{"id":85328,"date":"2020-06-15T01:42:33","date_gmt":"2020-06-14T23:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1"},"modified":"2020-06-15T01:42:33","modified_gmt":"2020-06-14T23:42:33","slug":"opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","title":{"rendered":"Experien\u021ba utiliz\u0103rii tehnologiei Rutoken pentru \u00eenregistrarea \u0219i autorizarea utilizatorilor \u00een sistem (partea 1)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bun\u0103 ziua! Vreau s\u0103 \u00eemp\u0103rt\u0103\u0219esc experien\u021ba mea pe aceast\u0103 tem\u0103.<\/p>\n

Rutoken este o solu\u021bie hardware \u0219i software \u00een domeniul autentific\u0103rii, protec\u021biei informa\u021biilor \u0219i semn\u0103turii electronice. Practic, este un stick USB care poate stoca datele de autentificare folosite de utilizator pentru a accesa sistemul. <\/p>\n

\u00cen acest exemplu, se folose\u0219te Rutoken ECP 2.0. <\/p>\n

Pentru a lucra cu acest Rutoken, este necesar s\u0103 instala\u021bi driverul pe Windows.<\/a><\/noindex>.<\/p>\n

Pentru Windows, instalarea doar a driverului asigur\u0103 tot ce este necesar pentru ca sistemul de operare s\u0103 recunoasc\u0103 Rutokenul dumneavoastr\u0103 \u0219i s\u0103 poat\u0103 lucra cu el.<\/p>\n

<\/a><\/noindex> Cu Rutokenul se poate interac\u021biona \u00een diverse moduri. Se poate accesa din partea serverului aplica\u021biei sau direct din partea clientului. \u00cen acest exemplu, se va analiza interac\u021biunea cu Rutokenul din partea clientului aplica\u021biei. <\/p>\n

Partea clientului aplica\u021biei interac\u021bioneaz\u0103 cu Rutokenul prin intermediul plugin-ului Rutoken. Aceasta este o aplica\u021bie care se instaleaz\u0103 separat \u00een fiecare browser. Pentru Windows, trebuie doar s\u0103 desc\u0103rca\u021bi \u0219i s\u0103 instala\u021bi plugin-ul, disponibil la acest link.<\/a><\/noindex>.<\/p>\n

Acum putem interac\u021biona cu Rutokenul din partea clientului aplica\u021biei.<\/p>\n

\u00cen acest exemplu, este prezentat\u0103 ideea realiz\u0103rii unui algoritm de autorizare a utilizatorului \u00een sistem utiliz\u00e2nd schema challenge-response. <\/p>\n

Ideea principal\u0103 este urm\u0103toarea: <\/p>\n

    \n
  1. Clientul trimite o cerere de autorizare c\u0103tre server.<\/li>\n
  2. Serverul, ca r\u0103spuns la cererea clientului, trimite un \u0219ir aleator.<\/li>\n
  3. Clientul completeaz\u0103 acest \u0219ir cu 32 de bi\u021bi aleatori.<\/li>\n
  4. Clientul semneaz\u0103 \u0219irul ob\u021binut cu certificatul s\u0103u.<\/li>\n
  5. Clientul trimite serverului mesajul codificat ob\u021binut.<\/li>\n
  6. Serverul verific\u0103 semn\u0103tura, ob\u021bin\u00e2nd mesajul ini\u021bial necodificat.<\/li>\n
  7. Serverul separ\u0103 ultimii 32 de bi\u021bi din mesajul necodificat ob\u021binut.<\/li>\n
  8. Serverul compar\u0103 rezultatul ob\u021binut cu mesajul care a fost trimis la cererea de autorizare.<\/li>\n
  9. Dac\u0103 mesajele sunt identice, autorizarea este considerat\u0103 reu\u0219it\u0103.<\/li>\n<\/ol>\n

    \n\u00cen algoritmul de mai sus exist\u0103 no\u021biunea de certificat. \u00cen cadrul acestui exemplu, este necesar s\u0103 \u00een\u021belegem o anumit\u0103 teorie criptografic\u0103. Pe Habr exist\u0103 un articol excelent pe aceast\u0103 tem\u0103.<\/a><\/noindex>.<\/p>\n

    \u00cen acest exemplu, vom folosi algoritmi de criptare asimetrici. Pentru a implementa algoritmi de criptare asimetrici, este necesar s\u0103 avem un pereche de chei \u0219i un certificat. <\/p>\n

    Perechea de chei const\u0103 din dou\u0103 p\u0103r\u021bi: cheia privat\u0103 \u0219i cheia public\u0103. Cheia privat\u0103, a\u0219a cum sugereaz\u0103 \u0219i numele s\u0103u, trebuie s\u0103 fie secret\u0103. O folosim pentru a decripta informa\u021biile. Cheia public\u0103 poate fi distribuit\u0103 oricui. Aceast\u0103 cheie este utilizat\u0103 pentru criptarea datelor. Astfel, orice utilizator poate cripta datele folosind cheia public\u0103, dar doar de\u021bin\u0103torul cheii private poate decripta aceste informa\u021bii. <\/p>\n

    Certificatul este un document electronic care con\u021bine informa\u021bii despre utilizatorul c\u0103ruia \u00eei apar\u021bine certificatul, precum \u0219i cheia public\u0103. Av\u00e2nd un certificat, utilizatorul poate semna orice date \u0219i le poate trimite pe server, care poate verifica aceast\u0103 semn\u0103tur\u0103 \u0219i decripta datele.<\/p>\n

    Pentru a putea semna corect un mesaj cu un certificat, este necesar\u0103 crearea corect\u0103 a acestuia. Astfel, pe RUTOKEN, mai \u00eent\u00e2i se creeaz\u0103 o pereche de chei, iar apoi certificatul trebuie s\u0103 fie legat de cheia public\u0103 a acestei perechi de chei. Certificatul trebuie s\u0103 aib\u0103 exact cheia public\u0103 care se afl\u0103 pe RUTOKEN, este important. Dac\u0103 cre\u0103m pur \u0219i simplu o pereche de chei \u0219i un certificat pe partea clientului a aplica\u021biei, cum va putea apoi serverul s\u0103 decripteze acest mesaj criptat? Deoarece nu \u0219tie nimic nici despre perechea de chei, nici despre certificat. <\/p>\n

    Dac\u0103 te aprofundezi mai mult \u00een acest subiect, po\u021bi g\u0103si informa\u021bii interesante pe internet. Exist\u0103 anumite autorit\u0103\u021bi de certificare \u00een care avem \u00eencredere. Aceste autorit\u0103\u021bi de certificare pot emite certificate utilizatorilor, iar ele instaleaz\u0103 aceste certificate pe propriul server. Dup\u0103 aceea, c\u00e2nd clientul se conecteaz\u0103 la acest server, vede acel certificat \u0219i observ\u0103 c\u0103 a fost emis de o autoritate de certificare, ceea ce \u00eenseamn\u0103 c\u0103 acest server poate fi de \u00eencredere. Informa\u021bii suplimentare despre cum s\u0103 configurezi totul corect se g\u0103sesc \u0219i pe internet. De exemplu, po\u021bi \u00eencepe cu aceasta<\/a><\/noindex>.<\/p>\n

    Dac\u0103 ne \u00eentoarcem la sarcina noastr\u0103, solu\u021bia pare evident\u0103. Trebuie s\u0103 cre\u0103m cumva centrul nostru de certificare. Dar \u00eenainte de asta, trebuie s\u0103 clarific\u0103m pe ce baz\u0103 centrul de certificare ar trebui s\u0103 emit\u0103 un certificat utilizatorului, av\u00e2nd \u00een vedere c\u0103 nu \u0219tie nimic despre el. (De exemplu, numele s\u0103u, prenumele etc.) Exist\u0103 o chestie care se nume\u0219te cerere de certificat. Mai multe detalii despre acest standard pot fi g\u0103site, de exemplu, pe Wikipedia. ro.wikipedia.org\/wiki\/PKCS<\/a><\/noindex>
    \nVom folosi versiunea 1.7 \u2014 PKCS#10.<\/p>\n

    Vom descrie algoritmul de generare a certificatului pe RutuToken (sursa original\u0103 \u2014 documenta\u021bia<\/a><\/noindex>):<\/p>\n

      \n
    1. Pe client, cre\u0103m o pereche de chei \u0219i o salv\u0103m pe RutuToken. (salvarea se face automat)<\/li>\n
    2. Pe client, cre\u0103m o cerere de certificat.<\/li>\n
    3. Trimitem aceast\u0103 cerere de la client la server.<\/li>\n
    4. La primirea cererii de certificat pe server, emitim certificat cu centrul nostru de certificare.<\/li>\n
    5. Trimitem acest certificat la client.<\/li>\n
    6. Pe client, salv\u0103m certificatul pe RutuToken.<\/li>\n
    7. Certificatul trebuie s\u0103 fie legat de perechea de chei care a fost creat\u0103 la primul pas.<\/li>\n<\/ol>\n

      \nAcum devine clar cum va putea serverul s\u0103 decripteze semn\u0103tura clientului, av\u00e2nd \u00een vedere c\u0103 el \u00eensu\u0219i i-a emis certificat. <\/p>\n

      \u00cen partea urm\u0103toare, vom analiza \u00een detaliu cum s\u0103 configur\u0103m centrul nostru de certificare pe baza unei biblioteci criptografice complete cu surs\u0103 deschis\u0103 openSSL.
      \n
      Sursa:       habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

      \u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c! \u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441\u0432\u043e\u0438\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u043e \u0434\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u043c\u0435. \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u2014 \u044d\u0442\u043e \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0449\u0438\u0442\u044b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438. \u041f\u043e \u0441\u0443\u0442\u0438 \u044d\u0442\u043e \u0442\u0430\u043a\u0430\u044f \u0444\u043b\u0435\u0448\u043a\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0432 \u0441\u0435\u0431\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u043b\u044f \u0432\u0445\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443. \u0412 \u0434\u0430\u043d\u043d\u043e\u043c \u043f\u0440\u0438\u043c\u0435\u0440\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u042d\u0426\u041f 2.0. \u0414\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u044d\u0442\u0438\u043c \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85328","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Experien\u021ba aplic\u0103rii tehnologiei RutuToken pentru \u00eenregistrarea \u0219i autorizarea utilizatorilor \u00een sistem (partea 1) | ProHoster","description":"Bun\u0103 ziua! Vreau s\u0103 \u00eemp\u0103rt\u0103\u0219esc experien\u021ba mea pe aceast\u0103 tem\u0103. RutuToken este solu\u021bii hardware \u0219i software \u00een domeniul autentific\u0103rii, protec\u021biei informa\u021biei \u0219i semn\u0103turii electronice.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u044b\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u0434\u043b\u044f \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 (\u0447\u0430\u0441\u0442\u044c 1) | ProHoster","og:description":"\u0414\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c! \u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441\u0432\u043e\u0438\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u043e \u0434\u0430\u043d\u043d\u043e\u0439 \u0442\u0435\u043c\u0435. \u0420\u0443\u0442\u043e\u043a\u0435\u043d \u2014 \u044d\u0442\u043e \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0435 \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0430\u0449\u0438\u0442\u044b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/opyt-primeneniya-tehnologii-rutoken-dlya-registraczii-i-avtorizaczii-polzovatelej-v-sisteme-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-14T23:42:33+00:00","article:modified_time":"2020-06-14T23:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85328","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:39:25","updated":"2022-09-28 02:14:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/85328","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=85328"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/85328\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=85328"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=85328"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=85328"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}