Ko etahi tauira o te whakarite WiFi umanga kua oti te korero. I konei ka whakaahua ahau me pehea taku whakatinana i tetahi otinga rite me nga raru i pa ki a au i te wa e hono ana ki nga taputapu rereke. Ka whakamahia e matou te LDAP o naianei me nga kaiwhakamahi kua rehitatia, ka whakaara ake i a FreeRadius me te whirihora i te WPA2-Enterprise ki te kaiwhakahaere Ubnt. He ahua ngawari nga mea katoa. Kia kite tatou…
He iti mo nga tikanga EAP
I mua i te haere ki te mahi, me whakatau he aha te tikanga motuhēhēnga ka whakamahia e mātou i roto i tā mātou otinga.
Mai i Wikipedia:
Ko te EAP he anga motuhēhēnga e whakamahia ana i roto i nga whatunga ahokore me nga hononga tohu-ki-ira. I whakaahuatia tuatahitia te whakatakotoranga i RFC 3748 ka whakahoutia ki RFC 5247.
Ka whakamahia te EAP ki te kowhiri i te tikanga motuhēhēnga, te tuku kī, me te tukatuka i aua kī ki te mono-mai e kiia nei ko nga tikanga EAP. He maha nga tikanga EAP, kua tautuhia me te EAP ake ka tukuna e nga kaihoko takitahi. Ko te EAP e kore e tautuhi i te paparanga hono, ka tautuhi noa i te whakatakotoranga karere. Kei ia kawa e whakamahi ana i te EAP tana ake kawa whakamaarama karere EAP.
Ko nga tikanga ake:
- Ko LEAP he kawa rangatira i whakawhanakehia e CISCO. I kitea nga whakaraeraetanga. I tenei wa kaore i te tūtohutia mo te whakamahi
- He pai te tautoko a EAP-TLS i waenga i nga kaihoko ahokore. He kawa haumaru na te mea ko ia te kaiwhakakapi ki nga paerewa SSL. Ko te whakarite i te kiritaki he tino uaua. Me whai tiwhikete kiritaki hei taapiri i te kupuhipa. Ka tautokohia i runga i nga punaha maha
- EAP-TTLS - e tautokohia ana i runga i nga punaha maha, he pai te haumarutanga ma te whakamahi i nga tiwhikete PKI anake i runga i te tūmau motuhēhēnga.
- Ko te EAP-MD5 tetahi atu paerewa tuwhera. He iti rawa te haumarutanga. He whakaraerae, kaore e tautoko i te whakamotuhēhē tahi me te whakatipuranga matua
- EAP-IKEv2 - i runga i te Kawa Whakawhiti Kupu Ipurangi putanga 2. Ka whakarato i te motuhēhēnga tahi me te whakaturanga matua hui i waenga i te kiritaki me te tūmau
- Ko te PEAP he otinga tahi o CISCO, Microsoft me RSA Security hei paerewa tuwhera. Kei te waatea i roto i nga hua, e whakarato ana i te haumarutanga tino pai. He rite ki te EAP-TTLS, me whai tiwhikete anake i te taha tūmau
- Ko PEAPv0/EAP-MSCHAPv2 te tuarua o ngā paerewa e whakamahia whānuitia ana i te ao i muri i te EAP-TLS. E whakamahia ana mō te whakawhitiwhiti kōrero kiritaki-tūmau e Microsoft, Cisco, me Apple. Linux
- PEAPv1/EAP-GTC - I hangaia e Cisco hei huarahi kē atu ki te PEAPv0/EAP-MSCHAPv2. Kāore e tiaki i ngā raraunga manatoko i tētahi ara. Kāore e tautokona i roto i Windows OS
- Ko te EAP-FAST he tikanga i hangaia e Cisco hei whakatika i nga hapa o LEAP. Ka whakamahi i te Tiwhikete Whakaaetanga Uru (PAC). Kore rawa i oti
Ahakoa te maha o ngā momo whiringa, he iti tonu te kōwhiringa. Ko te tikanga manatoko e hiahiatia ana: he pai te haumarutanga, he tautoko i ngā taputapu katoa (Windows 10, macOS, Linux, Android, iOS) ā, ko te mea pono, ko te māmā ake, ko te pai ake. Nō reira, ko te kōwhiringa i taka ki te EAP-TTLS me te kawa PAP.
Ka ara ake pea te patai - He aha te take e whakamahia ai te PAP? I muri i nga mea katoa, ka tukuna e ia nga kupuhipa i roto i nga tuhinga maamaa?
Ae ka tika. Ko nga korero i waenga i a FreeRadius me FreeIPA ka penei. I roto i te aratau patuiro, ka taea e koe te whai me pehea te tuku ingoa kaiwhakamahi me te kupuhipa. Ae, me tuku kia haere, ko koe anake te uru ki te tūmau FreeRadius.
Ka taea e koe te panui atu mo te mahi a EAP-TTLS
FreeRADIUS
Ka whakaarahia e mātou a FreeRadius ki CentOS 7.6. Kāore he mea uaua i konei, ka tāutahia e mātou i te huarahi noa.
yum install freeradius freeradius-utils freeradius-ldap -yKo te Putanga 3.0.13 kua whakauruhia mai i nga kete. Ko te whakamutunga ka taea te tango
Whai muri i tenei, kei te mahi kee a FreeRadius. Ka taea e koe te whakakore i te raina i roto i /etc/raddb/users
steve Cleartext-Password := "testing"Whakarewa ki te tūmau i roto i te aratau patuiro
freeradius -XMe hanga he hononga whakamatautau mai i te localhost
radtest steve testing 127.0.0.1 1812 testing123He whakautu I whiwhi Uru-Whakaae Id 115 mai i 127.0.0.1:1812 ki 127.0.0.1:56081 roa 20, te tikanga he pai nga mea katoa. Haere i mua.
Ka hono tatou i te kōwae whakakahore.
ln -s /etc/raddb/mods-available/ldap /etc/raddb/mods-enabled/ldapA ka huri tonu tatou. Kei te hiahia matou FreeRadius kia uru atu ki te FreeIPA
mods-enabled/ldap
ldap {
server="ldap://ldap.server.com"
port=636
start_tls=yes
identity="uid=admin,cn=users,dc=server,dc=com"
password=**********
base_dn="cn=users,dc=server,dc=com"
set_auth_type=yes
...
user {
base_dn="${..base_dn}"
filter="(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
}
...Tīmataria anō te tūmau pūtoro ka taki i te tukutahitanga o ngā kaiwhakamahi LDAP:
radtest user_ldap password_ldap localhost 1812 testing123 Whakatika eap in mods-whakahohea/eap
I konei ka taapirihia e rua nga waahanga o te eap. Ka rereke noa nga tiwhikete me nga ki. Ka whakamarama ahau he aha i tika ai tenei i raro nei.
mods-whakahohea/eap
eap eap-client { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests}
tls-config tls-common {
private_key_file = ${certdir}/fisrt.key
certificate_file = ${certdir}/first.crt
dh_file = ${certdir}/dh
ca_path = ${cadir}
cipher_list = "HIGH"
cipher_server_preference = no
ecdh_curve = "prime256v1"
check_crl = no
}
ttls {
tls = tls-common
default_eap_type = md5
copy_request_to_tunnel = no
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
}
}
eap eap-guest {
default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests}
tls-config tls-common {
private_key_passwotd=blablabla
private_key_file = ${certdir}/server.key
certificate_file = ${certdir}/server.crt
dh_file = ${certdir}/dh
ca_path = ${cadir}
cipher_list = "HIGH"
cipher_server_preference = no
ecdh_curve = "prime256v1"
check_crl = no
}
ttls {
tls = tls-common
default_eap_type = md5
copy_request_to_tunnel = no
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
}
}Whakatikatika ano pae-whakahohea/ taunoa. Kei te pirangi ahau ki nga waahanga whakamana me te whakamotuhēhē.
pae-whakahohea/ taunoa
authorize {
filter_username
preprocess
if (&User-Name == "guest") {
eap-guest {
ok = return
}
}
elsif (&User-Name == "client") {
eap-client {
ok = return
}
}
else {
eap-guest {
ok = return
}
}
ldap
if ((ok || updated) && User-Password) {
update {
control:Auth-Type := ldap
}
}
expiration
logintime
pap
}
authenticate {
Auth-Type LDAP {
ldap
}
Auth-Type eap-guest {
eap-guest
}
Auth-Type eap-client {
eap-client
}
pap
}I roto i te waahanga whakamana ka tangohia e matou nga waahanga katoa kaore e hiahiatia. Ka waiho e matou ko ldap anake. Tāpirihia te manatoko kiritaki ma te ingoa kaiwhakamahi. Koinei te take i taapirihia e matou e rua nga waahanga o te eap i runga ake nei.
EAP mahaKo te mea nui, ina hono ana i ētahi taputapu, ka whakamahia e mātou ngā tiwhikete pūnaha me te tohu i tētahi rohe. He tiwhikete me te kī tā mātou mai i tētahi mana tiwhikete pono. Ki taku whakaaro he māmā ake tēnei tukanga hononga i te tāuta i tētahi tiwhikete waitohu-ake ki ia taputapu. Engari kāore tonu i taea e mātou te mawhiti me ngā tiwhikete waitohu-ake. Ngā taputapu Samsung me Android Kāore e taea e te Putanga 6 te whakamahi i ngā tiwhikete pūnaha. Nō reira, ka hangaia e mātou he tauira eap-manuhiri motuhake me ngā tiwhikete kua hainatia e rātou anō. Mō ngā atu pūrere katoa, ka whakamahia e mātou te eap-kiritaki me te tiwhikete pono. Ka whakatauhia te Ingoa-Kaiwhakamahi e te āpure Ingoakore ina hono te pūrere. E toru noa ngā uara e whakaaetia ana: Manuhiri, Kiritaki, me tētahi āpure kau. Ka makahia ngā mea katoa. Ka whirihorahia tēnei i roto i ngā kaupapa here. Ka hoatu e au he tauira i muri mai.
Me whakatika nga waahanga whakamana me te whakamotuhēhē i roto pae-whakahohea/roto-tunnel
pae-whakahohea/roto-tunnel
authorize {
filter_username
filter_inner_identity
update control {
&Proxy-To-Realm := LOCAL
}
ldap
if ((ok || updated) && User-Password) {
update {
control:Auth-Type := ldap
}
}
expiration
digest
logintime
pap
}
authenticate {
Auth-Type eap-guest {
eap-guest
}
Auth-Type eap-client {
eap-client
}
Auth-Type PAP {
pap
}
ldap
}I muri mai, me tohu koe i roto i nga kaupapa here ko nga ingoa ka taea te whakamahi mo te takiuru kore ingoa. Whakatikatika kaupapa here.d/filter.
Me kimi rarangi rite ki tenei:
if (&outer.request:User-Name !~ /^(anon|@)/) {
update request {
Module-Failure-Message = "User-Name is not anonymized"
}
reject
}A i raro i roto i te elsif taapirihia nga uara e hiahiatia ana:
elsif (&outer.request:User-Name !~ /^(guest|client|@)/) {
update request {
Module-Failure-Message = "User-Name is not anonymized"
}
reject
}Inaianei me neke tatou ki te whaiaronga kete. I konei me whakatakoto e koe te matua me te tiwhikete mai i tetahi mana tiwhikete pono, kei a matou kee me te whakaputa tiwhikete haina-whaiaro mo te eap-manuhiri.
Hurihia nga tawhā i te kōnae ca.cnf.
ca.cnf
...
default_days = 3650
default_md = sha256
...
input_password = blablabla
output_password = blablabla
...
countryName = RU
stateOrProvinceNmae = State
localityNmae = City
organizationName = NONAME
emailAddress = admin@admin.ru
commonName = "CA FreeRadius"Ka tuhia e matou nga uara rite ki te konae server.cnf. Ka huri noa tatou
Ingoa noa:
server.cnf
...
default_days = 3650
default_md = sha256
...
input_password = blablabla
output_password = blablabla
...
countryName = RU
stateOrProvinceNmae = State
localityNmae = City
organizationName = NONAME
emailAddress = admin@admin.ru
commonName = "Server Certificate FreeRadius"Waihanga:
makeKua reri. Kua riro server.crt и server.key kua rēhita kē mātou i runga ake nei i roto i te manuhiri-eap.
Ka mutu, me taapiri o tatou tohu uru ki te konae kaihoko.conf. Kei a au e 7. Kia kore ai e taapiri i ia waahi motuhake, ka tuhia noa e matou te whatunga kei roto i a raatau (kei roto aku waahi uru ki tetahi VLAN motuhake).
client APs {
ipaddr = 192.168.100.0/24
password = password_AP
}Ubiquiti kaiwhakahaere
Ka whakaarahia e matou he whatunga motuhake i runga i te kaiwhakahaere. Kia 192.168.2.0/24
Haere ki nga tautuhinga -> kōtaha. Me hanga he mea hou:
Ka tuhia e matou te wahitau me te tauranga o te radius server me te kupuhipa i tuhia ki te konae kiritaki.conf:
Waihangatia he ingoa whatunga ahokore hou. Tīpakohia te WPA-EAP (Hononga) hei tikanga motuhēhēnga ka whakapūtā te kōtaha pūtoro i hangaia:
Ka tiakina e matou nga mea katoa, tono ka haere tonu.
Te whakarite kiritaki
Me timata ma te tino uaua!
Windows 10
Ko te uauatanga e ahu mai ana i te meka e Windows Kāore tonu e taea te hono atu ki te WiFi kamupene mā te rohe. Nō reira, me tāpiri ā-ringa tā mātou tiwhikete ki te toa tiwhikete pono. Ka taea e koe te whakamahi i tētahi tiwhikete kua hainatia e koe anō, i tētahi rānei nō te CA. Ka whakamahia e au te mea whakamutunga.
Whai muri ka hiahia koe ki te hanga hononga hou. Ki te mahi i tenei, haere ki te whatunga me nga tautuhinga Ipurangi -> Whatunga me te Tiri Pokapū -> Waihanga me te whirihora i tetahi hononga hou, whatunga ranei:
Ka whakauruhia e matou te ingoa whatunga ka huri i te momo haumarutanga. Na ka paato huri i nga tautuhinga hononga a ki te ripa Haumarutanga, tohua te motuhēhēnga whatunga - EAP-TTLS.
Ka haere matou ki nga tawhā, ka tohu i te muna o te motuhēhēnga - kiritaki. Hei mana tiwhikete pono, tohua te tiwhikete i taapirihia e matou, tirohia te pouaka "Kaua e tukuna he powhiri ki te kaiwhakamahi mena kaore e taea te whakamana i te tūmau" ka kowhiria te tikanga motuhēhēnga - kupuhipa kore whakamuna (PAP).
I muri mai, haere ki nga tautuhinga matatau, hoatu he tohu ki runga "Whakaahua te aratau motuhēhēnga." Tīpakohia "Motuhēhēnga Kaiwhakamahi" ka paato i runga tiakina nga tohu. I konei ka hiahia koe ki te whakauru username_ldap me password_ldap
Ka tiakina e matou nga mea katoa, tono, kati. Ka taea e koe te hono atu ki tetahi whatunga hou.
Linux
I tirohia e au Ubuntu 18.04, 18.10, Fedora 29, 30.
Tuatahi, tikiake te tiwhikete. Kāore i kitea e au i roto i Linux, ka taea te whakamahi i ngā tiwhikete pūnaha, ā, he wāhi rokiroki pērā anō kei reira?
Ka hono tatou ma te rohe. Na reira, me whai tiwhikete mai i te mana tohu i hokona mai ai to maatau tiwhikete.
Ko nga hononga katoa ka mahia ki te matapihi kotahi. Tīpakohia to maatau whatunga:
ingoamuna - kiritaki
rohe — te rohe i tukuna ai te tiwhikete
Android
kore-Samsung
Mai i te putanga 7, i te wa e hono ana i a WiFi, ka taea e koe te whakamahi i nga tiwhikete punaha ma te tohu i te rohe anake:
rohe — te rohe i tukuna ai te tiwhikete
ingoamuna - kiritaki
Samsung
Ka rite ki taku i tuhi i runga ake nei, kaore nga taputapu Samsung e mohio ki te whakamahi i nga tiwhikete punaha i te wa e hono ana ki te WiFi, kaore hoki he kaha ki te hono ma te rohe. Na reira, me taapiri koe i te tiwhikete pakiaka o te mana tiwhikete (ca.pem, ka mauhia e matou ki runga i te tūmau Radius). I konei ka whakamahia te haina-whaiaro.
Tangohia te tiwhikete ki to taputapu me te whakauru.
Te whakauru tiwhikete
I te wa ano, ka hiahia koe ki te tautuhi i te tauira iriti mata, te tohu titi, te kupuhipa ranei, mena kaore ano kia tautuhia:
I whakaatu ahau i tetahi putanga uaua o te whakauru i tetahi tiwhikete. I te nuinga o nga taputapu, paato noa i te tiwhikete kua tangohia.
Ina whakauruhia te tiwhikete, ka taea e koe te haere ki te hononga:
tiwhikete - tohuhia te mea i whakauruhia e koe
kaiwhakamahi ingoamuna - manuhiri
macOS
Ka taea e nga taputapu Apple mai i te pouaka te hono noa ki te EAP-TLS, engari me maka tonu he tiwhikete ki a raatau. Hei tautuhi i tetahi tikanga hononga rereke, me whakamahi koe i te Apple Configurator 2. Na reira, me tango tuatahi koe ki to Mac, hanga he tohu hou me te taapiri i nga tautuhinga WiFi e tika ana.
Kaiwhakarato Apple
Whakauruhia to ingoa whatunga ki konei
Momo Haumarutanga - WPA2 Enterprise
Momo EAP kua whakaaetia - TTLS
Ingoa Kaiwhakamahi me te Kupuhipa - waiho kau
Motuhēhēnga o roto - PAP
Tuakiri-waho-kiritaki
Ripa whakawhirinaki. I konei ka tohuhia to tatou rohe
Katoa. Ka taea te penapena, te haina me te toha ki nga taputapu
I muri i te rite o te kōtaha, me tango e koe ki to Mac me te whakauru. I te wa o te whakaurunga, me tohu koe i te usernmae_ldap me te kupuhipa_ldap o te kaiwhakamahi:
iOS
He rite te tukanga macOS. Me whakamahi koe i tētahi kōtaha (ka taea e koe te whakamahi i te kōtaha kotahi mō macOS(Tirohia i runga ake nei me pēhea te waihanga i tētahi kōtaha i roto i te Apple Configurator.)
Tikiake kōtaha, tāuta, tāuruhia ngā taipitopito tuakiri, hono:
Heoi ano. I whakaturia e matou he tūmau Radius, i tukutahia ki te FreeIPA, ka kii atu ki nga Ubiquiti AP ki te whakamahi i te WPA2-EAP.
Nga patai pea
V: me pehea te whakawhiti i tetahi korero / tiwhikete ki tetahi kaimahi?
WHAKAMAHI: Ka penapenahia e ahau nga tiwhikete/tohu katoa i runga i te FTP me te uru ma te ipurangi. I whakaarahia he whatunga manuhiri me te rohe tere me te uru ki te Ipurangi anake, haunga te ftp.
Ko te motuhēhēnga ka roa mo te 2 nga ra, ka mutu ka tautuhi ano ka waiho te kiritaki kaore he Ipurangi. Ko tera. Ina hiahia te kaimahi ki te hono atu ki te WiFi, ka hono tuatahi ia ki te whatunga manuhiri, ka uru atu ki te FTP, ka tango i te tiwhikete, i te whaarangi ranei e hiahiatia ana e ia, ka whakauruhia, katahi ka hono atu ki te whatunga umanga.
V: he aha e kore ai e whakamahi i te aronuinga me MSCHAPv2? He haumaru ake ia!
WHAKAMAHI: Tuatahi, he pai te mahi a tēnei kaupapa mō te NPS (Windows Ko tā mātou whakatinanatanga me whai whirihoranga tāpiri o te LDAP (FreeIpa) me te penapena i ngā tohu kupuhipa ki te tūmau. Kāore i te tūtohutia kia whirihoranga tāpirihia, nā te mea ka ara ake pea ngā raruraru tukutahitanga pūkete. Tuarua, ko te tohu he MD4, nō reira kāore e tino whakarei ake i te haumarutanga.
V: Ka taea te whakamana i nga taputapu ma te whakamahi i nga wahitau mac?
WHAKAMAHI: KAO, kare tenei i te haumaru, ka taea e te kaitukino te whakarereke i nga wahitau MAC, me te mea nui atu kaore i te tautokohia te whakamanatanga a nga wahitau MAC i runga i nga taputapu maha
V: hei aha enei tiwhikete katoa hei whakamahi? ka taea e koe te whakauru me te kore ratou?
WHAKAMAHI: Ka whakamahia nga tiwhikete hei whakamana i te tūmau. Ko era. ina hono ana, ka tirohia e te taputapu he tūmau ka taea te whakawhirinaki, kaore ranei. Ki te he, ka haere tonu te motuhēhēnga, ki te kore, kua katia te hononga. Ka taea e koe te hono me te kore tiwhikete, engari ki te whakatuhia e te kaitukino, e noho tata ana ranei he tūmau radius me tetahi waahi uru he rite te ingoa ki a matou i te kainga, ka taea e ia te haukoti i nga tohu a te kaiwhakamahi (kaua e wareware kei te tukuna i roto i nga tuhinga maamaa). A, ka whakamahia he tiwhikete, ka kite te hoariri i roto i ana rakau ko to tatou Ingoa Kaiwhakamahi tito noa - te manuhiri, te kaihoko ranei me te hapa momo - Tiwhikete CA Unknown
he iti ake anō mō macOSI te nuinga o te wā i runga i macOS Ka tāuta anō te pūnaha mā te ipurangi. I te aratau whakaora, me hono te Mac ki te WiFi, ā, kāore e mahi tā mātou WiFi kamupene, me te whatunga manuhiri rānei. Nāku ake i whakarite tētahi atu whatunga, he whatunga WPA2-PSK noa, he mea huna, mō ngā mahi hangarau anake. Tērā atu rānei, ka taea e koe te hanga i tētahi puku USB whakaara me te pūnaha kua tāutahia i mua. Heoi, ki te mea nō muri i te tau 2015 tō Mac, me kimi e koe he urutau mō tēnei puku USB.
Source: will.com
