{"id":38891,"date":"2019-10-31T22:26:35","date_gmt":"2019-10-31T19:26:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip\/"},"modified":"2019-10-31T22:26:35","modified_gmt":"2019-10-31T19:26:35","slug":"sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","title":{"rendered":"Partajarea re\u021bea a tokenului criptografic de c\u0103tre utilizatori pe baza usbip","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen leg\u0103tur\u0103 cu modificarea legisla\u021biei referitoare la serviciile de \u00eencredere (\u201eDespre serviciile electronice de \u00eencredere\u201d Ucraina), a ap\u0103rut necesitatea ca mai multe departamente ale companiei s\u0103 lucreze cu chei stocate pe token-uri (\u00een prezent, problema num\u0103rului de chei hardware este \u00eenc\u0103 deschis\u0103).<\/p>\n

Ca instrument cu cele mai sc\u0103zute costuri (gratuit), alegerea s-a \u00eendreptat imediat spre usbip<\/a><\/noindex>. Serverul pe Ubintu 18.04 a \u00eenceput s\u0103 func\u021bioneze datorit\u0103 publica\u021biei \u00cembl\u00e2nzirea USB\/IP<\/a><\/noindex> \u0219i a fost testat cu succes pe mai multe unit\u0103\u021bi flash (\u00een lipsa, la acel moment, a token-ului). Nu au fost identificate probleme speciale, \u00een afar\u0103 de monopolul de\u021bin\u0103torului (rezervarea pentru utilizator) \u00een acel moment. Este clar c\u0103 pentru a organiza accesul mai multor utilizatori (m\u0103car dou\u0103, pentru \u00eenceput) este necesar\u0103 \u00eemp\u0103r\u021birea accesului \u00een timp \u0219i obligarea lor s\u0103 lucreze pe r\u00e2nd.<\/p>\n

S-a pus \u00eentrebarea: Cum putem, cu cele mai pu\u021bine manevre, s\u0103 facem ca tuturor s\u0103 le func\u021bioneze\u2026
\n<\/a><\/noindex><\/p>\n

O parte mai rudimentar\u0103<\/h1>\n

<\/p>\n

\"Partajarea
\nVarianta I<\/b>. C\u00e2teva scurt\u0103turi c\u0103tre fi\u0219ierele bat, \u0219i anume
\na) Conectarea cheii de acces.
\nb) Deconectarea inten\u021bionat\u0103. <\/p>\n

Punctul «b<\/b>» controversat, de aceea s-a decis s\u0103 se ofere un timp de lucru de 3 minute cu cheia.<\/p>\n

Particularitatea clientului usbip este c\u0103 dup\u0103 ce este pornit, r\u0103m\u00e2ne suspendat \u00een consol\u0103; f\u0103r\u0103 \u00eentreruperea sesiunii consolei, conectarea se poate \u00eencheia \u201ebrutal\u201d din partea clientului \u0219i, de asemenea, din partea serverului.<\/p>\n

\n Iat\u0103 ce a func\u021bionat corect pentru noi:<\/p>\n

primul: conectarea on.bat<\/i><\/b> <\/p>\n

usbip -a 172.16.12.26 4-1\nmsg * \"Semn\u0103tura\/token-ul nu sunt disponibile sau sunt ocupate \"<\/code><\/pre>\n
al doilea: deconectarea off.bat<\/i><\/b><\/p>\n
ping 127.0.0.1 -n 180\ntaskkill \/IM usbip.exe \/F<\/code><\/pre>\n
\nf\u0103r\u0103 a conta pe con\u0219tiin\u021ba utilizatorului, scripturile au fost unite \u00een token.bat<\/i><\/b><\/p>\n
on.bat | off.bat<\/code><\/pre>\n
\nCe rezult\u0103: toate fi\u0219ierele se afl\u0103 \u00eentr-un singur folder, pornirea se face cu fi\u0219ierul token.bat. Dac\u0103 conexiunea este \u00eenchis\u0103 de utilizator, apare imediat un mesaj de indisponibilitate a cheii; \u00een alte cazuri, doar dup\u0103 180 de pinguri. Linile de cod prezentate pot fi echipate cu «@ECHO OFF» \u0219i dirijarea consolei c\u0103tre «> nul» pentru a nu \u0219oca prea tare utilizatorul, dar nu este obligatoriu pentru lansarea \u00een testare. Primul \u201erulaj\u201d pe un dispozitiv USB a ar\u0103tat c\u0103 totul este previzibil, fiabil \u0219i precis. De asemenea, din partea serverului nu sunt necesare manipul\u0103ri.<\/p>\n
\"Partajarea
\n
\nDesigur, \u00een timpul lucrului direct cu tokenul, totul nu a decurs a\u0219a cum era de a\u0219teptat: la conectarea fizic\u0103 \u00een gestionarul de dispozitive, tokenul se \u00eenregistreaz\u0103 ca 2 dispozitive (WUDF \u0219i card smart), iar c\u00e2nd este conectat prin re\u021bea, doar ca WUDF (de\u0219i pentru solicitarea codului PIN, asta este suficient).<\/p>\n
\"Partajarea
\n
\nDe asemenea, s-a dovedit c\u0103 \u201etaskkill\u201d nu este chiar at\u00e2t de dur, iar \u00eenchiderea conexiunii pe client este problematic\u0103 \u0219i chiar dac\u0103 reu\u0219e\u0219ti, nu garanteaz\u0103 \u00eenchiderea acesteia pentru el pe server.<\/p>\n
Dedic\u00e2nd toate consolele pe client, al doilea script a luat forma:<\/p>\n
ping 127.0.0.1 -n 180 > nul\ntaskkill \/IM usbip.exe \/F \/T > nul\nping 127.0.0.1 -n 10 > nul\ntaskkill \/IM conhost.exe \/F \/T > nul<\/code><\/pre>\n
\nde\u0219i eficien\u021ba sa este sub 50%, pentru c\u0103 serverul continua s\u0103 considere conexiunea deschis\u0103.<\/p>\n
Problemele de conexiune au dus la g\u00e2nduri despre modernizarea p\u0103r\u021bii server.<\/p>\n
Partea server<\/h1>\n
\nCe este nevoie:<\/p>\n
    \n
  1. Deconectarea utilizatorilor inactivi de la serviciu.<\/li>\n
  2. A vedea cine folose\u0219te acum (sau mai ocup\u0103) tokenul.<\/li>\n
  3. A vedea dac\u0103 tokenul este conectat la computer.<\/li>\n<\/ol>\n
    \nRezolvarea acestor sarcini a fost decis\u0103 prin intermediul serviciilor crontab \u0219i apache. Discretizarea actualiz\u0103rii st\u0103rii rezultatelor monitoriz\u0103rii punctelor 2 \u0219i 3 sugereaz\u0103 c\u0103 sistemul de fi\u0219iere poate fi localizat pe ramdrive. \u00cen \/etc\/fstab a fost ad\u0103ugat\u0103 linia <\/p>\n
    tmpfs   \/ram_drive      tmpfs   defaults,nodev,size=64K         0       0\n<\/code><\/pre>\n
    \n\u00cen r\u0103d\u0103cin\u0103 a fost creat un folder script cu scripturi: demontare-montare token usb_restart.sh <\/p>\n
    usbip unbind -b 1-2\nsleep 2\nusbip bind -b 1-2\nsleep 2\nusbip attach --remote=localhost --busid=1-2\nsleep 2\nusbip detach --port=00<\/code><\/pre>\n
    \nob\u021binerea listei de dispozitive active usblist_id.sh<\/p>\n
    usbip list -r 127.0.0.1 | grep ':' |awk -F \":\" '{print $1}'| sed s\/' '\/\/g | grep -v \"^$\" > \/ram_drive\/usb_id.txt<\/code><\/pre>\n
    \nob\u021binerea listei de IP-uri active (cu modific\u0103ri ulterioare pentru afi\u0219area identificatorilor utilizatorilor) usbip_client_ip.sh<\/p>\n
    netstat -an | grep :3240 | grep ESTABLISHED|awk '{print $5}'|cut -f1 -d\":\" > \/ram_drive\/usb_ip_cli.txt<\/code><\/pre>\n
    \n\u00eentreg crontab arat\u0103 astfel:<\/p>\n
    *\/5 * * * * \/!script\/usb_restart.sh > \/dev\/null 2>&1\n* * * * * ( sleep 30 ; \/!script\/usblist_id.sh > \/dev\/null)\n* * * * * (sleep 10 ; \/!script\/usbip_client_ip.sh > \/dev\/null)<\/code><\/pre>\n
    \nA\u0219adar, avem: la fiecare 5 minute poate fi conectat un nou utilizator, indiferent de cine a lucrat cu tokenul. La serverul http, un folder \/ramdrive este conectat printr-un link simbolic, \u00een care sunt salvate 2 fi\u0219iere text, care arat\u0103 starea serverului usbip.<\/p>\n
    Partea urm\u0103toare: \u201eUr\u00e2t \u00een ambalaj\u201d<\/h1>\n
    \nVarianta II.<\/b> Un pic de bucurie pentru utilizator printr-o interfa\u021b\u0103 mai pu\u021bin \u00eenfrico\u0219\u0103toare. Av\u00e2nd \u00een vedere c\u0103 utilizatorii au diferite versiuni de Windows cu cadre diferite, precum \u0219i drepturi diferite, nu am g\u0103sit o abordare mai pu\u021bin problematic\u0103 dec\u00e2t Lazarus<\/a><\/noindex> \u00een acest caz (de\u0219i sunt de partea C#, dar nu \u00een acest context). Se pot rula fi\u0219iere bat din interfa\u021b\u0103, chiar \u0219i \u00een fundal, minizate, dar f\u0103r\u0103 o testare adecvat\u0103, personal cred c\u0103 este necesar s\u0103 vizualiz\u0103m pentru a aduna nemul\u021bumirile utilizatorilor.<\/p>\n
    \"Partajarea
    \n
    \nInterfa\u021ba \u0219i partea programatic\u0103 au rezolvat urm\u0103toarele sarcini:<\/p>\n
      \n
    1. Afi\u0219area st\u0103rii de ocupare a tokenului \u00een acest moment.<\/li>\n
    2. La prima rulare, configurarea ini\u021bial\u0103 cu generarea fi\u0219ierelor bat \u201ecorecte\u201d care implementeaz\u0103 pornirea \u0219i \u00eentreruperea sesiunii de lucru cu serverul tokenului. La rul\u0103rile ulterioare, implementarea \u00een modul \u201eserviciu\u201d cu parol\u0103.<\/li>\n
    3. Verificarea existen\u021bei conexiunii cu serverul, \u00een urma c\u0103reia se realizeaz\u0103 \u00eentrebarea acestuia despre ocupare sau se afi\u0219eaz\u0103 mesaje despre probleme. La restabilirea conexiunii, programul \u00eencepe automat s\u0103 func\u021bioneze \u00een mod normal.<\/li>\n<\/ol>\n
      \nLucrul cu serverul WEB a fost realizat prin intermediul pluginului suplimentar fphttpclient.<\/p>\n
      \r\n        \"Reda\u021bi\r\n        
      <\/div>\r\n    <\/div><\/center>
      \n      aici va fi un link c\u0103tre versiunea curent\u0103 a clientului<\/a><\/noindex><\/p>\n
      exist\u0103, de asemenea, un continuare a g\u00e2ndurilor despre subiectul articolului, precum \u0219i oparte din entuziasmul ini\u021bial pentru produsul VirtualHere \u0219i caracteristicile sale\u2026
      \n
      Sursa:       habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
      \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u0443\u0433 ( \u00ab\u041f\u0440\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0441\u043b\u0443\u0433\u0438\u00bb \u0423\u043a\u0440\u0430\u0438\u043d\u0430), \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c \u043e\u0442\u0434\u0435\u043b\u0430\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u043a\u043b\u044e\u0447\u0430\u043c\u0438, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u043d\u0430 \u0442\u043e\u043a\u0435\u043d\u0430\u0445 (\u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442, \u0432\u043e\u043f\u0440\u043e\u0441 \u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0435\u0449\u0435 \u043e\u0442\u043a\u0440\u044b\u0442). \u041a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0441 \u043d\u0430\u0438\u043c\u0435\u043d\u044c\u0448\u0438\u043c\u0438 \u0437\u0430\u0442\u0440\u0430\u0442\u0430\u043c\u0438 (\u0431\u0435\u0437\u0432\u043e\u0437\u043c\u0435\u0437\u0434\u043d\u043e) \u0441\u0440\u0430\u0437\u0443 \u0432\u044b\u0431\u043e\u0440 \u043f\u0430\u043b \u043d\u0430 usbip. \u0421\u0435\u0440\u0432\u0435\u0440 \u043d\u0430 Ubintu 18.04 \u0437\u0430\u0440\u0430\u0431\u043e\u0442\u0430\u043b \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0423\u043a\u0440\u043e\u0449\u0430\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29176,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38891","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Partajarea re\u021bea a tokenului criptografic de c\u0103tre utilizatori pe baza usbip | ProHoster","description":"\u00cen urma modific\u0103rii legisla\u021biei privind serviciile de \u00eencredere ( \u201eDespre serviciile electronice de \u00eencredere\u201d Ucraina), a ap\u0103rut necesitatea ca mai multe departamente din companie s\u0103 lucreze cu cheile plasate pe.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u0441\u0435\u0442\u0435\u0432\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0442\u043e\u043a\u0435\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 usbip | ProHoster","og:description":"\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0437\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u0443\u0433 ( \u00ab\u041f\u0440\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u044b\u0435 \u0434\u043e\u0432\u0435\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0443\u0441\u043b\u0443\u0433\u0438\u00bb \u0423\u043a\u0440\u0430\u0438\u043d\u0430), \u043d\u0430 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u043c \u043e\u0442\u0434\u0435\u043b\u0430\u043c \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u043a\u043b\u044e\u0447\u0430\u043c\u0438, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/sovmestnoe-setevoe-ispolzovanie-kriptograficheskogo-tokena-polzovatelyami-na-baze-usbip","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:26:35+00:00","article:modified_time":"2019-10-31T19:26:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38891","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:51:37","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:00:28","updated":"2026-01-23 23:51:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/38891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=38891"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/38891\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/29176"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=38891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=38891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=38891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}