{"id":36535,"date":"2019-10-31T22:12:11","date_gmt":"2019-10-31T19:12:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\/"},"modified":"2019-10-31T22:12:11","modified_gmt":"2019-10-31T19:12:11","slug":"kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","title":{"rendered":"Si t\u00eb p\u00ebrdorni modulet PAM p\u00ebr autentifikim lokal n\u00eb Linux me \u00e7el\u00ebsat GOST-2012 n\u00eb Rutoken","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Si t\u00eb p\u00ebrdorni modulet PAM p\u00ebr autentifikim lokal n\u00eb Linux me \u00e7el\u00ebsat GOST-2012 n\u00eb Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/e6656d4db027ab2705550726d5ab1908.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFjal\u00ebt kalimi t\u00eb thjeshta nuk mbrojn\u00eb, nd\u00ebrsa ato t\u00eb komplikuara \u00ebsht\u00eb e v\u00ebshtir\u00eb t'i kujtohen. K\u00ebshtuq\u00eb, ato shpesh p\u00ebrfundojn\u00eb n\u00ebn nj\u00eb etik\u00ebt n\u00eb tastier\u00eb ose n\u00eb monitor. P\u00ebr t'u siguruar q\u00eb fjal\u00ebt kalimi mbahen n\u00eb mend nga p\u00ebrdoruesit \"t\u00eb harruar\" dhe q\u00eb siguria e mbrojtjes nuk humbet \u2013 ekziston autentifikimi me dy faktor\u00eb (2FA).<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Fal\u00eb kombinimit t\u00eb faktor\u00ebve t\u00eb zot\u00ebrimit t\u00eb pajisjes dhe dijenis\u00eb s\u00eb PIN-it t\u00eb saj, vet\u00eb PIN-i mund t\u00eb jet\u00eb m\u00eb i thjesht\u00eb dhe m\u00eb i leht\u00eb p\u00ebr t'u kujtuar. Mungesat n\u00eb gjat\u00ebsi ose rast\u00ebsin\u00eb e PIN-it kompensohen nga k\u00ebrkesa e zot\u00ebrimit fizik dhe kufizimet n\u00eb provat e PIN-it. <\/p>\n<p>P\u00ebrve\u00e7 k\u00ebsaj, n\u00eb institucionet shtet\u00ebrore ndodhi q\u00eb t\u00eb duan q\u00eb gjith\u00e7ka t\u00eb funksionoj\u00eb sipas standardeve GOST. N\u00eb lidhje me k\u00ebt\u00eb variant t\u00eb 2FA p\u00ebr hyrje n\u00eb Linux do t\u00eb flas. Do t\u00eb filloj nga larg.<\/p>\n<h1>Modulet PAM<\/h1>\n<p>\nModulet e Autentifikimit t\u00eb Nd\u00ebrlidhura (Pluggable Authentication Modules, PAM) jan\u00eb module me nj\u00eb API standard dhe realizime t\u00eb mekanizmave t\u00eb ndrysh\u00ebm t\u00eb autentifikimit n\u00eb aplikacione. <br \/>\nT\u00eb gjitha mjetet dhe aplikacionet q\u00eb din\u00eb t\u00eb punojn\u00eb me PAM, i kapin ato dhe mund t'i p\u00ebrdorin p\u00ebr autentifikimin e p\u00ebrdoruesit.<br \/>\nN\u00eb praktik\u00eb, kjo funksionon p\u00ebraf\u00ebrsisht k\u00ebshtu: komand\u00ebs login i qaset PAM, e cila i b\u00ebn t\u00eb gjitha kontrollimet e nevojshme me ndihm\u00ebn e moduleve t\u00eb p\u00ebrcaktuara n\u00eb skedarin e konfigurimit dhe i kthen rezultatin komand\u00ebs login.<\/p>\n<h2>librtpam<\/h2>\n<p>\nModuli i zhvilluar nga kompania \"Aktiv\" shton autentifikimin me dy faktor\u00eb p\u00ebr p\u00ebrdoruesit p\u00ebrmes kartave inteligjente ose USB-token\u00ebve duke p\u00ebrdorur \u00e7el\u00ebsa asimetrik\u00eb sipas standardeve t\u00eb fundit t\u00eb kriptografis\u00eb vend\u00ebse. <\/p>\n<p>Le t\u00eb shqyrtojm\u00eb parimin e funksionimit t\u00eb tij:<\/p>\n<ul>\n<li>n\u00eb token ruhet certifikata e p\u00ebrdoruesit dhe \u00e7el\u00ebsi i tij privat;<\/li>\n<li>certifikata \u00ebsht\u00eb ruajtur n\u00eb katalogun personal t\u00eb p\u00ebrdoruesit si e besuar.<\/li>\n<\/ul>\n<p>Procesi i autentifikimit ndodh n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb:<\/p>\n<ol>\n<li>N\u00eb RuToken k\u00ebrkohet certifikata personale e p\u00ebrdoruesit.<\/li>\n<li>K\u00ebrkohet PIN-i i token-it.<\/li>\n<li>N\u00ebnshkruhet nj\u00eb t\u00eb dh\u00ebn\u00eb t\u00eb rast\u00ebsishme me \u00e7el\u00ebsin privat direkt n\u00eb \u00e7ipin e RuToken-it.<\/li>\n<li>N\u00ebnshkrimi i marr\u00eb kontrollohet me \u00e7el\u00ebsin publik nga certifikata e p\u00ebrdoruesit.<\/li>\n<li>Moduli i kthen aplikacionit t\u00eb thirrur rezultatin e kontrollit t\u00eb n\u00ebnshkrimit.<\/li>\n<\/ol>\n<p>Mund t\u00eb autentifikoheni me \u00e7el\u00ebsa GOST R 34.10-2012 (gjat\u00ebsit\u00eb 256 ose 512 bit) ose me GOST R 34.10-2001 t\u00eb vjet\u00ebruar. <\/p>\n<p>Nuk\u00eb keni p\u00ebr t\u00eb shqet\u00ebsuar p\u00ebr sigurin\u00eb e \u00e7el\u00ebsave \u2013 ato gjenerohen drejtp\u00ebrdrejt n\u00eb Rutok\u00ebn dhe kurr\u00eb nuk e l\u00ebn\u00eb memorjen e tij gjat\u00eb operacioneve kriptografike.<\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb p\u00ebrdorni modulet PAM p\u00ebr autentifikim lokal n\u00eb Linux me \u00e7el\u00ebsat GOST-2012 n\u00eb Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/61047962c9aee308d69553201e05203d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRutoken ECP 2.0 \u00ebsht\u00eb e certifikuar nga FSB dhe FSTEK sipas NTV 4, prandaj mund t\u00eb p\u00ebrdoret n\u00eb sistemet informative q\u00eb trajtojn\u00eb informacion t\u00eb besuesh\u00ebm. <\/p>\n<h2>P\u00ebrdorimi praktik<\/h2>\n<p>\nP\u00ebrshtatet pothuajse \u00e7do Linux modern, p\u00ebr shembull, do t\u00eb p\u00ebrdorim xUbuntu 18.10.<\/p>\n<h3>1) Instaloni paketat e nevojshme<\/h3>\n<p>\n<code>sudo apt-get install libccid pcscd opensc<\/code><br \/>\nN\u00ebse d\u00ebshironi t\u00eb shtoni bllokimin e ekranit me t\u00eb kaluar\u00ebn e ekranit \u2013 instaloni gjithashtu paket\u00ebn <code>libpam-pkcs11<\/code>.<\/p>\n<h3>2) Shtoni modulin PAM me mb\u00ebshtetje p\u00ebr GOST<\/h3>\n<p>\nNgarkoni bibliotek\u00ebn me <noindex><a rel=\"nofollow\" href=\"https:\/\/download.rutoken.ru\/Rutoken\/PAM\/\">https:\/\/download.rutoken.ru\/Rutoken\/PAM\/<\/a><\/noindex><br \/>\nKopjoni p\u00ebrmbajtjen e dosjes PAM librtpam.so.1.0.0 n\u00eb dosjen sistemore<br \/>\n<code>\/usr\/lib\/<\/code> ose <code>\/usr\/lib\/x86_64-linux-gnu\/<\/code>ose <code>\/usr\/lib64<\/code><\/p>\n<h3>3) Instaloni paket\u00ebn me librtpkcs11ecp.so<\/h3>\n<p>\nNgarkoni dhe instaloni paketin DEB ose RPM n\u00eb lidhjen: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rutoken.ru\/support\/download\/pkcs\/\">https:\/\/www.rutoken.ru\/support\/download\/pkcs\/<\/a><\/noindex><\/p>\n<h3>4) Kontrolloni n\u00ebse Rutoken ECP 2.0 punon n\u00eb sistem<\/h3>\n<p>\nN\u00eb terminal ekzekutoni<br \/>\n<code>$ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -T<\/code><br \/>\nN\u00ebse shihni rreshtin <code>Rutoken ECP<\/code> at\u00ebher\u00eb gjith\u00e7ka \u00ebsht\u00eb n\u00eb rregull.<\/p>\n<h3>5) Lexoni certifikat\u00ebn<\/h3>\n<p>\nKontrolloni n\u00ebse pajisja ka certifikat\u00ebn<br \/>\n<code>$ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -O<\/code><br \/>\nN\u00ebse pas rreshtit:<br \/>\n<code>Using slot 0 with a present token (0x0)<\/code><\/p>\n<ul>\n<li><b>informacioni shfaqet<\/b> p\u00ebr \u00e7el\u00ebsat dhe certifikatat, at\u00ebher\u00eb \u00ebsht\u00eb e nevojshme t\u00eb lexoni certifikat\u00ebn dhe t\u00eb ruani n\u00eb disk. P\u00ebr k\u00ebt\u00eb, ekzekutoni komand\u00ebn e m\u00ebposhtme, ku n\u00eb vend t\u00eb {id} duhet t\u00eb vendosni ID-n\u00eb e certifikat\u00ebs q\u00eb e keni par\u00eb n\u00eb daljen e komand\u00ebs s\u00eb m\u00ebparshme:<br \/>\n<code>$ pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so -r -y cert --id {id} --output-file cert.crt<\/code><br \/>\n N\u00ebse skedari cert.crt \u00ebsht\u00eb krijuar kaloni n\u00eb pik\u00ebn 6).<\/li>\n<li><b>nuk ka asgj\u00eb<\/b>at\u00ebher\u00eb pajisja \u00ebsht\u00eb e zbraz\u00ebt. Kontaktoni administratorin ose krijoni \u00e7el\u00ebsat dhe certifikat\u00ebn vet\u00eb, duke ndjekur pik\u00ebn tjet\u00ebr.<\/li>\n<\/ul>\n<h4>5.1) Krijoni nj\u00eb certifikat\u00eb testuese<\/h4>\n<p><\/p>\n<blockquote><p>Kujdes! Metodat e p\u00ebrshkruara p\u00ebr krijimin e \u00e7el\u00ebsave dhe certifikatave jan\u00eb t\u00eb p\u00ebrshtatshme p\u00ebr testim dhe nuk jan\u00eb t\u00eb destinuara p\u00ebr p\u00ebrdorim n\u00eb m\u00ebnyr\u00eb operative. P\u00ebr k\u00ebt\u00eb, duhet t\u00eb p\u00ebrdoren \u00e7el\u00ebsat dhe certifikatat q\u00eb jan\u00eb l\u00ebshuar nga nj\u00eb autoritet i besuesh\u00ebm t\u00eb certifikimit t\u00eb organizat\u00ebs tuaj ose nga nj\u00eb qend\u00ebr e akredituar t\u00eb verifikimit.<br \/>\nModuli PAM \u00ebsht\u00eb krijuar p\u00ebr t\u00eb mbrojtur kompjuter\u00ebt lokal\u00eb dhe parashikon funksionimin n\u00eb organizata t\u00eb vogla. Duke qen\u00eb se p\u00ebrdoruesit jan\u00eb t\u00eb pak\u00ebt, Administratori mund t\u00eb ndjek\u00eb vet\u00eb rinovimin e certifikatave dhe t\u00eb bllokoj\u00eb manualisht llogarit\u00eb, si dhe t\u00eb menaxhoj\u00eb afatin e vlefshm\u00ebris\u00eb s\u00eb certifikatave. Moduli PAM aktualisht nuk \u00ebsht\u00eb n\u00eb gjendje t\u00eb verifikoj\u00eb certifikatat p\u00ebrmes CRL dhe t\u00eb ndihmoj\u00eb n\u00eb nd\u00ebrtimin e zinxhir\u00ebve t\u00eb besimit.<\/p><\/blockquote>\n<h4>Nj\u00eb rrug\u00eb e thjesht\u00eb (n\u00ebp\u00ebrmjet shfletuesit)<\/h4>\n<p>\nP\u00ebr t\u00eb marr\u00eb nj\u00eb certifikat\u00eb testimi, p\u00ebrdorni <noindex><a rel=\"nofollow\" href=\"https:\/\/ra.rutoken.ru\/\">sh\u00ebrbimin n\u00eb internet \"Qendra e Regjistrimit Rutan\"<\/a><\/noindex>. Procesi do t\u00eb zgjas\u00eb jo m\u00eb shum\u00eb se 5 minuta.<\/p>\n<h4>Rruga e gjahtar\u00ebve (n\u00ebp\u00ebrmjet konsol\u00ebs dhe ndoshta kompilatorit)<\/h4>\n<p>\n<b>Kontrolloni versionin e OpenSC <\/b><br \/>\n<code>$ opensc-tool --version<\/code><br \/>\nN\u00ebse versioni \u00ebsht\u00eb m\u00eb i vog\u00ebl se 0.20, p\u00ebrdit\u00ebsoni ose nd\u00ebrtoni <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/AktivCo\/OpenSC\/tree\/gostr3410-2012\/\">degresin pkcs11-tool me mb\u00ebshtetje p\u00ebr GOST-2012<\/a><\/noindex> nga GitHub-i yn\u00eb (n\u00eb momentin e publikimit t\u00eb k\u00ebtij artikulli, l\u00ebshimi 0.20 nuk ishte ende b\u00ebr\u00eb) ose nga dega master e projektit kryesor OpenSC, jo m\u00eb von\u00eb se <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OpenSC\/OpenSC\/tree\/8cf1e6f769b36bdcadc3958574305b90e88c816d\">komitit 8cf1e6f<\/a><\/noindex><\/p>\n<p>Krijoni nj\u00eb \u00e7ift ky\u00e7esh me parametrat:<br \/>\n<code>--key-type: GOSTR3410-2012-512:A (GOST-2012 512 bit me parametrin A), GOSTR3410-2012-256:A (GOST-2012 256 bit me parametrin A)<\/code><\/p>\n<p><code>--id: <\/code> identifikuesi i objektit (CKA_ID) n\u00eb form\u00ebn e numrave dyshifror\u00eb n\u00eb hex nga tabela ASCII. P\u00ebrdorni vet\u00ebm kodet ASCII t\u00eb simboleve t\u00eb printueshme, pasi id do t\u00eb duhet t\u00eb d\u00ebrgohet n\u00eb OpenSSL si nj\u00eb varg. P\u00ebr shembull, kodet ASCII \"3132\" korrespondojn\u00eb me vargun \"12\". <b> P\u00ebr leht\u00ebsi, mund t\u00eb p\u00ebrdorni <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rapidtables.com\/convert\/number\/ascii-to-hex.html\">sh\u00ebrbimin n\u00eb internet p\u00ebr konvertimin e vargjeve n\u00eb kode ASCII<\/a><\/noindex><\/b>.<\/p>\n<p><code>$ .\/pkcs11-tool --module \/usr\/lib\/librtpkcs11ecp.so --keypairgen --key-type GOSTR3410-2012-512:A -l --id 3132<\/code><\/p>\n<p>M\u00eb pas do t\u00eb krijojm\u00eb nj\u00eb certifikat\u00eb. M\u00eb posht\u00eb do t\u00eb p\u00ebrshkruhen dy rrug\u00eb: e para p\u00ebrmes U\u00c7 (do t\u00eb p\u00ebrdorim U\u00c7 testuese), e dyta - vet\u00eb-n\u00ebnshkruar. P\u00ebr k\u00ebt\u00eb, s\u00eb pari duhet t\u00eb instaloni dhe konfiguroni OpenSSL version 1.1 ose m\u00eb t\u00eb ri p\u00ebr t\u00eb punuar me Rutan p\u00ebrmes modulit t\u00eb ve\u00e7ant\u00eb rtengine duke p\u00ebrdorur udh\u00ebzimin <noindex><a rel=\"nofollow\" href=\"https:\/\/dev.rutoken.ru\/display\/PUB\/%D0%A3%D1%81%D1%82%D0%B0%D0%BD%D0%BE%D0%B2%D0%BA%D0%B0+%D0%B8+%D0%BD%D0%B0%D1%81%D1%82%D1%80%D0%BE%D0%B9%D0%BA%D0%B0+OpenSSL\">Instalimi dhe konfigurimi i OpenSSL<\/a><\/noindex>.<br \/>\nP\u00ebr shembull: p\u00ebr '-<code>-id 3132<\/code>' n\u00eb OpenSSL duhet t\u00eb specifikoni \u00ab<code>pkcs11:id=12<\/code>&#171;. <\/p>\n<p>Mund t\u00eb shfryt\u00ebzoni sh\u00ebrbimet e U\u00c7-testues, t\u00eb cilat jan\u00eb shum\u00eb, p\u00ebr shembuj, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cryptopro.ru\/solutions\/test-ca\">ja<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"http:\/\/testcert.infotecs.ru\/\">ja <\/a><\/noindex>dhe <noindex><a rel=\"nofollow\" href=\"http:\/\/soft.lissi.ru\/services\/test_ca\/\">ja<\/a><\/noindex>, p\u00ebr t\u00eb cilin do t\u00eb krijojm\u00eb nj\u00eb k\u00ebrkes\u00eb p\u00ebr certifikat\u00eb<\/p>\n<p>Nj\u00eb mund\u00ebsi tjet\u00ebr \u00ebsht\u00eb t\u00eb dor\u00ebzoheni dhe t\u00eb krijoni nj\u00eb certifikat\u00eb vet\u00eb-n\u00ebnshkruar<br \/>\n<code>$ openssl k\u00ebrkes\u00eb -utf8 <b>-e re<\/b> -forma e \u00e7el\u00ebsit engine -\u00e7el\u00ebsi \"pkcs11:id=12\" -engine rtengine -d\u00ebrgo req.csr<\/code><\/p>\n<p>Ngarkohet certifikata n\u00eb pajisje<br \/>\n<code>$ openssl k\u00ebrkes\u00eb -utf8 <b>-x509<\/b> -keyform engine -key \"pkcs11:id=12\" -engine rtengine -out cert.cer<\/code><\/p>\n<h3>6) Regjistroni certifikat\u00ebn n\u00eb sistem<\/h3>\n<p>\nSigurohuni q\u00eb certifikata juaj t\u00eb duket si nj\u00eb skedar base64:<\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb p\u00ebrdorni modulet PAM p\u00ebr autentifikim lokal n\u00eb Linux me \u00e7el\u00ebsat GOST-2012 n\u00eb Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/83a7e25541041d02365141e682bd4635.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00ebse certifikata juaj duket k\u00ebshtu:<\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb p\u00ebrdorni modulet PAM p\u00ebr autentifikim lokal n\u00eb Linux me \u00e7el\u00ebsat GOST-2012 n\u00eb Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/f385e4e288a49acfb2c54be4c24749e7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nat\u00ebher\u00eb duhet t\u00eb konvertoni certifikat\u00ebn nga formati DER n\u00eb formatin PEM (base64)<\/p>\n<p><code>$ openssl x509 -in cert.crt -out cert.pem -inform DER -outform PEM<\/code><br \/>\nK\u00ebrkojm\u00eb p\u00ebrs\u00ebri q\u00eb tani gjith\u00e7ka t\u00eb jet\u00eb n\u00eb rregull.<\/p>\n<p>Shtojm\u00eb certifikat\u00ebn n\u00eb list\u00ebn e certifikatave t\u00eb besuara<br \/>\n<code>$ mkdir ~\/.eid<br \/>\n$ chmod 0755 ~\/.eid<br \/>\n$ cat cert.pem &gt;&gt; ~\/.eid\/authorized_certificates<br \/>\n$ chmod 0644 ~\/.eid\/authorized_certificates<\/code><br \/>\nRreshti i fundit mbron list\u00ebn e certifikatave t\u00eb besuara nga modifikimi aksidental ose t\u00eb q\u00ebllimsh\u00ebm nga p\u00ebrdorues t\u00eb tjer\u00eb. Kjo p\u00ebrjashton situat\u00ebn kur dikush shton k\u00ebtu certifikat\u00ebn e tij dhe mund t\u00eb hyj\u00eb n\u00eb sistem n\u00eb emrin tuaj.<\/p>\n<h3>7) Konfigurojm\u00eb autentifikimin <\/h3>\n<p>\nKonfigurimi i modulit ton\u00eb PAM \u00ebsht\u00eb krejt\u00ebsisht standard dhe b\u00ebhet pik\u00ebrisht si konfigurohen modul\u00ebt e tjer\u00eb. Krijojm\u00eb n\u00eb skedarin <code>\/usr\/share\/pam-configs\/rutoken-gost-pam<\/code> duke p\u00ebrfshir\u00eb emrin e plot\u00eb t\u00eb modulit, n\u00ebse \u00ebsht\u00eb aktivuar nga e para, prioritetin e modulit dhe parametrat e autentifikimit.<br \/>\nN\u00eb parametrat e autentifikimit ka k\u00ebrkesa p\u00ebr suksesin e operacionit:<\/p>\n<ul>\n<li>required (i nevojsh\u00ebm): modulet e tilla duhet t\u00eb kthejn\u00eb nj\u00eb p\u00ebrgjigje pozitive. N\u00ebse rezultati i thirrjes s\u00eb modulit p\u00ebrmban nj\u00eb p\u00ebrgjigje negative, kjo do t\u00eb \u00e7oj\u00eb n\u00eb nj\u00eb gabim autentifikimi. K\u00ebrkesa do t\u00eb anulohet, por modulet e tjera do t\u00eb thirren.<\/li>\n<li>requisite (e nevojshme): ngjash\u00ebm me required, por menj\u00ebher\u00eb \u00e7on n\u00eb d\u00ebshtimin e autentifikimit dhe injoron modulet e tjera.<\/li>\n<li>sufficient (e mjaftueshme): n\u00ebse para nj\u00eb moduli t\u00eb till\u00eb nuk ka ndonj\u00eb nga modulet required ose sufficient q\u00eb ktheu nj\u00eb rezultat negativ, at\u00ebher\u00eb moduli do t\u00eb kthej\u00eb nj\u00eb p\u00ebrgjigje pozitive. Modulet e mbetura do t\u00eb injorohen.<\/li>\n<li>optional (shtes\u00eb): n\u00ebse n\u00eb stek nuk ka modulet required dhe asnj\u00eb nga modulet sufficient nuk ka kthyer nj\u00eb rezultat pozitiv, at\u00ebher\u00eb t\u00eb pakt\u00ebn nj\u00eb nga modulet optional duhet t\u00eb kthej\u00eb nj\u00eb p\u00ebrgjigje pozitive.<\/li>\n<\/ul>\n<p>\nP\u00ebrmbajtja e plot\u00eb e skedarit <code>\/usr\/share\/pam-configs\/rutoken-gost-pam<\/code>:<br \/>\n<code>Emri: Rutoken PAM GOST<br \/>\nParazgjedhja: po<br \/>\nPrioriteti: 800<br \/>\nLloji i Autentikimit: Primar<br \/>\nAutentikimi: i mjaftuesh\u00ebm \/usr\/lib\/librtpam.so.1.0.0 \/usr\/lib\/librtpkcs11ecp.so<\/code><\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb p\u00ebrdorni modulet PAM p\u00ebr autentifikim lokal n\u00eb Linux me \u00e7el\u00ebsat GOST-2012 n\u00eb Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/804bd960918413e2134617b2ce31f0af.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nshkruajm\u00eb skedarin, pas k\u00ebsaj ekzekutojm\u00eb<br \/>\n<code>$ sudo pam-auth-update<\/code><br \/>\nn\u00eb dritaren e shfaqur v\u00ebm\u00eb nj\u00eb yll pran\u00eb <b>Rutoken PAM GOST<\/b> and click <b>OK<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb p\u00ebrdorni modulet PAM p\u00ebr autentifikim lokal n\u00eb Linux me \u00e7el\u00ebsat GOST-2012 n\u00eb Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/2fb2e020c943ef3a22f09985a939a1c9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>8) Kontrollojm\u00eb konfigurimin <\/h3>\n<p>\nP\u00ebr t\u00eb kuptuar se gjith\u00e7ka \u00ebsht\u00eb konfiguruar, por p\u00ebr t\u00eb mos humbur mund\u00ebsin\u00eb e hyrjes n\u00eb sistem, shkruani komand\u00ebn<br \/>\n<code>$ sudo login<\/code><br \/>\nShkruani emrin e p\u00ebrdoruesit. Gjith\u00e7ka \u00ebsht\u00eb konfiguruar sakt\u00eb, n\u00ebse sistemi k\u00ebrkon PIN-in e pajisjes.<\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb p\u00ebrdorni modulet PAM p\u00ebr autentifikim lokal n\u00eb Linux me \u00e7el\u00ebsat GOST-2012 n\u00eb Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/2501ca77a0c881ebb9fe588031a2c8ef.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>9) Konfigurojm\u00eb bllokimin e kompjuterit gjat\u00eb nxjerrjes s\u00eb tokenit<\/h3>\n<p>\nN\u00eb paket\u00ebn <code>libpam-pkcs11<\/code> p\u00ebrfshihet utilita <code>pkcs11_eventmgr,<\/code> e cila lejon kryerjen e veprimeve t\u00eb ndryshme me rastin e ngjarjeve PKCS#11.<br \/>\nP\u00ebr konfigurimin <code>pkcs11_eventmgr<\/code> sh\u00ebrben skedari i konfigurimit: <code>\/etc\/pam_pkcs11\/pkcs11_eventmgr.conf<\/code><br \/>\n<i>P\u00ebr shp\u00ebrndarje t\u00eb ndryshme t\u00eb Linux-it, komanda q\u00eb shkakton bllokimin e llogaris\u00eb gjat\u00eb nxjerrjes s\u00eb kartave inteligjente ose tokenit do t\u00eb ndryshoj\u00eb. Shih. <code>event card_remove<\/code>.<\/i><br \/>\nNj\u00eb shembull i skedarit t\u00eb konfigurimit paraqitet m\u00eb posht\u00eb:<\/p>\n<pre><code class=\"xml\">pkcs11_eventmgr\n{\n    # Aktivimi n\u00eb sfond\n    daemon = true;\n     \n    # Konfigurimi i mesazheve t\u00eb zgjeruara\n    debug = false;\n \n    # Koha e anketimit n\u00eb sekonda\n    polling_time = 1;\n \n    # Caktimi i koh\u00ebs p\u00ebr skadimin e kart\u00ebs\n    # N\u00eb m\u00ebnyr\u00eb t\u00eb parazgjedhur 0\n    expire_time = 0;\n \n    # Zgjedhja e bibliotek\u00ebs pkcs11 p\u00ebr pun\u00ebn me Rutoken\n    pkcs11_module = usr\/lib\/librtpkcs11ecp.so;\n \n    # Veprime me kart\u00ebn\n    # Karta \u00ebsht\u00eb futur:\n    event card_insert {\n        # Lini vlerat e parazgjedhura (nuk ndodh asgj\u00eb)\n        on_error = ignore ;\n \n        action = \"\/bin\/false\";\n    }\n \n    # Karta \u00ebsht\u00eb nxjerr\u00eb\n    event card_remove {\n        on_error = ignore;\n         \n        # Th\u00ebrrisni funksionin e bllokimit t\u00eb ekranit\n        \n        # P\u00ebr GNOME \n        action = \"dbus-send --type=method_call --dest=org.gnome.ScreenSaver \/org\/gnome\/ScreenSaver org.gnome.ScreenSaver.Lock\";\n        \n        # P\u00ebr XFCE\n        # action = \"xflock4\";\n        \n        # P\u00ebr Astra Linux (FLY)\n        # action = \"fly-wmfunc FLYWM_LOCK\";\n    }\n \n    # Karta \u00ebsht\u00eb nxjerr\u00eb p\u00ebr nj\u00eb koh\u00eb t\u00eb gjat\u00eb\n    event expire_time {\n        # Lini vlerat e parazgjedhura (nuk ndodh asgj\u00eb)\n        on_error = ignore;\n \n        action = \"\/bin\/false\";\n    }\n}<\/code><\/pre>\n<p>Pas k\u00ebsaj, shtoni aplikacionin <code>pkcs11_eventmgr<\/code> n\u00eb ngarkimin automatik. P\u00ebr k\u00ebt\u00eb, redaktoni skedarin .bash_profile:<br \/>\n<code>$ nano \/home\/\/.bash_profile<\/code><br \/>\nShtoni n\u00eb fund t\u00eb skedarit rreshtin pkcs11_eventmgr dhe rinisni sistemin.<\/p>\n<p><b>Hapat e p\u00ebrshkruar p\u00ebr konfigurimin e sistemit operativ mund t\u00eb p\u00ebrdoren si udh\u00ebzime n\u00eb \u00e7do shp\u00ebrndarje moderne t\u00eb Linux, duke p\u00ebrfshir\u00eb ato t\u00eb brendshme. <\/b><\/p>\n<p><img decoding=\"async\" alt=\"Si t\u00eb p\u00ebrdorni modulet PAM p\u00ebr autentifikim lokal n\u00eb Linux me \u00e7el\u00ebsat GOST-2012 n\u00eb Rutoken\" src=\"\/wp-content\/uploads\/2019\/07\/ec235d0d0d50e23fbf09d4849d1fdd11.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>P\u00ebrfundim <\/h2>\n<p>\nPC-t\u00eb me Linux n\u00eb strukturat shtet\u00ebrore ruse po b\u00ebhen gjithnj\u00eb e m\u00eb t\u00eb njohura, dhe t\u00eb konfigurosh nj\u00eb autentikim t\u00eb besuesh\u00ebm me dy faktor\u00eb n\u00eb k\u00ebt\u00eb OS nuk \u00ebsht\u00eb gjithmon\u00eb e leht\u00eb. Ne do t\u00eb ishim t\u00eb lumtur t'ju ndihmojm\u00eb me k\u00ebt\u00eb udh\u00ebzues p\u00ebr t\u00eb zgjidhur \"problemin e fjal\u00ebkalimeve\" dhe p\u00ebr t\u00eb mbrojtur sigurt aksesin n\u00eb PC, pa e shpenzuar shum\u00eb koh\u00eb.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/aktiv-company\/blog\/461199\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0441\u0442\u044b\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u043d\u0435 \u0437\u0430\u0449\u0438\u0449\u0430\u044e\u0442, \u0430 \u0441\u043b\u043e\u0436\u043d\u044b\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u043e\u043c\u043d\u0438\u0442\u044c. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043e\u043d\u0438 \u0442\u0430\u043a \u0447\u0430\u0441\u0442\u043e \u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0441\u0442\u0438\u043a\u0435\u0440\u0435 \u043f\u043e\u0434 \u043a\u043b\u0430\u0432\u0438\u0430\u0442\u0443\u0440\u043e\u0439 \u0438\u043b\u0438 \u043d\u0430 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0435. \u0427\u0442\u043e\u0431\u044b \u043f\u0430\u0440\u043e\u043b\u0438 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u0432 \u0433\u043e\u043b\u043e\u0432\u0430\u0445 \u201c\u0437\u0430\u0431\u044b\u0432\u0447\u0438\u0432\u044b\u0445\u201d \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u043d\u0430\u0434\u0451\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0442\u044b \u043d\u0435 \u0442\u0435\u0440\u044f\u043b\u0430\u0441\u044c \u2013 \u0435\u0441\u0442\u044c \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u0430\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f (2\u0424\u0410). \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u044e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0432\u043b\u0430\u0434\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0438 \u0437\u043d\u0430\u043d\u0438\u044f \u0435\u0433\u043e PIN-\u043a\u043e\u0434\u0430, \u0441\u0430\u043c PIN-\u043a\u043e\u0434 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u0440\u043e\u0449\u0435 \u0438 \u043b\u0435\u0433\u0447\u0435 \u0434\u043b\u044f \u0437\u0430\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27347,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-36535","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\".\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PAM-\u043c\u043e\u0434\u0443\u043b\u0438 \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Linux \u043f\u043e \u043a\u043b\u044e\u0447\u0430\u043c \u0413\u041e\u0421\u0422-2012 \u043d\u0430 \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\".\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:12:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:12:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Si t\u00eb p\u00ebrdorni modulet PAM p\u00ebr autentikimin lokal n\u00eb Linux me \u00e7el\u00ebsat GOST-2012 n\u00eb Rutoken | ProHoster","description":".","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c PAM-\u043c\u043e\u0434\u0443\u043b\u0438 \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Linux \u043f\u043e \u043a\u043b\u044e\u0447\u0430\u043c \u0413\u041e\u0421\u0422-2012 \u043d\u0430 \u0420\u0443\u0442\u043e\u043a\u0435\u043d\u0435 | ProHoster","og:description":".","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-ispolzovat-pam-moduli-dlya-lokalnoj-autentifikatsii-v-linux-po-klyucham-gost-2012-na-rutokene","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:12:11+00:00","article:modified_time":"2019-10-31T19:12:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36535","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 03:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:43:32","updated":"2026-01-22 03:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/36535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=36535"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/36535\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/27347"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=36535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=36535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=36535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}