Ko etahi tauira o te whakarite WiFi umanga kua oti te korero. I konei ka whakaahua ahau me pehea taku whakatinana i tetahi otinga rite me nga raru i pa ki a au i te wa e hono ana ki nga taputapu rereke. Ka whakamahia e matou te LDAP o naianei me nga kaiwhakamahi kua rehitatia, ka whakaara ake i a FreeRadius me te whirihora i te WPA2-Enterprise ki te kaiwhakahaere Ubnt. He ahua ngawari nga mea katoa. Kia kite tatou…
He iti mo nga tikanga EAP
I mua i te haere ki te mahi, me whakatau he aha te tikanga motuhēhēnga ka whakamahia e mātou i roto i tā mātou otinga.
Mai i Wikipedia:
Ko te EAP he anga motuhēhēnga e whakamahia ana i roto i nga whatunga ahokore me nga hononga tohu-ki-ira. I whakaahuatia tuatahitia te whakatakotoranga i RFC 3748 ka whakahoutia ki RFC 5247.
Ka whakamahia te EAP ki te kowhiri i te tikanga motuhēhēnga, te tuku kī, me te tukatuka i aua kī ki te mono-mai e kiia nei ko nga tikanga EAP. He maha nga tikanga EAP, kua tautuhia me te EAP ake ka tukuna e nga kaihoko takitahi. Ko te EAP e kore e tautuhi i te paparanga hono, ka tautuhi noa i te whakatakotoranga karere. Kei ia kawa e whakamahi ana i te EAP tana ake kawa whakamaarama karere EAP.
Ko nga tikanga ake:
- Ko LEAP he kawa rangatira i whakawhanakehia e CISCO. I kitea nga whakaraeraetanga. I tenei wa kaore i te tūtohutia mo te whakamahi
- He pai te tautoko a EAP-TLS i waenga i nga kaihoko ahokore. He kawa haumaru na te mea ko ia te kaiwhakakapi ki nga paerewa SSL. Ko te whakarite i te kiritaki he tino uaua. Me whai tiwhikete kiritaki hei taapiri i te kupuhipa. Ka tautokohia i runga i nga punaha maha
- EAP-TTLS - e tautokohia ana i runga i nga punaha maha, he pai te haumarutanga ma te whakamahi i nga tiwhikete PKI anake i runga i te tūmau motuhēhēnga.
- Ko te EAP-MD5 tetahi atu paerewa tuwhera. He iti rawa te haumarutanga. He whakaraerae, kaore e tautoko i te whakamotuhēhē tahi me te whakatipuranga matua
- EAP-IKEv2 - i runga i te Kawa Whakawhiti Kupu Ipurangi putanga 2. Ka whakarato i te motuhēhēnga tahi me te whakaturanga matua hui i waenga i te kiritaki me te tūmau
- Ko te PEAP he otinga tahi o CISCO, Microsoft me RSA Security hei paerewa tuwhera. Kei te waatea i roto i nga hua, e whakarato ana i te haumarutanga tino pai. He rite ki te EAP-TTLS, me whai tiwhikete anake i te taha tūmau
- PEAPv0/EAP-MSCHAPv2 - I muri i te EAP-TLS, koinei te paerewa tuarua e whakamahia nuitia ana i te ao. I whakamahia te hononga kiritaki-tūmau i roto i Microsoft, Cisco, Apple, Linux
- PEAPv1/EAP-GTC - I hangaia e Cisco hei rereke ki te PEAPv0/EAP-MSCHAPv2. Kaore e tiakina nga raraunga motuhēhēnga ahakoa he aha. Kaore i te tautokohia i runga i te OS Windows
- Ko te EAP-FAST he tikanga i hangaia e Cisco hei whakatika i nga hapa o LEAP. Ka whakamahi i te Tiwhikete Whakaaetanga Uru (PAC). Kore rawa i oti
O enei kanorau katoa, kaore ano kia pai te whiriwhiri. Ko te tikanga motuhēhēnga i hiahiatia: te haumarutanga pai, te tautoko i runga i nga taputapu katoa (Windows 10, macOS, Linux, Android, iOS) me te mea, ko te ngawari te pai ake. Na reira, i taka te whiringa ki runga i te EAP-TTLS i te taha o te kawa PAP.
Ka ara ake pea te patai - He aha te take e whakamahia ai te PAP? I muri i nga mea katoa, ka tukuna e ia nga kupuhipa i roto i nga tuhinga maamaa?
Ae ka tika. Ko nga korero i waenga i a FreeRadius me FreeIPA ka penei. I roto i te aratau patuiro, ka taea e koe te whai me pehea te tuku ingoa kaiwhakamahi me te kupuhipa. Ae, me tuku kia haere, ko koe anake te uru ki te tūmau FreeRadius.
Ka taea e koe te panui atu mo te mahi a EAP-TTLS
FreeRADIUS
Ko FreeRadius ka whakaarahia i runga i te CentOS 7.6. Kaore he mea uaua i konei, ka whakatauhia e matou ki nga tikanga o mua.
yum install freeradius freeradius-utils freeradius-ldap -yKo te Putanga 3.0.13 kua whakauruhia mai i nga kete. Ko te whakamutunga ka taea te tango
Whai muri i tenei, kei te mahi kee a FreeRadius. Ka taea e koe te whakakore i te raina i roto i /etc/raddb/users
steve Cleartext-Password := "testing"Whakarewa ki te tūmau i roto i te aratau patuiro
freeradius -XMe hanga he hononga whakamatautau mai i te localhost
radtest steve testing 127.0.0.1 1812 testing123He whakautu I whiwhi Uru-Whakaae Id 115 mai i 127.0.0.1:1812 ki 127.0.0.1:56081 roa 20, te tikanga he pai nga mea katoa. Haere i mua.
Ka hono tatou i te kōwae whakakahore.
ln -s /etc/raddb/mods-available/ldap /etc/raddb/mods-enabled/ldapA ka huri tonu tatou. Kei te hiahia matou FreeRadius kia uru atu ki te FreeIPA
mods-enabled/ldap
ldap {
server="ldap://ldap.server.com"
port=636
start_tls=yes
identity="uid=admin,cn=users,dc=server,dc=com"
password=**********
base_dn="cn=users,dc=server,dc=com"
set_auth_type=yes
...
user {
base_dn="${..base_dn}"
filter="(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
}
...Tīmataria anō te tūmau pūtoro ka taki i te tukutahitanga o ngā kaiwhakamahi LDAP:
radtest user_ldap password_ldap localhost 1812 testing123
Whakatika eap in mods-enabled/eap
I konei ka taapirihia e rua nga waahanga o te eap. Ka rereke noa nga tiwhikete me nga ki. Ka whakamarama ahau he aha i tika ai tenei i raro nei.
mods-enabled/eap
eap eap-client { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests}
tls-config tls-common {
private_key_file = ${certdir}/fisrt.key
certificate_file = ${certdir}/first.crt
dh_file = ${certdir}/dh
ca_path = ${cadir}
cipher_list = "HIGH"
cipher_server_preference = no
ecdh_curve = "prime256v1"
check_crl = no
}
ttls {
tls = tls-common
default_eap_type = md5
copy_request_to_tunnel = no
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
}
}
eap eap-guest {
default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests}
tls-config tls-common {
private_key_passwotd=blablabla
private_key_file = ${certdir}/server.key
certificate_file = ${certdir}/server.crt
dh_file = ${certdir}/dh
ca_path = ${cadir}
cipher_list = "HIGH"
cipher_server_preference = no
ecdh_curve = "prime256v1"
check_crl = no
}
ttls {
tls = tls-common
default_eap_type = md5
copy_request_to_tunnel = no
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
}
}Whakatikatika ano pae-whakahohea/ taunoa. Kei te pirangi ahau ki nga waahanga whakamana me te whakamotuhēhē.
pae-whakahohea/ taunoa
authorize {
filter_username
preprocess
if (&User-Name == "guest") {
eap-guest {
ok = return
}
}
elsif (&User-Name == "client") {
eap-client {
ok = return
}
}
else {
eap-guest {
ok = return
}
}
ldap
if ((ok || updated) && User-Password) {
update {
control:Auth-Type := ldap
}
}
expiration
logintime
pap
}
authenticate {
Auth-Type LDAP {
ldap
}
Auth-Type eap-guest {
eap-guest
}
Auth-Type eap-client {
eap-client
}
pap
}I roto i te waahanga whakamana ka tangohia e matou nga waahanga katoa kaore e hiahiatia. Ka waiho e matou ko ldap anake. Tāpirihia te manatoko kiritaki ma te ingoa kaiwhakamahi. Koinei te take i taapirihia e matou e rua nga waahanga o te eap i runga ake nei.
EAP mahaKo te meka ko te wa e hono ana etahi taputapu, ka whakamahia e matou nga tiwhikete punaha me te tohu i te rohe. He tiwhikete me tetahi taviri mai i tetahi mana tiwhikete pono. Ko ahau ake, ki taku whakaaro, he ngawari ake te mahi hononga penei i te maka i tetahi tiwhikete haina-whaiaro ki ia taputapu. Engari ahakoa karekau he tiwhikete i hainatia e ia ake, kare tonu i tutuki. Ko nga taputapu Samsung me te Android =< 6 nga putanga kaore e taea te whakamahi i nga tiwhikete punaha. Na reira, ka hangaia e matou he tauira motuhake o te manuhiri-eap mo ratou me nga tiwhikete haina-whaiaro. Mo etahi atu taputapu katoa, ka whakamahia e matou te kaihoko-eap me te tiwhikete pono. Ko te Ingoa-Kaiwhakamahi ka whakatauhia e te mara Anonymous ka hono te taputapu. E 3 noa nga uara ka whakaaetia: Manuhiri, Kiritaki me tetahi mara putua. Ko era atu mea katoa ka makahia. Ka whirihorahia i roto i nga kaitōrangapū. Ka hoatu e ahau he tauira i muri tata nei.
Me whakatika nga waahanga whakamana me te whakamotuhēhē i roto pae-whakahohea/roto-tunnel
pae-whakahohea/roto-tunnel
authorize {
filter_username
filter_inner_identity
update control {
&Proxy-To-Realm := LOCAL
}
ldap
if ((ok || updated) && User-Password) {
update {
control:Auth-Type := ldap
}
}
expiration
digest
logintime
pap
}
authenticate {
Auth-Type eap-guest {
eap-guest
}
Auth-Type eap-client {
eap-client
}
Auth-Type PAP {
pap
}
ldap
}I muri mai, me tohu koe i roto i nga kaupapa here ko nga ingoa ka taea te whakamahi mo te takiuru kore ingoa. Whakatikatika kaupapa here.d/filter.
Me kimi rarangi rite ki tenei:
if (&outer.request:User-Name !~ /^(anon|@)/) {
update request {
Module-Failure-Message = "User-Name is not anonymized"
}
reject
}A i raro i roto i te elsif taapirihia nga uara e hiahiatia ana:
elsif (&outer.request:User-Name !~ /^(guest|client|@)/) {
update request {
Module-Failure-Message = "User-Name is not anonymized"
}
reject
}Inaianei me neke tatou ki te whaiaronga kete. I konei me whakatakoto e koe te matua me te tiwhikete mai i tetahi mana tiwhikete pono, kei a matou kee me te whakaputa tiwhikete haina-whaiaro mo te eap-manuhiri.
Hurihia nga tawhā i te kōnae ca.cnf.
ca.cnf
...
default_days = 3650
default_md = sha256
...
input_password = blablabla
output_password = blablabla
...
countryName = RU
stateOrProvinceNmae = State
localityNmae = City
organizationName = NONAME
emailAddress = [email protected]
commonName = "CA FreeRadius"Ka tuhia e matou nga uara rite ki te konae server.cnf. Ka huri noa tatou
Ingoa noa:
server.cnf
...
default_days = 3650
default_md = sha256
...
input_password = blablabla
output_password = blablabla
...
countryName = RU
stateOrProvinceNmae = State
localityNmae = City
organizationName = NONAME
emailAddress = [email protected]
commonName = "Server Certificate FreeRadius"Waihanga:
makeKua reri. Kua riro server.crt и server.key kua rēhita kē mātou i runga ake nei i roto i te manuhiri-eap.
Ka mutu, me taapiri o tatou tohu uru ki te konae kaihoko.conf. Kei a au e 7. Kia kore ai e taapiri i ia waahi motuhake, ka tuhia noa e matou te whatunga kei roto i a raatau (kei roto aku waahi uru ki tetahi VLAN motuhake).
client APs {
ipaddr = 192.168.100.0/24
password = password_AP
}Ubiquiti kaiwhakahaere
Ka whakaarahia e matou he whatunga motuhake i runga i te kaiwhakahaere. Kia 192.168.2.0/24
Haere ki nga tautuhinga -> kōtaha. Me hanga he mea hou:
Ka tuhia e matou te wahitau me te tauranga o te radius server me te kupuhipa i tuhia ki te konae kiritaki.conf:
Waihangatia he ingoa whatunga ahokore hou. Tīpakohia te WPA-EAP (Hononga) hei tikanga motuhēhēnga ka whakapūtā te kōtaha pūtoro i hangaia:
Ka tiakina e matou nga mea katoa, tono ka haere tonu.
Te whakarite kiritaki
Me timata ma te tino uaua!
10 Windows
Ko te uaua ka heke ki te meka kaore ano a Windows e mohio ki te hono atu ki te WiFi umanga ma te rohe. No reira, me tuku a-ringa i to maatau tiwhikete ki te toa tiwhikete pono. I konei ka taea e koe te whakamahi i haina-whaiaro mai i te mana tohu. Ka whakamahia e ahau te tuarua.
Whai muri ka hiahia koe ki te hanga hononga hou. Ki te mahi i tenei, haere ki te whatunga me nga tautuhinga Ipurangi -> Whatunga me te Tiri Pokapū -> Waihanga me te whirihora i tetahi hononga hou, whatunga ranei:
Ka whakauruhia e matou te ingoa whatunga ka huri i te momo haumarutanga. Na ka paato huri i nga tautuhinga hononga a ki te ripa Haumarutanga, tohua te motuhēhēnga whatunga - EAP-TTLS.
Ka haere matou ki nga tawhā, ka tohu i te muna o te motuhēhēnga - kiritaki. Hei mana tiwhikete pono, tohua te tiwhikete i taapirihia e matou, tirohia te pouaka "Kaua e tukuna he powhiri ki te kaiwhakamahi mena kaore e taea te whakamana i te tūmau" ka kowhiria te tikanga motuhēhēnga - kupuhipa kore whakamuna (PAP).
I muri mai, haere ki nga tautuhinga matatau, hoatu he tohu ki runga "Whakaahua te aratau motuhēhēnga." Tīpakohia "Motuhēhēnga Kaiwhakamahi" ka paato i runga tiakina nga tohu. I konei ka hiahia koe ki te whakauru username_ldap me password_ldap
Ka tiakina e matou nga mea katoa, tono, kati. Ka taea e koe te hono atu ki tetahi whatunga hou.
Linux
I whakamatauria e ahau i runga i te Ubuntu 18.04, 18.10, Fedora 29, 30.
Tuatahi, me tango to tatou tiwhikete. Kaore au i kitea i roto i te Linux mena ka taea te whakamahi i nga tiwhikete punaha me te mea he toa pera ano.
Ka hono tatou ma te rohe. Na reira, me whai tiwhikete mai i te mana tohu i hokona mai ai to maatau tiwhikete.
Ko nga hononga katoa ka mahia ki te matapihi kotahi. Tīpakohia to maatau whatunga:
ingoamuna - kiritaki
rohe — te rohe i tukuna ai te tiwhikete
Android
kore-Samsung
Mai i te putanga 7, i te wa e hono ana i a WiFi, ka taea e koe te whakamahi i nga tiwhikete punaha ma te tohu i te rohe anake:
rohe — te rohe i tukuna ai te tiwhikete
ingoamuna - kiritaki
Samsung
Ka rite ki taku i tuhi i runga ake nei, kaore nga taputapu Samsung e mohio ki te whakamahi i nga tiwhikete punaha i te wa e hono ana ki te WiFi, kaore hoki he kaha ki te hono ma te rohe. Na reira, me taapiri koe i te tiwhikete pakiaka o te mana tiwhikete (ca.pem, ka mauhia e matou ki runga i te tūmau Radius). I konei ka whakamahia te haina-whaiaro.
Tangohia te tiwhikete ki to taputapu me te whakauru.
Te whakauru tiwhikete
I te wa ano, ka hiahia koe ki te tautuhi i te tauira iriti mata, te tohu titi, te kupuhipa ranei, mena kaore ano kia tautuhia:
I whakaatu ahau i tetahi putanga uaua o te whakauru i tetahi tiwhikete. I te nuinga o nga taputapu, paato noa i te tiwhikete kua tangohia.
Ina whakauruhia te tiwhikete, ka taea e koe te haere ki te hononga:
tiwhikete - tohuhia te mea i whakauruhia e koe
kaiwhakamahi ingoamuna - manuhiri
MacOS
Ka taea e nga taputapu Apple mai i te pouaka te hono noa ki te EAP-TLS, engari me maka tonu he tiwhikete ki a raatau. Hei tautuhi i tetahi tikanga hononga rereke, me whakamahi koe i te Apple Configurator 2. Na reira, me tango tuatahi koe ki to Mac, hanga he tohu hou me te taapiri i nga tautuhinga WiFi e tika ana.
Kaiwhakarato Apple
Whakauruhia to ingoa whatunga ki konei
Momo Haumarutanga - WPA2 Enterprise
Momo EAP kua whakaaetia - TTLS
Ingoa Kaiwhakamahi me te Kupuhipa - waiho kau
Motuhēhēnga o roto - PAP
Tuakiri-waho-kiritaki
Ripa whakawhirinaki. I konei ka tohuhia to tatou rohe
Katoa. Ka taea te penapena, te haina me te toha ki nga taputapu
I muri i te rite o te kōtaha, me tango e koe ki to Mac me te whakauru. I te wa o te whakaurunga, me tohu koe i te usernmae_ldap me te kupuhipa_ldap o te kaiwhakamahi:
iOS
He rite te tukanga ki te macOS. Me whakamahi koe i tetahi tohu (ka taea e koe te whakamahi i te mea ano mo te macOS. Me pehea te hanga i tetahi tohu ki Apple Configurator, tirohia i runga ake nei).
Tikiake kōtaha, tāuta, tāuruhia ngā taipitopito tuakiri, hono:
Heoi ano. I whakaturia e matou he tūmau Radius, i tukutahia ki te FreeIPA, ka kii atu ki nga Ubiquiti AP ki te whakamahi i te WPA2-EAP.
Nga patai pea
V: me pehea te whakawhiti i tetahi korero / tiwhikete ki tetahi kaimahi?
WHAKAMAHI: Ka penapenahia e ahau nga tiwhikete/tohu katoa i runga i te FTP me te uru ma te ipurangi. I whakaarahia he whatunga manuhiri me te rohe tere me te uru ki te Ipurangi anake, haunga te ftp.
Ko te motuhēhēnga ka roa mo te 2 nga ra, ka mutu ka tautuhi ano ka waiho te kiritaki kaore he Ipurangi. Ko tera. Ina hiahia te kaimahi ki te hono atu ki te WiFi, ka hono tuatahi ia ki te whatunga manuhiri, ka uru atu ki te FTP, ka tango i te tiwhikete, i te whaarangi ranei e hiahiatia ana e ia, ka whakauruhia, katahi ka hono atu ki te whatunga umanga.
V: he aha e kore ai e whakamahi i te aronuinga me MSCHAPv2? He haumaru ake ia!
WHAKAMAHI: Tuatahi, he pai te mahi o taua kaupapa i runga i te NPS (Windows Network Policy System), i roto i ta maatau whakatinanatanga he mea tika ki te whirihora ano i te LDAP (FreeIpa) me te penapena i nga tohu kupuhipa ki runga i te tūmau. Tāpiri. e kore e pai ki te hanga tautuhinga, no te mea. Ka taea e tenei te arahi ki nga raruraru rereke o te tukutahi i te ultrasound. Tuarua, ko te hash he MD4, no reira kaore e nui te haumarutanga.
V: Ka taea te whakamana i nga taputapu ma te whakamahi i nga wahitau mac?
WHAKAMAHI: KAO, kare tenei i te haumaru, ka taea e te kaitukino te whakarereke i nga wahitau MAC, me te mea nui atu kaore i te tautokohia te whakamanatanga a nga wahitau MAC i runga i nga taputapu maha
V: hei aha enei tiwhikete katoa hei whakamahi? ka taea e koe te whakauru me te kore ratou?
WHAKAMAHI: Ka whakamahia nga tiwhikete hei whakamana i te tūmau. Ko era. ina hono ana, ka tirohia e te taputapu he tūmau ka taea te whakawhirinaki, kaore ranei. Ki te he, ka haere tonu te motuhēhēnga, ki te kore, kua katia te hononga. Ka taea e koe te hono me te kore tiwhikete, engari ki te whakatuhia e te kaitukino, e noho tata ana ranei he tūmau radius me tetahi waahi uru he rite te ingoa ki a matou i te kainga, ka taea e ia te haukoti i nga tohu a te kaiwhakamahi (kaua e wareware kei te tukuna i roto i nga tuhinga maamaa). A, ka whakamahia he tiwhikete, ka kite te hoariri i roto i ana rakau ko to tatou Ingoa Kaiwhakamahi tito noa - te manuhiri, te kaihoko ranei me te hapa momo - Tiwhikete CA Unknown
he iti ake mo te macOSKo te tikanga, i runga i te macOS, ka mahia ano te punaha ma te Ipurangi. I roto i te aratau whakaora, me hono te Mac ki WiFi, a ka kore e mahi to tatou WiFi umanga me te whatunga manuhiri ki konei. Ko ahau ake, i whakaarahia e ahau tetahi atu whatunga, ko te WPA2-PSK o mua, he mea huna, mo nga mahi hangarau anake. Ka taea ranei e koe te hanga i tetahi puku kohiko USB bootable me te punaha i mua. Engari ki te mea kei muri to Mac i te tau 2015, me rapu ano koe i tetahi urutau mo tenei puku kohiko)
Source: will.com