{"id":78242,"date":"2020-04-18T01:42:36","date_gmt":"2020-04-17T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa"},"modified":"2020-04-18T01:42:36","modified_gmt":"2020-04-17T23:42:36","slug":"realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","title":{"rendered":"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Pokra\u010duj\u00fac v s\u00e9rii \u010dl\u00e1nkov na t\u00e9mu organiz\u00e1cie <strong>Remote-Access VPN<\/strong> pr\u00edstupu nem\u00f4\u017eem sa nepodeli\u0165 o zauj\u00edmav\u00fa sk\u00fasenos\u0165 s nasaden\u00edm <strong>vysoko zabezpe\u010denej konfigur\u00e1cie VPN<\/strong>. N\u00e1ro\u010dn\u00fa \u00falohu mi poskytol jeden z\u00e1kazn\u00edk (s\u00fa aj vyn\u00e1lezcovia v rusk\u00fdch dedin\u00e1ch), ale Challenge Accepted a bolo to kreat\u00edvne zrealizovan\u00e9. V\u00fdsledkom je zauj\u00edmav\u00fd koncept s nasleduj\u00facimi charakteristikami:<\/p>\n<p><\/p>\n<ol>\n<li>Nieko\u013eko ochrann\u00fdch faktorov proti podv\u00e1dzaniu koncov\u00e9ho zariadenia (s pr\u00edsnou v\u00e4zbou na pou\u017e\u00edvate\u013ea);\n<ul>\n<li>Hodnotenie zhody PC pou\u017e\u00edvate\u013ea s pridelen\u00fdm UDID povolen\u00e9ho PC v autentifika\u010dnej datab\u00e1ze; <\/li>\n<li>S MFA, pou\u017e\u00edva\u010dou UDID PC z certifik\u00e1tu pre sekund\u00e1rnu autentifik\u00e1ciu cez Cisco DUO <em>(M\u00f4\u017ee sa pripoji\u0165 ka\u017ed\u00fd SAML\/RADIUS kompatibiln\u00fd syst\u00e9m)<\/em>; <\/li>\n<\/ul>\n<\/li>\n<li>Viacfaktorov\u00e1 autentifik\u00e1cia: \n<ul>\n<li>Certifik\u00e1t pou\u017e\u00edvate\u013ea s overen\u00edm pol\u00ed a sekund\u00e1rnou autentifik\u00e1ciou pod\u013ea jedn\u00e9ho z nich;<\/li>\n<li>Prihlasovacie \u00fadaje (nemenn\u00e9, prevzat\u00e9 z certifik\u00e1tu) a heslo;<\/li>\n<\/ul>\n<\/li>\n<li>Hodnotenie stavu, prip\u00e1jaj\u00faceho sa hostite\u013ea (Posture)<\/li>\n<\/ol>\n<p><\/p>\n<p><strong>Pou\u017eit\u00e9 komponenty rie\u0161enia:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Cisco ASA (VPN br\u00e1na);<\/li>\n<li>Cisco ISE (Autentifik\u00e1cia \/ Autoriza\u010dn\u00e1 \/ \u00da\u010dtovanie, Hodnotenie stavu, CA);<\/li>\n<li>Cisco DUO (Viacfaktorov\u00e1 autentifik\u00e1cia) <em>(M\u00f4\u017ee sa pripoji\u0165 ka\u017ed\u00fd SAML\/RADIUS kompatibiln\u00fd syst\u00e9m)<\/em>;<\/li>\n<li>Cisco AnyConnect (viac\u00fa\u010delov\u00fd agent pre pracovn\u00e9 stanice a mobiln\u00e9 OS);<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p><strong>Za\u010dnime s po\u017eiadavkami z\u00e1kazn\u00edka:<\/strong><\/p>\n<p><\/p>\n<ol>\n<li>Pou\u017e\u00edvate\u013e by mal ma\u0165 mo\u017enos\u0165 stiahnu\u0165 klienta AnyConnect z VPN br\u00e1ny pomocou svojej autentifik\u00e1cie Prihlasovacie \u00fadaje\/Heslo, v\u0161etky potrebn\u00e9 moduly AnyConnect by sa mali automaticky nain\u0161talova\u0165 v s\u00falade s politikou pou\u017e\u00edvate\u013ea;<\/li>\n<li>Pou\u017e\u00edvate\u013e by mal ma\u0165 mo\u017enos\u0165 automaticky si vytvori\u0165 certifik\u00e1t (pre jeden zo scen\u00e1rov, hlavn\u00fdm je v\u0161ak manu\u00e1lna v\u00fdp\u00edska a nahratie na PC), ja som realizoval automatick\u00e9 vytv\u00e1ranie certifik\u00e1tu na uk\u00e1\u017eku (nikdy nie je neskoro ho odstr\u00e1ni\u0165).<\/li>\n<li>Hlavn\u00e1 autentifik\u00e1cia by mala prebieha\u0165 v nieko\u013ek\u00fdch f\u00e1zach, najsk\u00f4r ide o autentifik\u00e1ciu certifik\u00e1tu s anal\u00fdzou potrebn\u00fdch pol\u00ed a ich hodn\u00f4t, n\u00e1sledne pou\u017e\u00edvate\u013esk\u00e9 meno\/heslo, len tentokr\u00e1t by sa do okna prihlasovania malo automaticky doplni\u0165 meno pou\u017e\u00edvate\u013ea uveden\u00e9 v poli certifik\u00e1tu <strong>Subject Name (CN)<\/strong> bez mo\u017enosti \u00fapravy.<\/li>\n<li>Je potrebn\u00e9 zabezpe\u010di\u0165, \u017ee zariadenie, z ktor\u00e9ho sa vykon\u00e1va prihl\u00e1senie, je podnikov\u00fd notebook vydan\u00fd pou\u017e\u00edvate\u013eovi na vzdialen\u00fd pr\u00edstup, a nie nie\u010do in\u00e9. (Existuje nieko\u013eko vari\u00e1nt na splnenie tejto po\u017eiadavky)<\/li>\n<li>Je potrebn\u00e9 vykona\u0165 hodnotenie stavu pripojen\u00e9ho zariadenia (v tomto kroku PC) s kontrolou celej obsiahlej tabu\u013eky po\u017eiadaviek z\u00e1kazn\u00edka (zh\u0155\u0148aj\u00fac):\n<ul>\n<li>S\u00fabory a ich vlastnosti;<\/li>\n<li>Z\u00e1znamy v registri;<\/li>\n<li>Opravy OS z poskytnut\u00e9ho zoznamu (n\u00e1sledne integr\u00e1cia SCCM);<\/li>\n<li>Pr\u00edtomnos\u0165 antiv\u00edrusu ur\u010dit\u00e9ho v\u00fdrobcu a aktu\u00e1lnos\u0165 podpisov;<\/li>\n<li>Aktivita ur\u010dit\u00fdch slu\u017eieb;<\/li>\n<li>Pr\u00edtomnos\u0165 ur\u010dit\u00fdch nain\u0161talovan\u00fdch programov;<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/p>\n<p>Na za\u010diatok odpor\u00fa\u010dam povinne si pozrie\u0165 video-demonstr\u00e1ciu vykonanej realiz\u00e1cie na <strong>Youtube (5 min\u00fat)<\/strong>.<\/p>\n<p>\n<center><div class=\"youtube-placeholder\" data-id=\"cBftD3KFK98\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/cBftD3KFK98\/hqdefault.jpg\" alt=\"Prehrajte video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>Teraz navrhujem zv\u00e1\u017ei\u0165 detaily realiz\u00e1cie, ktor\u00e9 neboli spomenut\u00e9 vo videu.<\/p>\n<p><\/p>\n<p><strong>Priprav\u00edme profil AnyConnect:<\/strong><\/p>\n<p><\/p>\n<p>Pr\u00edklad vytvorenia profilu (v r\u00e1mci menu v ASDM) som u\u017e uviedol vo svojej \u010dl\u00e1nku o nastaven\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing klastru<\/a><\/noindex>. Teraz chcem osobitne upozorni\u0165 na tie mo\u017enosti, ktor\u00e9 budeme potrebova\u0165:<\/p>\n<p><\/p>\n<p>V profile uvedieme br\u00e1nu VPN a n\u00e1zov profilu na pripojenie na koncovom klientovi:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/45ff3cb1f7b592e102bd6e256ae26043.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Urob\u00edme nastavenia automatick\u00e9ho vyd\u00e1vania certifik\u00e1tu zo strany profilu, pri\u010dom uvedieme najm\u00e4 parametre certifik\u00e1tu a \u010do je charakteristick\u00e9, zameriame sa na pole <strong>Initials (I)<\/strong>, kde je manu\u00e1lne zadan\u00e1 konkr\u00e9tna hodnota <strong>UDID<\/strong> testovacieho zariadenia (Jedine\u010dn\u00fd identifik\u00e1tor zariadenia, ktor\u00fd generuje Cisco AnyConnect klient).<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/89d4edb4f1b166eda75916286998a4bf.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Tu chcem spravi\u0165 lyrick\u00e9 odbo\u010denie, preto\u017ee tento \u010dl\u00e1nok popisuje koncept, pre demon\u0161tra\u010dn\u00e9 \u00fa\u010dely tu bol zadan\u00fd UDID na vyd\u00e1vanie certifik\u00e1tu v poli Initials profilu AnyConnect. Samozrejme, v re\u00e1lnom \u017eivote, ak by ste to takto spravili, v\u0161etci klienti by dostali certifik\u00e1t s rovnak\u00fdm UDID v tomto poli a ni\u010d by im nefungovalo, preto\u017ee potrebuj\u00fa UDID svojho konkr\u00e9tneho PC. AnyConnect bohu\u017eia\u013e zatia\u013e nerealizuje substit\u00faciu v profile pri \u017eiadosti o certifik\u00e1t do po\u013ea UDID cez premenn\u00fa prostredia, ako to napr\u00edklad rob\u00ed s premennou <strong>%USER%<\/strong>.<\/p>\n<p><\/p>\n<p>Je potrebn\u00e9 poznamena\u0165, \u017ee z\u00e1kazn\u00edk (tohto scen\u00e1ra) p\u00f4vodne pl\u00e1nuje s\u00e1m vyd\u00e1va\u0165 certifik\u00e1ty so zadan\u00fdm UDID manu\u00e1lne na tak\u00e9 Ochrann\u00e9 PC, \u010do nie je pre neho \u017eiadny probl\u00e9m. Av\u0161ak pre v\u00e4\u010d\u0161inu z n\u00e1s je d\u00f4le\u017eit\u00e1 automatiz\u00e1cia (aspo\u0148 pre m\u0148a ur\u010dite =). <\/p>\n<p><\/p>\n<p>A tu je, \u010do m\u00f4\u017eem pon\u00faknu\u0165 v oblasti automatiz\u00e1cie. Ak by sa certifik\u00e1t automaticky generoval s pou\u017eit\u00edm AnyConnect a dynamicky by sa nahradil UDID, existuje aj in\u00fd sp\u00f4sob, ktor\u00fd si vy\u017eaduje trochu kreat\u00edvneho myslenia a zru\u010dn\u00fdch r\u00fak \u2013 op\u00ed\u0161em v\u00e1m koncept. Najprv si pozrime, ako sa UDID vytv\u00e1ra na r\u00f4znych opera\u010dn\u00fdch syst\u00e9moch agentom AnyConnect: <\/p>\n<p><\/p>\n<ul>\n<li><strong>Windows<\/strong> \u2014 SHA-256 hash kombin\u00e1cie k\u013e\u00fa\u010da z registri DigitalProductID a Machine SID<\/li>\n<li><strong>OSX<\/strong> \u2014 SHA-256 hash PlatformUUID<\/li>\n<li><strong>Linux<\/strong> \u2014 SHA-256 hash UUID root part\u00edcie.<\/li>\n<li><strong>Apple iOS<\/strong> \u2014 SHA-256 hash PlatformUUID<\/li>\n<li><strong>Android<\/strong> \u2013 Pozri dokument\u00e1ciu k <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/security\/vpn_client\/anyconnect\/anyconnect40\/administration\/guide\/b_AnyConnect_Administrator_Guide_4-0\/b_AnyConnect_Administrator_Guide_4-0_chapter_01010.html#reference_C87ADD1C58F64EF8928D921323209AA6\">odkaze<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<p>Na z\u00e1klade toho vytvor\u00edme skript pre na\u0161e firemn\u00e9 opera\u010dn\u00e9 syst\u00e9my Windows, ktor\u00fd lok\u00e1lne vypo\u010d\u00edta UDID pod\u013ea zn\u00e1mych vstupn\u00fdch \u00fadajov a vytvor\u00ed po\u017eiadavku na vydanie certifik\u00e1tu, pri\u010dom do potrebn\u00e9ho po\u013ea vlo\u017e\u00ed tento UDID, mimochodom, m\u00f4\u017eete vyda\u0165 aj strojov\u00fd certifik\u00e1t, ktor\u00fd bol vydan\u00fd AD (pridan\u00edm do sch\u00e9my dvojitej autentifik\u00e1cie pod\u013ea certifik\u00e1tu <strong>Multiple Certificate<\/strong>). <\/p>\n<p><\/p>\n<p><strong>Priprav\u00edme nastavenia zo strany Cisco ASA:<\/strong><\/p>\n<p><\/p>\n<p>Vytvor\u00edme TrustPoint pre ISE CA server, ktor\u00fd bude vyd\u00e1va\u0165 certifik\u00e1ty klientom. Proced\u00faru importu Key-Chain nebudem popisova\u0165, pr\u00edklad je uveden\u00fd v mojom \u010dl\u00e1nku o nastaven\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing klastru<\/a><\/noindex>. <\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">crypto ca trustpoint ISE-CA\n enrollment terminal\n crl configure<\/code><\/pre>\n<p><\/p>\n<p>Nastavujeme rozdelenie pod\u013ea Tunnel-Group na z\u00e1klade pravidiel v s\u00falade s pol\u00edm v certifik\u00e1te, pod\u013ea ktor\u00e9ho sa vykon\u00e1va autentifik\u00e1cia. Tu sa nastavuje aj profil AnyConnect, ktor\u00fd sme vytvorili v predch\u00e1dzaj\u00facom kroku. Upozor\u0148ujem, \u017ee pou\u017e\u00edvam hodnotu <strong>SECUREBANK-RA<\/strong>, pre presun pou\u017e\u00edvate\u013eov s vydan\u00fdm certifik\u00e1tom do tunelovej skupiny <strong>SECURE-BANK-VPN<\/strong>, v\u0161imnite si, \u017ee toto pole m\u00e1m nastaven\u00e9 v sekcii po\u017eiadavky na certifik\u00e1t profilu AnyConnect.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">tunnel-group-map enable rules\n!\ncrypto ca certificate map OU-Map 6\n subject-name attr ou eq securebank-ra\n!\nwebvpn\n anyconnect profiles SECUREBANK disk0:\/securebank.xml\n certificate-group-map OU-Map 6 SECURE-BANK-VPN\n!<\/code><\/pre>\n<p><\/p>\n<p>Nastavujeme autentifika\u010dn\u00e9 servery. V mojom pr\u00edpade ide o ISE pre prv\u00fa f\u00e1zu autentifik\u00e1cie a DUO (Radius Proxy) ako MFA.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">! CISCO ISE\naaa-server ISE protocol radius\n authorize-only\n interim-accounting-update periodic 24\n dynamic-authorization\naaa-server ISE (inside) host 192.168.99.134\n key *****\n!\n! DUO RADIUS PROXY\naaa-server DUO protocol radius\naaa-server DUO (inside) host 192.168.99.136\n timeout 60\n key *****\n authentication-port 1812\n accounting-port 1813\n no mschapv2-capable\n!<\/code><\/pre>\n<p><\/p>\n<p>Vytv\u00e1rame skupinov\u00e9 politiky a tunelov\u00e9 skupiny a pomocn\u00e9 ich komponenty:<\/p>\n<p><\/p>\n<p>Tunelov\u00e1 skupina <strong>DefaultWEBVPNGroup<\/strong> bude pou\u017eit najprv na stiahnutie klienta AnyConnect VPN a na vydanie pou\u017e\u00edvate\u013esk\u00e9ho certifik\u00e1tu pomocou funkcie SCEP-Proxy ASA; preto s\u00fa aktivovan\u00e9 pr\u00edslu\u0161n\u00e9 mo\u017enosti na samotnej tunelovej skupine, ako aj na pridru\u017eenej skupinovej politike. <strong>AC-Download<\/strong>, ako aj na s\u0165ahovanom profile AnyConnect (polia pre vydanie certifik\u00e1tu at\u010f.). V tejto skupinovej politike tie\u017e uv\u00e1dzame potrebu s\u0165ahovania. <strong>ISE Posture Module<\/strong>.<\/p>\n<p><\/p>\n<p>Tunelov\u00e1 skupina <strong>SECURE-BANK-VPN<\/strong> bude automaticky pou\u017e\u00edvan\u00fd klientom pri autentifik\u00e1cii prostredn\u00edctvom vydan\u00e9ho certifik\u00e1tu v predch\u00e1dzaj\u00facom kroku, ke\u010f\u017ee v s\u00falade s Certificate Map, pripojenie sa bude realizova\u0165 pr\u00e1ve na t\u00fato tunelov\u00fa skupinu. Povieme si o zauj\u00edmav\u00fdch mo\u017enostiach tu:<\/p>\n<p><\/p>\n<ul>\n<li><strong>secondary-authentication-server-group DUO<\/strong> # \u0417\u0430\u0434\u0430\u0435\u043c \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO (Radius Proxy)<\/li>\n<li><strong>username-from-certificate CN<\/strong> # \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0435 CN \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043b\u043e\u0433\u0438\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f<\/li>\n<li><strong>secondary-username-from-certificate I<\/strong> # \u0414\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u043d\u043e\u0435 \u0438 \u043f\u043e\u043b\u044f Initials (I) \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430.<\/li>\n<li><strong>pre-fill-username client<\/strong> # \u0434\u0435\u043b\u0430\u0435\u043c \u043f\u0440\u0435\u0434\u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u043e\u043a\u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f<\/li>\n<li><strong>secondary-pre-fill-username client hide use-common-password push<\/strong> # \u041f\u0440\u044f\u0447\u0435\u043c \u043e\u043a\u043d\u043e \u0432\u0432\u043e\u0434\u0430 \u043b\u043e\u0433\u0438\u043d\u0430\/\u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 DUO \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u043e\u043b\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u043c\u0435\u0442\u043e\u0434 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f (sms\/push\/phone) \u2013 \u0434\u043e\u043a\u0430 <noindex><a rel=\"nofollow\" href=\"https:\/\/duo.com\/docs\/ciscoasa-radius\">tu<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">!\naccess-list posture-redirect extended permit tcp any host 72.163.1.80 \naccess-list posture-redirect extended deny ip any any\n!\naccess-list VPN-Filter extended permit ip any any\n!\nip local pool vpn-pool 192.168.100.33-192.168.100.63 mask 255.255.255.224\n!\ngroup-policy SECURE-BANK-VPN internal\ngroup-policy SECURE-BANK-VPN attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ngroup-policy AC-DOWNLOAD internal\ngroup-policy AC-DOWNLOAD attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n scep-forwarding-url value http:\/\/ise.ashes.cc:9090\/auth\/caservice\/pkiclient.exe\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ntunnel-group DefaultWEBVPNGroup general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n accounting-server-group ISE\n default-group-policy AC-DOWNLOAD\n scep-enrollment enable\ntunnel-group DefaultWEBVPNGroup webvpn-attributes\n authentication aaa certificate\n!\ntunnel-group SECURE-BANK-VPN type remote-access\ntunnel-group SECURE-BANK-VPN general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n secondary-authentication-server-group DUO\n accounting-server-group ISE\n default-group-policy SECURE-BANK-VPN\n username-from-certificate CN\n secondary-username-from-certificate I\ntunnel-group SECURE-BANK-VPN webvpn-attributes\n authentication aaa certificate\n pre-fill-username client\n secondary-pre-fill-username client hide use-common-password push\n group-alias SECURE-BANK-VPN enable\n dns-group ASHES-DNS\n!<\/code><\/pre>\n<p><\/p>\n<p><strong>\u010ealej prejdeme k ISE:<\/strong><\/p>\n<p><\/p>\n<p>Nastav\u00edme lok\u00e1lneho pou\u017e\u00edvate\u013ea (m\u00f4\u017eeme pou\u017ei\u0165 aj AD\/LDAP\/ODBC at\u010f.), pre jednoduch\u0161ie som vytvoril lok\u00e1lneho pou\u017e\u00edvate\u013ea priamo v ISE a priradil ho do po\u013ea <strong>description<\/strong> <strong>UDID PC<\/strong> z ktor\u00e9ho m\u00e1 povolen\u00fd pr\u00edstup cez VPN. V pr\u00edpade pou\u017eitia lok\u00e1lnej autentifik\u00e1cie na ISE budem obmedzen\u00fd len na jedno zariadenie, preto\u017ee pol\u00ed nie je to\u013eko, ale pri extern\u00fdch autentifika\u010dn\u00fdch datab\u00e1zach tieto obmedzenia nebud\u00fa.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/ea73d4bab6c0872f7c3aef4ad1345b12.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Pozrime sa na politiku autoriz\u00e1cie, je rozdelen\u00e1 na \u0161tyri f\u00e1zy pripojenia:<\/p>\n<p><\/p>\n<ul>\n<li><strong>F\u00e1za 1<\/strong> \u2014 Politika na stiahnutie agenta AnyConnect a vydanie certifik\u00e1tu<\/li>\n<li><strong>F\u00e1za 2<\/strong> \u2014 Politika prim\u00e1rnej autentifik\u00e1cie Prihlasovanie (z certifik\u00e1tu)\/Heslo + Certifik\u00e1t s valid\u00e1ciou UDID<\/li>\n<li><strong>F\u00e1za 3<\/strong> \u2014 Sekund\u00e1rna autentifik\u00e1cia cez Cisco DUO (MFA) s UDID ako pou\u017e\u00edvate\u013esk\u00fdm menom + Hodnotenie stavu<\/li>\n<li><strong>F\u00e1za 4<\/strong> \u2014 Kone\u010dn\u00e1 autoriz\u00e1cia v stave:\n<ul>\n<li>Compliant;<\/li>\n<li>valid\u00e1ciou UDID (z certifik\u00e1tu + viazanie na prihlasovanie), <\/li>\n<li>Cisco DUO MFA;<\/li>\n<li>Autentifik\u00e1cia pod\u013ea prihlasovania; <\/li>\n<li>Autentifik\u00e1cia pod\u013ea certifik\u00e1tu;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/f0927091b896dc1e8b7fde35f9ff9211.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Pozrime sa na zauj\u00edmav\u00fa podmienku <strong>UUID_VALIDATED<\/strong>, t\u00e1to presne sleduje, \u010di sa autentifikuj\u00faci pou\u017e\u00edvate\u013e skuto\u010dne pripojil z PC s povolen\u00fdm UDID asociovan\u00fdm v poli <strong>Description<\/strong> \u00fa\u010det, vyzeraj\u00fa podmienky takto:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/73952c705b376246f8b2fb9de883302b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Profil autoriz\u00e1cie, pou\u017e\u00edvan\u00fd v 1,2,3 f\u00e1zach vyzer\u00e1 nasledovne:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/4b1eb6688a5a42d74b587424b02624e1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Skontrolova\u0165, ako konkr\u00e9tne n\u00e1m prich\u00e1dza UDID od klienta AnyConnect m\u00f4\u017eeme pozrie\u0165 v ISE detailoch rel\u00e1cie klienta. V detailoch uvid\u00edme, \u017ee AnyConnect prostredn\u00edctvom mechanizmu <strong>ACIDEX<\/strong> posiela nielen \u00fadaje o platforme, ale aj UDID zariadenia ako <strong>Cisco-AV-PAIR<\/strong>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/34859d3b6a5edb448999eaec49c59669.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Pozrime sa na certifik\u00e1t, ktor\u00fd bol vydan\u00fd pou\u017e\u00edvate\u013eovi a pole <strong>Initials (I)<\/strong>, ktor\u00e9 sa pou\u017e\u00edva na to, aby sme ho vzali ako prihlasovacie meno pre sekund\u00e1rnu autentifik\u00e1ciu MFA na Cisco DUO:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/ac5928db33e5dbbb1bd7e2190da6d9fa.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Na strane DUO Radius Proxy v logu jasne vid\u00edme, ak\u00fdm sp\u00f4sobom ide po\u017eiadavka na autentifik\u00e1ciu, ide s pou\u017eit\u00edm UDID ako pou\u017e\u00edvate\u013esk\u00e9ho mena:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/791f5470115460dc4d920096e79dde0f.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Z poh\u013eadu port\u00e1lu DUO vid\u00edme \u00faspe\u0161n\u00fa udalos\u0165 autentifik\u00e1cie:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/a31e31c57ad8b6e4ba021f3da7eedb7e.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A v vlastnostiach pou\u017e\u00edvate\u013ea m\u00e1m nastaven\u00e9 <strong>ALIAS<\/strong>, ktor\u00fd som pou\u017eil na prihlasovanie, a to je UDID povolen\u00e9ho PC na prihlasovanie:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Realiz\u00e1cia konceptu vysoko chr\u00e1nen\u00e9ho vzdialen\u00e9ho pr\u00edstupu\" src=\"\/wp-content\/uploads\/2020\/04\/4035937749d1b85bad291aa4ec407352.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>V d\u00f4sledku toho sme z\u00edskali:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Viacfaktorov\u00fa autentifik\u00e1ciu pou\u017e\u00edvate\u013ea a zariadenia;<\/li>\n<li>Ochranu pred podvodn\u00fdm zariaden\u00edm pou\u017e\u00edvate\u013ea;<\/li>\n<li>Hodnotenie stavu zariadenia;<\/li>\n<li>Potenci\u00e1l na posilnenie kontroly s po\u010d\u00edta\u010dov\u00fdm certifik\u00e1tom dom\u00e9ny at\u010f.;<\/li>\n<li>Komplexn\u00e1 ochrana vzdialen\u00e9ho pracovn\u00e9ho miesta s automaticky nasadzovan\u00fdmi bezpe\u010dnostn\u00fdmi modulmi;<\/li>\n<\/ul>\n<p><\/p>\n<p>Odkazy na \u010dl\u00e1nky s\u00e9rie Cisco VPN:<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">Nasadenie klastru ASA VPN Load-Balancing<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493774\/\">Optimaliz\u00e1cia cloudov\u00fdch slu\u017eieb v tuneli AnyConnect VPN na Cisco ASA<\/a><\/noindex><\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/497618\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e); [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Implement\u00e1cia konceptu vysoko zabezpe\u010den\u00e9ho vzdialen\u00e9ho pr\u00edstupu | ProHoster","description":"Pokra\u010duj\u00fac v s\u00e9rii \u010dl\u00e1nkov na t\u00e9mu organiz\u00e1cie pr\u00edstupu Remote-Access VPN sa nem\u00f4\u017eem nepodeli\u0165 o zauj\u00edmav\u00e9 sk\u00fasenosti s nasaden\u00edm vysoko zabezpe\u010denej konfigur\u00e1cie VPN.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-17T23:42:36+00:00","article:modified_time":"2020-04-17T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:02:45","updated":"2022-09-29 00:42:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/78242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=78242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/78242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/78243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=78242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=78242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=78242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}