{"id":78242,"date":"2020-04-18T01:42:36","date_gmt":"2020-04-17T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa"},"modified":"2020-04-18T01:42:36","modified_gmt":"2020-04-17T23:42:36","slug":"realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","title":{"rendered":"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Continu\u00e2nd seria de articole pe tema organiz\u0103rii <strong>Remote-Access VPN<\/strong> accesului nu pot s\u0103 nu \u00eemp\u0103rt\u0103\u0219esc o experien\u021b\u0103 interesant\u0103 de implementare <strong>a unei configura\u021bii VPN foarte securizate<\/strong>. O provocare neobi\u0219nuit\u0103 mi-a fost aruncat\u0103 de un client (exist\u0103 inven\u021bi cu adev\u0103rat \u00een satele ruse\u0219ti), dar Challenge Accepted \u0219i implementat creativ. Ca rezultat, a ie\u0219it un concept interesant cu urm\u0103toarele caracteristici:<\/p>\n<p><\/p>\n<ol>\n<li>Mai multe niveluri de protec\u021bie \u00eempotriva \u00eenlocuirii dispozitivului final (cu legare strict\u0103 la utilizator);\n<ul>\n<li>Evaluarea conformit\u0103\u021bii PC-ului utilizatorului cu UDID-ul PC-ului permis \u00een baza de autentificare; <\/li>\n<li>Cu MFA, utiliz\u00e2nd UDID-ul PC-ului din certificat pentru autentificarea secundar\u0103 prin Cisco DUO <em>(Poate fi conectat\u0103 orice solu\u021bie compatibil\u0103 SAML\/RADIUS)<\/em>; <\/li>\n<\/ul>\n<\/li>\n<li>Autentificare multifactorial\u0103: \n<ul>\n<li>Certificatul utilizatorului cu verificarea c\u00e2mpurilor \u0219i autentificarea secundar\u0103 pe baza uneia dintre acestea;<\/li>\n<li>Login (netransferabil, preluat din certificat) \u0219i parol\u0103;<\/li>\n<\/ul>\n<\/li>\n<li>Evaluarea st\u0103rii gazdelor conectate (Posture)<\/li>\n<\/ol>\n<p><\/p>\n<p><strong>Componentele solu\u021biei utilizate:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Cisco ASA (Gateway VPN);<\/li>\n<li>Cisco ISE (Autentificare \/ Autorizare \/ Contabilizare, Evaluarea St\u0103rii, CA);<\/li>\n<li>Cisco DUO (Autentificare multifactorial\u0103) <em>(Poate fi conectat\u0103 orice solu\u021bie compatibil\u0103 SAML\/RADIUS)<\/em>;<\/li>\n<li>Cisco AnyConnect (Agent multipurpose pentru sta\u021bii de lucru \u0219i sisteme de operare mobile);<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p><strong>S\u0103 \u00eencepem cu cerin\u021bele clientului:<\/strong><\/p>\n<p><\/p>\n<ol>\n<li>Utilizatorul trebuie s\u0103 aib\u0103 posibilitatea, prin autentificarea sa Login\/Parol\u0103, s\u0103 descarce clientul AnyConnect de pe gateway-ul VPN, toate modulele necesare AnyConnect trebuie s\u0103 fie instalate automat conform politicii utilizatorului;<\/li>\n<li>Utilizatorul trebuie s\u0103 aib\u0103 posibilitatea emiterea automat\u0103 a certificatului (pentru unul dintre scenarii, scenariul principal fiind emiterea manual\u0103 \u0219i \u00eenc\u0103rcarea pe PC), eu am implementat emiterea automat\u0103 pentru demonstra\u021bie (niciodat\u0103 nu e prea t\u00e2rziu pentru a fi eliminat\u0103).<\/li>\n<li>Autentificarea principal\u0103 trebuie s\u0103 aib\u0103 loc \u00een mai multe etape, \u00eent\u00e2i se face autentificarea certificatului cu analiza c\u00e2mpurilor necesare \u0219i a valorilor lor, apoi login\/parol\u0103, doar c\u0103 la acest pas \u00een fereastra de login trebuie s\u0103 fie introdus numele utilizatorului specificat \u00een c\u00e2mpul certificatului <strong>Subject Name (CN)<\/strong> f\u0103r\u0103 posibilitatea de editare.<\/li>\n<li>Este necesar s\u0103 ne asigur\u0103m c\u0103 dispozitivul de pe care se efectueaz\u0103 logarea este laptopul corporatist emis utilizatorului pentru accesul de la distan\u021b\u0103, \u0219i nu altceva. (Au fost realizate mai multe variante pentru a satisface aceast\u0103 cerin\u021b\u0103)<\/li>\n<li>Trebuie efectuat\u0103 o evaluare a st\u0103rii dispozitivului conectat (\u00een aceast\u0103 etap\u0103, PC-ul) cu verificarea unei liste complete de cerin\u021be ale clientului (\u00een general):\n<ul>\n<li>Fi\u0219iere \u0219i propriet\u0103\u021bile acestora;<\/li>\n<li>\u00cenregistr\u0103ri \u00een registru;<\/li>\n<li>Patch-uri OS din lista furnizat\u0103 (\u00een continuare integrarea SCCM);<\/li>\n<li>Existenta antivirus-ului de la un anumit produc\u0103tor \u0219i actualitatea semn\u0103turilor;<\/li>\n<li>Activitatea unor servicii specifice;<\/li>\n<li>Existenta unor programe instalate;<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/p>\n<p>Pentru \u00eenceput, propun s\u0103 ne uit\u0103m obligatoriu la demonstra\u021bia video a realiz\u0103rii ob\u021binute pe <strong>Youtube (5 minute)<\/strong>.<\/p>\n<p>\n<center><div class=\"youtube-placeholder\" data-id=\"cBftD3KFK98\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/cBftD3KFK98\/hqdefault.jpg\" alt=\"Reda\u021bi video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>Acum propun s\u0103 examin\u0103m detaliile implement\u0103rii care nu au fost acoperite \u00een video.<\/p>\n<p><\/p>\n<p><strong>S\u0103 preg\u0103tim profilul AnyConnect:<\/strong><\/p>\n<p><\/p>\n<p>Exemplul de creare a profilului (\u00een ceea ce prive\u0219te meniul din ASDM) l-am men\u021bionat anterior \u00een articolul meu despre configurarea <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing clusterului<\/a><\/noindex>. Acum vreau s\u0103 subliniez op\u021biunile de care avem nevoie:<\/p>\n<p><\/p>\n<p>\u00cen profil, vom specifica gateway-ul VPN \u0219i numele profilului pentru conectarea pe clientul final:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat\" src=\"\/wp-content\/uploads\/2020\/04\/45ff3cb1f7b592e102bd6e256ae26043.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Vom efectua set\u0103rile pentru emiterea automat\u0103 a certificatului din partea profilului, men\u021bion\u00e2nd, \u00een special, parametrii certificatului \u0219i, ceea ce este important, vom acorda aten\u021bie c\u00e2mpului <strong>Initials (I)<\/strong>, unde este introdus manual o valoare specific\u0103 <strong>UDID<\/strong> al ma\u0219inii de test (Identificatorul unic al dispozitivului, generat de clientul Cisco AnyConnect).<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat\" src=\"\/wp-content\/uploads\/2020\/04\/89d4edb4f1b166eda75916286998a4bf.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Aici vreau s\u0103 fac o devia\u021bie liric\u0103, deoarece acest articol descrie conceptul, pentru scopuri demonstrative aici este introdus UDID pentru emiterea certificatului \u00een c\u00e2mpul Initials al profilului AnyConnect. Desigur, \u00een realitate, dac\u0103 proceda\u021bi astfel, to\u021bi clien\u021bii vor primi un certificat cu acela\u0219i UDID \u00een acest c\u00e2mp \u0219i nimic nu va func\u021biona pentru ei, deoarece au nevoie de UDID-ul specific al PC-ului lor. Din p\u0103cate, AnyConnect nu implementeaz\u0103 \u00eenc\u0103 \u00een profil substituirea cererii de certificat \u00een c\u00e2mpul UDID printr-o variabil\u0103 de mediu, a\u0219a cum face, de exemplu, cu variabila <strong>%USER%<\/strong>.<\/p>\n<p><\/p>\n<p>Este de remarcat c\u0103 clientul (\u00een acest scenariu) inten\u021bioneaz\u0103 ini\u021bial s\u0103 emit\u0103 singur certificate cu UDID-ul specificat manual pe astfel de PC-uri Sigurate, ceea ce nu este o problem\u0103 pentru el. Cu toate acestea, pentru majoritatea dintre noi, dorim automatizare (ei bine, pentru mine cu siguran\u021b\u0103 =). <\/p>\n<p><\/p>\n<p>\u0218i iat\u0103 ce pot propune \u00een ceea ce prive\u0219te automatizarea. Dac\u0103 certificatul care se elibereaz\u0103 automat prin AnyConnect nu poate insera dinamic UDID, exist\u0103 \u0219i o alt\u0103 metod\u0103, care va necesita pu\u021bin\u0103 g\u00e2ndire creativ\u0103 \u0219i abilit\u0103\u021bi practice \u2013 voi descrie conceptul. \u00cen primul r\u00e2nd, s\u0103 analiz\u0103m cum se formeaz\u0103 UDID pe diferite sisteme de operare prin agentul AnyConnect: <\/p>\n<p><\/p>\n<ul>\n<li><strong>Windows<\/strong> \u2014 hash SHA-256 al combina\u021biei dintre cheia de registry DigitalProductID \u0219i Machine SID<\/li>\n<li><strong>OSX<\/strong> \u2014 hash SHA-256 al PlatformUUID<\/li>\n<li><strong>Linux<\/strong> \u2014 hash SHA-256 al UUID al parti\u021biei root.<\/li>\n<li><strong>Apple iOS<\/strong> \u2014 hash SHA-256 al PlatformUUID<\/li>\n<li><strong>Android<\/strong> \u2013 Vede\u021bi documentul despre <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/security\/vpn_client\/anyconnect\/anyconnect40\/administration\/guide\/b_AnyConnect_Administrator_Guide_4-0\/b_AnyConnect_Administrator_Guide_4-0_chapter_01010.html#reference_C87ADD1C58F64EF8928D921323209AA6\">linkul<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<p>Prin urmare, vom crea un script pentru sistemele noastre de operare corporative Windows, iar cu acest script calcul\u0103m local UDID-ul pe baza datelor de intrare cunoscute \u0219i form\u0103m o solicitare pentru emiterea certificatului, introduc\u00e2nd \u00een c\u00e2mpul corespunz\u0103tor acest UDID. De altfel, poate fi utilizat \u0219i un certificat de ma\u0219in\u0103 emis de AD (ad\u0103ug\u00e2nd \u00een schema o autentificare dubl\u0103 prin certificat) <strong>Certificat multiple<\/strong>). <\/p>\n<p><\/p>\n<p><strong>Preg\u0103tim configura\u021biile din partea Cisco ASA:<\/strong><\/p>\n<p><\/p>\n<p>Vom crea un TrustPoint pentru serverul ISE CA, acesta va elibera certificatele clien\u021bilor. Nu voi discuta procedura de importare a Key-Chain, exemplul este descris \u00een articolul meu despre configurare <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing clusterului<\/a><\/noindex>. <\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">crypto ca trustpoint ISE-CA\n enrollment terminal\n crl configure<\/code><\/pre>\n<p><\/p>\n<p>Configur\u0103m distribu\u021bia \u00een func\u021bie de Tunnel-Group pe baza regulilor conform c\u0103ror c\u00e2mpuri din certificat se realizeaz\u0103 autentificarea. De asemenea, aici se configureaz\u0103 profilul AnyConnect, pe care l-am realizat \u00een etapa anterioar\u0103. Sublinez c\u0103 folosesc valoarea <strong>SECUREBANK-RA<\/strong>, pentru a transfera utilizatorii cu certificat emis \u00een grupul de tunel <strong>SECURE-BANK-VPN<\/strong>, re\u021bine\u021bi c\u0103 acest c\u00e2mp este completat \u00een cadrul cererii de certificat pentru profilul AnyConnect.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">tunnel-group-map enable rules\n!\ncrypto ca certificate map OU-Map 6\n subject-name attr ou eq securebank-ra\n!\nwebvpn\n anyconnect profiles SECUREBANK disk0:\/securebank.xml\n certificate-group-map OU-Map 6 SECURE-BANK-VPN\n!<\/code><\/pre>\n<p><\/p>\n<p>Configur\u0103m serverele de autentificare. \u00cen cazul meu, este ISE pentru prima etap\u0103 de autentificare \u0219i DUO (Radius Proxy) ca MFA.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">! CISCO ISE\naaa-server ISE protocol radius\n authorize-only\n interim-accounting-update periodic 24\n dynamic-authorization\naaa-server ISE (inside) host 192.168.99.134\n key *****\n!\n! DUO RADIUS PROXY\naaa-server DUO protocol radius\naaa-server DUO (inside) host 192.168.99.136\n timeout 60\n key *****\n authentication-port 1812\n accounting-port 1813\n no mschapv2-capable\n!<\/code><\/pre>\n<p><\/p>\n<p>Cre\u0103m politici de grup \u0219i grupuri de tunel \u0219i componentele lor auxiliare:<\/p>\n<p><\/p>\n<p>Grupa de tunel <strong>DefaultWEBVPNGroup<\/strong> va fi utilizat ini\u021bial pentru desc\u0103rcarea clientului AnyConnect VPN \u0219i emiterea certificatului utilizatorului folosind func\u021bia SCEP-Proxy a ASA, pentru aceasta sunt activate op\u021biunile corespunz\u0103toare at\u00e2t \u00een grupul de tunel, c\u00e2t \u0219i \u00een politica de grup asociat\u0103 <strong>AC-Download<\/strong>, precum \u0219i \u00een profilul desc\u0103rcat AnyConnect (c\u00e2mpurile pentru emiterea certificatului etc.). De asemenea, \u00een aceast\u0103 politic\u0103 de grup specific\u0103m necesitatea desc\u0103rc\u0103rii <strong>ISE Posture Module<\/strong>.<\/p>\n<p><\/p>\n<p>Grupa de tunel <strong>SECURE-BANK-VPN<\/strong> va fi utilizat automat de client \u00een timpul autentific\u0103rii cu certificatul emis \u00een etapa anterioar\u0103, deoarece conform H\u0103r\u021bii Certificatului, conexiunea se va alinia cu acest grup de tunel. Voi povesti despre op\u021biunile interesante aici:<\/p>\n<p><\/p>\n<ul>\n<li><strong>secondary-authentication-server-group DUO<\/strong> # \u0417\u0430\u0434\u0430\u0435\u043c \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO (Radius Proxy)<\/li>\n<li><strong>username-from-certificate CN<\/strong> # \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0435 CN \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043b\u043e\u0433\u0438\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f<\/li>\n<li><strong>secondary-username-from-certificate I<\/strong> # \u0414\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u043d\u043e\u0435 \u0438 \u043f\u043e\u043b\u044f Initials (I) \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430.<\/li>\n<li><strong>pre-fill-username client<\/strong> # \u0434\u0435\u043b\u0430\u0435\u043c \u043f\u0440\u0435\u0434\u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u043e\u043a\u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f<\/li>\n<li><strong>secondary-pre-fill-username client hide use-common-password push<\/strong> # \u041f\u0440\u044f\u0447\u0435\u043c \u043e\u043a\u043d\u043e \u0432\u0432\u043e\u0434\u0430 \u043b\u043e\u0433\u0438\u043d\u0430\/\u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 DUO \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u043e\u043b\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u043c\u0435\u0442\u043e\u0434 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f (sms\/push\/phone) \u2013 \u0434\u043e\u043a\u0430 <noindex><a rel=\"nofollow\" href=\"https:\/\/duo.com\/docs\/ciscoasa-radius\">aici<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">!\naccess-list posture-redirect extended permit tcp any host 72.163.1.80 \naccess-list posture-redirect extended deny ip any any\n!\naccess-list VPN-Filter extended permit ip any any\n!\nip local pool vpn-pool 192.168.100.33-192.168.100.63 mask 255.255.255.224\n!\ngroup-policy SECURE-BANK-VPN internal\ngroup-policy SECURE-BANK-VPN attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ngroup-policy AC-DOWNLOAD internal\ngroup-policy AC-DOWNLOAD attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n scep-forwarding-url value http:\/\/ise.ashes.cc:9090\/auth\/caservice\/pkiclient.exe\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ntunnel-group DefaultWEBVPNGroup general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n accounting-server-group ISE\n default-group-policy AC-DOWNLOAD\n scep-enrollment enable\ntunnel-group DefaultWEBVPNGroup webvpn-attributes\n authentication aaa certificate\n!\ntunnel-group SECURE-BANK-VPN type remote-access\ntunnel-group SECURE-BANK-VPN general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n secondary-authentication-server-group DUO\n accounting-server-group ISE\n default-group-policy SECURE-BANK-VPN\n username-from-certificate CN\n secondary-username-from-certificate I\ntunnel-group SECURE-BANK-VPN webvpn-attributes\n authentication aaa certificate\n pre-fill-username client\n secondary-pre-fill-username client hide use-common-password push\n group-alias SECURE-BANK-VPN enable\n dns-group ASHES-DNS\n!<\/code><\/pre>\n<p><\/p>\n<p><strong>S\u0103 trecem acum la ISE:<\/strong><\/p>\n<p><\/p>\n<p>Configur\u0103m un utilizator local (se pot folosi \u0219i AD\/LDAP\/ODBC etc.), pentru simplificare am creat un utilizator local \u00een ISE \u0219i l-am asignat \u00een c\u00e2mpul <strong>description<\/strong> <strong>UDID PC<\/strong> de la care i se permite accesul prin VPN. \u00cen cazul utiliz\u0103rii autentific\u0103rii locale \u00een ISE, voi fi restric\u021bionat doar la un singur dispozitiv, deoarece nu sunt at\u00e2t de multe c\u00e2mpuri, dar nu voi avea astfel de restric\u021bii \u00een bazele externe de autentificare.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat\" src=\"\/wp-content\/uploads\/2020\/04\/ea73d4bab6c0872f7c3aef4ad1345b12.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>S\u0103 analiz\u0103m politica de autorizare, aceasta este \u00eemp\u0103r\u021bit\u0103 \u00een patru etape de conectare:<\/p>\n<p><\/p>\n<ul>\n<li><strong>Etapa 1<\/strong> \u2014 Politica pentru desc\u0103rcarea agentului AnyConnect \u0219i emiterea certificatul<\/li>\n<li><strong>Etapa 2<\/strong> \u2014 Politica de autentificare ini\u021bial\u0103 Login (din certificat)\/Parol\u0103 + Certificat cu validarea UDID<\/li>\n<li><strong>Etapa 3<\/strong> \u2014 Autentificarea secundar\u0103 prin Cisco DUO (MFA) folosind UDID ca nume de utilizator + Evaluarea st\u0103rii<\/li>\n<li><strong>Etapa 4<\/strong> \u2014 Autorizare final\u0103 \u00een stare:\n<ul>\n<li>Conform;<\/li>\n<li>validarea UDID (din certificat + leg\u0103tura cu login-ul), <\/li>\n<li>Cisco DUO MFA;<\/li>\n<li>Autentificare pe baza login-ului; <\/li>\n<li>Autentificare pe baza certificatului;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat\" src=\"\/wp-content\/uploads\/2020\/04\/f0927091b896dc1e8b7fde35f9ff9211.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>S\u0103 privim o condi\u021bie interesant\u0103 <strong>UUID_VALIDATED<\/strong>, care verific\u0103 dac\u0103 utilizatorul care se autentific\u0103 provine de la un PC cu UDID-ul permis asociat \u00een c\u00e2mpul <strong>Description<\/strong> contului, condi\u021biile aspecteaz\u0103 astfel:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat\" src=\"\/wp-content\/uploads\/2020\/04\/73952c705b376246f8b2fb9de883302b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Profilul de autorizare folosit \u00een etapele 1, 2, 3 arat\u0103 astfel:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat\" src=\"\/wp-content\/uploads\/2020\/04\/4b1eb6688a5a42d74b587424b02624e1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Pentru a verifica cum ne este trimis UDID-ul de c\u0103tre clientul AnyConnect, putem verifica detaliile sesiunii clientului \u00een ISE. \u00cen detalii, vom observa c\u0103 AnyConnect prin mecanismul <strong>ACIDEX<\/strong> trimite nu doar date despre platform\u0103, ci \u0219i UDID-ul dispozitivului ca <strong>Cisco-AV-PAIR<\/strong>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat\" src=\"\/wp-content\/uploads\/2020\/04\/34859d3b6a5edb448999eaec49c59669.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>S\u0103 ne concentr\u0103m asupra certificatului emis utilizatorului \u0219i al c\u00e2mpului <strong>Initials (I)<\/strong>, care este folosit pentru a ob\u021bine login-ul \u00een rolul de autentificare secundar\u0103 MFA \u00een Cisco DUO:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat\" src=\"\/wp-content\/uploads\/2020\/04\/ac5928db33e5dbbb1bd7e2190da6d9fa.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Pe partea DUO Radius Proxy \u00een jurnal vedem clar cum se efectueaz\u0103 cererea de autentificare, aceasta se face folosind UDID-ul ca nume de utilizator:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat\" src=\"\/wp-content\/uploads\/2020\/04\/791f5470115460dc4d920096e79dde0f.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Din partea portalului DUO vedem un eveniment de autentificare reu\u0219it:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat\" src=\"\/wp-content\/uploads\/2020\/04\/a31e31c57ad8b6e4ba021f3da7eedb7e.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>\u0218i \u00een propriet\u0103\u021bile utilizatorului am setat <strong>ALIAS<\/strong>, pe care l-am folosit pentru login, care de fapt este UDID-ul permis pentru login-ul PC-ului:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementarea conceptului de acces la distan\u021b\u0103 \u00eenalt protejat\" src=\"\/wp-content\/uploads\/2020\/04\/4035937749d1b85bad291aa4ec407352.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>\u00cen rezultat, am ob\u021binut:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Autentificarea multifactor a utilizatorului \u0219i dispozitivului;<\/li>\n<li>Protec\u021bia \u00eempotriva falsific\u0103rii dispozitivului utilizatorului;<\/li>\n<li>Evaluarea st\u0103rii dispozitivului;<\/li>\n<li>Potent\u021bial de consolidare a controlului cu certificatul de ma\u0219in\u0103 al domeniului etc.;<\/li>\n<li>O solu\u021bie complet\u0103 pentru protec\u021bia locului de munc\u0103 la distan\u021b\u0103 cu module de securitate desf\u0103\u0219urate automat;<\/li>\n<\/ul>\n<p><\/p>\n<p>Linkuri c\u0103tre articolele din seria Cisco VPN:<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">Desf\u0103\u0219urarea unui cluster ASA VPN cu echilibrare a \u00eenc\u0103rc\u0103rii<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493774\/\">Optimizarea serviciilor cloud \u00een tunelul VPN AnyConnect pe Cisco ASA<\/a><\/noindex><\/li>\n<\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/497618\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e); [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Implementarea conceptului de acces la distan\u021b\u0103 de \u00eenalt\u0103 securitate | ProHoster","description":"Continu\u00e2nd seria de articole despre organizarea accesului VPN la distan\u021b\u0103, nu pot s\u0103 nu \u00eemp\u0103rt\u0103\u0219esc o experien\u021b\u0103 interesant\u0103 \u00een desf\u0103\u0219urarea unei configura\u021bii VPN de \u00eenalt\u0103 securitate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-17T23:42:36+00:00","article:modified_time":"2020-04-17T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:02:45","updated":"2022-09-29 00:42:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/78242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=78242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/78242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/78243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=78242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=78242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=78242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}