{"id":37065,"date":"2019-10-31T22:15:33","date_gmt":"2019-10-31T19:15:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/wifi-enterprise-freeradius-freeipa-ubiquiti\/"},"modified":"2019-10-31T22:15:33","modified_gmt":"2019-10-31T19:15:33","slug":"wifi-enterprise-freeradius-freeipa-ubiquiti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","title":{"rendered":"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4c045a0710e5eb14b73359afad484c3d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVe\u0107 su opisani neki primjeri organizacije korporativnog WiFi-a. Ovdje \u0107u opisati kako sam realizovao takvo re\u0161enje i probleme sa kojima sam se suo\u010dio prilikom povezivanja na razli\u010ditim ure\u0111ajima. Koristi\u0107emo postoje\u0107i LDAP sa unetim korisnicima, podi\u0107i FreeRadius i postaviti WPA2-Enterprise na Ubnt kontroleru. Naizgled je sve jednostavno. Vidjet \u0107emo...<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Malo o metodama EAP<\/h2>\n<p>\nPrije nego \u0161to zapo\u010dnemo izvr\u0161enje zadatka, potrebno je odrediti koji metod autentifikacije \u0107emo koristiti u na\u0161em re\u0161enju.<\/p>\n<p><b>Iz Wikipedije:<\/b><\/p>\n<blockquote><p>EAP je okvir autentifikacije koji se \u010desto koristi u be\u017ei\u010dnim mre\u017eama i ta\u010dka-ta\u010dka vezama. Format je prvi put opisan u RFC 3748 i a\u017euriran u RFC 5247.<br \/>\nEAP se koristi za odabir metoda autentifikacije, prenos klju\u010deva i obradu tih klju\u010deva pomo\u0107u modula koji se nazivaju EAP metodama. Postoji mnogo EAP metod\u00e2, kako onih definiranih zajedno sa samim EAP-om, tako i onih koje su izdale razli\u010dite kompanije. EAP ne defini\u0161e sloj kanala, ve\u0107 samo defini\u0161e format poruka. Svaki protokol koji koristi EAP ima svoj vlastiti protokol za inkapsulaciju EAP poruka. <\/p><\/blockquote>\n<p>\n<b>Metodi sami:<\/b><\/p>\n<ul>\n<li>LEAP je proprietary protokol razvijen od strane CISCO-a. Prona\u0111ene su ranjivosti. Trenutno se ne preporu\u010duje za upotrebu. <\/li>\n<li> EAP-TLS se dobro podr\u017eava me\u0111u vendora be\u017ei\u010dnih veza. Je siguran protokol, budu\u0107i da je naslednik SSL standarda. Konfiguracija klijenta je prili\u010dno slo\u017eena. Potreban je klijentski sertifikat pored lozinke. Podr\u017eava se u mnogim sistemima. <\/li>\n<li> EAP-TTLS se \u0161iroko podr\u017eava u mnogim sistemima, nudi dobru sigurnost, koriste\u0107i PKI sertifikate samo na serveru autentifikacije. <\/li>\n<li> EAP-MD5 je drugi otvoreni standard. Nudi minimalnu sigurnost. Ranjiv je, ne podr\u017eava me\u0111usobnu autentifikaciju i generaciju klju\u010deva. <\/li>\n<li> EAP-IKEv2 se oslanja na Internet Key Exchange Protocol verzija 2. Obezbe\u0111uje me\u0111usobnu autentifikaciju i uspostavljanje sesijskog klju\u010da izme\u0111u klijenta i servera. <\/li>\n<li> PEAP je zajedni\u010dko re\u0161enje CISCO-a, Microsoft-a i RSA Security-a kao otvoreni standard. \u0160iroko je dostupno u proizvodima, obezbe\u0111uje veoma dobru sigurnost. Sli\u010dno je EAP-TTLS, tra\u017ee\u0107i samo sertifikat na serverskoj strani. <\/li>\n<li> PEAPv0\/EAP-MSCHAPv2 \u2014 nakon EAP-TLS, to je drugi naj\u0161ire kori\u0161teni standard u svijetu. Koristi se klijent-server veza u Microsoftu, Cisco, Apple, Linux <\/li>\n<li> PEAPv1\/EAP-GTC \u2014 razvijen od strane Cisco kao alternativa PEAPv0\/EAP-MSCHAPv2. Ne \u0161titi autentifikacijske podatke u nijednom slu\u010daju. Nije podr\u017ean u Windows OS <\/li>\n<li> EAP-FAST \u2014 metoda koju je razvio Cisco kako bi ispravila nedostatke LEAP-a. Koristi Protected Access Credential (PAC). Potpuno nije dovr\u0161en <\/li>\n<\/ul>\n<p>\nOd svega tog raznolika izbora, opcije ipak nisu mnoge. Od metode autentifikacije se tra\u017eila: dobra sigurnost, podr\u0161ka na svim ure\u0111ajima (Windows 10, macOS, Linux, Android, iOS) i, zapravo, \u0161to jednostavnije, to bolje. Stoga je izbor pao na EAP-TTLS u kombinaciji s PAP protokolom. <br \/>\nMo\u017eda se mo\u017ee javiti pitanje \u2014 Za\u0161to koristiti PAP? jer \u0161alje lozinke u otvorenom obliku? <\/p>\n<p>Da, sve je u redu. Komunikacija izme\u0111u FreeRadius i FreeIPA \u0107e se odvijati ba\u0161 na taj na\u010din. U debug modu mo\u017eete pratiti kako se \u0161alju korisni\u010dko ime i lozinka. I neka se \u0161alju, samo vi imate pristup serveru FreeRadius.<\/p>\n<p>Vi\u0161e o radu EAP-TTLS mo\u017eete pro\u010ditati <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.bmstu.wiki\/EAP-TTLS_(Tunneled_Transport_Layer_Security)\">ovdje<br \/>\n<\/a><\/noindex><\/p>\n<h2>FreeRADIUS<\/h2>\n<p>\nFreeRadius \u0107emo postaviti na CentOS 7.6. Ovdje nema ni\u0161ta slo\u017eeno, instaliramo na obi\u010dan na\u010din.<\/p>\n<pre><code class=\"bash\">yum install freeradius freeradius-utils freeradius-ldap -y<\/code><\/pre>\n<p>\n<i>Iz paketa se instalira verzija 3.0.13. Posljednju mo\u017eete nabaviti na <noindex><a rel=\"nofollow\" href=\"https:\/\/freeradius.org\/\">https:\/\/freeradius.org\/<\/a><\/noindex><\/i><\/p>\n<p>Nakon toga FreeRadius ve\u0107 radi. Mo\u017eete u \/etc\/raddb\/users odkomentirati redak<\/p>\n<pre><code class=\"bash\">steve   Cleartext-Password := \"testing\"<\/code><\/pre>\n<p>\nPokrenite server u debug modu<\/p>\n<pre><code class=\"bash\">freeradius -X<\/code><\/pre>\n<p>\nI napravimo testnu vezu s localhostom<\/p>\n<pre><code class=\"bash\">radtest steve testing 127.0.0.1 1812 testing123<\/code><\/pre>\n<p>\nDobiven je odgovor <i>Received Access-Accept Id 115 from 127.0.0.1:1812 to 127.0.0.1:56081 length 20<\/i>, zna\u010di sve je u redu. Idemo dalje.<\/p>\n<p>Povezujemo modul <i><b>ldap<\/b><\/i>.<\/p>\n<pre><code class=\"bash\">ln -s \/etc\/raddb\/mods-available\/ldap \/etc\/raddb\/mods-enabled\/ldap<\/code><\/pre>\n<p>\nI odmah ga mijenjamo. Trebamo da FreeRadius mo\u017ee pristupiti FreeIPA<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/ldap<\/b><\/p>\n<pre><code class=\"bash\">ldap {\nserver=\"ldap:\/\/ldap.server.com\"\nport=636\nstart_tls=yes\nidentity=\"uid=admin,cn=users,dc=server,dc=com\"\npassword=**********\nbase_dn=\"cn=users,dc=server,dc=com\"\nset_auth_type=yes\n...\nuser {\nbase_dn=\"${..base_dn}\"\nfilter=\"(uid=%{%{Stripped-User-Name}:-%{User-Name}})\"\n}\n...<\/code><\/pre>\n<p>Ponovo pokre\u0107emo radius-server i provjeravamo sinhronizaciju LDAP korisnika:<\/p>\n<pre><code class=\"bash\">radtest user_ldap password_ldap localhost 1812 testing123<\/code><\/pre>\n<p>\nUre\u0111ujemo eap u <i><b>mods-enabled\/eap<\/b><\/i><br \/>\nOvdje \u0107emo dodati dva primjera eap. Oni \u0107e se razlikovati samo po certifikatima i klju\u010devima. Malo ni\u017ee \u0107u objasniti za\u0161to ba\u0161 tako<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/eap<\/b><\/p>\n<pre><code class=\"bash\">eap eap-client {                                                                                                                                                                                                                           default_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_file = ${certdir}\/fisrt.key\n           certificate_file = ${certdir}\/first.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}\neap eap-guest {\ndefault_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_passwotd=blablabla\n           private_key_file = ${certdir}\/server.key\n           certificate_file = ${certdir}\/server.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}<\/code><\/pre>\n<p>Zatim ure\u0111ujemo <i><b>site-enabled\/default<\/b><\/i>. Interesiraju nas sekcije authorize i authenticate.<\/p>\n<p><b class=\"spoiler_title\">site-enabled\/default<\/b><\/p>\n<pre><code class=\"bash\">autorizacija {\n  filter_username\n  preprocess\n  ako (&amp;User-Name == &quot;guest&quot;) {\n   eap-guest {\n       ok = return\n   }\n  }\n  ina\u010de ako (&amp;User-Name == &quot;client&quot;) {\n    eap-client {\n       ok = return \n    }\n  }\n  ina\u010de {\n    eap-guest {\n       ok = return\n    }\n  }\n  ldap\n  ako ((ok || updated) &amp;&amp; User-Password) {\n    update {\n        control:Auth-Type := ldap\n    }\n  }\n  expiration\n  logintime\n  pap\n  }\n\nautentifikacija {\n  Auth-Type LDAP {\n    ldap\n  }\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  pap\n}<\/code><\/pre>\n<p>U sekciji authorize uklanjamo sve module koji nam nisu potrebni. Ostavimo samo ldap. Dodajemo provjeru klijenta po korisni\u010dkom imenu. Upravo zbog toga smo iznad dodali dva primjera eap.<\/p>\n<p><b class=\"spoiler_title\">Multi EAP<\/b>Naime, pri povezivanju nekih ure\u0111aja koristit \u0107emo sustavske certifikate i navesti domen. Imamo certifikat i klju\u010d od pouzdane certifikacijske ustanove. Po mom osobnom mi\u0161ljenju, ovakva procedura povezivanja je jednostavnija nego slati na svaki ure\u0111aj samo-potpisane certifikate. No, ni bez samo-potpisanih certifikata nismo uspjeli izbje\u0107i. Samsung ure\u0111aji i Android &lt;= 6 verzije ne znaju koristiti sustavske certifikate. Zato za njih kreiramo poseban primjer eap-guest sa samo-potpisanim certifikatima. Za sve ostale ure\u0111aje koristit \u0107emo eap-client s pouzdanim certifikatom. User-Name se definira prema polju Anonymous prilikom povezivanja ure\u0111aja. Dozvoljena su samo 3 vrijednosti: Guest, Client i prazno polje. Sve ostalo se odbacuje. Ovo se postavlja u politikama. Primjer \u0107u \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043c malo kasnije.<\/p>\n<p>Ure\u0111ujemo sekcije authorize i authenticate u <i><b>site-enabled\/inner-tunnel<\/b><\/i><\/p>\n<p><b class=\"spoiler_title\">site-enabled\/inner-tunnel<\/b><\/p>\n<pre><code class=\"bash\">autorizacija {\n  filter_username\n  filter_inner_identity\n  update control {\n   &amp;Proxy-To-Realm := LOCAL\n  }\n  ldap\n  ako ((ok || updated) &amp;&amp; User-Password) {\n    update {\n        control:Auth-Type := ldap\n    }\n  }\n  expiration\n  digest\n  logintime\n  pap\n  }\n\nautentifikacija {\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  Auth-Type PAP {\n    pap\n  }\n  ldap\n}<\/code><\/pre>\n<p>Zatim je potrebno navesti u politikama koja imena se mogu koristiti za anonimni ulaz. Ure\u0111ujemo <b><i>policy.d\/filter<\/i><\/b>.<\/p>\n<p>Potrebno je prona\u0107i linije sli\u010dne ovome:<\/p>\n<pre><code class=\"bash\">ako (&amp;outer.request:User-Name !~ \\\/^(anon|@)\\\/\/) {\n  update request {\n    Module-Failure-Message = &quot;User-Name nije anonimiziran&quot;\n  }\n  odbij\n}<\/code><\/pre>\n<p>\nI ispod u elsif dodajemo potrebne vrijednosti:<\/p>\n<pre><code class=\"bash\">ina\u010de ako (&amp;outer.request:User-Name !~ \\\/^(guest|client|@)\\\/\/) {\n  update request {\n    Module-Failure-Message = &quot;User-Name nije anonimiziran&quot;\n  }\n  odbij\n}<\/code><\/pre>\n<p>\nSada se moramo preseliti u direktorij <b><i>certs<\/i><\/b>. Ovdje je potrebno staviti klju\u010d i certifikat od pouzdane certifikacijske ustanove koji ve\u0107 imamo te generirati samo-potpisane certifikate za eap-guest.<\/p>\n<p>Promjena parametara u datoteci <b><i>ca.cnf<\/i><\/b>.<\/p>\n<p><b class=\"spoiler_title\">ca.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndefault_days = 3650\ndefault_md = sha256\n...\ninput_password = blablabla\noutput_password = blablabla\n...\ncountryName = HR\nstateOrProvinceNmae = Dr\u017eava\nlocalityNmae = Grad\norganizationName = NONAME\nemailAddress = admin@admin.hr\ncommonName = &quot;CA FreeRadius&quot;<\/code><\/pre>\n<p>Iste vrijednosti upisujemo u datoteku <b><i><i>server.cnf<\/i><\/i><\/b>. Mijenjamo samo <br \/>\n<b>commonName<\/b>:<\/p>\n<p><b class=\"spoiler_title\">server.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndefault_days = 3650\ndefault_md = sha256\n...\ninput_password = blablabla\noutput_password = blablabla\n...\ncountryName = HR\nstateOrProvinceNmae = Dr\u017eava\nlocalityNmae = Grad\norganizationName = NONAME\nemailAddress = admin@admin.hr\ncommonName = &quot;Server Certificate FreeRadius&quot;<\/code><\/pre>\n<p>Kreiramo:<\/p>\n<pre><code class=\"bash\">make<\/code><\/pre>\n<p>\nGotovo. Dobiveni <b><i>server.crt<\/i><\/b> i <b><i>server.key<\/i><\/b> ve\u0107 su zapisani gore u eap-guest.<\/p>\n<p>I na kraju, dodajemo na\u0161e pristupne to\u010dke u datoteku <b><i>client.conf<\/i><\/b>. Imam ih 7. Da ne dodajem svaku to\u010dku posebno, upisat \u0107emo samo mre\u017eu u kojoj se nalaze (moje pristupne to\u010dke se nalaze u posebnom VLAN-u).<\/p>\n<pre><code class=\"bash\">client APs {\nipaddr = 192.168.100.0\/24\npassword = password_AP\n}<\/code><\/pre>\n<p><\/p>\n<h2>Ubiquiti kontroler<\/h2>\n<p>\nNa kontroleru podi\u017eemo posebnu mre\u017eu. Neka bude 192.168.2.0\/24<br \/>\nIdemo u postavke -&gt; profil. Kreiramo novi:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/57d97f7ef2db1a62633aa16131435065.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUpisujemo adresu i port radius-servera i lozinku koju smo napisali u datoteci <b><i>clients.conf<\/i><\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/edab8e5ef03897c88bb45b2912e577ec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKreiramo novo ime be\u017ei\u010dne mre\u017ee. Kao metodu autentikacije biramo WPA-EAP (Enterprise) i navodimo stvoreni radius-profil:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9dc918b734cac3d7382db796feb6b7a2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSve spremamo, primjenjujemo i idemo dalje.<\/p>\n<h2>Postavke klijenata<\/h2>\n<p>\nPo\u010dinjemo s najte\u017eim!<\/p>\n<h3>Windows 10<\/h3>\n<p>\nTe\u017eina se svodi na to da Windows jo\u0161 uvijek ne mo\u017ee povezati s korporativnim WiFi-em putem domene. Stoga je potrebno ru\u010dno dodati na\u0161 certifikat u pohranu pouzdanih certifikata. Ovdje se mo\u017ee koristiti ili samopotpisani ili iz centra za certificiranje. Ja \u0107u koristiti drugi. <\/p>\n<p>Zatim trebate stvoriti novu vezu. Da bismo to u\u010dinili, idemo u postavke mre\u017ee i interneta -&gt; Centar za upravljanje mre\u017eama i zajedni\u010dkim pristupom -&gt; Stvaranje i postavljanje nove veze ili mre\u017ee:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/406e515cff889ea70e226116f1dc0521.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f88e592920e43d42cc7fed34423f09ea.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1d7c045e02eb8e3b14016aacfa00da4c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRu\u010dno upisujemo ime mre\u017ee i mijenjamo tip sigurnosti. Nakon toga kliknemo na <i>izmijeni postavke veze<\/i> i u kartici Sigurnost biramo provjeru autenti\u010dnosti mre\u017ee - EAP-TTLS.<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/7e736b4cffd6dca5fdd9df70cedd7988.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/6c328ff8b4a434ed488c46b594aa5108.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d4a3d2883088a06592addae770a12a16.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIdemo u postavke, upisujemo privatnost autentikacije - <b>klijent<\/b>. Kao pouzdani centar za certificiranje biramo na\u0161 dodani certifikat, ozna\u010davamo opciju \u201eNe tra\u017eiti od korisnika poziv za autorizaciju ako ne uspije autentificirati poslu\u017eitelj\u201c i metodu provjere autenti\u010dnosti biramo - ne\u0161ifrirana lozinka (PAP).<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb4897493f805f0d8869c22a1b706dec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZatim ulazimo u dodatne opcije, stavljamo oznaku na \u00abOdredite na\u010din provjere autenti\u010dnosti\u00bb. Biramo opciju \u00abProvjera autenti\u010dnosti korisnika\u00bb i kliknemo na <i>spremi vjerodajnice<\/i>. Ovdje \u0107emo unijeti username_ldap i password_ldap<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/469bb4337e4e601a80de1021a48bc101.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/999dc6c41a69b22c8de2b49398c9a613.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/75347f2f7140cac58a181a325ab0f3ad.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSve spremamo, primjenjujemo, zatvaramo. Mo\u017eemo se povezati na novu mre\u017eu.<\/p>\n<h3>Linux<\/h3>\n<p>\nProvjeravao sam na Ubuntu 18.04, 18.10, Fedora 29, 30.<\/p>\n<p>Za po\u010detak, preuzimamo certifikat. Nisam na\u0161ao u Linuxu, postoji li mogu\u0107nost kori\u0161tenja sistemskih certifikata i postoji li uop\u0107e takvo spremi\u0161te. <\/p>\n<p>Povezat \u0107emo se putem domena. Stoga je potreban certifikat certifikacijskog centra od kojeg smo nabavili na\u0161 certifikat.<\/p>\n<p>Sva povezanost se obavlja u jednom prozoru. Odabiremo na\u0161u mre\u017eu:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e05f44a52ee7290921b5b74df718a0c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>anonymous \u2014 klijent<br \/>\ndomain \u2014 domena na koju je izdan certifikat<br \/>\n<\/i><\/p>\n<h3>Android<\/h3>\n<p><\/p>\n<h4>non-Samsung<\/h4>\n<p>\nOd verzije 7 pri povezivanju na WiFi mogu\u0107e je koristiti sistemske certifikate, navode\u0107i samo domenu:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f935493cbe35f5a19c4da8bb5632604f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>domain \u2014 domena na koju je izdan certifikat<br \/>\nanonymous \u2014 klijent<br \/>\n<\/i><\/p>\n<h4>Samsung<\/h4>\n<p>\nKao \u0161to sam ranije napisao, Samsung ure\u0111aji ne mogu koristiti sistemske certifikate prilikom povezivanja na WiFi, i nemaju mogu\u0107nost povezivanja putem domene. Stoga treba ru\u010dno dodati korijenski certifikat certifikacijskog centra (ca.pem, preuzimamo na Radius serveru). Ovdje \u0107e se koristiti samopotpisani.<\/p>\n<p>Preuzimamo certifikat na svoje ure\u0111aje i instaliramo ga.<\/p>\n<p><b class=\"spoiler_title\">Instalacija certifikata<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d02770f35c44a618f2f6243085c258b8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb9ec984d5e68824ebd0b138551a87c2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/2c5c95c339b00085845470fdff56932e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1561758abad60a168e067f1ecb0b94f5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPri tome, bit \u0107e potrebno postaviti sliku za otklju\u010davanje ekrana, PIN kod ili lozinku, ako ve\u0107 nije postavljena:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eeb9189ecdb8c255f2b76918ec1954b5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/741c2f6df3e50c5ebb94c76e907efb33.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Prikazao sam slo\u017eenu varijantu instalacije certifikata. Na ve\u0107ini ure\u0111aja dovoljno je jednostavno pritisnuti na preuzeti certifikat.<\/i><\/p>\n<p>Kada je certifikat instaliran, mo\u017eemo pre\u0107i na povezivanje:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4e2a8716b30634b3effdb0f2cbf781af.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>certifikat \u2014 navodimo onaj koji smo instalirali<br \/>\nanonimni korisnik \u2014 gost<br \/>\n<\/i><\/p>\n<h3>macOS<\/h3>\n<p>\nApple ure\u0111aji iz kutije mogu se povezati samo na EAP-TLS, ali i dalje je potrebno dodati im certifikat. Da bismo naveli drugu metodu povezivanja, treba koristiti Apple Configurator 2. Prethodno je potrebno preuzeti ga na Mac, kreirati novi profil i dodati sve potrebne WiFi postavke.<\/p>\n<p><b class=\"spoiler_title\">Apple Configurator<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1864dedc371b851dbf2594eff3ec7fc7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0847466b361f681bcfcabee92f1ac885.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Ovdje upisujemo ime svoje mre\u017ee<br \/>\nVrsta sigurnosti \u2014 WPA2 Enterprise<br \/>\nPrihva\u0107ene EAP vrste \u2014 TTLS<br \/>\nKorisni\u010dko ime i lozinka \u2014 ostavimo praznima<br \/>\nUnutarnja autentifikacija \u2014 PAP<br \/>\nVanjski identitet \u2014 klijent <br \/>\n<\/i><\/p>\n<p><i>Kartica Povjerenje. Ovdje navodimo na\u0161u domenu<\/i><\/p>\n<p>Sve. Profil mo\u017eemo spremiti, potpisati i distribuirati na ure\u0111aje<\/p>\n<p>Nakon \u0161to je profil spreman, morat \u0107ete ga preuzeti na Mac i instalirati. Tijekom instalacije bit \u0107e potrebno unijeti username_ldap i password_ldap korisnika:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d7cb1cbcfd1de930d0718c1596bc60d7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/dd2e90a77fd9b64f6a98b0c0b21a080c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/c1cb62ec60fc835353c5e409a138f0be.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>iOS<\/h3>\n<p>\nPostupak je sli\u010dan onome na macOS-u. Potrebno je koristiti profil (mo\u017eete koristiti isti kao za macOS. Kako stvoriti profil u Apple Configuratoru, pogledajte gore).<\/p>\n<p>Preuzimamo profil, instaliramo, unosimo korisni\u010dke podatke, povezujemo se:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e2be411c0dfb427bfd54ad0b1f42dcb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d637fa93c0bcf09d1a5eb3701f769d4f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0908737918cd81cbf3e1ebf9ba0d9820.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/3821dc0bd6f866730575c6ceb3d5bbfb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/b4b0bf189ac037345e33e7864bfb2ad8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f5f9b7168ac14b67d6f4753d050a742e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa tome je gotovo. Postavili smo Radius poslu\u017eitelj, sinkronizirali ga s FreeIPA i zatra\u017eili da pristupne to\u010dke Ubiquiti koriste WPA2-EAP.<\/p>\n<h2>Mogu\u0107a pitanja<\/h2>\n<p>\n<b>P:<\/b> kako poslati profil\/sertifikat zaposleniku?<\/p>\n<p><b>O:<\/b> Sve sertifikate\/profil \u010duvam na FTP-u s pristupom putem weba. Postavio sam gostuju\u0107u mre\u017eu s ograni\u010denjem brzine i pristupom samo internetu, osim FTP-u. <br \/>\nAutentifikacija traje 2 dana, nakon \u010dega se resetira i klijent ostaje bez interneta. Dakle, kada zaposlenik \u017eeli povezati se na WiFi, prvo se pove\u017ee na gostuju\u0107u mre\u017eu, zatim u\u0111e na FTP, preuzme mu potrebni sertifikat ili profil, instalira ih, i nakon toga se mo\u017ee povezati na korporativnu mre\u017eu.<\/p>\n<p><b>P:<\/b> za\u0161to ne koristiti shemu s MSCHAPv2? Ona je sigurnija!<\/p>\n<p><b>O:<\/b> prvo, takva shema dobro radi na NPS-u (Windows Network Policy System), u na\u0161oj implementaciji je potrebno dodatno konfigurirati LDAP (FreeIpa) i \u010duvati hashove lozinki na serveru. Dodatna pode\u0161avanja nisu po\u017eeljna, jer to mo\u017ee dovesti do raznih problema s uskla\u0111ivanjem korisni\u010dkih ra\u010duna. Drugo, hash je MD4, tako da to ne pove\u0107ava sigurnost.<\/p>\n<p><b>P:<\/b> mo\u017ee li se autorizirati ure\u0111aje prema MAC adresama?<\/p>\n<p><b>O:<\/b> NE, to nije sigurno, napada\u010d mo\u017ee promijeniti MAC adrese, a osim toga, autorizacija prema MAC adresama nije podr\u017eana na mnogim ure\u0111ajima. <\/p>\n<p><b>P:<\/b> za\u0161to uop\u0107e koristiti sve te sertifikate? mo\u017ee se i bez njih povezati.<\/p>\n<p><b>O:<\/b> Certifikati se koriste za ovjeru poslu\u017eitelja. Odnosno, ure\u0111aj prilikom povezivanja provjerava je li to poslu\u017eitelj kojemu se mo\u017ee vjerovati ili ne. Ako jest, autentifikacija ide dalje, a ako nije, veza se prekida. Mo\u017ee se povezivati i bez certifikata, ali ako zlonamjerni korisnik ili susjed pokrene radius-poslu\u017eitelj te pristupnu to\u010dku s istim imenom kao na\u0161, lako mo\u017ee presresti korisni\u010dke podatke (ne zaboravite, oni se prenose u otvorenom obliku). Kada se koristi certifikat, neprijatelj u svojim logovima vidi samo na\u0161a izmi\u0161ljena korisni\u010dka imena \u2014 guest ili client te gre\u0161ku tipa \u2014 Unknown CA Certificate.<\/p>\n<p><b class=\"spoiler_title\">Jo\u0161 malo o macOS-u.<\/b>Obi\u010dno se na macOS ponovna instalacija sustava radi putem interneta. U na\u010dinu oporavka, Mac se mora povezati na WiFi, i ovdje ne\u0107e raditi niti na\u0161 korporativni WiFi, niti gostinjska mre\u017ea. Osobno sam postavio jo\u0161 jednu mre\u017eu, obi\u010dnu po WPA2-PSK, skrivenu, samo za tehni\u010dke operacije. Tako\u0111er se mo\u017ee unaprijed napraviti alat za pokretanje s sustavom. No, ako je Mac nakon 2015. godine, potrebno je nabaviti adapter za tu fle\u0161ku.)<\/p>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/463225\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0423\u0436\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e WiFi. \u0417\u0434\u0435\u0441\u044c \u044f \u0440\u0430\u0441\u043f\u0438\u0448\u0443 \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0411\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0439\u0441\u044f LDAP \u0441 \u0437\u0430\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u043f\u043e\u0434\u043d\u0438\u043c\u0435\u043c FreeRadius \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043c WPA2-Enterprise \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 Ubnt. \u0412\u0440\u043e\u0434\u0435 \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c\u2026 \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 EAP \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u0442\u044c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27785,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37065","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:33+00:00","article:modified_time":"2019-10-31T19:15:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37065","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:36:42","updated":"2026-01-22 05:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/37065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=37065"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/37065\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/27785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=37065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=37065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=37065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}