{"id":37065,"date":"2019-10-31T22:15:33","date_gmt":"2019-10-31T19:15:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/wifi-enterprise-freeradius-freeipa-ubiquiti\/"},"modified":"2019-10-31T22:15:33","modified_gmt":"2019-10-31T19:15:33","slug":"wifi-enterprise-freeradius-freeipa-ubiquiti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","title":{"rendered":"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4c045a0710e5eb14b73359afad484c3d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nByly pops\u00e1ny n\u011bkter\u00e9 p\u0159\u00edklady organizace podnikov\u00e9 WiFi. Zde pop\u00ed\u0161u, jak jsem implementoval podobn\u00e9 \u0159e\u0161en\u00ed a probl\u00e9my, se kter\u00fdmi jsem se setkal p\u0159i p\u0159ipojov\u00e1n\u00ed na r\u016fzn\u00fdch za\u0159\u00edzen\u00edch. Budeme pou\u017e\u00edvat ji\u017e existuj\u00edc\u00ed LDAP s registrovan\u00fdmi u\u017eivateli, nasad\u00edme FreeRadius a nastav\u00edme WPA2-Enterprise na ovlada\u010di Ubnt. Vypad\u00e1 to jednoduch\u00e9. Uvid\u00edme...<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>N\u011bco o metod\u00e1ch EAP<\/h2>\n<p>\nP\u0159edt\u00edm, ne\u017e se pust\u00edme do \u00fakolu, je t\u0159eba ur\u010d\u00edt, jakou metodu autentizace budeme pou\u017e\u00edvat v na\u0161em \u0159e\u0161en\u00ed.<\/p>\n<p><b>Z wikipedie:<\/b><\/p>\n<blockquote><p>EAP je autentiza\u010dn\u00ed r\u00e1mec, kter\u00fd se \u010dasto pou\u017e\u00edv\u00e1 v bezdr\u00e1tov\u00fdch s\u00edt\u00edch a p\u0159ipojen\u00edch point-to-point. Form\u00e1t byl poprv\u00e9 pops\u00e1n v RFC 3748 a aktualizov\u00e1n v RFC 5247.<br \/>\nEAP se pou\u017e\u00edv\u00e1 k v\u00fdb\u011bru metody autentizace, p\u0159enosu kl\u00ed\u010d\u016f a zpracov\u00e1n\u00ed t\u011bchto kl\u00ed\u010d\u016f modul\u00e1rn\u00edmi metodami EAP. Existuje mnoho metod EAP, jak definovan\u00fdch spole\u010dn\u011b s EAP, tak vydan\u00fdch jednotliv\u00fdmi v\u00fdrobci. EAP nedefinuje kan\u00e1lovou \u00farove\u0148, pouze ur\u010duje form\u00e1t zpr\u00e1v. Ka\u017ed\u00fd protokol pou\u017e\u00edvaj\u00edc\u00ed EAP m\u00e1 sv\u016fj vlastn\u00ed protokol pro enkapsulaci EAP zpr\u00e1v. <\/p><\/blockquote>\n<p>\n<b>Samotn\u00e9 metody:<\/b><\/p>\n<ul>\n<li>LEAP - propriet\u00e1rn\u00ed protokol vyvinut\u00fd CISCO. Byly nalezeny zranitelnosti. V sou\u010dasnosti se nedoporu\u010duje pou\u017e\u00edvat. <\/li>\n<li> EAP-TLS - dob\u0159e podporovan\u00fd mezi dodavateli bezdr\u00e1tov\u00fdch spojen\u00ed. Je to bezpe\u010dn\u00fd protokol, jeliko\u017e je n\u00e1stupcem SSL standard\u016f. Nastaven\u00ed klienta je pom\u011brn\u011b slo\u017eit\u00e9. Vy\u017eaduje klientsk\u00fd certifik\u00e1t vedle hesla. Je podporov\u00e1no v mnoha syst\u00e9mech. <\/li>\n<li> EAP-TTLS - \u0161iroce podporov\u00e1no v mnoha syst\u00e9mech, nab\u00edz\u00ed dobrou bezpe\u010dnost, pou\u017e\u00edvaj\u00edc\u00ed PKI certifik\u00e1ty pouze na serveru autentizace. <\/li>\n<li> EAP-MD5 - dal\u0161\u00ed otev\u0159en\u00fd standard. Nab\u00edz\u00ed minim\u00e1ln\u00ed \u00farove\u0148 bezpe\u010dnosti. Je zraniteln\u00fd, nepodporuje vz\u00e1jemnou autentizaci a generaci kl\u00ed\u010d\u016f. <\/li>\n<li> EAP-IKEv2 - vych\u00e1z\u00ed z Internet Key Exchange Protocol verze 2. Zaji\u0161\u0165uje vz\u00e1jemnou autentizaci a vytvo\u0159en\u00ed session key mezi klientem a serverem. <\/li>\n<li> PEAP - spole\u010dn\u00e9 \u0159e\u0161en\u00ed CISCO, Microsoft a RSA Security jako otev\u0159en\u00fd standard. \u0160iroce dostupn\u00e9 v produktech, poskytuje velmi dobrou bezpe\u010dnost. Podob\u00e1 se EAP-TTLS, vy\u017eaduje pouze certifik\u00e1t na serverov\u00e9 stran\u011b. <\/li>\n<li> PEAPv0\/EAP-MSCHAPv2 \u2014 po EAP-TLS je to druh\u00fd nej\u0161ir\u0161e pou\u017e\u00edvan\u00fd standard na sv\u011bt\u011b. Pou\u017e\u00edv\u00e1 vztah klient-server v Microsoftu, Cisco, Apple, Linux. <\/li>\n<li> PEAPv1\/EAP-GTC \u2014 byl vytvo\u0159en spole\u010dnost\u00ed Cisco jako alternativa PEAPv0\/EAP-MSCHAPv2. V \u017e\u00e1dn\u00e9m p\u0159\u00edpad\u011b nechr\u00e1n\u00ed autentiza\u010dn\u00ed \u00fadaje. Nejsou podporov\u00e1ny v opera\u010dn\u00edm syst\u00e9mu Windows. <\/li>\n<li> EAP-FAST \u2014 metoda vyvinut\u00e1 spole\u010dnost\u00ed Cisco k odstran\u011bn\u00ed nedostatk\u016f LEAP. Pou\u017e\u00edv\u00e1 Protected Access Credential (PAC). Nen\u00ed pln\u011b vyvinut\u00e1. <\/li>\n<\/ul>\n<p>\nZ cel\u00e9 t\u00e9to rozmanitosti v\u0161ak volba nen\u00ed p\u0159\u00edli\u0161 velk\u00e1. Od metody autentizace se vy\u017eadovalo: dobr\u00e1 bezpe\u010dnost, podpora na v\u0161ech za\u0159\u00edzen\u00edch (Windows 10, macOS, Linux, Android, iOS), a vlastn\u011b, \u010d\u00edm jednodu\u0161\u0161\u00ed, t\u00edm lep\u0161\u00ed. Proto byla volba d\u00e1na na EAP-TTLS v kombinaci s protokolem PAP. <br \/>\nM\u016f\u017ee se objevit ot\u00e1zka \u2014 pro\u010d pou\u017e\u00edvat PAP? V\u017edy\u0165 p\u0159ece p\u0159en\u00e1\u0161\u00ed hesla v ne\u0161ifrovan\u00e9 podob\u011b? <\/p>\n<p>Ano, je to pravda. Komunikace mezi FreeRadius a FreeIPA prob\u011bhne t\u00edmto zp\u016fsobem. V re\u017eimu lad\u011bn\u00ed m\u016f\u017eete sledovat, jak se odes\u00edlaj\u00ed u\u017eivatelsk\u00e9 jm\u00e9no a heslo. A a\u0165 se klidn\u011b pos\u00edlaj\u00ed, jen vy m\u00e1te p\u0159\u00edstup na server FreeRadius.<\/p>\n<p>Podrobn\u011bji o fungov\u00e1n\u00ed EAP-TTLS si m\u016f\u017eete p\u0159e\u010d\u00edst. <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.bmstu.wiki\/EAP-TTLS_(Tunneled_Transport_Layer_Security)\">tady<br \/>\n<\/a><\/noindex><\/p>\n<h2>FreeRADIUS<\/h2>\n<p>\nFreeRadius budeme zprovoz\u0148ovat na CentOS 7.6. Nen\u00ed to nic slo\u017eit\u00e9ho, nainstalujeme to standardn\u00edm zp\u016fsobem.<\/p>\n<pre><code class=\"bash\">yum install freeradius freeradius-utils freeradius-ldap -y<\/code><\/pre>\n<p>\n<i>Z bal\u00ed\u010dk\u016f se instaluje verze 3.0.13. Nejnov\u011bj\u0161\u00ed si m\u016f\u017eete st\u00e1hnout na <noindex><a rel=\"nofollow\" href=\"https:\/\/freeradius.org\/\">https:\/\/freeradius.org\/<\/a><\/noindex><\/i><\/p>\n<p>Pot\u00e9 u\u017e FreeRadius funguje. M\u016f\u017eete v \/etc\/raddb\/users odkomentovat \u0159\u00e1dek<\/p>\n<pre><code class=\"bash\">steve   Cleartext-Password := \"testing\"<\/code><\/pre>\n<p>\nSpus\u0165te server v re\u017eimu lad\u011bn\u00ed.<\/p>\n<pre><code class=\"bash\">freeradius -X<\/code><\/pre>\n<p>\nA prove\u010fte testovac\u00ed p\u0159ipojen\u00ed na localhost.<\/p>\n<pre><code class=\"bash\">radtest steve testing 127.0.0.1 1812 testing123<\/code><\/pre>\n<p>\nObdr\u017eeli jsme odpov\u011b\u010f. <i>Received Access-Accept Id 115 from 127.0.0.1:1812 to 127.0.0.1:56081 length 20.<\/i>, tak\u017ee v\u0161e je v po\u0159\u00e1dku. Pokra\u010dujeme d\u00e1l.<\/p>\n<p>P\u0159ipoj\u00edme modul. <i><b>ldap<\/b><\/i>.<\/p>\n<pre><code class=\"bash\">ln -s \/etc\/raddb\/mods-available\/ldap \/etc\/raddb\/mods-enabled\/ldap<\/code><\/pre>\n<p>\nA ihned ho zm\u011bn\u00edme. Pot\u0159ebujeme, aby FreeRadius mohl komunikovat s FreeIPA.<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/ldap<\/b><\/p>\n<pre><code class=\"bash\">ldap {\nserver=\"ldap:\/\/ldap.server.com\"\nport=636\nstart_tls=yes\nidentity=\"uid=admin,cn=users,dc=server,dc=com\"\npassword=**********\nbase_dn=\"cn=users,dc=server,dc=com\"\nset_auth_type=yes\n...\nuser {\nbase_dn=\"${..base_dn}\"\nfilter=\"(uid=%{%{Stripped-User-Name}:-%{User-Name}})\"\n}\n...<\/code><\/pre>\n<p>Restartujeme radius-server a kontrolujeme synchronizaci u\u017eivatel\u016f LDAP:<\/p>\n<pre><code class=\"bash\">radtest user_ldap password_ldap localhost 1812 testing123<\/code><\/pre>\n<p>\nUprav\u00edme eap v <i><b>mods-enabled\/eap<\/b><\/i><br \/>\nZde p\u0159id\u00e1me dv\u011b instance eap. Ty se budou li\u0161it pouze certifik\u00e1ty a kl\u00ed\u010di. Pozd\u011bji vysv\u011btl\u00edm, pro\u010d pr\u00e1v\u011b t\u00edmto zp\u016fsobem.<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/eap<\/b><\/p>\n<pre><code class=\"bash\">eap eap-client {                                                                                                                                                                                                                         default_eap_type = ttls                                                                                                                                                                                                               timer_expire = 60                                                                                                                                                                                                                     ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_file = ${certdir}\/fisrt.key\n           certificate_file = ${certdir}\/first.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                      \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}\neap eap-guest {\ndefault_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                     ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_passwotd=blablabla\n           private_key_file = ${certdir}\/server.key\n           certificate_file = ${certdir}\/server.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                      \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}<\/code><\/pre>\n<p>D\u00e1le upravujeme <i><b>site-enabled\/default<\/b><\/i>. Zaj\u00edm\u00e1me se o sekce authorize a authenticate.<\/p>\n<p><b class=\"spoiler_title\">site-enabled\/default<\/b><\/p>\n<pre><code class=\"bash\">autorizovat {\n  filtr_username\n  preprocess\n  pokud (&amp;User-Name == \"guest\") {\n   eap-guest {\n       ok = return\n   }\n  }\n  jinak pokud (&amp;User-Name == \"client\") {\n    eap-client {\n       ok = return \n    }\n  }\n  jinak {\n    eap-guest {\n       ok = return\n    }\n  }\n  ldap\n  pokud ((ok || updated) &amp;&amp; User-Password) {\n    update {\n        control:Auth-Type := ldap\n    }\n  }\n  expiration\n  logintime\n  pap\n  }\n\nautentizovat {\n  Auth-Type LDAP {\n    ldap\n  }\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  pap\n}<\/code><\/pre>\n<p>V sekci authorize odstran\u00edme v\u0161echny moduly, kter\u00e9 nepot\u0159ebujeme. Nech\u00e1me pouze ldap. P\u0159id\u00e1me kontrolu klienta podle u\u017eivatelsk\u00e9ho jm\u00e9na. Pr\u00e1v\u011b pro to jsme p\u0159idali v\u00fd\u0161e dva instance eap.<\/p>\n<p><b class=\"spoiler_title\">Multi EAP<\/b>O co jde, je, \u017ee p\u0159i p\u0159ipojov\u00e1n\u00ed n\u011bkter\u00fdch za\u0159\u00edzen\u00ed budeme pou\u017e\u00edvat syst\u00e9mov\u00e9 certifik\u00e1ty a uv\u00e1d\u011bt dom\u00e9nu. M\u00e1me certifik\u00e1t a kl\u00ed\u010d od d\u016fv\u011bryhodn\u00e9ho certifika\u010dn\u00edho \u00fa\u0159adu. Osobn\u011b si mysl\u00edm, \u017ee takov\u00fd postup p\u0159ipojen\u00ed je jednodu\u0161\u0161\u00ed, ne\u017e m\u00edt na ka\u017ed\u00e9m za\u0159\u00edzen\u00ed samostatn\u011b podepsan\u00fd certifik\u00e1t. Ale ani bez samostatn\u011b podepsan\u00fdch certifik\u00e1t\u016f se n\u00e1m to nepoda\u0159ilo. Za\u0159\u00edzen\u00ed Samsung a Android &lt;= 6 verze neum\u011bj\u00ed pou\u017e\u00edvat syst\u00e9mov\u00e9 certifik\u00e1ty. Proto pro n\u011b vytv\u00e1\u0159\u00edme samostatnou instanci eap-guest se samostatn\u011b podepsan\u00fdmi certifik\u00e1ty. Pro v\u0161echna ostatn\u00ed za\u0159\u00edzen\u00ed budeme pou\u017e\u00edvat eap-client s d\u016fv\u011bryhodn\u00fdm certifik\u00e1tem. User-Name se ur\u010duje podle pole Anonymous p\u0159i p\u0159ipojen\u00ed za\u0159\u00edzen\u00ed. Je povoleno pou\u017e\u00edt pouze 3 hodnoty: Guest, Client a pr\u00e1zdn\u00e9 pole. V\u0161echno ostatn\u00ed bude odm\u00edtnuto. To se nastavuje v politik\u00e1ch. P\u0159\u00edklad uvedu o n\u011bco pozd\u011bji.<\/p>\n<p>Uprav\u00edme sekce authorize a authenticate v <i><b>site-enabled\/inner-tunnel<\/b><\/i><\/p>\n<p><b class=\"spoiler_title\">site-enabled\/inner-tunnel<\/b><\/p>\n<pre><code class=\"bash\">autorizovat {\n  filtr_username\n  filtr_inner_identity\n  update control {\n   &amp;Proxy-To-Realm := LOCAL\n  }\n  ldap\n  pokud ((ok || updated) &amp;&amp; User-Password) {\n    update {\n        control:Auth-Type := ldap\n    }\n  }\n  expiration\n  digest\n  logintime\n  pap\n  }\n\nautentizovat {\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  Auth-Type PAP {\n    pap\n  }\n  ldap\n}<\/code><\/pre>\n<p>D\u00e1le je pot\u0159eba definovat v politik\u00e1ch, jak\u00e1 jm\u00e9na mohou b\u00fdt pou\u017eita pro anonymn\u00ed p\u0159ihl\u00e1\u0161en\u00ed. Uprav\u00edme <b><i>policy.d\/filter<\/i><\/b>.<\/p>\n<p>Je nutn\u00e9 naj\u00edt \u0159\u00e1dky podobn\u00e9 tomu:<\/p>\n<pre><code class=\"bash\">pokud (&amp;outer.request:User-Name !~ \/^(anon|@)\/) {\n  update request {\n    Module-Failure-Message = \"User-Name nen\u00ed anonymizov\u00e1n\"\n  }\n  zam\u00edtnout\n}<\/code><\/pre>\n<p>\nA n\u00ed\u017ee v elsif p\u0159idat pot\u0159ebn\u00e9 hodnoty:<\/p>\n<pre><code class=\"bash\">jinak pokud (&amp;outer.request:User-Name !~ \/^(guest|client|@)\/) {\n  update request {\n    Module-Failure-Message = \"User-Name nen\u00ed anonymizov\u00e1n\"\n  }\n  zam\u00edtnout\n}<\/code><\/pre>\n<p>\nNyn\u00ed se mus\u00edme p\u0159esunout do adres\u00e1\u0159e <b><i>certs<\/i><\/b>. Sem je pot\u0159eba um\u00edstit kl\u00ed\u010d a certifik\u00e1t od d\u016fv\u011bryhodn\u00e9ho certifika\u010dn\u00edho \u00fa\u0159adu, kter\u00fd ji\u017e m\u00e1me, a je t\u0159eba vygenerovat samostatn\u011b podepsan\u00e9 certifik\u00e1ty pro eap-guest.<\/p>\n<p>Upravujeme parametry v souboru <b><i>ca.cnf<\/i><\/b>.<\/p>\n<p><b class=\"spoiler_title\">ca.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndefault_days = 3650\ndefault_md = sha256\n...\ninpu_password = blablabla\noutput_password = blablabla\n...\ncountryName = RU\nstateOrProvinceNmae = St\u00e1t\nlocalityNmae = M\u011bsto\norganizationName = NONAME\nemailAddress = admin@admin.ru\ncommonName = \"CA FreeRadius\"<\/code><\/pre>\n<p>Stejn\u00e9 hodnoty zapisujeme do souboru <b><i><i>server.cnf<\/i><\/i><\/b>. M\u011bn\u00edme pouze <br \/>\n<b>commonName<\/b>:<\/p>\n<p><b class=\"spoiler_title\">server.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndefault_days = 3650\ndefault_md = sha256\n...\ninpu_password = blablabla\noutput_password = blablabla\n...\ncountryName = RU\nstateOrProvinceNmae = St\u00e1t\nlocalityNmae = M\u011bsto\norganizationName = NONAME\nemailAddress = admin@admin.ru\ncommonName = \"Server Certificate FreeRadius\"<\/code><\/pre>\n<p>Vytv\u00e1\u0159\u00edme:<\/p>\n<pre><code class=\"bash\">make<\/code><\/pre>\n<p>\nHotovo. Obdr\u017eeli jsme <b><i>server.crt<\/i><\/b> a <b><i>server.key<\/i><\/b> u\u017e m\u00e1me zapsan\u00e9 v\u00fd\u0161e v eap-guest.<\/p>\n<p>A nakonec p\u0159id\u00e1me na\u0161e p\u0159\u00edstupov\u00e9 body do souboru <b><i>client.conf<\/i><\/b>. M\u00e1m jich 7. Abychom nemuseli p\u0159id\u00e1vat ka\u017ed\u00fd bod zvl\u00e1\u0161\u0165, zap\u00ed\u0161eme pouze s\u00ed\u0165, ve kter\u00e9 se nach\u00e1zej\u00ed (m\u00e1m p\u0159\u00edstupov\u00e9 body ve zvl\u00e1\u0161tn\u00edm VLAN).<\/p>\n<pre><code class=\"bash\">client APs {\nipaddr = 192.168.100.0\/24\npassword = password_AP\n}<\/code><\/pre>\n<p><\/p>\n<h2>Ubiquiti Controller<\/h2>\n<p>\nNa controlleru vytvo\u0159\u00edme zvl\u00e1\u0161tn\u00ed s\u00ed\u0165. Nechme to b\u00fdt 192.168.2.0\/24<br \/>\nP\u0159ejdeme do nastaven\u00ed -&gt; profil. Vytvo\u0159\u00edme nov\u00fd:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/57d97f7ef2db1a62633aa16131435065.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZap\u00ed\u0161eme adresu a port radius-serveru a heslo, kter\u00e9 jsme uvedli v souboru <b><i>clients.conf<\/i><\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/edab8e5ef03897c88bb45b2912e577ec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVytvo\u0159\u00edme nov\u00e9 jm\u00e9no bezdr\u00e1tov\u00e9 s\u00edt\u011b. Jako metodu autentizace vybereme WPA-EAP (Enterprise) a uvedeme vytvo\u0159en\u00fd radius profil:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9dc918b734cac3d7382db796feb6b7a2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u0161e ulo\u017e\u00edme, pou\u017eijeme a jdeme d\u00e1l.<\/p>\n<h2>Nastaven\u00ed klient\u016f<\/h2>\n<p>\nZa\u010dneme s t\u00edm nejt\u011b\u017e\u0161\u00edm!<\/p>\n<h3>Windows 10<\/h3>\n<p>\nObt\u00ed\u017enost spo\u010d\u00edv\u00e1 v tom, \u017ee Windows zat\u00edm neum\u00ed p\u0159ipojit k podnikov\u00e9 WiFi podle dom\u00e9ny. Proto je nutn\u00e9 ru\u010dn\u011b vlo\u017eit n\u00e1\u0161 certifik\u00e1t do \u00falo\u017ei\u0161t\u011b d\u016fv\u011bryhodn\u00fdch certifik\u00e1t\u016f. M\u016f\u017eeme pou\u017e\u00edt jak samopodepsan\u00fd, tak certifik\u00e1t od certifika\u010dn\u00ed autority. J\u00e1 pou\u017eiji druh\u00fd. <\/p>\n<p>D\u00e1le je t\u0159eba vytvo\u0159it nov\u00e9 p\u0159ipojen\u00ed. K tomu p\u0159ejdeme do nastaven\u00ed s\u00edt\u011b a internetu -&gt; Centrum spr\u00e1vy s\u00edt\u00ed a sd\u00edlen\u00ed -&gt; Vytvo\u0159en\u00ed a nastaven\u00ed nov\u00e9ho p\u0159ipojen\u00ed nebo s\u00edt\u011b:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/406e515cff889ea70e226116f1dc0521.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f88e592920e43d42cc7fed34423f09ea.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1d7c045e02eb8e3b14016aacfa00da4c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRu\u010dn\u011b zapisujeme jm\u00e9no s\u00edt\u011b a m\u011bn\u00edme typ zabezpe\u010den\u00ed. Pot\u00e9 klikneme na <i>zm\u011bnit parametry p\u0159ipojen\u00ed<\/i> a v z\u00e1lo\u017ece Bezpe\u010dnost vybereme ov\u011b\u0159ov\u00e1n\u00ed s\u00edt\u011b \u2014 EAP-TTLS.<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/7e736b4cffd6dca5fdd9df70cedd7988.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/6c328ff8b4a434ed488c46b594aa5108.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d4a3d2883088a06592addae770a12a16.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159ejdeme do nastaven\u00ed, zap\u00ed\u0161eme d\u016fv\u011brnost autentizace \u2014 <b>client<\/b>. Jako d\u016fv\u011bryhodnou certifika\u010dn\u00ed autoritu vybereme n\u00e1mi p\u0159idan\u00fd certifik\u00e1t, za\u0161krtneme pol\u00ed\u010dko \u201eNepod\u00e1vat u\u017eivateli v\u00fdzvu, pokud se nepoda\u0159\u00ed autorizovat server\u201c a metodu ov\u011b\u0159ov\u00e1n\u00ed vybereme \u2014 ne\u0161ifrovan\u00e9 heslo (PAP).<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb4897493f805f0d8869c22a1b706dec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nD\u00e1le se dostaneme do pokro\u010dil\u00fdch parametr\u016f, za\u0161krtneme \u201eUve\u010fte re\u017eim ov\u011b\u0159ov\u00e1n\u00ed\u201c. Vybereme mo\u017enost \u201eOv\u011b\u0159en\u00ed u\u017eivatele\u201c a klikneme na <i>ulo\u017eit p\u0159ihla\u0161ovac\u00ed \u00fadaje<\/i>. Zde je t\u0159eba zadat username_ldap a password_ldap<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/469bb4337e4e601a80de1021a48bc101.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/999dc6c41a69b22c8de2b49398c9a613.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/75347f2f7140cac58a181a325ab0f3ad.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u0161echno ulo\u017e\u00edme, pou\u017eijeme, zav\u0159eme. M\u016f\u017eeme se p\u0159ipojit k nov\u00e9 s\u00edti.<\/p>\n<h3>Linux<\/h3>\n<p>\nOtestoval jsem to na Ubuntu 18.04, 18.10, Fedora 29, 30.<\/p>\n<p>Nejd\u0159\u00edve si st\u00e1hneme certifik\u00e1t. Nena\u0161el jsem v Linuxu mo\u017enost pou\u017e\u00edt syst\u00e9mov\u00e9 certifik\u00e1ty a zda tam v\u016fbec existuje takov\u00e9 \u00falo\u017ei\u0161t\u011b. <\/p>\n<p>Budeme se p\u0159ipojovat p\u0159es dom\u00e9nu. Proto je pot\u0159eba certifik\u00e1t certifika\u010dn\u00ed autority, u kter\u00e9 byl n\u00e1\u0161 certifik\u00e1t zakoupen.<\/p>\n<p>Cel\u00e9 p\u0159ipojen\u00ed se uskute\u010d\u0148uje v jednom okn\u011b. Vybereme na\u0161i s\u00ed\u0165:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e05f44a52ee7290921b5b74df718a0c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>anonymous \u2014 client<br \/>\ndomain \u2014 dom\u00e9na, na kterou byl certifik\u00e1t vyd\u00e1n<br \/>\n<\/i><\/p>\n<h3>Android<\/h3>\n<p><\/p>\n<h4>non-Samsung<\/h4>\n<p>\nOd verze 7 p\u0159i p\u0159ipojov\u00e1n\u00ed WiFi lze vyu\u017e\u00edt syst\u00e9mov\u00e9 certifik\u00e1ty, pokud uvedete pouze dom\u00e9nu:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f935493cbe35f5a19c4da8bb5632604f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>domain \u2014 dom\u00e9na, na kterou byl certifik\u00e1t vyd\u00e1n<br \/>\nanonymous \u2014 client<br \/>\n<\/i><\/p>\n<h4>Samsung<\/h4>\n<p>\nJak jsem ji\u017e psal v\u00fd\u0161e, za\u0159\u00edzen\u00ed Samsung neum\u00ed pou\u017e\u00edvat syst\u00e9mov\u00e9 certifik\u00e1ty p\u0159i p\u0159ipojen\u00ed WiFi a nemaj\u00ed mo\u017enost se p\u0159ipojit p\u0159es dom\u00e9nu. Proto je t\u0159eba ru\u010dn\u011b p\u0159idat ko\u0159enov\u00fd certifik\u00e1t certifika\u010dn\u00ed autority (ca.pem, vezmeme na Radius serveru). Zde bude pou\u017eit samopodepsan\u00fd.<\/p>\n<p>St\u00e1hneme certifik\u00e1t na sv\u00e9 za\u0159\u00edzen\u00ed a nainstalujeme ho.<\/p>\n<p><b class=\"spoiler_title\">Instalace certifik\u00e1tu<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d02770f35c44a618f2f6243085c258b8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb9ec984d5e68824ebd0b138551a87c2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/2c5c95c339b00085845470fdff56932e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1561758abad60a168e067f1ecb0b94f5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159itom bude t\u0159eba nastavit kresbu pro odemknut\u00ed obrazovky, PIN k\u00f3d nebo heslo, pokud je\u0161t\u011b nen\u00ed nastaveno:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eeb9189ecdb8c255f2b76918ec1954b5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/741c2f6df3e50c5ebb94c76e907efb33.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Uk\u00e1zal jsem slo\u017eitou variantu instalace certifik\u00e1tu. Na v\u011bt\u0161in\u011b za\u0159\u00edzen\u00ed sta\u010d\u00ed jednodu\u0161e kliknout na sta\u017een\u00fd certifik\u00e1t.<\/i><\/p>\n<p>Jakmile je certifik\u00e1t nainstalov\u00e1n, m\u016f\u017eeme p\u0159ej\u00edt k p\u0159ipojen\u00ed:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4e2a8716b30634b3effdb0f2cbf781af.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>certifik\u00e1t \u2014 uv\u00e1d\u00edme ten, kter\u00fd jsme nainstalovali<br \/>\nanonymn\u00ed u\u017eivatel \u2014 guest<br \/>\n<\/i><\/p>\n<h3>macOS<\/h3>\n<p>\nZa\u0159\u00edzen\u00ed Apple z krabice se mohou p\u0159ipojit pouze k EAP-TLS, ale st\u00e1le je pot\u0159eba jim nahr\u00e1t certifik\u00e1t. Abyste uvedli jinou metodu p\u0159ipojen\u00ed, mus\u00edte pou\u017e\u00edt Apple Configurator 2. P\u0159edt\u00edm je samoz\u0159ejm\u011b t\u0159eba si ho st\u00e1hnout na Mac, vytvo\u0159it nov\u00fd profil a p\u0159idat v\u0161echny pot\u0159ebn\u00e9 nastaven\u00ed WiFi.<\/p>\n<p><b class=\"spoiler_title\">Apple Configurator<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1864dedc371b851dbf2594eff3ec7fc7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0847466b361f681bcfcabee92f1ac885.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Zde uv\u00e1d\u00edme n\u00e1zev sv\u00e9 s\u00edt\u011b<br \/>\nTyp zabezpe\u010den\u00ed \u2014 WPA2 Enterprise<br \/>\nP\u0159ijateln\u00e9 EAP typy \u2014 TTLS<br \/>\nU\u017eivatelsk\u00e9 jm\u00e9no a heslo \u2014 nech\u00e1v\u00e1me pr\u00e1zdn\u00e9<br \/>\nVnit\u0159n\u00ed ov\u011b\u0159ov\u00e1n\u00ed \u2014 PAP<br \/>\nVn\u011bj\u0161\u00ed identita \u2014 client <br \/>\n<\/i><\/p>\n<p><i>Z\u00e1lo\u017eka D\u016fv\u011bra. Zde uv\u00e1d\u00edme na\u0161i dom\u00e9nu<\/i><\/p>\n<p>V\u0161echno. Profil lze ulo\u017eit, podepsat a distribuovat na za\u0159\u00edzen\u00ed.<\/p>\n<p>Jakmile je profil p\u0159ipraven, je t\u0159eba ho st\u00e1hnout na Mac a nainstalovat. V pr\u016fb\u011bhu instalace bude t\u0159eba zadat username_ldap a password_ldap u\u017eivatele:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d7cb1cbcfd1de930d0718c1596bc60d7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/dd2e90a77fd9b64f6a98b0c0b21a080c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/c1cb62ec60fc835353c5e409a138f0be.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>iOS<\/h3>\n<p>\nProces je podobn\u00fd jako na macOS. Je t\u0159eba pou\u017e\u00edt profil (m\u016f\u017ee b\u00fdt stejn\u00fd jako pro macOS. Jak vytvo\u0159it profil v Apple Configurator, viz v\u00fd\u0161e).<\/p>\n<p>St\u00e1hneme profil, nainstalujeme, zad\u00e1me p\u0159ihla\u0161ovac\u00ed \u00fadaje, p\u0159ipoj\u00edme se:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e2be411c0dfb427bfd54ad0b1f42dcb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d637fa93c0bcf09d1a5eb3701f769d4f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0908737918cd81cbf3e1ebf9ba0d9820.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/3821dc0bd6f866730575c6ceb3d5bbfb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/b4b0bf189ac037345e33e7864bfb2ad8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f5f9b7168ac14b67d6f4753d050a742e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00edmto jsme v\u0161e dokon\u010dili. Nastavili jsme Radius server, synchronizovali ho s FreeIPA a ur\u010dili p\u0159\u00edstupov\u00fdm bod\u016fm Ubiquiti, aby pou\u017e\u00edvaly WPA2-EAP.<\/p>\n<h2>Mo\u017en\u00e9 dotazy<\/h2>\n<p>\n<b>Ot\u00e1zka:<\/b> jak p\u0159edat profil\/certifik\u00e1t zam\u011bstnanci?<\/p>\n<p><b>Odpov\u011b\u010f:<\/b> V\u0161echny certifik\u00e1ty\/profily uchov\u00e1v\u00e1m na FTP s p\u0159\u00edstupem p\u0159es web. Nastavil jsem hostitelskou s\u00ed\u0165 s omezen\u00edm rychlosti a p\u0159\u00edstupem pouze na internet, krom\u011b FTP. <br \/>\nAutentizace trv\u00e1 2 dny, pot\u00e9 se resetuje a klient z\u016fst\u00e1v\u00e1 bez internetu. Tedy kdy\u017e se zam\u011bstnanec chce p\u0159ipojit k WiFi, nejd\u0159\u00edve se p\u0159ipoj\u00ed k hostitelsk\u00e9 s\u00edti, p\u0159ihl\u00e1s\u00ed se na FTP, st\u00e1hne si pot\u0159ebn\u00fd certifik\u00e1t nebo profil, nainstaluje je a pot\u00e9 se m\u016f\u017ee p\u0159ipojit k firemn\u00ed s\u00edti.<\/p>\n<p><b>Ot\u00e1zka:<\/b> pro\u010d nepou\u017e\u00edvat sch\u00e9ma s MSCHAPv2? je p\u0159ece bezpe\u010dn\u011bj\u0161\u00ed!<\/p>\n<p><b>Odpov\u011b\u010f:<\/b> za prv\u00e9, toto sch\u00e9ma dob\u0159e funguje na NPS (Windows Network Policy System), v na\u0161\u00ed implementaci je nutn\u00e9 nav\u00edc konfigurovat LDAP (FreeIPA) a uchov\u00e1vat hash hesel na serveru. Dal\u0161\u00ed nastaven\u00ed nen\u00ed \u017e\u00e1douc\u00ed, proto\u017ee m\u016f\u017ee v\u00e9st k r\u016fzn\u00fdm probl\u00e9m\u016fm se synchronizac\u00ed u\u017eivatelsk\u00fdch \u00fa\u010dt\u016f. Za druh\u00e9, hash je MD4, tak\u017ee to bezpe\u010dnost p\u0159\u00edli\u0161 nezvy\u0161uje.<\/p>\n<p><b>Ot\u00e1zka:<\/b> je mo\u017en\u00e9 autorizovat za\u0159\u00edzen\u00ed podle MAC adres?<\/p>\n<p><b>Odpov\u011b\u010f:<\/b> NE, to nen\u00ed bezpe\u010dn\u00e9, \u00fato\u010dn\u00edk m\u016f\u017ee fale\u0161n\u011b generovat MAC adresy, a nav\u00edc autorizace podle MAC adres nen\u00ed podporov\u00e1na na mnoha za\u0159\u00edzen\u00edch. <\/p>\n<p><b>Ot\u00e1zka:<\/b> pro\u010d v\u016fbec pou\u017e\u00edvat v\u0161echny tyto certifik\u00e1ty? d\u00e1 se p\u0159ece i bez nich p\u0159ipojit.<\/p>\n<p><b>Odpov\u011b\u010f:<\/b> Certifik\u00e1ty se pou\u017e\u00edvaj\u00ed k autorizaci serveru. Tj. za\u0159\u00edzen\u00ed p\u0159i p\u0159ipojen\u00ed kontroluje, zda je to server, kter\u00e9mu lze d\u016fv\u011b\u0159ovat, nebo ne. Pokud ano, autentizace pokra\u010duje, pokud ne, p\u0159ipojen\u00ed se uzav\u00edr\u00e1. Je mo\u017en\u00e9 se p\u0159ipojit i bez certifik\u00e1t\u016f, ale pokud \u00fato\u010dn\u00edk nebo soused spust\u00ed doma radius-server a p\u0159\u00edstupov\u00fd bod se stejn\u00fdm n\u00e1zvem jako my, m\u016f\u017ee snadno zachytit u\u017eivatelsk\u00e9 \u00fadaje (nezapome\u0148me, \u017ee se p\u0159en\u00e1\u0161ej\u00ed v otev\u0159en\u00e9 podob\u011b). A kdy\u017e se pou\u017e\u00edv\u00e1 certifik\u00e1t, nep\u0159\u00edtel uvid\u00ed ve sv\u00fdch log\u00e1ch pouze na\u0161e smy\u0161len\u00e9 u\u017eivatelsk\u00e9 jm\u00e9no \u2013 guest nebo client a chybu typu \u2013 Unknown CA Certificate.<\/p>\n<p><b class=\"spoiler_title\">Je\u0161t\u011b n\u011bco o macOS.<\/b>Obvykle se na macOS reinstaluje syst\u00e9m p\u0159es internet. V re\u017eimu obnoven\u00ed mus\u00ed b\u00fdt Mac p\u0159ipojen k WiFi, a zde nefunguje ani na\u0161e firemn\u00ed WiFi, ani hostitelsk\u00e1 s\u00ed\u0165. Osobn\u011b jsem z\u0159\u00eddil je\u0161t\u011b jednu s\u00ed\u0165, b\u011b\u017enou podle WPA2-PSK, skrytou, pouze pro technick\u00e9 operace. Alternativn\u011b je mo\u017en\u00e9 p\u0159edem vytvo\u0159it bootovac\u00ed flash disk se syst\u00e9mem. Ale pokud je Mac po roce 2015, bude t\u0159eba sehnat adapt\u00e9r pro tento flash disk).<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/463225\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0423\u0436\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e WiFi. \u0417\u0434\u0435\u0441\u044c \u044f \u0440\u0430\u0441\u043f\u0438\u0448\u0443 \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0411\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0439\u0441\u044f LDAP \u0441 \u0437\u0430\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u043f\u043e\u0434\u043d\u0438\u043c\u0435\u043c FreeRadius \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043c WPA2-Enterprise \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 Ubnt. \u0412\u0440\u043e\u0434\u0435 \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c\u2026 \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 EAP \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u0442\u044c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27785,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37065","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:33+00:00","article:modified_time":"2019-10-31T19:15:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37065","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:36:42","updated":"2026-01-22 05:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=37065"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37065\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/27785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=37065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=37065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=37065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}