{"id":78242,"date":"2020-04-18T01:42:36","date_gmt":"2020-04-17T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa"},"modified":"2020-04-18T01:42:36","modified_gmt":"2020-04-17T23:42:36","slug":"realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","title":{"rendered":"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Duke vazhduar serin\u00eb e artikujve mbi organizimin <strong>VPN me Qasje t\u00eb Larg\u00ebt<\/strong> e qasjes, nuk mund t\u00eb mos ndaj nj\u00eb p\u00ebrvoj\u00eb interesante mbi zhvillimin <strong>e nj\u00eb konfiguracioni VPN me siguri t\u00eb lart\u00eb<\/strong>. Nj\u00eb detyr\u00eb jo e thjesht\u00eb m\u00eb dha nj\u00eb klient (ka imagjinat\u00eb n\u00eb fshatrat ruse), por Sfida e Pranua dhe e realizuar n\u00eb m\u00ebnyr\u00eb kreative. Si rezultat, u krijua nj\u00eb koncept interesant me karakteristikat e m\u00ebposhtme:<\/p>\n<p><\/p>\n<ol>\n<li>Disa faktor\u00eb mbrojtjeje ndaj z\u00ebvend\u00ebsimit t\u00eb pajisjes finale (me lidhje t\u00eb rrept\u00eb me p\u00ebrdoruesin);\n<ul>\n<li>Vler\u00ebsimi i p\u00ebrputhshm\u00ebris\u00eb s\u00eb PC-s\u00eb s\u00eb p\u00ebrdoruesit me UDID-n\u00eb e PC-s\u00eb t\u00eb lejuar n\u00eb baz\u00ebn e autentikimit; <\/li>\n<li>Me MFA, q\u00eb p\u00ebrdor UDID-n\u00eb e PC-s\u00eb nga certifikata p\u00ebr autentikimin e dyt\u00eb n\u00ebp\u00ebrmjet Cisco DUO <em>(Mund t\u00eb lidhet \u00e7do SAML\/RADIUS i pajtuesh\u00ebm)<\/em>; <\/li>\n<\/ul>\n<\/li>\n<li>Autentikimi shum\u00ebfaktorial: \n<ul>\n<li>Certifikata e p\u00ebrdoruesit me verifikimin e fushave dhe autentikimin e dyt\u00eb p\u00ebrmes nj\u00ebr\u00ebs prej tyre;<\/li>\n<li>Login (i pandryshuesh\u00ebm, marr\u00eb nga certifikata) dhe fjal\u00ebkalimi;<\/li>\n<\/ul>\n<\/li>\n<li>Vler\u00ebsimi i gjendjes s\u00eb hostit q\u00eb po lidhet (Posture)<\/li>\n<\/ol>\n<p><\/p>\n<p><strong>Komponent\u00ebt e p\u00ebrdorur n\u00eb zgjidhje:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Cisco ASA (VPN Gateway);<\/li>\n<li>Cisco ISE (Autentikimi \/ Autorizimi \/ Llogaritja, Vler\u00ebsimi i Gjendjes, CA);<\/li>\n<li>Cisco DUO (Autentikimi shum\u00ebfaktorial) <em>(Mund t\u00eb lidhet \u00e7do SAML\/RADIUS i pajtuesh\u00ebm)<\/em>;<\/li>\n<li>Cisco AnyConnect (Agjenti shum\u00ebfunksional p\u00ebr stacionet e pun\u00ebs dhe sistemet operative mobile);<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p><strong>T\u00eb fillojm\u00eb me k\u00ebrkesat e klientit:<\/strong><\/p>\n<p><\/p>\n<ol>\n<li>P\u00ebrdoruesi duhet, me autentikimin e tij Login\/Fjal\u00ebkalim, t\u00eb ket\u00eb mund\u00ebsi t\u00eb shkarkoj\u00eb klientin AnyConnect nga VPN gateway, t\u00eb gjitha modulet e nevojshme t\u00eb AnyConnect duhet t\u00eb instalohen automatikisht sipas politik\u00ebs s\u00eb p\u00ebrdoruesit;<\/li>\n<li>P\u00ebrdoruesi duhet t\u00eb ket\u00eb mund\u00ebsi automatikisht t\u00eb merr nj\u00eb certifikat\u00eb (p\u00ebr nj\u00eb nga skenar\u00ebt, skenari kryesor \u00ebsht\u00eb ndarja manuale dhe ngarkimi n\u00eb PC), un\u00eb e realizova ndarjen automatike p\u00ebr demonstration (asnj\u00ebher\u00eb nuk \u00ebsht\u00eb von\u00eb p\u00ebr t\u00eb hequr).<\/li>\n<li>Autentikimi kryesor duhet t\u00eb kaloj\u00eb n\u00eb disa etapa, fillimisht b\u00ebhet autentikimi i certifikat\u00ebs me analiz\u00ebn e fushave t\u00eb nevojshme dhe vlerave t\u00eb tyre, m\u00eb pas login\/fjal\u00ebkalimi, vet\u00ebm q\u00eb k\u00ebsaj here emri i p\u00ebrdoruesit, iSpecified n\u00eb fush\u00ebn e certifikat\u00ebs <strong>Emri i Subjektit (CN)<\/strong> pa mund\u00ebsi p\u00ebr ta redaktuar.<\/li>\n<li>Duhet t\u00eb sigurohemi q\u00eb pajisja nga e cila b\u00ebhet hyrja \u00ebsht\u00eb laptopi korporativ i dh\u00ebn\u00eb p\u00ebrdoruesit p\u00ebr qasje n\u00eb distanc\u00eb, dhe jo ndonj\u00eb gj\u00eb tjet\u00ebr. (Jan\u00eb b\u00ebr\u00eb disa variante p\u00ebr t\u00eb p\u00ebrmbushur k\u00ebt\u00eb k\u00ebrkes\u00eb)<\/li>\n<li>Duhet t\u00eb b\u00ebhet nj\u00eb vler\u00ebsim i gjendjes s\u00eb pajisjes q\u00eb po lidh\u00ebt (n\u00eb k\u00ebt\u00eb faz\u00eb PC) me kontrollin e nj\u00eb tabele t\u00eb plot\u00eb t\u00eb k\u00ebrkesave t\u00eb klientit (p\u00ebrmbledhtazi):\n<ul>\n<li>Skedar\u00ebt dhe pronat e tyre;<\/li>\n<li>Sh\u00ebnimet e regjistrit;<\/li>\n<li>Patch-et e OS-s\u00eb nga lista e ofruar (n\u00eb t\u00eb ardhmen integrimi SCCM);<\/li>\n<li>Prania e antivirusit t\u00eb nj\u00eb prodhuesi t\u00eb caktuar dhe aktualiteti i n\u00ebnshkrimeve;<\/li>\n<li>Aktiviteti i sh\u00ebrbimeve t\u00eb caktuara;<\/li>\n<li>Prania e disa programeve t\u00eb instaluara;<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/p>\n<p>Faleminderit, un\u00eb sugjeroj fillimisht t\u00eb shikojm\u00eb nj\u00eb demo video t\u00eb realizimit t\u00eb arritur n\u00eb <strong>Youtube (5 minuta)<\/strong>.<\/p>\n<p>\n<center><div class=\"youtube-placeholder\" data-id=\"cBftD3KFK98\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/cBftD3KFK98\/hqdefault.jpg\" alt=\"Luaj videon\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>Tani sugjeroj t\u00eb shqyrtojm\u00eb detajet e realizimit q\u00eb nuk u p\u00ebrmend\u00ebn n\u00eb videon-promovim.<\/p>\n<p><\/p>\n<p><strong>T\u00eb p\u00ebrgatisim profilin AnyConnect:<\/strong><\/p>\n<p><\/p>\n<p>Nj\u00eb shembuj i krijimit t\u00eb profilit (n\u00eb planin e menus\u00eb n\u00eb ASDM) e kam dh\u00ebn\u00eb m\u00eb par\u00eb n\u00eb artikullin tim p\u00ebr konfigurimin <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing t\u00eb klasterit<\/a><\/noindex>. Tani dua t\u00eb theksoj opsionet q\u00eb na nevojiten:<\/p>\n<p><\/p>\n<p>N\u00eb profil do t\u00eb tregojm\u00eb portin VPN dhe emrin e profilit p\u00ebr lidhjen n\u00eb klientin p\u00ebrfundimtar:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs\" src=\"\/wp-content\/uploads\/2020\/04\/45ff3cb1f7b592e102bd6e256ae26043.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Do t\u00eb b\u00ebjm\u00eb konfigurimin e automatizimit t\u00eb l\u00ebshimit t\u00eb certifikatave nga ana e profilit, duke dh\u00ebn\u00eb, n\u00eb ve\u00e7anti, parametrat e certifikat\u00ebs dhe, q\u00eb \u00ebsht\u00eb karakteristik\u00eb, do t\u00eb fokusojm\u00eb v\u00ebmendjen n\u00eb fush\u00ebn <strong>Initials (I)<\/strong>, ku \u00ebsht\u00eb ruajtur manualisht nj\u00eb vler\u00eb e caktuar <strong>UDID<\/strong> t\u00eb makin\u00ebs testuese (Identifikuesi Unik i Pajisjes, i cili gjenerohet nga klienti Cisco AnyConnect).<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs\" src=\"\/wp-content\/uploads\/2020\/04\/89d4edb4f1b166eda75916286998a4bf.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>K\u00ebtu dua t\u00eb b\u00ebj nj\u00eb devijim lirik, pasi ky artikull p\u00ebrshkruan konceptin, p\u00ebr q\u00ebllime demonstruese, k\u00ebtu \u00ebsht\u00eb ruajtur UDID p\u00ebr l\u00ebshimin e certifikat\u00ebs n\u00eb fush\u00ebn Initials t\u00eb profilit AnyConnect. Sigurisht, n\u00eb jet\u00ebn reale, n\u00ebse e b\u00ebni k\u00ebt\u00eb, t\u00eb gjith\u00eb klient\u00ebt do t\u00eb marrin nj\u00eb certifikat\u00eb me UDID t\u00eb nj\u00ebjt\u00eb n\u00eb k\u00ebt\u00eb fush\u00eb dhe nuk do t\u00eb funksionoj\u00eb asgj\u00eb p\u00ebr ta, pasi ata kan\u00eb nevoj\u00eb p\u00ebr UDID-n\u00eb specifike t\u00eb PC-s\u00eb s\u00eb tyre. AnyConnect, fatkeq\u00ebsisht, ende nuk e implementon z\u00ebvend\u00ebsimin n\u00eb profilin p\u00ebr k\u00ebrkes\u00ebn e certifikat\u00ebs n\u00eb fush\u00ebn UDID p\u00ebrmes nj\u00eb variabeli ambienti, si\u00e7 e b\u00ebn p\u00ebr shembull me variablin <strong>%USER%<\/strong>.<\/p>\n<p><\/p>\n<p>Duhet theksuar se klienti (i k\u00ebtij skenari) fillimisht planifikon t\u00eb l\u00ebshoj\u00eb vet\u00eb certifikata me UDID t\u00eb caktuar manualisht p\u00ebr ato PC t\u00eb Mbrojtura, q\u00eb nuk paraqet ndonj\u00eb problem p\u00ebr t\u00eb. Megjithat\u00eb, p\u00ebr shumic\u00ebn prej nesh do t\u00eb d\u00ebshironim automatizim (n\u00eb m\u00ebnyr\u00eb q\u00eb un\u00eb sigurisht =). <\/p>\n<p><\/p>\n<p>Dhe k\u00ebtu \u00ebsht\u00eb se \u00e7far\u00eb mund t\u00eb ofroj p\u00ebr automatizimin. N\u00ebse l\u00ebshojm\u00eb nj\u00eb certifikat\u00eb automatikisht, AnyConnect duke vendosur dinamikisht UDID-n\u00eb, ndon\u00ebse kjo nuk \u00ebsht\u00eb e mundur, ka nj\u00eb m\u00ebnyr\u00eb tjet\u00ebr q\u00eb do t\u00eb k\u00ebrkoj\u00eb pak mendim krijues dhe duar t\u00eb zhd\u00ebrvjellta \u2013 do t\u00eb flas p\u00ebr konceptin. Fillimisht le t\u00eb shqyrtojm\u00eb se si formohet UDID n\u00eb sisteme t\u00eb ndryshme operative nga agjenti AnyConnect: <\/p>\n<p><\/p>\n<ul>\n<li><strong>Windows<\/strong> \u2014 SHA-256 hash i kombinimit t\u00eb \u00e7el\u00ebsit t\u00eb regjistrit DigitalProductID dhe Machine SID<\/li>\n<li><strong>OSX<\/strong> \u2014 SHA-256 hash i PlatformUUID<\/li>\n<li><strong>Linux<\/strong> \u2014 SHA-256 hash i UUID t\u00eb particionit root.<\/li>\n<li><strong>Apple iOS<\/strong> \u2014 SHA-256 hash i PlatformUUID<\/li>\n<li><strong>Android<\/strong> \u2013 Shiko dokumentin p\u00ebr <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/security\/vpn_client\/anyconnect\/anyconnect40\/administration\/guide\/b_AnyConnect_Administrator_Guide_4-0\/b_AnyConnect_Administrator_Guide_4-0_chapter_01010.html#reference_C87ADD1C58F64EF8928D921323209AA6\">linkun<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<p>Prandaj, ne p\u00ebrgatisim nj\u00eb skript p\u00ebr sistemet tona operative korporative Windows, me k\u00ebt\u00eb skript llogaritim lokalisht UDID-n\u00eb sipas t\u00eb dh\u00ebnave t\u00eb njohura dhe formojm\u00eb nj\u00eb k\u00ebrkes\u00eb p\u00ebr l\u00ebshimin e certifikat\u00ebs duke futur n\u00eb fush\u00ebn e duhur k\u00ebt\u00eb UDID, p\u00ebr t\u00eb cilin mund t\u00eb jet\u00eb edhe nj\u00eb certifikat\u00eb makine, e l\u00ebshuar nga AD (duke shtuar n\u00eb skem\u00ebn e dyfisht\u00eb autentifikimin me certifikat\u00ebn <strong>Multiple Certificate<\/strong>). <\/p>\n<p><\/p>\n<p><strong>T\u00eb p\u00ebrgatisim konfigurimet nga Cisco ASA:<\/strong><\/p>\n<p><\/p>\n<p>T\u00eb krijojm\u00eb nj\u00eb TrustPoint p\u00ebr serverin ISE CA, ky i fundit do t\u00eb l\u00ebshoj\u00eb certifikatat p\u00ebr klient\u00ebt. Nuk do t\u00eb shqyrtoj procedur\u00ebn e importit t\u00eb Key-Chain, shembulli \u00ebsht\u00eb p\u00ebrshkruar n\u00eb artikullin tim p\u00ebr konfigurimin <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing t\u00eb klasterit<\/a><\/noindex>. <\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">crypto ca trustpoint ISE-CA\n enrollment terminal\n crl configure<\/code><\/pre>\n<p><\/p>\n<p>Konfiguroni shp\u00ebrndarjen sipas Tunnel-Group mbi baz\u00ebn e rregullave n\u00eb p\u00ebrputhje me fushat n\u00eb certifikat\u00ebn me t\u00eb cil\u00ebn b\u00ebhet autentifikimi. Po ashtu, k\u00ebtu konfigurohet profili AnyConnect, i b\u00ebr\u00eb nga ne n\u00eb faz\u00ebn e kaluar. V\u00eb re q\u00eb p\u00ebrdor vler\u00ebn <strong>SECUREBANK-RA<\/strong>, p\u00ebr t\u00eb transferuar p\u00ebrdoruesit me certifikat\u00ebn e l\u00ebshuar n\u00eb grupin tunel <strong>SECURE-BANK-VPN<\/strong>, v\u00ebreni q\u00eb ky fush\u00eb \u00ebsht\u00eb vendosur n\u00eb rubrik\u00ebn e k\u00ebrkes\u00ebs p\u00ebr certifikat\u00ebn e profilit AnyConnect.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">tunnel-group-map enable rules\n!\ncrypto ca certificate map OU-Map 6\n subject-name attr ou eq securebank-ra\n!\nwebvpn\n anyconnect profiles SECUREBANK disk0:\/securebank.xml\n certificate-group-map OU-Map 6 SECURE-BANK-VPN\n!<\/code><\/pre>\n<p><\/p>\n<p>Konfiguroni server\u00ebt e autentifikimit. N\u00eb rastin tim, kjo \u00ebsht\u00eb ISE p\u00ebr faz\u00ebn e par\u00eb t\u00eb autentifikimit dhe DUO (Radius Proxy) si MFA.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">! CISCO ISE\naaa-server ISE protocol radius\n authorize-only\n interim-accounting-update periodic 24\n dynamic-authorization\naaa-server ISE (inside) host 192.168.99.134\n key *****\n!\n! DUO RADIUS PROXY\naaa-server DUO protocol radius\naaa-server DUO (inside) host 192.168.99.136\n timeout 60\n key *****\n authentication-port 1812\n accounting-port 1813\n no mschapv2-capable\n!<\/code><\/pre>\n<p><\/p>\n<p>Krijoni politika grupore dhe grupe tunelesh dhe p\u00ebrb\u00ebr\u00ebsit e tyre ndihm\u00ebs:<\/p>\n<p><\/p>\n<p>Grupi Tunel <strong>DefaultWEBVPNGroup<\/strong> do t\u00eb p\u00ebrdoret kryesisht p\u00ebr shkarkimin e klientit AnyConnect VPN dhe p\u00ebr l\u00ebshimin e certifikat\u00ebs s\u00eb p\u00ebrdoruesit duke p\u00ebrdorur funksionin SCEP-Proxy t\u00eb ASA, p\u00ebr k\u00ebt\u00eb kemi aktivizuar opsionet p\u00ebrkat\u00ebse si n\u00eb grupin e tunelave, ashtu edhe n\u00eb politik\u00ebn e grupit t\u00eb asociuar <strong>AC-Download<\/strong>, ashtu si n\u00eb profilin e shkarkuar AnyConnect (fushat e l\u00ebshimit t\u00eb certifikat\u00ebs etj.). Po ashtu, n\u00eb k\u00ebt\u00eb politik\u00eb grupi specifikojm\u00eb nevoj\u00ebn p\u00ebr shkarkimin <strong>ISE Posture Module<\/strong>.<\/p>\n<p><\/p>\n<p>Grupi Tunel <strong>SECURE-BANK-VPN<\/strong> do t\u00eb p\u00ebrdoret automatikisht nga klienti gjat\u00eb autentifikimit me certifikat\u00ebn e l\u00ebshuar n\u00eb faz\u00ebn e m\u00ebparshme, pasi sipas Hart\u00ebs s\u00eb Certifikatave, lidhja do t\u00eb p\u00ebrfundoj\u00eb n\u00eb k\u00ebt\u00eb grup tunelesh. Do flas p\u00ebr opsionet interesante k\u00ebtu:<\/p>\n<p><\/p>\n<ul>\n<li><strong>grupi i server\u00ebve t\u00eb autentifikimit dyt\u00ebsor DUO<\/strong> # \u0417\u0430\u0434\u0430\u0435\u043c \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO (Radius Proxy)<\/li>\n<li><strong>emri-i-p\u00ebrdoruesit-nga-certifikata CN<\/strong> # \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0435 CN \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043b\u043e\u0433\u0438\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f<\/li>\n<li><strong>emri-i-p\u00ebrdoruesit-dyt\u00ebsor-nga-certifikata I<\/strong> # \u0414\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u043d\u043e\u0435 \u0438 \u043f\u043e\u043b\u044f Initials (I) \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430.<\/li>\n<li><strong>parafillo-emrin klient<\/strong> # \u0434\u0435\u043b\u0430\u0435\u043c \u043f\u0440\u0435\u0434\u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u043e\u043a\u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f<\/li>\n<li><strong>parafillo-emrin-dyt\u00ebsor klient fsheh p\u00ebrdor-password t\u00eb zakonsh\u00ebm shtytje<\/strong> # \u041f\u0440\u044f\u0447\u0435\u043c \u043e\u043a\u043d\u043e \u0432\u0432\u043e\u0434\u0430 \u043b\u043e\u0433\u0438\u043d\u0430\/\u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 DUO \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u043e\u043b\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u043c\u0435\u0442\u043e\u0434 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f (sms\/push\/phone) \u2013 \u0434\u043e\u043a\u0430 <noindex><a rel=\"nofollow\" href=\"https:\/\/duo.com\/docs\/ciscoasa-radius\">k\u00ebtu<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">!\nlista e qasjes posture-redirect e zgjatur lejone tcp \u00e7do host 72.163.1.80 \nlista e qasjes posture-redirect e zgjatur ndalon ip \u00e7do \u00e7do\n!\nlista e qasjes VPN-Filter e zgjatur lejone ip \u00e7do \u00e7do\n!\npool lokal adresash vpn-pool 192.168.100.33-192.168.100.63 mask 255.255.255.224\n!\ngrup-politik SECURE-BANK-VPN t\u00eb brendsh\u00ebm\ngrup-politik SECURE-BANK-VPN atribute\n vler\u00eb dns-server 192.168.99.155 192.168.99.130\n vler\u00eb vpn-filter VPN-Filter\n protokolli i tunelit vpn ssl-client \n politika e tunelit t\u00eb ndar\u00eb tunnelall\n vlera e domenit-default ashes.cc\n vler\u00eb address-pools vpn-pool\n webvpn\n  anyconnect ssl dtls aktivizo\n  anyconnect mtu 1300\n  anyconnect mbaj-installuesin t\u00eb instaluar\n  anyconnect ssl mbajalive 20\n  anyconnect ssl rindej koh\u00eb asnj\u00eb\n  anyconnect ssl metod\u00eb rindej ssl\n  anyconnect dpd-interval klient 30\n  anyconnect dpd-interval port 30\n  anyconnect ssl kompresimi lzs\n  anyconnect dtls kompresimi lzs\n  anyconnect moduli vler\u00eb iseposture\n  anyconnect profilet vler\u00eb SECUREBANK tip p\u00ebrdoruesi\n!\ngrup-politik AC-DOWNLOAD t\u00eb brendsh\u00ebm\ngrup-politik AC-DOWNLOAD atribute\n vler\u00eb dns-server 192.168.99.155 192.168.99.130\n vler\u00eb vpn-filter VPN-Filter\n protokolli i tunelit vpn ssl-client \n politika e tunelit t\u00eb ndar\u00eb tunnelall\n vlera e domenit-default ashes.cc\n vler\u00eb address-pools vpn-pool\n vlera scep-forwarding-url http:\/\/ise.ashes.cc:9090\/auth\/caservice\/pkiclient.exe\n webvpn\n  anyconnect ssl dtls aktivizo\n  anyconnect mtu 1300\n  anyconnect mbaj-installuesin t\u00eb instaluar\n  anyconnect ssl mbajalive 20\n  anyconnect ssl rindej koh\u00eb asnj\u00eb\n  anyconnect ssl metod\u00eb rindej ssl\n  anyconnect dpd-interval klient 30\n  anyconnect dpd-interval port 30\n  anyconnect ssl kompresimi lzs\n  anyconnect dtls kompresimi lzs\n  anyconnect moduli vler\u00eb iseposture\n  anyconnect profilet vler\u00eb SECUREBANK tip p\u00ebrdoruesi\n!\ngrup-tuneli DefaultWEBVPNGroup atribute t\u00eb p\u00ebrgjithshme\n pool-adresash vpn-pool\n grupi i serverit t\u00eb autentifikimit ISE\n grupi i serverit t\u00eb nj\u00ebjt\u00ebsim ISE\n grupi-default politik AC-DOWNLOAD\n regjistrimi scep aktivizo\ngrup-tuneli DefaultWEBVPNGroup atribute webvpn\n autentikimi aaa certifikat\n!\ngrup-tuneli SECURE-BANK-VPN tipi qasje-ndryshe\ngrup-tuneli SECURE-BANK-VPN atribute t\u00eb p\u00ebrgjithshme\n pool-adresash vpn-pool\n grupi i serverit t\u00eb autentifikimit ISE\n grupi i serverit t\u00eb autentifikimit dyt\u00ebsor DUO\n grupi i serverit t\u00eb nj\u00ebjt\u00ebsim ISE\n grupi-default politik SECURE-BANK-VPN\n emri-i-p\u00ebrdoruesit-nga-certifikata CN\n emri-i-p\u00ebrdoruesit-dyt\u00ebsor-nga-certifikata I\ngrup-tuneli SECURE-BANK-VPN atribute webvpn\n autentikimi aaa certifikat\n parafillo-emrin klient\n parafillo-emrin-dyt\u00ebsor klient fsheh p\u00ebrdor-password t\u00eb zakonsh\u00ebm shtytje\n alias-grupi SECURE-BANK-VPN aktivizo\n grupi-dns ASHES-DNS\n!<\/code><\/pre>\n<p><\/p>\n<p><strong>Tani kalojm\u00eb te ISE:<\/strong><\/p>\n<p><\/p>\n<p>Konfigurojm\u00eb nj\u00eb p\u00ebrdorues lokal (mund t\u00eb p\u00ebrdoren edhe AD\/LDAP\/ODBC etj.), p\u00ebr thjesht\u00ebsi un\u00eb krijova nj\u00eb p\u00ebrdorues lokal n\u00eb ISE dhe e em\u00ebrova n\u00eb fush\u00ebn <strong>description<\/strong> <strong>UDID i PC-s\u00eb<\/strong> n\u00eb t\u00eb cilin i lejohet hyrja p\u00ebrmes VPN. N\u00eb rastin e p\u00ebrdorimit t\u00eb autentifikimit lokal n\u00eb ISE, do t\u00eb jem i kufizuar n\u00eb nj\u00eb pajisje, pasi fushat nuk jan\u00eb shum\u00eb, por n\u00eb bazat e t\u00eb dh\u00ebnave t\u00eb jashtme nuk do t\u00eb kem k\u00ebto kufizime.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs\" src=\"\/wp-content\/uploads\/2020\/04\/ea73d4bab6c0872f7c3aef4ad1345b12.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Le t\u00eb shikojm\u00eb politik\u00ebn e autorizimit, e cila ndahet n\u00eb kat\u00ebr faza t\u00eb lidhjes:<\/p>\n<p><\/p>\n<ul>\n<li><strong>Faza 1<\/strong> \u2014 Politika p\u00ebr shkarkimin e agjentit AnyConnect dhe l\u00ebshimin e certifikat\u00ebs<\/li>\n<li><strong>Stage 2<\/strong> \u2014 Politika e autentifikimit fillestar Login (nga certifikata)\/Fjal\u00ebkalimi + Certifikata me validimin e UDID<\/li>\n<li><strong>Stage 3<\/strong> \u2014 Autentifikimi i dyt\u00eb p\u00ebrmes Cisco DUO (MFA) sipas UDID si emri i p\u00ebrdoruesit + Vler\u00ebsimi i gjendjes<\/li>\n<li><strong>Stage 4<\/strong> \u2014 Autorizimi p\u00ebrfundimtar n\u00eb gjendjen:\n<ul>\n<li>N\u00eb p\u00ebrputhje;<\/li>\n<li>me validimin e UDID (nga certifikata + lidhja me loginin), <\/li>\n<li>Cisco DUO MFA;<\/li>\n<li>Autentifikimi sipas login; <\/li>\n<li>Autentifikimi sipas certifikat\u00ebs;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs\" src=\"\/wp-content\/uploads\/2020\/04\/f0927091b896dc1e8b7fde35f9ff9211.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Le t\u00eb shikojm\u00eb nj\u00eb kusht interesant <strong>UUID_VALIDATED<\/strong>, pik\u00ebrisht ai shqyrton n\u00ebse p\u00ebrdoruesi q\u00eb po autentikohet ka ardhur v\u00ebrtet nga nj\u00eb PC me UDID t\u00eb lejuar t\u00eb asociuar n\u00eb fush\u00ebn <strong>P\u00ebrshkrimi<\/strong> e llogaris\u00eb, kushtet duken k\u00ebshtu:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs\" src=\"\/wp-content\/uploads\/2020\/04\/73952c705b376246f8b2fb9de883302b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Profili i autorizimit, i cili p\u00ebrdoret n\u00eb fazat 1, 2, 3 duket si m\u00eb posht\u00eb:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs\" src=\"\/wp-content\/uploads\/2020\/04\/4b1eb6688a5a42d74b587424b02624e1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Mund t\u00eb kontrollojm\u00eb se si na vjen UDID nga klienti AnyConnect duke par\u00eb detajet e sesionit t\u00eb klientit n\u00eb ISE. N\u00eb detaje do t\u00eb shohim se AnyConnect d\u00ebrgon p\u00ebrmes mekanizmit <strong>ACIDEX<\/strong> jo vet\u00ebm t\u00eb dh\u00ebnat mbi platform\u00ebn, por gjithashtu UDID e pajisjes si <strong>Cisco-AV-PAIR<\/strong>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs\" src=\"\/wp-content\/uploads\/2020\/04\/34859d3b6a5edb448999eaec49c59669.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Le t\u00eb kuptojm\u00eb certifikat\u00ebn e l\u00ebshuar p\u00ebr p\u00ebrdoruesin dhe fush\u00ebn <strong>Initials (I)<\/strong>, e cila p\u00ebrdoret p\u00ebr ta marr\u00eb at\u00eb si rol login p\u00ebr autentifikimin e dyt\u00eb MFA n\u00eb Cisco DUO:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs\" src=\"\/wp-content\/uploads\/2020\/04\/ac5928db33e5dbbb1bd7e2190da6d9fa.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>N\u00eb an\u00ebn e DUO Radius Proxy n\u00eb log ne qart\u00eb shohim se si b\u00ebhet k\u00ebrkesa p\u00ebr autentifikim, ajo vjen me p\u00ebrdorimin e UDID si emri i p\u00ebrdoruesit:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs\" src=\"\/wp-content\/uploads\/2020\/04\/791f5470115460dc4d920096e79dde0f.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Nga portali DUO shohim ngjarjen e suksesshme t\u00eb autentifikimit:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs\" src=\"\/wp-content\/uploads\/2020\/04\/a31e31c57ad8b6e4ba021f3da7eedb7e.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Dhe n\u00eb pronat e p\u00ebrdoruesit un\u00eb kam vendosur <strong>ALIAS<\/strong>, q\u00eb e p\u00ebrdorova p\u00ebr login, nga ana tjet\u00ebr kjo \u00ebsht\u00eb UDID e lejuar p\u00ebr PC-n\u00eb e login:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Implementimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb distanc\u00ebs\" src=\"\/wp-content\/uploads\/2020\/04\/4035937749d1b85bad291aa4ec407352.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>Si rezultat, ne mor\u00ebm:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Autentifikimin shum\u00ebfaktorik t\u00eb p\u00ebrdoruesit dhe pajisjes;<\/li>\n<li>Mbrojtjen nga nd\u00ebrhyrjet e pajisjes s\u00eb p\u00ebrdoruesit;<\/li>\n<li>Vler\u00ebsimin e gjendjes s\u00eb pajisjes;<\/li>\n<li>Potencialin p\u00ebr forcimin e kontrollit me certifikat\u00ebn e makin\u00ebs t\u00eb domain-it etj.;<\/li>\n<li>Mbrojtje t\u00eb plot\u00eb p\u00ebr vendin e pun\u00ebs t\u00eb larg\u00ebt me module sigurie q\u00eb implementohen automatikisht;<\/li>\n<\/ul>\n<p><\/p>\n<p>Lidhje p\u00ebr artikujt e seris\u00eb Cisco VPN:<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">Implementimi i klasterit ASA VPN Load-Balancing<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493774\/\">Optimizimi i sh\u00ebrbimeve n\u00eb rrjetin AnyConnect VPN n\u00eb Cisco ASA<\/a><\/noindex><\/li>\n<\/ul>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/497618\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e); [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zbatimi i konceptit t\u00eb qasjes s\u00eb sigurt t\u00eb larg\u00ebt | ProHoster","description":"Duke vazhduar serin\u00eb e artikujve mbi organizimin e qasjes n\u00eb VPN p\u00ebr qasje t\u00eb larg\u00ebt, nuk mund t\u00eb mos ndaja p\u00ebrvoj\u00ebn interesante t\u00eb implementimit t\u00eb nj\u00eb konfigurimi VPN me nivel t\u00eb lart\u00eb sigurie.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-17T23:42:36+00:00","article:modified_time":"2020-04-17T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:02:45","updated":"2022-09-29 00:42:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/78242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=78242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/78242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/78243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=78242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=78242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=78242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}