{"id":37065,"date":"2019-10-31T22:15:33","date_gmt":"2019-10-31T19:15:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/wifi-enterprise-freeradius-freeipa-ubiquiti\/"},"modified":"2019-10-31T22:15:33","modified_gmt":"2019-10-31T19:15:33","slug":"wifi-enterprise-freeradius-freeipa-ubiquiti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","title":{"rendered":"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4c045a0710e5eb14b73359afad484c3d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOleme juba kirjeldanud m\u00f5ningaid n\u00e4iteid ettev\u00f5tte WiFi korraldamiseks. Siin ma selgitan, kuidas selline lahendus ellu viia ja millised probleemid olid seoses erinevate seadmetega \u00fchendamisega. Kasutame juba olemasolevat LDAP koos registreeritud kasutajatega, seadistame FreeRadiusi ja konfigureerime WPA2-Enterprise Ubnt kontrolleris. N\u00e4ib, et k\u00f5ik on lihtne. Vaadake\u2026<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Natuke EAP meetoditest<\/h2>\n<p>\nEnne \u00fclesande t\u00e4itmise alustamist tuleb otsustada, millist autentimismeetodit meie lahenduses kasutada.<\/p>\n<p><b>Vikipeediast:<\/b><\/p>\n<blockquote><p>EAP on autentimisraamistik, mida kasutatakse sageli traadita v\u00f5rkudes ja punkt-punkt \u00fchendustes. Formaat kirjeldati esmakordselt RFC 3748-s ja uuendati RFC 5247-s.<br \/>\nEAP-d kasutatakse autentimismeetodi valimiseks, v\u00f5tmete edastamiseks ja nende v\u00f5tmete t\u00f6\u00f6tlemiseks, mida tehakse EAP meetoditeks nimetatud moodulite kaudu. EAP meetodeid on palju, nii neid, mis on m\u00e4\u00e4ratletud koos EAP-iga, kui ka eraldi tootjate poolt v\u00e4lja antud. EAP ei m\u00e4\u00e4ratle kanalitaset, see m\u00e4\u00e4ratleb ainult s\u00f5numite formaadi. Igal EAP-d kasutaval protokollil on oma EAP s\u00f5numite kapseldamise protokoll. <\/p><\/blockquote>\n<p>\n<b>Meetodid ise:<\/b><\/p>\n<ul>\n<li>LEAP on CISCO loodud patenteeritud protokoll. Leitud on turvaauke. Praegu ei soovitata kasutada. <\/li>\n<li> EAP-TLS on h\u00e4sti toetatud traadita \u00fchenduste pakkujate seas. See on turvaline protokoll, kuna on SSL-standardite j\u00e4reltulija. Kliendi seadistamine on \u00fcsna keeruline. Vajalik on klientsertifikaat koos parooliga. Toetatakse paljudes s\u00fcsteemides. <\/li>\n<li> EAP-TTLS on laialdaselt toetatud paljudes s\u00fcsteemides, pakkudes head turvalisust, kasutades PKI sertifikaate ainult autentimisseervas. <\/li>\n<li> EAP-MD5 on teine avatud standard. Pakkuda minimaalset turvalisust. On haavatav, ei toeta vastastikust autentimist ja v\u00f5tmete genereerimist. <\/li>\n<li> EAP-IKEv2 p\u00f5hineb Internet Key Exchange Protokollil versioon 2. Tagab vastastikuse autentimise ja seansiv\u00f5tme loomise kliendi ja serveri vahel. <\/li>\n<li> PEAP on CISCO, Microsofti ja RSA Security \u00fchislahendus, millel on avatud standard. Laialdaselt saadaval toodetes, tagades v\u00e4ga hea turvalisuse. Sarnane EAP-TTLS-iga, n\u00f5udes ainult sertifikaati serveripoolses osas. <\/li>\n<li> PEAPv0\/EAP-MSCHAPv2 \u2014 p\u00e4rast EAP-TLS on see teine laialdaselt kasutatav standard maailmas. Kasutatakse kliendi-serveri suhet Microsoftis, Ciscos, Apple'is ja Linuxis. <\/li>\n<li> PEAPv1\/EAP-GTC \u2014 loodud Cisco poolt alternatiivina PEAPv0\/EAP-MSCHAPv2-le. Ei kaitse autentimisandmeid mingil juhul. Windows OS-is ei toetata. <\/li>\n<li> EAP-FAST \u2014 meetod, mille on v\u00e4lja t\u00f6\u00f6tanud Cisco, et parandada LEAP-i puudusi. Kasutab Protected Access Credential (PAC). Pole t\u00e4ielikult arendatud. <\/li>\n<\/ul>\n<p>\nK\u00f5ikidest neist valikutest ei ole valik siiski lai. Autentimismeetodilt n\u00f5uti: head turvalisust, tuge erinevates seadmetes (Windows 10, macOS, Linux, Android, iOS) ja lihtsust. Seega langes valik EAP-TTLS kasuks koos PAP-protokolliga. <br \/>\nV\u00f5ib tekkida k\u00fcsimus \u2014 miks siis kasutada PAP-i? kas see ei edasta paroole avatud kujul? <\/p>\n<p>Jah, k\u00f5ik on \u00f5ige. Suhtlemine FreeRadius ja FreeIPA vahel toimub just nii. Vigade j\u00e4lgimise re\u017eiimis saab j\u00e4lgida, kuidas edastatakse kasutajanimi ja parool. Ja olgu saadetud, kuid teil on ju juurdep\u00e4\u00e4s FreeRadius serverile.<\/p>\n<p>Lisainfot EAP-TTLS t\u00f6\u00f6 kohta saab lugeda. <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.bmstu.wiki\/EAP-TTLS_(Tunneled_Transport_Layer_Security)\">siit<br \/>\n<\/a><\/noindex><\/p>\n<h2>FreeRADIUS<\/h2>\n<p>\nT\u00f5stame FreeRadius \u00fcles CentOS 7.6-l. Siin pole midagi keerulist, installeerime tavap\u00e4rasel viisil.<\/p>\n<pre><code class=\"bash\">yum install freeradius freeradius-utils freeradius-ldap -y<\/code><\/pre>\n<p>\n<i>Pakettidest installitakse versioon 3.0.13. Viimast saab v\u00f5tta aadressilt. <noindex><a rel=\"nofollow\" href=\"https:\/\/freeradius.org\/\">https:\/\/freeradius.org\/<\/a><\/noindex><\/i><\/p>\n<p>P\u00e4rast seda t\u00f6\u00f6tab FreeRadius juba. Failis \/etc\/raddb\/users saab kommenteerida rea.<\/p>\n<pre><code class=\"bash\">steve   Cleartext-Password := \"testing\"<\/code><\/pre>\n<p>\nK\u00e4ivita server silumise re\u017eiimis.<\/p>\n<pre><code class=\"bash\">freeradius -X<\/code><\/pre>\n<p>\nJa teeme katse\u00fchenduse localhostiga.<\/p>\n<pre><code class=\"bash\">radtest steve testing 127.0.0.1 1812 testing123<\/code><\/pre>\n<p>\nSaime vastuse. <i>Received Access-Accept Id 115 from 127.0.0.1:1812 to 127.0.0.1:56081 length 20<\/i>, see t\u00e4hendab, et k\u00f5ik on korras. J\u00e4tkame edasi.<\/p>\n<p>\u00dchendame mooduli. <i><b>ldap<\/b><\/i>.<\/p>\n<pre><code class=\"bash\">ln -s \/etc\/raddb\/mods-available\/ldap \/etc\/raddb\/mods-enabled\/ldap<\/code><\/pre>\n<p>\nJa muudame seda kohe. Me vajame, et FreeRadius saaks r\u00e4\u00e4kida FreeIPA-ga.<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/ldap<\/b><\/p>\n<pre><code class=\"bash\">ldap {\nserver=\"ldap:\/\/ldap.server.com\"\nport=636\nstart_tls=yes\nidentity=\"uid=admin,cn=users,dc=server,dc=com\"\npassword=**********\nbase_dn=\"cn=users,dc=server,dc=com\"\nset_auth_type=yes\n...\nuser {\nbase_dn=\"${..base_dn}\"\nfilter=\"(uid=%{%{Stripped-User-Name}:-%{User-Name}})\"\n}\n...<\/code><\/pre>\n<p>Taask\u00e4ivitage radius-server ja kontrollige LDAP kasutajate s\u00fcnkroonimist:<\/p>\n<pre><code class=\"bash\">radtest user_ldap password_ldap localhost 1812 testing123<\/code><\/pre>\n<p>\nToimetame eap-d <i><b>mods-enabled\/eap<\/b><\/i><br \/>\nSiia lisame kaks eksemplari eap-d. Need erinevad ainult sertifikaatide ja v\u00f5tmete poolest. Veidi allpool selgitan, miks just nii.<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/eap<\/b><\/p>\n<pre><code class=\"bash\">eap eap-client {                                                                                                                                                                                                                           default_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_file = ${certdir}\/fisrt.key\n           certificate_file = ${certdir}\/first.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}\neap eap-guest {\ndefault_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_passwotd=blablabla\n           private_key_file = ${certdir}\/server.key\n           certificate_file = ${certdir}\/server.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}<\/code><\/pre>\n<p>J\u00e4tkame redigeerimist <i><b>site-enabled\/default<\/b><\/i>. Huvi pakuvad jaotised authorize ja authenticate.<\/p>\n<p><b class=\"spoiler_title\">site-enabled\/default<\/b><\/p>\n<pre><code class=\"bash\">authorize {\n  filter_username\n  preprocess\n  if (&amp;User-Name == \"guest\") {\n   eap-guest {\n       ok = return\n   }\n  }\n  elsif (&amp;User-Name == \"client\") {\n    eap-client {\n       ok = return \n    }\n  }\n  else {\n    eap-guest {\n       ok = return\n    }\n  }\n  ldap\n  if ((ok || updated) &amp;&amp; User-Password) {\n    update {\n        control:Auth-Type := ldap\n    }\n  }\n  expiration\n  logintime\n  pap\n  }\n\nauthenticate {\n  Auth-Type LDAP {\n    ldap\n  }\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  pap\n}<\/code><\/pre>\n<p>Jaotis authorize loobime k\u00f5ik moodulid, mida me ei vaja. J\u00e4tame alles ainult ldap. Lisame kliendi kontrolli kasutajanime j\u00e4rgi. Just selleks lisasime varem kaks eksemplari eap.<\/p>\n<p><b class=\"spoiler_title\">Multi EAP<\/b>Tegelikult, kui \u00fchendame m\u00f5ned seadmed, kasutame s\u00fcsteemi sertifikaate ja m\u00e4rkime domeeni. Meil on sertifikaat ja v\u00f5ti usaldusv\u00e4\u00e4rselt sertifitseerimiskeskuselt. Minu arvates on see \u00fchendumisprotseduur lihtsam, kui visata igale seadmele iseallkirjastatud sertifikaat. Kuid ka ilma iseallkirjastatud sertifikaatideta me ei saanud hakkama. Samsungi seadmed ja Android &lt; 6 versioon ei oska kasutada s\u00fcsteemi sertifikaate. Seet\u00f5ttu loome neile eraldi eksemplari eap-guest iseallkirjastatud sertifikaatidega. K\u00f5ikidele teistele seadmetele kasutame eap-client usaldusv\u00e4\u00e4rse sertifikaadiga. User-Name m\u00e4\u00e4ratakse Anonymous v\u00e4ljast \u00fchendamisel. Lubatud on kasutada ainult 3 v\u00e4\u00e4rtust: Guest, Client ja t\u00fchi v\u00e4li. K\u00f5ik muu j\u00e4etakse k\u00f5rvale. See seadistatakse poliitikates. Toome n\u00e4ite natuke hiljem.<\/p>\n<p>Redigeerime jaotised authorize ja authenticate <i><b>site-enabled\/inner-tunnel<\/b><\/i><\/p>\n<p><b class=\"spoiler_title\">site-enabled\/inner-tunnel<\/b><\/p>\n<pre><code class=\"bash\">authorize {\n  filter_username\n  filter_inner_identity\n  update control {\n   &amp;Proxy-To-Realm := LOCAL\n  }\n  ldap\n  if ((ok || updated) &amp;&amp; User-Password) {\n    update {\n        control:Auth-Type := ldap\n    }\n  }\n  expiration\n  digest\n  logintime\n  pap\n  }\n\nauthenticate {\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  Auth-Type PAP {\n    pap\n  }\n  ldap\n}<\/code><\/pre>\n<p>J\u00e4tkamiseks peame poliitikates m\u00e4\u00e4rama, milliseid nimesid saab kasutada anon\u00fc\u00fcmseks sisenemiseks. Redigeerime <b><i>policy.d\/filter<\/i><\/b>.<\/p>\n<p>Peame leidma read, mis n\u00e4evad v\u00e4lja sellised:<\/p>\n<pre><code class=\"bash\">if (&amp;outer.request:User-Name !~ \/^(anon|@)\/) {\n  update request {\n    Module-Failure-Message = \"User-Name is not anonymized\"\n  }\n  reject\n}<\/code><\/pre>\n<p>\nJa allpool elsif lisama vajalikud v\u00e4\u00e4rtused:<\/p>\n<pre><code class=\"bash\">elsif (&amp;outer.request:User-Name !~ \/^(guest|client|@)\/) {\n  update request {\n    Module-Failure-Message = \"User-Name is not anonymized\"\n  }\n  reject\n}<\/code><\/pre>\n<p>\nN\u00fc\u00fcd peame liikuma katalooge <b><i>certs<\/i><\/b>. Siia tuleb panna v\u00f5ti ja sertifikaat usaldusv\u00e4\u00e4rselt sertifitseerimiskeskuselt, mis meil juba on, ja genereerida iseallkirjastatud sertifikaadid eap-guest jaoks.<\/p>\n<p>Muudame parameetreid failis <b><i>ca.cnf<\/i><\/b>.<\/p>\n<p><b class=\"spoiler_title\">ca.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndefault_days = 3650\ndefault_md = sha256\n...\ninput_password = blablabla\noutput_password = blablabla\n...\ncountryName = EE\nstateOrProvinceNmae = Riik\nlocalityNmae = Linn\norganizationName = NONAME\nemailAddress = admin@admin.ee\ncommonName = \"CA FreeRadius\"<\/code><\/pre>\n<p>Samad v\u00e4\u00e4rtused kirjutame failis <b><i><i>server.cnf<\/i><\/i><\/b>. Muudame ainult <br \/>\n<b>commonName<\/b>:<\/p>\n<p><b class=\"spoiler_title\">server.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndefault_days = 3650\ndefault_md = sha256\n...\ninput_password = blablabla\noutput_password = blablabla\n...\ncountryName = EE\nstateOrProvinceNmae = Riik\nlocalityNmae = Linn\norganizationName = NONAME\nemailAddress = admin@admin.ee\ncommonName = \"Server Certificate FreeRadius\"<\/code><\/pre>\n<p>Loomeme:<\/p>\n<pre><code class=\"bash\">tee<\/code><\/pre>\n<p>\nValmis. Saadud <b><i>server.crt<\/i><\/b> ja <b><i>server.key<\/i><\/b> on meil juba soovitud eap-guest failis.<\/p>\n<p>Ja viimane, lisame meie juurdep\u00e4\u00e4supunktid faili <b><i>client.conf<\/i><\/b>. Mul on neid 7. Selleks, et mitte iga punkti eraldi lisada, kirjutame lihtsalt v\u00f5rgu, kuhu nad kuuluvad (minu juurdep\u00e4\u00e4supunktid asuvad eraldi VLAN-is).<\/p>\n<pre><code class=\"bash\">client APs {\nipaddr = 192.168.100.0\/24\npassword = password_AP\n}<\/code><\/pre>\n<p><\/p>\n<h2>Ubiquiti kontroller<\/h2>\n<p>\nKontrolleris loome eraldi v\u00f5rgu. Olgu see 192.168.2.0\/24<br \/>\nLiigume seadetesse -&gt; profiil. Loome uue:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/57d97f7ef2db1a62633aa16131435065.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKiresime radius-serveri aadressi ja portaad ja parooli, mille me failis oleme m\u00e4\u00e4ranud <b><i>clients.conf<\/i><\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/edab8e5ef03897c88bb45b2912e577ec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLoome uue juhtmeta v\u00f5rgu nime. Autentimise meetodina valime WPA-EAP (Enterprise) ja osutame loodud radius-profiilile:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9dc918b734cac3d7382db796feb6b7a2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKinnitame k\u00f5ik, rakendame ja liigume edasi.<\/p>\n<h2>Kliendi seadistamine<\/h2>\n<p>\nAlustame k\u00f5ige keerulisemast!<\/p>\n<h3>ja Android. Ja kuigi sageli ei toimind need s\u00fcsteemid eriti h\u00e4sti, on huvitav, et see on \u00fcldse v\u00f5imalik.<\/h3>\n<p>\nRaskus seisneb selles, et Windows ei oska veel domeeni kaudu ettev\u00f5tte WiFi-iga \u00fchenduda. Seet\u00f5ttu peame k\u00e4sitsi oma sertifikaadi usaldusv\u00e4\u00e4rsete sertifikaatide salvestusse lisama. Siin saab kasutada kas ise allkirjastatud v\u00f5i sertifitseerimiskeskusest. <\/p>\n<p>Seej\u00e4rel tuleb luua uus \u00fchendus. Selleks liikume v\u00f5rgu- ja Interneti seadete juurde -&gt; V\u00f5rgu ja jagamise juhtimiskeskus -&gt; Uue \u00fchenduse v\u00f5i v\u00f5rgu loomine ja seadistamine:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/406e515cff889ea70e226116f1dc0521.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f88e592920e43d42cc7fed34423f09ea.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1d7c045e02eb8e3b14016aacfa00da4c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00e4sitsi kirjutame v\u00f5rgu nime ja muudame turvat\u00fc\u00fcpi. Seej\u00e4rel vajutame <i>muuda \u00fchenduse seadeid<\/i> ja turvalisuse vahekaardil valime v\u00f5rgu autentimise - EAP-TTLS.<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/7e736b4cffd6dca5fdd9df70cedd7988.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/6c328ff8b4a434ed488c46b594aa5108.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d4a3d2883088a06592addae770a12a16.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSiseneme seadetele, m\u00e4\u00e4rame autentimise konfidentsiaalsuse - <b>client<\/b>. Usaldusv\u00e4\u00e4rse sertifitseerimiskeskuse valimisel valime lisatud sertifikaadi, m\u00e4rkime kasti \"\u00c4rge kuvage kasutajale kutset, kui serveri autentimine eba\u00f5nnestub\" ja autentimise meetodina valime - kr\u00fcpteerimata parooli (PAP).<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb4897493f805f0d8869c22a1b706dec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJ\u00e4tkame lisaseadete juurde, paneme m\u00e4rgi \"M\u00e4\u00e4rake autentimise re\u017eiim\". Valime \"Kasutaja autentimine\" ja vajutame <i>salvesta sisselogimisandmed<\/i>. Siia tuleb sisestada username_ldap ja password_ldap<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/469bb4337e4e601a80de1021a48bc101.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/999dc6c41a69b22c8de2b49398c9a613.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/75347f2f7140cac58a181a325ab0f3ad.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSalvestame k\u00f5ik, rakendame, sulgeme. Saame hakata uude v\u00f5rku \u00fchenduma.<\/p>\n<h3>Linux<\/h3>\n<p>\nOlen testinud Ubuntu 18.04, 18.10, Fedora 29, 30.<\/p>\n<p>Alustuseks laadime alla sertifikaadi. Ma ei leidnud Linuxist, kas on v\u00f5imalik kasutada s\u00fcsteemi sertifikaate ja kas seal on \u00fcldse selline hoidla. <\/p>\n<p>\u00dchendume domeeni kaudu. Seet\u00f5ttu on vajalik sertifikaat sertifitseerimisasutuselt, kellelt meie sertifikaat on soetatud.<\/p>\n<p>Kogu \u00fchendamine toimub \u00fches aknas. Valime meie v\u00f5rgu:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e05f44a52ee7290921b5b74df718a0c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>anon\u00fc\u00fcmne \u2014 klient<br \/>\ndomeen \u2014 domeen, millele sertifikaat on v\u00e4lja antud<br \/>\n<\/i><\/p>\n<h3>Android<\/h3>\n<p><\/p>\n<h4>non-Samsung<\/h4>\n<p>\nAlates versioonist 7 on WiFi \u00fchendamisel v\u00f5imalik kasutada s\u00fcsteemi sertifikaate, m\u00e4rkides ainult domeeni:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f935493cbe35f5a19c4da8bb5632604f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>domeen \u2014 domeen, millele sertifikaat on v\u00e4lja antud<br \/>\nanon\u00fc\u00fcmne \u2014 klient<br \/>\n<\/i><\/p>\n<h4>Samsung<\/h4>\n<p>\nNagu juba eespool mainisin, ei oska Samsungi seadmed WiFi \u00fchendamisel kasutada s\u00fcsteemi sertifikaate ja neil pole domeeni kaudu \u00fchendamise v\u00f5imalust. Seet\u00f5ttu tuleb k\u00e4sitsi lisada sertifitseerimiskeskuse juureskirjastus (ca.pem, saame Radius serverilt). Siin kasutatakse iseallkirjastatud sertifikaati.<\/p>\n<p>Laadime sertifikaadi oma seadmesse ja installime selle.<\/p>\n<p><b class=\"spoiler_title\">Sertifikaadi installimine<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d02770f35c44a618f2f6243085c258b8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb9ec984d5e68824ebd0b138551a87c2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/2c5c95c339b00085845470fdff56932e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1561758abad60a168e067f1ecb0b94f5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSelleks tuleb installida ekraanilukustuse muster, PIN-kood v\u00f5i parool, kui see pole veel seadistatud:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eeb9189ecdb8c255f2b76918ec1954b5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/741c2f6df3e50c5ebb94c76e907efb33.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Kusin keerukat sertifikaadi installimise varianti. Enamikus seadmetes piisab lihtsalt allalaaditud sertifikaadile klikkimisest.<\/i><\/p>\n<p>Kui sertifikaat on installitud, saame liikuda \u00fchendamise juurde:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4e2a8716b30634b3effdb0f2cbf781af.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>sertifikaat \u2014 n\u00e4itame seda, mida oleme installinud<br \/>\nanon\u00fc\u00fcmne kasutaja \u2014 k\u00fclaline<br \/>\n<\/i><\/p>\n<h3>macOS<\/h3>\n<p>\nApple'i seadmed saavad kohe \u00fchenduda ainult EAP-TLS-iga, kuid sertifikaat tuleb ikka neile edastada. Teise \u00fchendamismeetodi valimiseks tuleb kasutada Apple Configurator 2. Seet\u00f5ttu tuleb see eelnevalt Macile alla laadida, luua uus profiil ja lisada k\u00f5ik vajalikud WiFi seaded.<\/p>\n<p><b class=\"spoiler_title\">Apple Configurator<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1864dedc371b851dbf2594eff3ec7fc7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0847466b361f681bcfcabee92f1ac885.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Siin m\u00e4rkige oma v\u00f5rgu nimi<br \/>\nTurbet\u00fc\u00fcp \u2014 WPA2 Enterprise<br \/>\nAktsepteeritud EAP t\u00fc\u00fcbid \u2014 TTLS<br \/>\nKasutajanimi ja parool \u2014 j\u00e4tame t\u00fchjaks<br \/>\nSiseautentimine \u2014 PAP<br \/>\nV\u00e4line identiteet \u2014 klient <br \/>\n<\/i><\/p>\n<p><i>Usaldusv\u00e4\u00e4rsuse vahekaart. Siin m\u00e4rgime oma domeeni<\/i><\/p>\n<p>K\u00f5ik. Profiili saab salvestada, allkirjastada ja jagada seadmetele<\/p>\n<p>Kui profiil on valmis, tuleb see mac-ile alla laadida ja installida. Installimise k\u00e4igus tuleb sisestada kasutaja ldap ja parool ldap.<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d7cb1cbcfd1de930d0718c1596bc60d7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/dd2e90a77fd9b64f6a98b0c0b21a080c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/c1cb62ec60fc835353c5e409a138f0be.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>iOS<\/h3>\n<p>\nProtsess on samasugune nagu macOS-is. Tuleb kasutada profiili (seda v\u00f5ib kasutada sama, mis macOS-i jaoks). Kuidas profiili luua Apple Configuratoris, vaata \u00fclalpool).<\/p>\n<p>Laadi profiil alla, installi see, sisesta kasutajatunnused ja \u00fchenda:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e2be411c0dfb427bfd54ad0b1f42dcb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d637fa93c0bcf09d1a5eb3701f769d4f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0908737918cd81cbf3e1ebf9ba0d9820.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/3821dc0bd6f866730575c6ceb3d5bbfb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/b4b0bf189ac037345e33e7864bfb2ad8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f5f9b7168ac14b67d6f4753d050a742e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSellega on k\u00f5ik. Oleme seadistanud Radius-serveri, s\u00fcnkrooninud selle FreeIPA-ga ja m\u00e4\u00e4ranud Ubiquiti juurdep\u00e4\u00e4supunktidele kasutama WPA2-EAP.<\/p>\n<h2>V\u00f5imalikud k\u00fcsimused<\/h2>\n<p>\n<b>K:<\/b> kuidas edastada profiil\/sertifikaat t\u00f6\u00f6tajale?<\/p>\n<p><b>V:<\/b> K\u00f5ik sertifikaadid\/profiilid hoian FTP-s, millele p\u00e4\u00e4seb ligi l\u00e4bi veebi. Olen seadistanud k\u00fclalisjao, kus juurdep\u00e4\u00e4s on piiratud kiirusest ja ainult internetti, v\u00e4lja arvatud FTP. <br \/>\nAutentimine kestab 2 p\u00e4eva, p\u00e4rast mida see kustutatakse ja klient j\u00e4\u00e4b ilma internetita. Seega, kui t\u00f6\u00f6taja soovib WiFi-ga \u00fchendada, peab ta esmalt \u00fchendama k\u00fclalisse v\u00f5rku, minema FTP-sse, laadima alla soovitud sertifikaadi v\u00f5i profiili, installima need ja p\u00e4rast seda saab ta \u00fchendada ettev\u00f5tte v\u00f5rku.<\/p>\n<p><b>K:<\/b> miks mitte kasutada MSCHAPv2 skeemi? see on ju turvalisem!<\/p>\n<p><b>V:<\/b> Esiteks t\u00f6\u00f6tab see skeem h\u00e4sti NPS-is (Windows Network Policy System), meie rakenduses on vajalik t\u00e4iendavate LDAP (FreeIpa) seadistamine ja paroolide r\u00e4si hoidmine serveris. T\u00e4iendavate seadistuste tegemine pole soovitatav, kuna see v\u00f5ib p\u00f5hjustada erinevaid s\u00fcnkroonimisprobleeme. Teiseks, r\u00e4si on MD4, seega ei t\u00f5sta see eriti turvalisust.<\/p>\n<p><b>K:<\/b> kas seadmeid saab autoriseerida MAC-aadresside j\u00e4rgi?<\/p>\n<p><b>V:<\/b> EI, see ei ole turvaline, h\u00e4kker v\u00f5ib MAC-aadresse petta ja autoriseerimine MAC-aadresside j\u00e4rgi ei ole paljude seadmete poolt toetatud. <\/p>\n<p><b>K:<\/b> miks \u00fcldse neid sertifikaate kasutada? saab ju ka ilma nendeta \u00fchendada.<\/p>\n<p><b>V:<\/b> sertifikaate kasutatakse serveri autoriseerimiseks. See t\u00e4hendab, et seade kontrollib \u00fchendamisel, kas see on usaldusv\u00e4\u00e4rne server v\u00f5i mitte. Kui on, siis autentimine j\u00e4tkub, kui ei, siis \u00fchendus sulgetakse. \u00dchenduda on v\u00f5imalik ka sertifikaatideta, kuid kui pahatahtlik isik v\u00f5i naaber seab endale kodus radius-serveri ja juurdep\u00e4\u00e4supunkti sama nimega nagu meil, saab ta kergesti tabada kasutaja autentimistunnuseid (\u00e4rgem unustagem, et need edastatakse avatud kujul). Kui aga sertifikaati kasutatakse, n\u00e4eb vaenlane oma logides vaid meie v\u00e4ljam\u00f5eldud User-Name'id \u2014 k\u00fclaline v\u00f5i klient ja veateadet, nagu Unknown CA Certificate.<\/p>\n<p><b class=\"spoiler_title\">veel natuke macOS-ist<\/b>Tavaliselt toimub macOS-i uuesti installimine interneti kaudu. Taastere\u017eiimis peab mac olema \u00fchendatud WiFi-ga, ja siin ei t\u00f6\u00f6ta ei meie ettev\u00f5tte WiFi ega k\u00fclaliste v\u00f5rk. Isiklikult seadsin \u00fcles veel \u00fche v\u00f5rgu, tavalise WPA2-PSK v\u00f5rgu, peidetud, ainult tehniliste operatsioonide jaoks. V\u00f5i siis on v\u00f5imalik eelnevalt teha s\u00fcsteemiga k\u00e4ivitatav USB-m\u00e4lupulk. Kuid kui mac on p\u00e4rast 2015. aastat, tuleb veel leida adapter selle m\u00e4lupulga jaoks.)<\/p>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/463225\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0423\u0436\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e WiFi. \u0417\u0434\u0435\u0441\u044c \u044f \u0440\u0430\u0441\u043f\u0438\u0448\u0443 \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0411\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0439\u0441\u044f LDAP \u0441 \u0437\u0430\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u043f\u043e\u0434\u043d\u0438\u043c\u0435\u043c FreeRadius \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043c WPA2-Enterprise \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 Ubnt. \u0412\u0440\u043e\u0434\u0435 \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c\u2026 \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 EAP \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u0442\u044c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27785,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37065","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:33+00:00","article:modified_time":"2019-10-31T19:15:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37065","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:36:42","updated":"2026-01-22 05:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37065"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37065\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/27785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}