{"id":78242,"date":"2020-04-18T01:42:36","date_gmt":"2020-04-17T23:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa"},"modified":"2020-04-18T01:42:36","modified_gmt":"2020-04-17T23:42:36","slug":"realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","title":{"rendered":"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Forts\u00e4tter serien av artiklar om \u00e4mnet organisering <strong>Remote-Access VPN<\/strong> av tillg\u00e5ng kan jag inte undanh\u00e5lla en intressant erfarenhet av implementeringen <strong>av en h\u00f6gs\u00e4kerhetskonfiguration av VPN<\/strong>. En utmanande uppgift gavs av en kund (det finns p\u00e5hittiga personer i ryska byar), men Challenge Accepted och kreativt genomf\u00f6rt. Resultatet blev ett intressant koncept med f\u00f6ljande egenskaper:<\/p>\n<p><\/p>\n<ol>\n<li>Flera skyddsfaktorer mot f\u00f6rfalskning av den slutliga enheten (med strikt koppling till anv\u00e4ndaren);\n<ul>\n<li>Bed\u00f6mning av anv\u00e4ndarens dator mot den tilldelade UDID f\u00f6r den godk\u00e4nda datorn i autentiseringsdatabasen; <\/li>\n<li>Med MFA som anv\u00e4nder UDID f\u00f6r datorn fr\u00e5n certifikatet f\u00f6r sekund\u00e4r autentisering via Cisco DUO <em>(Kan kopplas till vilket SAML\/RADIUS-kompatibelt system som helst)<\/em>; <\/li>\n<\/ul>\n<\/li>\n<li>Multifaktorsautentisering: \n<ul>\n<li>Anv\u00e4ndarcertifikat med kontroll av f\u00e4lten och sekund\u00e4r autentisering enligt ett av dem;<\/li>\n<li>Inloggning (of\u00f6r\u00e4ndrad, h\u00e4mtad fr\u00e5n certifikatet) och l\u00f6senord;<\/li>\n<\/ul>\n<\/li>\n<li>Bed\u00f6mning av den anslutna v\u00e4rden (Posture)<\/li>\n<\/ol>\n<p><\/p>\n<p><strong>Anv\u00e4nda komponenter i l\u00f6sningen:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Cisco ASA (VPN-gateway);<\/li>\n<li>Cisco ISE (Autentisering \/ Auktorisering \/ Redovisning, Bed\u00f6mning av Status, CA);<\/li>\n<li>Cisco DUO (Multifaktorsautentisering) <em>(Kan kopplas till vilket SAML\/RADIUS-kompatibelt system som helst)<\/em>;<\/li>\n<li>Cisco AnyConnect (M\u00e5ngsidig agent f\u00f6r arbetsstationer och mobila operativsystem);<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p><strong>L\u00e5t oss b\u00f6rja med kundens krav:<\/strong><\/p>\n<p><\/p>\n<ol>\n<li>Anv\u00e4ndaren ska ha m\u00f6jlighet att ladda ner AnyConnect-klienten fr\u00e5n VPN-gatewayen med sin autentisering av Inloggning\/L\u00f6senord, alla n\u00f6dv\u00e4ndiga AnyConnect-moduler ska automatiskt installeras enligt anv\u00e4ndarens policy;<\/li>\n<li>Anv\u00e4ndaren ska ha m\u00f6jlighet till automatisk utf\u00e4rdande av certifikat (f\u00f6r ett av scenarierna, huvudsakligen \u00e4r scenariot manuell utf\u00e4rdande och uppladdning p\u00e5 datorn), jag har implementerat automatisk utf\u00e4rdande f\u00f6r demonstration (det \u00e4r aldrig f\u00f6r sent att ta bort).<\/li>\n<li>Den prim\u00e4ra autentiseringen ska ske i flera steg, f\u00f6rst ges certifikatets autentisering med analys av n\u00f6dv\u00e4ndiga f\u00e4lt och deras v\u00e4rden, d\u00e4refter inloggning\/l\u00f6senord, fast nu ska anv\u00e4ndarnamnet som anges i certifikatets f\u00e4lt <strong>Subject Name (CN)<\/strong> st\u00e4llas in utan m\u00f6jlighet till redigering.<\/li>\n<li>Det \u00e4r n\u00f6dv\u00e4ndigt att s\u00e4kerst\u00e4lla att enheten som anv\u00e4nds f\u00f6r inloggningen \u00e4r den f\u00f6retagsb\u00e4rbara dator som har utf\u00e4rdats till anv\u00e4ndaren f\u00f6r fj\u00e4rr\u00e5tkomst, och inget annat. (Flera alternativ har skapats f\u00f6r att uppfylla detta krav)<\/li>\n<li>Det ska g\u00f6ras en bed\u00f6mning av det anslutande enhetens tillst\u00e5nd (vid detta steg PC) med en kontroll av en helt\u00e4ckande kravtabell fr\u00e5n kunden (f\u00f6r att sammanfatta):\n<ul>\n<li>Filer och deras egenskaper;<\/li>\n<li>Registerposter;<\/li>\n<li>Operativsystemspatchar fr\u00e5n den angivna listan (i framtiden integration av SCCM);<\/li>\n<li>N\u00e4rvaro av antivirus fr\u00e5n en viss tillverkare och aktuell signatur;<\/li>\n<li>Aktivitet hos vissa tj\u00e4nster;<\/li>\n<li>N\u00e4rvaro av vissa installerade program;<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/p>\n<p>F\u00f6rst f\u00f6resl\u00e5r jag att vi obligatoriskt tittar p\u00e5 videodemonstrationen av den resulterande implementationen p\u00e5 <strong>Youtube (5 minuter)<\/strong>.<\/p>\n<p>\n<center><div class=\"youtube-placeholder\" data-id=\"cBftD3KFK98\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/cBftD3KFK98\/hqdefault.jpg\" alt=\"Spela video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>Nu f\u00f6resl\u00e5r jag att vi ser p\u00e5 detaljerna i implementationen som inte belyses i videon.<\/p>\n<p><\/p>\n<p><strong>L\u00e5t oss f\u00f6rbereda en AnyConnect-profil:<\/strong><\/p>\n<p><\/p>\n<p>Exempel p\u00e5 hur man skapar en profil (i menypunkt i ASDM) har jag tidigare tagit upp i min artikel om inst\u00e4llning av <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing kluster<\/a><\/noindex>. Nu vill jag s\u00e4rskilt n\u00e4mna de alternativ som vi beh\u00f6ver:<\/p>\n<p><\/p>\n<p>I profilen anger vi VPN-gatewayen och profilnamnet f\u00f6r anslutning p\u00e5 klienten:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst\" src=\"\/wp-content\/uploads\/2020\/04\/45ff3cb1f7b592e102bd6e256ae26043.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Vi utf\u00f6r inst\u00e4llningar f\u00f6r automatisk utf\u00e4rdande av certifikat fr\u00e5n profilen, d\u00e4r vi anger bland annat certifikatparametrarna, och som \u00e4r relevant, noterar vi f\u00e4ltet <strong>Initials (I)<\/strong>, d\u00e4r ett specifikt v\u00e4rde har skrivits in f\u00f6r hand <strong>UDID<\/strong> f\u00f6r testmaskinen (Unik enhetsidentifierare som genereras av Cisco AnyConnect-klienten).<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst\" src=\"\/wp-content\/uploads\/2020\/04\/89d4edb4f1b166eda75916286998a4bf.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>H\u00e4r vill jag g\u00f6ra en poetisk avvikelse, eftersom denna artikel beskriver konceptet; f\u00f6r demonstrationssyften har UDID angetts f\u00f6r utf\u00e4rdande av certifikatet i f\u00e4ltet Initials av AnyConnect-profilen. Sj\u00e4lvklart, i verkliga livet, om du g\u00f6r s\u00e5, kommer alla klienter att f\u00e5 certifikatet med samma UDID i detta f\u00e4lt, och inget av dem kommer att fungera, eftersom de beh\u00f6ver UDID specifikt f\u00f6r sin egen PC. Tyv\u00e4rr implementerar AnyConnect \u00e4nnu inte ers\u00e4ttning i profilen f\u00f6r certifikatf\u00f6rfr\u00e5gan i UDID-f\u00e4ltet via milj\u00f6variabeln, som den till exempel g\u00f6r med variabeln <strong>%USER%<\/strong>.<\/p>\n<p><\/p>\n<p>Det \u00e4r v\u00e4rt att notera att kunden (i detta scenario) ursprungligen planerar att sj\u00e4lv utf\u00e4rda certifikat med angiven UDID manuellt till dessa skyddade PC, vilket inte \u00e4r n\u00e5got problem f\u00f6r honom. Men f\u00f6r de flesta av oss vill vi ha automatisering (\u00e5h, f\u00f6r mig i alla fall=). <\/p>\n<p><\/p>\n<p>Och h\u00e4r \u00e4r vad jag kan erbjuda n\u00e4r det kommer till automatisering. Om man automatiskt skulle utf\u00e4rda ett certifikat i AnyConnect genom att dynamiskt infoga UDID, vilket inte \u00e4r m\u00f6jligt just nu, finns det en annan metod som kr\u00e4ver lite kreativt t\u00e4nkande och skickliga h\u00e4nder \u2013 jag ska f\u00f6rklara konceptet. L\u00e5t oss b\u00f6rja med att titta p\u00e5 hur UDID skapas p\u00e5 olika operativsystem av AnyConnect-agenten: <\/p>\n<p><\/p>\n<ul>\n<li><strong>Windows<\/strong> \u2014 SHA-256 hash av kombinationen av registret DigitalProductID och Machine SID<\/li>\n<li><strong>OSX<\/strong> \u2014 SHA-256 hash av PlatformUUID<\/li>\n<li><strong>Linux<\/strong> \u2014 SHA-256 hash av UUID f\u00f6r root-partitionen.<\/li>\n<li><strong>Apple iOS<\/strong> \u2014 SHA-256 hash av PlatformUUID<\/li>\n<li><strong>Android<\/strong> \u2013 Se dokumentet om <noindex><a rel=\"nofollow\" href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/security\/vpn_client\/anyconnect\/anyconnect40\/administration\/guide\/b_AnyConnect_Administrator_Guide_4-0\/b_AnyConnect_Administrator_Guide_4-0_chapter_01010.html#reference_C87ADD1C58F64EF8928D921323209AA6\">l\u00e4nken<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<p>D\u00e4rf\u00f6r skapar vi ett skript f\u00f6r v\u00e5ra f\u00f6retags-operativsystem Windows, d\u00e4r detta skript lokalt ber\u00e4knar UDID baserat p\u00e5 k\u00e4nda indata och genererar en beg\u00e4ran om utf\u00e4rdande av certifikat genom att fylla i UDID i det n\u00f6dv\u00e4ndiga f\u00e4ltet, f\u00f6rresten kan det ocks\u00e5 vara ett maskincertifikat som utf\u00e4rdats av AD (genom att l\u00e4gga till dubbel autentisering genom certifikat) <strong>Multiple Certificate<\/strong>). <\/p>\n<p><\/p>\n<p><strong>Vi f\u00f6rbereder inst\u00e4llningar fr\u00e5n Cisco ASA:<\/strong><\/p>\n<p><\/p>\n<p>Vi skapar TrustPoint f\u00f6r ISE CA-servern, som kommer att utf\u00e4rda certifikat till klienterna. Jag kommer inte att g\u00e5 igenom proceduren f\u00f6r att importera Key-Chain, det exemplet beskrivs i min artikel om inst\u00e4llning <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">VPN Load-Balancing kluster<\/a><\/noindex>. <\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">crypto ca trustpoint ISE-CA\n enrollment terminal\n crl configure<\/code><\/pre>\n<p><\/p>\n<p>Vi konfigurerar distributionen f\u00f6r Tunnel-Group baserat p\u00e5 regler i enlighet med f\u00e4lten i certifikatet, som anv\u00e4nds f\u00f6r autentisering. H\u00e4r konfigurerar vi ocks\u00e5 profil f\u00f6r AnyConnect, som vi skapade i f\u00f6reg\u00e5ende steg. Jag vill p\u00e5peka att jag anv\u00e4nder v\u00e4rdet <strong>SECUREBANK-RA<\/strong>, f\u00f6r att \u00f6verf\u00f6ra anv\u00e4ndare med utf\u00e4rdat certifikat till tunnelgruppen <strong>SECURE-BANK-VPN<\/strong>, observera att detta f\u00e4lt har angetts i beg\u00e4ran om certifikat f\u00f6r profilen AnyConnect.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">tunnel-group-map enable rules\n!\ncrypto ca certificate map OU-Map 6\n subject-name attr ou eq securebank-ra\n!\nwebvpn\n anyconnect profiles SECUREBANK disk0:\/securebank.xml\n certificate-group-map OU-Map 6 SECURE-BANK-VPN\n!<\/code><\/pre>\n<p><\/p>\n<p>Vi konfigurerar autentiseringstj\u00e4nster. I mitt fall \u00e4r det ISE f\u00f6r det f\u00f6rsta steget i autentisering och DUO (Radius Proxy) som MFA.<\/p>\n<p><\/p>\n<pre><code class=\"plaintext\">! CISCO ISE\naaa-server ISE protocol radius\n authorize-only\n interim-accounting-update periodic 24\n dynamic-authorization\naaa-server ISE (inside) host 192.168.99.134\n key *****\n!\n! DUO RADIUS PROXY\naaa-server DUO protocol radius\naaa-server DUO (inside) host 192.168.99.136\n timeout 60\n key *****\n authentication-port 1812\n accounting-port 1813\n no mschapv2-capable\n!<\/code><\/pre>\n<p><\/p>\n<p>Vi skapar grupprinciper och tunnelgrupper samt deras st\u00f6dkomponenter:<\/p>\n<p><\/p>\n<p>Tunnelgrupp <strong>DefaultWEBVPNGroup<\/strong> kommer prim\u00e4rt att anv\u00e4ndas f\u00f6r att ladda ner AnyConnect VPN-klienten och utf\u00e4rda anv\u00e4ndarcertifikat med SCEP-Proxy-funktionen i ASA. F\u00f6r detta har vi aktiverat motsvarande alternativ b\u00e5de i tunnelgruppen och i den associerade gruppolisen. <strong>AC-Nedladdning<\/strong>, samt i den nedladdade AnyConnect-profilen (f\u00e4lten f\u00f6r certifikatutf\u00e4rdande osv.). I denna gruppolicy anger vi ocks\u00e5 behovet av nedladdning. <strong>ISE Posture Module<\/strong>.<\/p>\n<p><\/p>\n<p>Tunnelgrupp <strong>SECURE-BANK-VPN<\/strong> kommer automatiskt att anv\u00e4ndas av klienten vid autentisering med det utf\u00e4rdade certifikatet fr\u00e5n f\u00f6reg\u00e5ende steg, eftersom kopplingen enligt Certificate Map kommer att tillh\u00f6ra just denna tunnelgrupp. Jag kommer att ber\u00e4tta om intressanta alternativ h\u00e4r:<\/p>\n<p><\/p>\n<ul>\n<li><strong>secondary-authentication-server-group DUO<\/strong> # \u0417\u0430\u0434\u0430\u0435\u043c \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u0443\u044e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO (Radius Proxy)<\/li>\n<li><strong>anv\u00e4ndarnamn-fr\u00e5n-certifikat CN<\/strong> # \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0435 CN \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043b\u043e\u0433\u0438\u043d\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f<\/li>\n<li><strong>sekund\u00e4rt-anv\u00e4ndarnamn-fr\u00e5n-certifikat I<\/strong> # \u0414\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 DUO \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u043d\u043e\u0435 \u0438 \u043f\u043e\u043b\u044f Initials (I) \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430.<\/li>\n<li><strong>f\u00f6rifyllda-anv\u00e4ndarnamn klient<\/strong> # \u0434\u0435\u043b\u0430\u0435\u043c \u043f\u0440\u0435\u0434\u0437\u0430\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u043c \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u043e\u043a\u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f<\/li>\n<li><strong>sekund\u00e4rt-f\u00f6rifyllt-anv\u00e4ndarnamn klient g\u00f6m anv\u00e4nd-gemensamt-l\u00f6senord push<\/strong> # \u041f\u0440\u044f\u0447\u0435\u043c \u043e\u043a\u043d\u043e \u0432\u0432\u043e\u0434\u0430 \u043b\u043e\u0433\u0438\u043d\u0430\/\u043f\u0430\u0440\u043e\u043b\u044f \u0434\u043b\u044f \u0432\u0442\u043e\u0440\u0438\u0447\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 DUO \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u043c\u0435\u0441\u0442\u043e \u043f\u043e\u043b\u044f \u043f\u0430\u0440\u043e\u043b\u044f \u043c\u0435\u0442\u043e\u0434 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f (sms\/push\/phone) \u2013 \u0434\u043e\u043a\u0430 <noindex><a rel=\"nofollow\" href=\"https:\/\/duo.com\/docs\/ciscoasa-radius\">). Ett typiskt exempel p\u00e5 anv\u00e4ndning:<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<pre><code class=\"plaintext\">!\naccess-list posture-redirect extended permit tcp any host 72.163.1.80 \naccess-list posture-redirect extended deny ip any any\n!\naccess-list VPN-Filter extended permit ip any any\n!\nip local pool vpn-pool 192.168.100.33-192.168.100.63 mask 255.255.255.224\n!\ngroup-policy SECURE-BANK-VPN internal\ngroup-policy SECURE-BANK-VPN attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ngroup-policy AC-DOWNLOAD internal\ngroup-policy AC-DOWNLOAD attributes\n dns-server value 192.168.99.155 192.168.99.130\n vpn-filter value VPN-Filter\n vpn-tunnel-protocol ssl-client \n split-tunnel-policy tunnelall\n default-domain value ashes.cc\n address-pools value vpn-pool\n scep-forwarding-url value http:\/\/ise.ashes.cc:9090\/auth\/caservice\/pkiclient.exe\n webvpn\n  anyconnect ssl dtls enable\n  anyconnect mtu 1300\n  anyconnect keep-installer installed\n  anyconnect ssl keepalive 20\n  anyconnect ssl rekey time none\n  anyconnect ssl rekey method ssl\n  anyconnect dpd-interval client 30\n  anyconnect dpd-interval gateway 30\n  anyconnect ssl compression lzs\n  anyconnect dtls compression lzs\n  anyconnect modules value iseposture\n  anyconnect profiles value SECUREBANK type user\n!\ntunnel-group DefaultWEBVPNGroup general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n accounting-server-group ISE\n default-group-policy AC-DOWNLOAD\n scep-enrollment enable\ntunnel-group DefaultWEBVPNGroup webvpn-attributes\n authentication aaa certificate\n!\ntunnel-group SECURE-BANK-VPN type remote-access\ntunnel-group SECURE-BANK-VPN general-attributes\n address-pool vpn-pool\n authentication-server-group ISE\n secondary-authentication-server-group DUO\n accounting-server-group ISE\n default-group-policy SECURE-BANK-VPN\n username-from-certificate CN\n secondary-username-from-certificate I\ntunnel-group SECURE-BANK-VPN webvpn-attributes\n authentication aaa certificate\n pre-fill-username client\n secondary-pre-fill-username client hide use-common-password push\n group-alias SECURE-BANK-VPN enable\n dns-group ASHES-DNS\n!<\/code><\/pre>\n<p><\/p>\n<p><strong>L\u00e5t oss g\u00e5 vidare till ISE:<\/strong><\/p>\n<p><\/p>\n<p>Vi konfigurerar en lokal anv\u00e4ndare (AD\/LDAP\/ODBC etc. kan ocks\u00e5 anv\u00e4ndas), f\u00f6r enkelhetens skull har jag skapat en lokal anv\u00e4ndare i ISE och tilldelat f\u00e4ltet <strong>description<\/strong> <strong>PC:s UDID<\/strong> fr\u00e5n vilken inloggning via VPN \u00e4r till\u00e5ten. Vid anv\u00e4ndning av lokal autentisering p\u00e5 ISE kommer jag att vara begr\u00e4nsad till en enhet, eftersom det inte finns s\u00e5 m\u00e5nga f\u00e4lt, men det kommer inte att finnas n\u00e5gra s\u00e5dana begr\u00e4nsningar i externa autentiseringsdatabaser.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst\" src=\"\/wp-content\/uploads\/2020\/04\/ea73d4bab6c0872f7c3aef4ad1345b12.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>L\u00e5t oss titta p\u00e5 auktoriseringspolicyn, den \u00e4r uppdelad i fyra faser av anslutning:<\/p>\n<p><\/p>\n<ul>\n<li><strong>Steg 1<\/strong> \u2014 Policyn f\u00f6r nedladdning av AnyConnect-agenten och utf\u00f6rande av certifikat<\/li>\n<li><strong>Steg 2<\/strong> \u2014 Policyn f\u00f6r prim\u00e4r autentisering Inloggning (fr\u00e5n certifikat)\/L\u00f6senord + Certifikat med UDID-validering<\/li>\n<li><strong>Steg 3<\/strong> \u2014 Sekund\u00e4r autentisering via Cisco DUO (MFA) med UDID som anv\u00e4ndarnamn + tillst\u00e5ndsv\u00e4rdering<\/li>\n<li><strong>Steg 4<\/strong> \u2014 Slutlig auktorisering i tillst\u00e5nd:\n<ul>\n<li>Efterlevande;<\/li>\n<li>validering av UDID (fr\u00e5n certifikat + koppling till inloggning), <\/li>\n<li>Cisco DUO MFA;<\/li>\n<li>Inloggningsautentisering; <\/li>\n<li>Certifikatautentisering;<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst\" src=\"\/wp-content\/uploads\/2020\/04\/f0927091b896dc1e8b7fde35f9ff9211.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>L\u00e5t oss titta p\u00e5 en intressant villkor <strong>UUID_VALIDATED<\/strong>, som just kontrollerar att den autentiserande anv\u00e4ndaren verkligen kommer fr\u00e5n en PC med den godk\u00e4nda UDID kopplad i f\u00e4ltet <strong>Beskrivning<\/strong> kontot, villkoren ser ut s\u00e5 h\u00e4r:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst\" src=\"\/wp-content\/uploads\/2020\/04\/73952c705b376246f8b2fb9de883302b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Auktoriseringsprofilen som anv\u00e4nds i steg 1, 2, 3 ser ut som f\u00f6ljer:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst\" src=\"\/wp-content\/uploads\/2020\/04\/4b1eb6688a5a42d74b587424b02624e1.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Vi kan kontrollera hur UDID kommer fr\u00e5n klienten AnyConnect genom att titta p\u00e5 ISE:s sessionsdetaljer. I detaljerna ser vi att AnyConnect via mekanismen <strong>ACIDEX<\/strong> skickar inte bara plattformsdata, utan \u00e4ven UDID f\u00f6r enheten som <strong>Cisco-AV-PAIR<\/strong>:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst\" src=\"\/wp-content\/uploads\/2020\/04\/34859d3b6a5edb448999eaec49c59669.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>L\u00e5t oss notera det utf\u00e4rdade certifikatet f\u00f6r anv\u00e4ndaren och f\u00e4ltet <strong>Initials (I)<\/strong>, som anv\u00e4nds f\u00f6r att ta det som inloggningsnamn f\u00f6r sekund\u00e4r MFA-autentisering p\u00e5 Cisco DUO:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst\" src=\"\/wp-content\/uploads\/2020\/04\/ac5928db33e5dbbb1bd7e2190da6d9fa.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>P\u00e5 DUO Radius Proxy-sidan ser vi tydligt hur autentiseringsf\u00f6rfr\u00e5gan g\u00e5r, den sker med UDID som anv\u00e4ndarnamn:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst\" src=\"\/wp-content\/uploads\/2020\/04\/791f5470115460dc4d920096e79dde0f.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Fr\u00e5n DUO-portalen ser vi en lyckad autentisering:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst\" src=\"\/wp-content\/uploads\/2020\/04\/a31e31c57ad8b6e4ba021f3da7eedb7e.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Och i anv\u00e4ndarens egenskaper har jag angett <strong>ALIAS<\/strong>, som jag anv\u00e4nde f\u00f6r inloggning, och detta \u00e4r UDID f\u00f6r den godk\u00e4nda inloggnings-PC:n:<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gskyddad fj\u00e4rr\u00e5tkomst\" src=\"\/wp-content\/uploads\/2020\/04\/4035937749d1b85bad291aa4ec407352.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p><strong>Som ett resultat fick vi:<\/strong><\/p>\n<p><\/p>\n<ul>\n<li>Flerfaktorautentisering f\u00f6r anv\u00e4ndare och enhet;<\/li>\n<li>Skydd mot f\u00f6rfalskning av anv\u00e4ndarens enhet;<\/li>\n<li>Utv\u00e4rdering av enhetens tillst\u00e5nd;<\/li>\n<li>Potential f\u00f6r \u00f6kad kontroll med maskincertifikat f\u00f6r dom\u00e4nen etc.;<\/li>\n<li>Omfattande skydd f\u00f6r fj\u00e4rrarbetsplatsen med automatiskt distribuerade s\u00e4kerhetsmoduler;<\/li>\n<\/ul>\n<p><\/p>\n<p>L\u00e4nkar till artiklar i Cisco VPN-serien:<\/p>\n<p><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493098\/\">Implementering av ASA VPN Load-Balancing-kluster<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/493774\/\">Optimering av molntj\u00e4nster i AnyConnect VPN-tunneln p\u00e5 Cisco ASA<\/a><\/noindex><\/li>\n<\/ul>\n<p>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/497618\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN. \u0417\u0430\u0434\u0430\u0447\u0443 \u043d\u0435\u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u043f\u043e\u0434\u043a\u0438\u043d\u0443\u043b \u043e\u0434\u0438\u043d \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a (\u0435\u0441\u0442\u044c \u0432\u044b\u0434\u0443\u043c\u0449\u0438\u043a\u0438 \u0432 \u0420\u0443\u0441\u0441\u043a\u0438\u0445 \u0441\u0435\u043b\u0435\u043d\u0438\u044f\u0445), \u043d\u043e Challenge Accepted \u0438 \u0442\u0432\u043e\u0440\u0447\u0435\u0441\u043a\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0439 \u043a\u043e\u043d\u0446\u0435\u043f\u0442 \u0441\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u0430\u043c\u0438: \u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0444\u0430\u043a\u0442\u043e\u0440\u043e\u0432 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u043e\u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 (\u0441 \u0436\u0435\u0441\u0442\u043a\u043e\u0439 \u043f\u0440\u0438\u0432\u044f\u0437\u043a\u043e\u0439 \u043a \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e); [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":78243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-78242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-17T23:42:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Genomf\u00f6rande av konceptet f\u00f6r h\u00f6gs\u00e4ker fj\u00e4rr\u00e5tkomst | ProHoster","description":"Fortfarande i artikelserien om att organisera Remote-Access VPN-\u00e5tkomst kan jag inte l\u00e5ta bli att dela med mig av intressanta erfarenheter kring distributionen av en h\u00f6gs\u00e4kerhetskonfiguration f\u00f6r VPN.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438 \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u0441\u0435\u0440\u0438\u044e \u0441\u0442\u0430\u0442\u044c\u0435\u0439 \u043f\u043e \u0442\u0435\u043c\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Remote-Access VPN \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0435 \u043c\u043e\u0433\u0443 \u043d\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 VPN.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/realizacziya-konczepczii-vysokozashhishhennogo-udalennogo-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-17T23:42:36+00:00","article:modified_time":"2020-04-17T23:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:02:45","updated":"2022-09-29 00:42:25","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/78242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=78242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/78242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/78243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=78242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=78242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=78242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}