit\u0103 codul PIN al tokenului.<\/li>\n<li>Se efectueaz\u0103 semn\u0103tura datelor aleatorii cu cheia privat\u0103 direct \u00een cipul Rutokenului.<\/li>\n<li>Semn\u0103tura ob\u021binut\u0103 este verificat\u0103 folosind cheia public\u0103 din certificatul utilizatorului.<\/li>\n<li>Modulul returneaz\u0103 aplica\u021biei care a solicitat rezultatul verific\u0103rii semn\u0103turii.<\/li>\n<\/ol>\n<p>Se poate autentifica folosind chei conform standardelor GOST R 34.10-2012 (de lungimi de 256 sau 512 bi\u021bi) sau \u00eenvechitului GOST R 34.10-2001. <\/p>\n<p>Nu trebuie s\u0103 ne facem griji cu privire la securitatea cheilor \u2013 acestea sunt generate direct \u00een Rutoken \u0219i nu p\u0103r\u0103sesc niciodat\u0103 memoria sa \u00een timpul opera\u021biunilor criptografice.<\/p>\n<p><img decoding=\"async\" alt=\"Cum s\u0103 folose\u0219ti modulele PAM pentru autentificarea local\u0103 \u00een Linux cu chei GOST-2012 pe Rutoken.\" src=\"\/wp-content\/uploads\/2019\/07\/61047962c9aee308d69553201e05203d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRutoken ECDP 2.0 este certificat de FSB \u0219i FSTEK conform NDV 4, ceea ce \u00eel face utilizabil \u00een sistemele informa\u021bionale care proceseaz\u0103 informa\u021bii confiden\u021biale. <\/p>\n<h2>Utilizare practic\u0103<\/h2>\n<p>\nSe potrive\u0219te practic orice versiune modern\u0103 de Linux, de exemplu, vom folosi xUbuntu 18.10.<\/p>\n<h3>1) Instal\u0103m pachetele necesare<\/h3>\n<p>\n<code>sudo apt-get install libccid pcscd opensc<\/code><br \/>\nDac\u0103 dori\u021bi s\u0103 ad\u0103uga\u021bi blocarea desktopului cu un screensaver \u2013 instala\u021bi suplimentar pachetul <code>libpam-pkcs11<\/code>.<\/p>\n<h3>2) Ad\u0103ug\u0103m modul PAM cu suport pentru standardele GOST<\/h3>\n<p>\n\u00cenc\u0103rc\u0103m biblioteca cu <noindex><a rel=\"nofollow\" href=\"https:\/\/download.rutoken.ru\/Rutoken\/PAM\/\">https:\/\/download.rutoken.ru\/Rutoken\/PAM\/<\/a><\/noindex><br \/>\nCopiem con\u021binutul folderului PAM librtpam.so.1.0.0 \u00een folderul sistemului<br \/>\n<code>\/usr\/lib\/<\/code> sau <code>\/usr\/lib\/x86_64-linux-gnu\/<\/code>sau <code>\/usr\/lib64<\/code><\/p>\n<h3>3) Instal\u0103m pachetul cu librtpkcs11ecp.so<\/h3>\n<p>\n\u00cenc\u0103rc\u0103m \u0219i instal\u0103m pachetul DEB sau RPM de la link-ul: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rutoken.ru\/support\/download\/pkcs\/\">https:\/\/www.rutoken.ru\/support\/download\/pkcs\/<\/a><\/noindex><\/p>\n<h3>4) Verific\u0103m dac\u0103 Rutoken ECDP 2.0 func\u021bioneaz\u0103 \u00een sistem<\/h3>\n<p>\n\u00cen terminal execut\u0103m<br \/>\n<code>$ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -T<\/code><br \/>\nDac\u0103 vede\u021bi linia <code>Rutoken ECP<\/code> \u2013 atunci totul este bine.<\/p>\n<h3>5) Citim certificatul<\/h3>\n<p>\nVerific\u0103m dac\u0103 pe dispozitiv exist\u0103 un certificat<br \/>\n<code>$ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -O<\/code><br \/>\nDac\u0103 dup\u0103 linia:<br \/>\n<code>Using slot 0 with a present token (0x0)<\/code><\/p>\n<ul>\n<li><b>apare informa\u021bia<\/b> despre chei \u0219i certificate, atunci trebuie s\u0103 citim certificatul \u0219i s\u0103-l salv\u0103m pe disc. Pentru aceasta, executa\u021bi urm\u0103toarea comand\u0103, unde \u00een loc de {id} trebuie s\u0103 introduce\u021bi ID-ul certificatului pe care l-a\u021bi v\u0103zut \u00een ie\u0219irea comenzii anterioare:<br \/>\n<code>$ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -r -y cert --id {id} --output-file cert.crt<\/code><br \/>\n \u00cen cazul \u00een care fi\u0219ierul cert.crt a fost creat, trecem la punctul 6).<\/li>\n<li><b>nu exist\u0103 nimic<\/b>, \u00eenseamn\u0103 c\u0103 dispozitivul este gol. V\u0103 rug\u0103m s\u0103 contacta\u021bi administratorul sau s\u0103 crea\u021bi chei \u0219i un certificat singuri, urm\u00e2nd punctul urm\u0103tor.<\/li>\n<\/ul>\n<h4>5.1) Cre\u0103m un certificat de test<\/h4>\n<p><\/p>\n<blockquote><p>Aten\u021bie! Metodele descrise pentru crearea cheilor \u0219i certificatelor sunt destinate test\u0103rii \u0219i nu ar trebui folosite \u00een modul opera\u021bional. Pentru aceasta, trebuie s\u0103 folosi\u021bi chei \u0219i certificate emise de o autoritate de certificare de \u00eencredere a organiza\u021biei dumneavoastr\u0103 sau de c\u0103tre un centru de certificare acreditat.<br \/>\nM Modul PAM este creat pentru a proteja computerele locale \u0219i preconizeaz\u0103 func\u021bionarea \u00een organiza\u021bii mici. Deoarece utilizatorii sunt pu\u021bini, administratorul poate supraveghea singur revocarea certificatelor \u0219i poate bloca manual conturile, la fel ca \u0219i data de expirare a certificatelor. Modulul PAM \u00een prezent nu poate verifica certificatul prin CRL \u0219i construi lan\u021buri de \u00eencredere.<\/p><\/blockquote>\n<h4>Calea simpl\u0103 (prin browser)<\/h4>\n<p>\nPentru a ob\u021bine un certificat de testare, utiliza\u021bi <noindex><a rel=\"nofollow\" href=\"https:\/\/ra.rutoken.ru\/\">serviciul web \u201eCentrul de \u00cenregistrare RUTOKEN\u201d<\/a><\/noindex>. Procesul va dura nu mai mult de 5 minute.<\/p>\n<h4>Calea geekului (prin consol\u0103 \u0219i, posibil, compilator)<\/h4>\n<p>\n<b>Verifica\u021bi versiunea OpenSC <\/b><br \/>\n<code>$ opensc-tool --version<\/code><br \/>\nDac\u0103 versiunea este mai mic\u0103 dec\u00e2t 0.20, actualiza\u021bi sau construi\u021bi <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/AktivCo\/OpenSC\/tree\/gostr3410-2012\/\">ramura pkcs11-tool cu suport pentru GOST-2012<\/a><\/noindex> din GitHub-ul nostru (la momentul public\u0103rii acestui articol, versiunea 0.20 nu fusese \u00eenc\u0103 lansat\u0103) sau din ramura master a proiectului OpenSC, nu mai t\u00e2rziu de <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OpenSC\/OpenSC\/tree\/8cf1e6f769b36bdcadc3958574305b90e88c816d\">commit-ul 8cf1e6f<\/a><\/noindex><\/p>\n<p>Gener\u0103m o pereche de chei cu parametrii:<br \/>\n<code>--key-type: GOSTR3410-2012-512:A (GOST-2012 512 bi\u021bi cu setul de parametrii A), GOSTR3410-2012-256:A (GOST-2012 256 bi\u021bi cu setul de parametrii A)<\/code><\/p>\n<p><code>--id: <\/code> identificatorul obiectului (CKA_ID) sub form\u0103 de numere hexazecimale de dou\u0103 cifre din tabelul ASCII. Utiliza\u021bi doar coduri ASCII pentru caracterele tip\u0103rite, deoarece id-ul va trebui transmis OpenSSL sub form\u0103 de \u0219ir. De exemplu, codul ASCII \u201e3132\u201d corespunde \u0219irului \u201e12\u201d. <b> Pentru comoditate, pute\u021bi folosi <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rapidtables.com\/convert\/number\/ascii-to-hex.html\">un serviciu online de conversie a \u0219irului \u00een coduri ASCII<\/a><\/noindex><\/b>.<\/p>\n<p><code>$ .\\\/pkcs11-tool --module \\\/usr\\\/lib\\\/librtpkcs11ecp.so --keypairgen --key-type GOSTR3410-2012-512:A -l --id 3132<\/code><\/p>\n<p>Apoi vom crea un certificat. Mai jos vor fi descrise dou\u0103 c\u0103i: prima prin UCA (vom folosi UCA-uri de test), a doua - auto-semnat. Pentru aceasta, mai \u00eent\u00e2i trebuie s\u0103 instala\u021bi \u0219i s\u0103 configura\u021bi OpenSSL versiunea 1.1 sau mai recent\u0103 pentru a lucra cu RUTOKEN prin modulul special rtengine folosind ghidul <noindex><a rel=\"nofollow\" href=\"https:\/\/dev.rutoken.ru\/display\/PUB\/%D0%A3%D1%81%D1%82%D0%B0%D0%BD%D0%BE%D0%B2%D0%BA%D0%B0+%D0%B8+%D0%BD%D0%B0%D1%81%D1%82%D1%80%D0%BE%D0%B9%D0%BA%D0%B0+OpenSSL\">Instalarea \u0219i configurarea OpenSSL<\/a><\/noindex>.<br \/>\nDe exemplu: pentru \u2018-<code>-id 3132<\/code>\u00een OpenSSL trebuie s\u0103 specifici \u00ab<code>pkcs11:id=12<\/code>&#171;. <\/p>\n<p>Pute\u021bi folosi serviciile unui UCA de testare, sunt multe, de exemplu, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cryptopro.ru\/solutions\/test-ca\">iat\u0103<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"http:\/\/testcert.infotecs.ru\/\">iat\u0103 <\/a><\/noindex>\u0219i <noindex><a rel=\"nofollow\" href=\"http:\/\/soft.lissi.ru\/services\/test_ca\/\">iat\u0103<\/a><\/noindex>, pentru aceasta, vom crea o solicitare pentru certificat<\/p>\n<p>O alt\u0103 op\u021biune \u2013 pute\u021bi ceda tenta\u021biei \u0219i s\u0103 crea\u021bi un certificat auto-semnat<br \/>\n<code>$ openssl req -utf8 <b>-new<\/b> -keyform engine -key \"pkcs11:id=12\" -engine rtengine -out req.csr<\/code><\/p>\n<p>\u00cenc\u0103rca\u021bi certificatul pe dispozitiv<br \/>\n<code>$ openssl req -utf8 <b>-x509<\/b> -keyform engine -key \"pkcs11:id=12\" -engine rtengine -out cert.cer<\/code><\/p>\n<h3>6) \u00cenregistra\u021bi certificatul \u00een sistem<\/h3>\n<p>\nAsigura\u021bi-v\u0103 c\u0103 certificatul dvs. arat\u0103 ca un fi\u0219ier base64:<\/p>\n<p><img decoding=\"async\" alt=\"Cum s\u0103 folose\u0219ti modulele PAM pentru autentificarea local\u0103 \u00een Linux cu chei GOST-2012 pe Rutoken.\" src=\"\/wp-content\/uploads\/2019\/07\/83a7e25541041d02365141e682bd4635.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDac\u0103 certificatul dvs. arat\u0103 astfel:<\/p>\n<p><img decoding=\"async\" alt=\"Cum s\u0103 folose\u0219ti modulele PAM pentru autentificarea local\u0103 \u00een Linux cu chei GOST-2012 pe Rutoken.\" src=\"\/wp-content\/uploads\/2019\/07\/f385e4e288a49acfb2c54be4c24749e7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\natunci trebuie s\u0103 converti\u021bi certificatul din format DER \u00een format PEM (base64)<\/p>\n<p><code>$ openssl x509 -in cert.crt -out cert.pem -inform DER -outform PEM<\/code><br \/>\nVerifica\u021bi din nou c\u0103 acum totul este \u00een regul\u0103.<\/p>\n<p>Ad\u0103ug\u0103m certificatul \u00een lista certificatelor de \u00eencredere<br \/>\n<code>$ mkdir ~\/.eid<br \/>\n$ chmod 0755 ~\/.eid<br \/>\n$ cat cert.pem &gt;&gt; ~\/.eid\/authorized_certificates<br \/>\n$ chmod 0644 ~\/.eid\/authorized_certificates<\/code><br \/>\nUltima linie protejeaz\u0103 lista certificatelor de \u00eencredere \u00eempotriva modific\u0103rii accidentale sau inten\u021bionate de c\u0103tre al\u021bi utilizatori. Acest lucru exclude situa\u021bia \u00een care cineva ar ad\u0103uga propriul certificat aici \u0219i ar putea accesa sistemul \u00een numele dumneavoastr\u0103.<\/p>\n<h3>7) Configur\u0103m autentificarea <\/h3>\n<p>\nConfigurarea modulului nostru PAM este complet standard \u0219i se face exact la fel ca \u0219i configur\u0103rile altor module. Cre\u0103m un fi\u0219ier <code>\/usr\/share\/pam-configs\/rutoken-gost-pam<\/code> care con\u021bine numele complet al modulului, dac\u0103 este activat implicit, prioritatea modulului \u0219i parametrii de autentificare.<br \/>\n\u00cen parametrii de autentificare exist\u0103 cerin\u021be pentru succesul opera\u021biei:<\/p>\n<ul>\n<li>required (necesar): aceste module trebuie s\u0103 returneze un r\u0103spuns pozitiv. Dac\u0103 rezultatul apelului modulului con\u021bine un r\u0103spuns negativ, acest lucru va duce la o eroare de autentificare. Cererea va fi anulat\u0103, dar celelalte module vor fi apelate.<\/li>\n<li>requisite (necesar): similar cu required, dar duce imediat la e\u0219ecul autentific\u0103rii \u0219i ignor\u0103 celelalte module.<\/li>\n<li>sufficient (suficient): dac\u0103 \u00eenainte de un astfel de modul niciunul dintre modulele required sau sufficient nu a returnat un rezultat negativ, atunci modulul va returna un r\u0103spuns pozitiv. Modulele r\u0103mase vor fi ignorate.<\/li>\n<li>optional (op\u021bional): dac\u0103 \u00een stiv\u0103 nu sunt module required \u0219i niciunul dintre modulele sufficient nu a returnat un r\u0103spuns pozitiv, atunci cel pu\u021bin unul dintre modulele optional trebuie s\u0103 returneze un r\u0103spuns pozitiv.<\/li>\n<\/ul>\n<p>\nCon\u021binutul complet al fi\u0219ierului <code>\/usr\/share\/pam-configs\/rutoken-gost-pam<\/code>:<br \/>\n<code>Nume: Rutoken PAM GOST<br \/>\nImplicit: da<br \/>\nPrioritate: 800<br \/>\nTip-Autentificare: Primar<br \/>\nAutentificare: suficient\u0103 \/usr\/lib\/librtpam.so.1.0.0 \/usr\/lib\/librtpkcs11ecp.so<\/code><\/p>\n<p><img decoding=\"async\" alt=\"Cum s\u0103 folose\u0219ti modulele PAM pentru autentificarea local\u0103 \u00een Linux cu chei GOST-2012 pe Rutoken.\" src=\"\/wp-content\/uploads\/2019\/07\/804bd960918413e2134617b2ce31f0af.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nsalv\u0103m fi\u0219ierul, apoi execut\u0103m<br \/>\n<code>$ sudo pam-auth-update<\/code><br \/>\n\u00een fereastra care apare, punem o stea l\u00e2ng\u0103 <b>Rutoken PAM GOST<\/b> \u0219i ap\u0103s\u0103m <b>OK<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Cum s\u0103 folose\u0219ti modulele PAM pentru autentificarea local\u0103 \u00een Linux cu chei GOST-2012 pe Rutoken.\" src=\"\/wp-content\/uploads\/2019\/07\/2fb2e020c943ef3a22f09985a939a1c9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>8) Verific\u0103m configurarea <\/h3>\n<p>\nPentru a verifica c\u0103 totul este configurat, dar f\u0103r\u0103 a pierde posibilitatea de a accesa sistemul, introduce\u021bi comanda<br \/>\n<code>$ sudo login<\/code><br \/>\nIntroduce\u021bi numele utilizatorului. Totul este configurat corect dac\u0103 sistemul cere codul PIN al dispozitivului.<\/p>\n<p><img decoding=\"async\" alt=\"Cum s\u0103 folose\u0219ti modulele PAM pentru autentificarea local\u0103 \u00een Linux cu chei GOST-2012 pe Rutoken.\" src=\"\/wp-content\/uploads\/2019\/07\/2501ca77a0c881ebb9fe588031a2c8ef.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>9) Configur\u0103m blocarea computerului la extragerea token-ului<\/h3>\n<p>\n\u00cen pachet este inclus\u0103 utilitarul <code>libpam-pkcs11<\/code> pkcs11_eventmgr, <code>care permite executarea diferitelor ac\u021biuni la apari\u021bia evenimentelor PKCS#11.<\/code> pkcs11_eventmgr<br \/>\nPentru configurare <code>serve\u0219te ca fi\u0219ier de configurare:<\/code> Pentru diferite distribu\u021bii Linux, comanda care invoc\u0103 blocarea contului la extragerea cardurilor inteligente sau a token-ului va fi diferit\u0103. Vezi. <code>\/etc\/pam_pkcs11\/pkcs11_eventmgr.conf<\/code><br \/>\n<i>event card_remove <code>Exemplul fi\u0219ierului de configurare este prezentat mai jos:<\/code>.<\/i><br \/>\nExemplul fi\u0219ierului de configura\u021bie este prezentat mai jos:<\/p>\n<pre><code class=\"xml\">pkcs11_eventmgr\n{\n    # Rulare \u00een background\n    daemon = true;\n     \n    # Configurarea mesajelor de depanare\n    debug = false;\n \n    # Timpul de polling \u00een secunde\n    polling_time = 1;\n \n    # Setarea timeout-ului pentru eliminarea cardului\n    # Implicit 0\n    expire_time = 0;\n \n    # Selectarea bibliotecii pkcs11 pentru lucrul cu Rutoken\n    pkcs11_module = usr\/lib\/librtpkcs11ecp.so;\n \n    # Ac\u021biuni cu cardul\n    # Card inserat:\n    event card_insert {\n        # L\u0103s\u0103m valorile implicite (nimic nu se \u00eent\u00e2mpl\u0103)\n        on_error = ignore ;\n \n        action = \"\/bin\/false\";\n    }\n \n    # Card extras\n    event card_remove {\n        on_error = ignore;\n         \n        # Apel\u0103m func\u021bia de blocare a ecranului\n        \n        # Pentru GNOME \n        action = \"dbus-send --type=method_call --dest=org.gnome.ScreenSaver \/org\/gnome\/ScreenSaver org.gnome.ScreenSaver.Lock\";\n        \n        # Pentru XFCE\n        # action = \"xflock4\";\n        \n        # Pentru Astra Linux (FLY)\n        # action = \"fly-wmfunc FLYWM_LOCK\";\n    }\n \n    # Cardul a fost extras mult timp\n    event expire_time {\n        # L\u0103s\u0103m valorile implicite (nimic nu se \u00eent\u00e2mpl\u0103)\n        on_error = ignore;\n \n        action = \"\/bin\/false\";\n    }\n}<\/code><\/pre>\n<p>Dup\u0103 aceasta, ad\u0103uga\u021bi aplica\u021bia <code>serve\u0219te ca fi\u0219ier de configurare:<\/code> \u00een autostart. Pentru aceasta, edita\u021bi fi\u0219ierul .bash_profile:<br \/>\n<code>$ nano \/home\/\/.bash_profile<\/code><br \/>\nAd\u0103uga\u021bi la sf\u00e2r\u0219itul fi\u0219ierului linia pkcs11_eventmgr \u0219i reporni\u021bi.<\/p>\n<p><b>Pa\u0219ii descri\u0219i pentru configurarea sistemului de operare pot fi folosi\u021bi ca instruc\u021biune \u00een orice distribu\u021bie modern\u0103 de Linux, inclusiv cele autohtone. <\/b><\/p>\n<p><img decoding=\"async\" alt=\"Cum s\u0103 folose\u0219ti modulele PAM pentru autentificarea local\u0103 \u00een Linux cu chei GOST-2012 pe Rutoken.\" src=\"\/wp-content\/uploads\/2019\/07\/ec235d0d0d50e23fbf09d4849d1fdd11.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Concluzie <\/h2>\n<p>\nPC-urile cu Linux \u00een structurile de stat ruse\u0219ti devin din ce \u00een ce mai populare, iar configurarea unei autentific\u0103ri \u00een doi pa\u0219i fiabile \u00een acest sistem de operare nu este \u00eentotdeauna simpl\u0103. Ne bucur\u0103m c\u0103 acest ghid poate ajuta la rezolvarea \"problemei parolelor\" \u0219i la protejarea fiabil\u0103 a accesului la PC, f\u0103r\u0103 a cheltui mult timp pe asta.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/aktiv-company\/blog\/461199\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0441\u0442\u044b\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u043d\u0435 \u0437\u0430\u0449\u0438\u0449\u0430\u044e\u0442, \u0430 \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u043e\u043c\u043d\u0438\u0442\u044c. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u043d\u0438 \u0442\u0430\u043a \u0447\u0430\u0441\u0442\u043e \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0441\u0442\u0438\u043a\u0435\u0440\u0435 \u043f\u043e\u0434 \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u043e\u0439 \u0438\u043b\u0438 \u043d\u0430 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0435. \u0427\u0442\u043e\u0431\u044b \u043f\u0430\u0440\u043e\u043b\u0438 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0433\u043e\u043b\u043e\u0432\u0430\u0445 \u201c\u0437\u0430\u0431\u044b\u0432\u0447\u0438\u0432\u044b\u0445\u201d \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0435 \u0442\u0435\u0440\u044f\u043b\u0430\u0441\u044c \u2013 \u0435\u0441\u0442\u044c \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f (2\u0424\u0410). \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u044e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0438 \u0437\u043d\u0430\u043d\u0438\u044f \u0435\u0433\u043e PIN-\u043a\u043e\u0434\u0430, \u0441\u0430\u043c PIN-\u043a\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435 \u0438 \u043b\u0435\u0433\u0447\u0435 \u0434\u043b\u044f \u0437\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27347,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36535","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PAM-\u043c\u043e\u0434\u0443\u043b\u0438 \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Linux \u043f\u043e \u043a\u043b\u044e\u0447\u0430\u043c \u0413\u041e\u0421\u0422-2012 \u043d\u0430 \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:12:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:12:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cum s\u0103 folosi\u021bi module PAM pentru autentificarea local\u0103 \u00een Linux prin cheile GOST-2012 pe Rutoken | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PAM-\u043c\u043e\u0434\u0443\u043b\u0438 \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Linux \u043f\u043e \u043a\u043b\u044e\u0447\u0430\u043c \u0413\u041e\u0421\u0422-2012 \u043d\u0430 \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u0435 | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:12:11+00:00","article:modified_time":"2019-10-31T19:12:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36535","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 03:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:43:32","updated":"2026-01-22 03:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/36535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=36535"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/36535\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/27347"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=36535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=36535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=36535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}