{"id":37065,"date":"2019-10-31T22:15:33","date_gmt":"2019-10-31T19:15:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/wifi-enterprise-freeradius-freeipa-ubiquiti\/"},"modified":"2019-10-31T22:15:33","modified_gmt":"2019-10-31T19:15:33","slug":"wifi-enterprise-freeradius-freeipa-ubiquiti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","title":{"rendered":"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4c045a0710e5eb14b73359afad484c3d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAu fost deja descrise c\u00e2teva exemple de organizare a WiFi-ului corporativ. Aici voi detalia cum am realizat o astfel de solu\u021bie \u0219i problemele \u00eent\u00e2mpinate la conectarea pe diferite dispozitive. Vom folosi LDAP-ul existent cu utilizatorii \u00eenregistra\u021bi, vom configura FreeRadius \u0219i vom seta WPA2-Enterprise pe controllerul Ubnt. Pare simplu. S\u0103 vedem...<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Pu\u021bin despre metodele EAP<\/h2>\n<p>\n\u00cenainte de a \u00eencepe de la sarcin\u0103, trebuie s\u0103 ne stabilim metoda de autentificare pe care o vom folosi \u00een solu\u021bia noastr\u0103.<\/p>\n<p><b>Din Wikipedia:<\/b><\/p>\n<blockquote><p>EAP este un cadru de autentificare care este adesea folosit \u00een re\u021belele wireless \u0219i \u00een conexiunile punct-la-punct. Formatul a fost descris pentru prima dat\u0103 \u00een RFC 3748 \u0219i actualizat \u00een RFC 5247.<br \/>\nEAP este folosit pentru a selecta metoda de autentificare, pentru transferul cheilor \u0219i pentru procesarea acestor chei prin modulele conectabile numite metode EAP. Exist\u0103 multe metode EAP, at\u00e2t definite \u00eempreun\u0103 cu EAP-ul, c\u00e2t \u0219i emise de diferi\u021bi produc\u0103tori. EAP nu define\u0219te nivelul canalului, ci doar formatul mesajelor. Fiecare protocol care utilizeaz\u0103 EAP are propriul protocol de \u00eencapsulare a mesajelor EAP. <\/p><\/blockquote>\n<p>\n<b>Metodele \u00een sine:<\/b><\/p>\n<ul>\n<li>LEAP este un protocol proprietar, dezvoltat de CISCO. Au fost g\u0103site vulnerabilit\u0103\u021bi. Actualmente, nu se recomand\u0103 utilizarea lui. <\/li>\n<li> EAP-TLS este bine suportat de furnizorii de conexiuni wireless. Este un protocol sigur, \u00eentruc\u00e2t este succesorul standardelor SSL. Configurarea clientului este destul de complicat\u0103. Este necesar un certificat de client pe l\u00e2ng\u0103 parol\u0103. Este suportat \u00een multe sisteme. <\/li>\n<li> EAP-TTLS este larg suportat de multe sisteme, oferind o bun\u0103 securitate, utiliz\u00e2nd certificate PKI doar pe serverul de autentificare. <\/li>\n<li> EAP-MD5 este un alt standard deschis. Ofer\u0103 o securitate minim\u0103. Este vulnerabil, nu suport\u0103 autentificarea reciproc\u0103 \u0219i generarea cheilor. <\/li>\n<li> EAP-IKEv2 se bazeaz\u0103 pe Internet Key Exchange Protocol versiunea 2. Ofer\u0103 autentificare reciproc\u0103 \u0219i stabilirea unei chei de sesiune \u00eentre client \u0219i server. <\/li>\n<li> PEAP este o solu\u021bie comun\u0103 dezvoltat\u0103 de CISCO, Microsoft \u0219i RSA Security ca standard deschis. Este accesibil pe scar\u0103 larg\u0103 \u00een produse \u0219i ofer\u0103 o securitate foarte bun\u0103. Este similar cu EAP-TTLS, necesit\u00e2nd doar un certificat pe partea serverului. <\/li>\n<li> PEAPv0\/EAP-MSCHAPv2 \u2014 dup\u0103 EAP-TLS, acesta este al doilea standard utilizat pe scar\u0103 larg\u0103 \u00een lume. Se folose\u0219te rela\u021bia client-server \u00een Microsoft, Cisco, Apple, Linux <\/li>\n<li> PEAPv1\/EAP-GTC \u2014 creat de Cisco ca alternativ\u0103 la PEAPv0\/EAP-MSCHAPv2. Nu protejeaz\u0103 datele de autentificare \u00een niciun caz. Nu sunt suportate \u00een Windows OS <\/li>\n<li> EAP-FAST \u2014 metod\u0103 dezvoltat\u0103 de Cisco pentru a corecta deficien\u021bele LEAP. Utilizeaz\u0103 Credentiala de Acces Protejat\u0103 (PAC). Nu este complet dezvoltat\u0103 <\/li>\n<\/ul>\n<p>\nDin toat\u0103 aceast\u0103 diversitate, alegerea nu este totu\u0219i foarte mare. De la metoda de autentificare se cerea: securitate bun\u0103, suport pe toate dispozitivele (Windows 10, macOS, Linux, Android, iOS) \u0219i, de fapt, cu c\u00e2t mai simplu, cu at\u00e2t mai bine. A\u0219adar, alegerea a fost EAP-TTLS \u00een combina\u021bie cu protocolul PAP. <br \/>\nPoate ap\u0103rea \u00eentrebarea \u2014 De ce s\u0103 folose\u0219ti PAP? deoarece transmite parolele \u00een clar? <\/p>\n<p>Da, este corect. Comunicarea \u00eentre FreeRadius \u0219i FreeIPA va avea loc exact a\u0219a. \u00cen modul de depanare po\u021bi urm\u0103ri cum sunt trimise username \u0219i password. \u0218i s\u0103 fie trimise, doar c\u0103 tu ai acces la serverul FreeRadius.<\/p>\n<p>Mai multe despre func\u021bionarea EAP-TTLS po\u021bi citi <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.bmstu.wiki\/EAP-TTLS_(Tunneled_Transport_Layer_Security)\">aici<br \/>\n<\/a><\/noindex><\/p>\n<h2>FreeRADIUS<\/h2>\n<p>\nVom instala FreeRadius pe CentOS 7.6. Aici nu este nimic complicat, \u00eel instal\u0103m \u00een mod obi\u0219nuit.<\/p>\n<pre><code class=\"bash\">yum install freeradius freeradius-utils freeradius-ldap -y<\/code><\/pre>\n<p>\n<i>Din pachete se instaleaz\u0103 versiunea 3.0.13. Ultima poate fi g\u0103sit\u0103 pe <noindex><a rel=\"nofollow\" href=\"https:\/\/freeradius.org\/\">https:\/\/freeradius.org\/<\/a><\/noindex><\/i><\/p>\n<p>Dup\u0103 aceasta, FreeRadius este deja func\u021bional. Po\u021bi decommenta linia \u00een \/etc\/raddb\/users<\/p>\n<pre><code class=\"bash\">steve   Cleartext-Password := \"testing\"<\/code><\/pre>\n<p>\nPorne\u0219te serverul \u00een modul de depanare<\/p>\n<pre><code class=\"bash\">freeradius -X<\/code><\/pre>\n<p>\n\u0218i facem o conexiune de testare de pe localhost<\/p>\n<pre><code class=\"bash\">radtest steve testing 127.0.0.1 1812 testing123<\/code><\/pre>\n<p>\nAm primit r\u0103spunsul <i>Received Access-Accept Id 115 from 127.0.0.1:1812 to 127.0.0.1:56081 length 20<\/i>, deci totul este \u00een regul\u0103. Continu\u0103m.<\/p>\n<p>Conect\u0103m modulul <i><b>ldap<\/b><\/i>.<\/p>\n<pre><code class=\"bash\">ln -s \/etc\/raddb\/mods-available\/ldap \/etc\/raddb\/mods-enabled\/ldap<\/code><\/pre>\n<p>\n\u0218i imediat \u00eel modific\u0103m. Trebuie s\u0103 facem astfel \u00eenc\u00e2t FreeRadius s\u0103 poat\u0103 accesa FreeIPA<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/ldap<\/b><\/p>\n<pre><code class=\"bash\">ldap {\nserver=\"ldap:\/\/ldap.server.com\"\nport=636\nstart_tls=yes\nidentity=\"uid=admin,cn=users,dc=server,dc=com\"\npassword=**********\nbase_dn=\"cn=users,dc=server,dc=com\"\nset_auth_type=yes\n...\nuser {\nbase_dn=\"${..base_dn}\"\nfilter=\"(uid=%{%{Stripped-User-Name}:-%{User-Name}})\"\n}\n...<\/code><\/pre>\n<p>Repornim serverul radius \u0219i verific\u0103m sincronizarea utilizatorilor LDAP:<\/p>\n<pre><code class=\"bash\">radtest user_ldap password_ldap localhost 1812 testing123<\/code><\/pre>\n<p>\nEdit\u0103m eap \u00een <i><b>mods-enabled\/eap<\/b><\/i><br \/>\nAici vom ad\u0103uga dou\u0103 instan\u021be eap. Acestea vor diferi doar prin certificate \u0219i chei. Mai jos voi explica de ce exact a\u0219a<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/eap<\/b><\/p>\n<pre><code class=\"bash\">eap eap-client {                                                                                                                                                                                                                           default_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_file = ${certdir}\/fisrt.key\n           certificate_file = ${certdir}\/first.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}\neap eap-guest {\ndefault_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_passwotd=blablabla\n           private_key_file = ${certdir}\/server.key\n           certificate_file = ${certdir}\/server.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}<\/code><\/pre>\n<p>Apoi edit\u0103m <i><b>site-enabled\/default<\/b><\/i>. Ne intereseaz\u0103 sectoarele authorize \u0219i authenticate.<\/p>\n<p><b class=\"spoiler_title\">site-enabled\/default<\/b><\/p>\n<pre><code class=\"bash\">autentificare {\n  filtrare_nume_utilizator\n  preprocessare\n  dac\u0103 (&amp;User-Name == \"guest\") {\n   eap-guest {\n       ok = return\n   }\n  }\n  alt dac\u0103 (&amp;User-Name == \"client\") {\n    eap-client {\n       ok = return \n    }\n  }\n  alt {\n    eap-guest {\n       ok = return\n    }\n  }\n  ldap\n  dac\u0103 ((ok || actualizat) &amp;&amp; User-Password) {\n    actualizare {\n        control:Auth-Type := ldap\n    }\n  }\n  expirare\n  timp_logare\n  pap\n  }\n\nautentificare {\n  Auth-Type LDAP {\n    ldap\n  }\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  pap\n}<\/code><\/pre>\n<p>\u00cen sec\u021biunea authorize elimin\u0103m toate modulele de care nu avem nevoie. L\u0103s\u0103m doar ldap. Ad\u0103ug\u0103m o verificare a clientului pe baza numelui de utilizator. Exact pentru aceasta am ad\u0103ugat anterior dou\u0103 instan\u021be de eap.<\/p>\n<p><b class=\"spoiler_title\">Multi EAP<\/b>Problema este c\u0103, conect\u00e2nd anumite dispozitive, vom folosi certificatele de sistem \u0219i vom indica domeniul. Avem un certificat \u0219i o cheie de la un centru de certificare de \u00eencredere. Personal, cred c\u0103 aceast\u0103 procedur\u0103 de conectare este mai simpl\u0103 dec\u00e2t s\u0103 trimitem pe fiecare dispozitiv un certificat auto-semnat. Dar nu am reu\u0219it s\u0103 sc\u0103p\u0103m de certificatele auto-semante. Dispozitivele Samsung \u0219i Android &lt; 6 versiuni nu \u0219tiu s\u0103 foloseasc\u0103 certificatele de sistem. De aceea, cre\u0103m o instan\u021b\u0103 separat\u0103 de eap-guest cu certificate auto-semante pentru acestea. Pentru toate celelalte dispozitive, vom folosi eap-client cu certificat de \u00eencredere. User-Name este determinat \u00een func\u021bie de c\u00e2mpul Anonymous la conectarea dispozitivului. Se permit doar 3 valori: Guest, Client \u0219i c\u00e2mpul gol. Restul sunt respinse. Acest lucru se configureaz\u0103 \u00een politici. Voi oferi un exemplu mai t\u00e2rziu.<\/p>\n<p>Vom edita sec\u021biunile authorize \u0219i authenticate \u00een <i><b>site-enabled\/inner-tunnel<\/b><\/i><\/p>\n<p><b class=\"spoiler_title\">site-enabled\/inner-tunnel<\/b><\/p>\n<pre><code class=\"bash\">autentificare {\n  filtrare_nume_utilizator\n  filtrare_identitate_intern\u0103\n  actualizare control {\n   &amp;Proxy-To-Realm := LOCAL\n  }\n  ldap\n  dac\u0103 ((ok || actualizat) &amp;&amp; User-Password) {\n    actualizare {\n        control:Auth-Type := ldap\n    }\n  }\n  expirare\n  digest\n  timp_logare\n  pap\n  }\n\nautentificare {\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  Auth-Type PAP {\n    pap\n  }\n  ldap\n}<\/code><\/pre>\n<p>Apoi trebuie s\u0103 specific\u0103m \u00een politici ce nume pot fi folosite pentru conectarea anonim\u0103. Edit\u0103m <b><i>policy.d\/filter<\/i><\/b>.<\/p>\n<p>Trebuie s\u0103 g\u0103sim linii care arat\u0103 a\u0219a:<\/p>\n<pre><code class=\"bash\">dac\u0103 (&amp;outer.request:User-Name !~ \/^(anon|@)\/) {\n  actualizare cerere {\n    Modul-Mesaj-E\u0219ec = \"User-Name nu este anonimizat\"\n  }\n  respinge\n}<\/code><\/pre>\n<p>\n\u0218i mai jos, \u00een elsif, ad\u0103ug\u0103m valorile necesare:<\/p>\n<pre><code class=\"bash\">alt dac\u0103 (&amp;outer.request:User-Name !~ \/^(guest|client|@)\/) {\n  actualizare cerere {\n    Modul-Mesaj-E\u0219ec = \"User-Name nu este anonimizat\"\n  }\n  respinge\n}<\/code><\/pre>\n<p>\nAcum trebuie s\u0103 ne mut\u0103m \u00een directorul <b><i>certs<\/i><\/b>. Aici trebuie s\u0103 plas\u0103m cheia \u0219i certificatul de la centrul de certificare de \u00eencredere pe care \u00eel avem \u0219i s\u0103 gener\u0103m certificate auto-semante pentru eap-guest.<\/p>\n<p>Modific\u0103m parametrii \u00een fi\u0219ierul <b><i>ca.cnf<\/i><\/b>.<\/p>\n<p><b class=\"spoiler_title\">ca.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\\nnum\u0103rul_zilelor_imediat = 3650\\nmd_default = sha256\\n...\\nintrare_parol\u0103 = blablabla\\noutparol\u0103 = blablabla\\n...\\nnume\u021aar\u0103 = RU\\nnumeStatProvinci\u0103 = Stat\\nnumeLocalitate = Ora\u0219\\nnumeOrganiza\u021bie = NONAME\\nemailAdres\u0103 = admin@admin.ru\\nnumeComun = \"CA FreeRadius\"<\/code><\/pre>\n<p>Asemenea valori le introducem \u00een fi\u0219ierul <b><i><i>server.cnf<\/i><\/i><\/b>. Modific\u0103m doar <br \/>\n<b>commonName<\/b>:<\/p>\n<p><b class=\"spoiler_title\">server.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\\nnum\u0103rul_zilelor_imediat = 3650\\nmd_default = sha256\\n...\\nintrare_parol\u0103 = blablabla\\noutparol\u0103 = blablabla\\n...\\nnume\u021aar\u0103 = RU\\nnumeStatProvinci\u0103 = Stat\\nnumeLocalitate = Ora\u0219\\nnumeOrganiza\u021bie = NONAME\\nemailAdres\u0103 = admin@admin.ru\\nnumeComun = \"Server Certificate FreeRadius\"<\/code><\/pre>\n<p>Cre\u0103m:<\/p>\n<pre><code class=\"bash\">make<\/code><\/pre>\n<p>\nGata. Am ob\u021binut <b><i>server.crt<\/i><\/b> \u0219i <b><i>server.key<\/i><\/b> pe care le-am men\u021bionat deja mai sus \u00een eap-guest.<\/p>\n<p>\u0218i \u00een final, s\u0103 ad\u0103ug\u0103m punctele noastre de acces \u00een fi\u0219ierul <b><i>client.conf<\/i><\/b>. Am 7. Pentru a nu ad\u0103uga fiecare punct individual, vom scrie doar re\u021beaua \u00een care se afl\u0103 (punctele mele de acces sunt \u00eentr-un VLAN separat).<\/p>\n<pre><code class=\"bash\">client APs {\nipaddr = 192.168.100.0\/24\npassword = password_AP\n}<\/code><\/pre>\n<p><\/p>\n<h2>Controller Ubiquiti<\/h2>\n<p>\nPe controller, cre\u0103m o re\u021bea separat\u0103. S\u0103 fie 192.168.2.0\/24<br \/>\nMergem la set\u0103ri -&gt; profil. Cre\u0103m unul nou:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/57d97f7ef2db1a62633aa16131435065.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIntroducem adresa \u0219i portul serverului radius \u0219i parola pe care am scris-o \u00een fi\u0219ierul <b><i>clients.conf<\/i><\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/edab8e5ef03897c88bb45b2912e577ec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCre\u0103m un nou nume pentru re\u021beaua wireless. Ca metod\u0103 de autentificare, alegem WPA-EAP (Enterprise) \u0219i indic\u0103m profilul radius creat:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9dc918b734cac3d7382db796feb6b7a2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSalv\u0103m tot, aplic\u0103m \u0219i mergem mai departe.<\/p>\n<h2>Configurarea clien\u021bilor<\/h2>\n<p>\nS\u0103 \u00eencepem cu cea mai complicat\u0103 parte!<\/p>\n<h3>Windows 10<\/h3>\n<p>\nComplica\u021bia provine din faptul c\u0103 Windows \u00eenc\u0103 nu poate s\u0103 se conecteze la WiFi-ul corporativ prin domeniu. Prin urmare, trebuie s\u0103 aducem manual certificatul nostru \u00een magazinul de certificare de \u00eencredere. Se poate folosi at\u00e2t un certificat auto-semnat, c\u00e2t \u0219i de la o autoritate de certificare. Eu voi folosi cel de-al doilea. <\/p>\n<p>Apoi, trebuie s\u0103 cre\u0103m o nou\u0103 conexiune. Pentru aceasta mergem la set\u0103rile re\u021belei \u0219i Internet -&gt; Centrul de control al re\u021belelor \u0219i partaj\u0103rii -&gt; Crearea \u0219i configurarea unei noi conexiuni sau re\u021bele:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/406e515cff889ea70e226116f1dc0521.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f88e592920e43d42cc7fed34423f09ea.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1d7c045e02eb8e3b14016aacfa00da4c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIntroducem manual numele re\u021belei \u0219i schimb\u0103m tipul de securitate. Apoi facem clic pe <i>modific\u0103 set\u0103rile de conexiune<\/i> \u0219i \u00een tab-ul Securitate alegem autentificarea re\u021belei \u2014 EAP-TTLS.<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/7e736b4cffd6dca5fdd9df70cedd7988.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/6c328ff8b4a434ed488c46b594aa5108.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d4a3d2883088a06592addae770a12a16.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIntr\u0103m \u00een set\u0103ri, introducem confiden\u021bialitatea autentific\u0103rii \u2014 <b>client<\/b>. Ca certificat de autoritate de certificare de \u00eencredere, alegem certificatul pe care l-am ad\u0103ugat, bif\u0103m op\u021biunea \u201eNu solicita utilizatorului o invita\u021bie dac\u0103 nu se poate autoriza serverul\u201d \u0219i metoda de autentificare aleas\u0103 este \u2014 parola necriptat\u0103 (PAP).<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb4897493f805f0d8869c22a1b706dec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nApoi, mergem la op\u021biunile suplimentare, bif\u0103m \u201eSpecifica\u021bi modul de autentificare\u201d. Select\u0103m \u201eAutentificarea utilizatorului\u201d \u0219i ap\u0103s\u0103m pe <i>salveaz\u0103 acreditivele<\/i>. Aici va trebui s\u0103 introducem username_ldap \u0219i password_ldap<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/469bb4337e4e601a80de1021a48bc101.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/999dc6c41a69b22c8de2b49398c9a613.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/75347f2f7140cac58a181a325ab0f3ad.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTotul se salveaz\u0103, aplic\u0103m, \u00eenchidem. Putem s\u0103 ne conect\u0103m la noua re\u021bea.<\/p>\n<h3>Linux<\/h3>\n<p>\nAm verificat pe Ubuntu 18.04, 18.10, Fedora 29, 30.<\/p>\n<p>Mai \u00eent\u00e2i, desc\u0103rc\u0103m certificatul. Nu am g\u0103sit \u00een Linux dac\u0103 exist\u0103 posibilitatea de a folosi certificatele sistemului \u0219i dac\u0103 exist\u0103 \u00een general un astfel de depozit. <\/p>\n<p>Ne vom conecta pe domeniu. Prin urmare, este necesar un certificat de la autoritatea de certificare care a emis certificatul nostru.<\/p>\n<p>\u00centreaga conexiune se realizeaz\u0103 \u00eentr-o singur\u0103 fereastr\u0103. Alegem re\u021beaua noastr\u0103:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e05f44a52ee7290921b5b74df718a0c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>anonymous \u2014 client<br \/>\ndomain \u2014 domeniul pentru care a fost emis certificatul<br \/>\n<\/i><\/p>\n<h3>Android<\/h3>\n<p><\/p>\n<h4>non-Samsung<\/h4>\n<p>\nDin versiunea 7, la conectarea WiFi se pot folosi certificatele sistemului, specific\u00e2nd doar domeniul:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f935493cbe35f5a19c4da8bb5632604f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>domain \u2014 domeniul pentru care a fost emis certificatul<br \/>\nanonymous \u2014 client<br \/>\n<\/i><\/p>\n<h4>Samsung<\/h4>\n<p>\nA\u0219a cum am men\u021bionat mai sus, dispozitivele Samsung nu pot folosi certificatele sistemului la conectarea WiFi \u0219i nu au op\u021biunea de a se conecta pe domeniu. Prin urmare, este necesar s\u0103 ad\u0103ug\u0103m manual certificatul r\u0103d\u0103cin\u0103 al autorit\u0103\u021bii de certificare (ca.pem, ob\u021binut de pe serverul Radius). Aici se va folosi un certificat auto-semnat.<\/p>\n<p>Desc\u0103rc\u0103m certificatul pe dispozitivul nostru \u0219i \u00eel instal\u0103m.<\/p>\n<p><b class=\"spoiler_title\">Instalarea certificatului<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d02770f35c44a618f2f6243085c258b8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb9ec984d5e68824ebd0b138551a87c2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/2c5c95c339b00085845470fdff56932e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1561758abad60a168e067f1ecb0b94f5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00cen acest proces, va fi necesar s\u0103 set\u0103m o imagine de deblocare a ecranului, un cod PIN sau o parol\u0103, dac\u0103 nu a fost deja setat\u0103:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eeb9189ecdb8c255f2b76918ec1954b5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/741c2f6df3e50c5ebb94c76e907efb33.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Am ilustrat varianta complex\u0103 de instalare a certificatului. Pe majoritatea dispozitivelor, este suficient s\u0103 ap\u0103sa\u021bi pe certificatul desc\u0103rcat.<\/i><\/p>\n<p>C\u00e2nd certificatul este instalat, putem trece la conectare:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4e2a8716b30634b3effdb0f2cbf781af.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>certificatul \u2014 specific\u0103m cel pe care l-am instalat<br \/>\nutilizator anonim \u2014 guest<br \/>\n<\/i><\/p>\n<h3>macOS<\/h3>\n<p>\nDispozitivele Apple din fabric\u0103 se pot conecta doar la EAP-TLS, dar trebuie totu\u0219i s\u0103 le \u00eenc\u0103rc\u0103m certificatul. Pentru a specifica o alt\u0103 metod\u0103 de conectare, trebuie s\u0103 folosim Apple Configurator 2. Prin urmare, trebuie s\u0103-l desc\u0103rc\u0103m mai \u00eent\u00e2i pe Mac, s\u0103 cre\u0103m un nou profil \u0219i s\u0103 ad\u0103ug\u0103m toate set\u0103rile necesare WiFi.<\/p>\n<p><b class=\"spoiler_title\">Apple Configurator<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1864dedc371b851dbf2594eff3ec7fc7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0847466b361f681bcfcabee92f1ac885.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Aici specific\u0103m numele re\u021belei noastre<br \/>\nTip de securitate \u2014 WPA2 Enterprise<br \/>\nTipuri EAP acceptate \u2014 TTLS<br \/>\nNume utilizator \u0219i Parol\u0103 \u2014 l\u0103s\u0103m goale<br \/>\nAutentificare intern\u0103 \u2014 PAP<br \/>\nIdentitate extern\u0103 \u2014 client <br \/>\n<\/i><\/p>\n<p><i>Tab-ul \u00cencredere. Aici specific\u0103m domeniul nostru<\/i><\/p>\n<p>Totul. Profilul poate fi salvat, semnat \u0219i distribuit pe dispozitive<\/p>\n<p>Dup\u0103 ce profilul este gata, trebuie s\u0103-l desc\u0103rca\u021bi pe Mac \u0219i s\u0103-l instala\u021bi. \u00cen timpul instal\u0103rii, va trebui s\u0103 introduce\u021bi username_ldap \u0219i password_ldap utilizatorului:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d7cb1cbcfd1de930d0718c1596bc60d7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/dd2e90a77fd9b64f6a98b0c0b21a080c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/c1cb62ec60fc835353c5e409a138f0be.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>iOS<\/h3>\n<p>\nProcesul este similar cu cel de pe macOS. Trebuie s\u0103 folosi\u021bi profilul (poate fi exact acela\u0219i ca pe macOS. Cum se creeaz\u0103 un profil \u00een Apple Configurator, consulta\u021bi mai sus).<\/p>\n<p>Desc\u0103rc\u0103m profilul, instal\u0103m, introducem datele de autentificare, ne conect\u0103m:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e2be411c0dfb427bfd54ad0b1f42dcb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d637fa93c0bcf09d1a5eb3701f769d4f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0908737918cd81cbf3e1ebf9ba0d9820.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/3821dc0bd6f866730575c6ceb3d5bbfb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/b4b0bf189ac037345e33e7864bfb2ad8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f5f9b7168ac14b67d6f4753d050a742e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAsta e tot. Am configurat serverul Radius, l-am sincronizat cu FreeIPA \u0219i am indicat punctelor de acces Ubiquiti s\u0103 foloseasc\u0103 WPA2-EAP.<\/p>\n<h2>Posibile \u00eentreb\u0103ri<\/h2>\n<p>\n<b>M:<\/b> cum se transmite profilul\/certificatul angajatului?<\/p>\n<p><b>R:<\/b> Toate certificatul\/profilii le p\u0103strez pe FTP cu acces prin web. Am ridicat o re\u021bea gazd\u0103 cu limitare la vitez\u0103 \u0219i acces doar la internet, cu excep\u021bia FTP-ului. <br \/>\nAutentificarea se men\u021bine timp de 2 zile, dup\u0103 care se reseteaz\u0103 \u0219i clientul r\u0103m\u00e2ne f\u0103r\u0103 internet. Astfel, c\u00e2nd angajatul dore\u0219te s\u0103 se conecteze la WiFi, mai \u00eent\u00e2i se conecteaz\u0103 la re\u021beaua gazd\u0103, acceseaz\u0103 FTP-ul, descarc\u0103 certificatul sau profilul de care are nevoie, le instaleaz\u0103 \u0219i apoi se poate conecta la re\u021beaua corporativ\u0103.<\/p>\n<p><b>M:<\/b> de ce s\u0103 nu folosim schema cu MSCHAPv2? nu este mai sigur\u0103?<\/p>\n<p><b>R:<\/b> \u00een primul r\u00e2nd, aceast\u0103 schem\u0103 func\u021bioneaz\u0103 bine pe NPS (Windows Network Policy System), \u00een implementarea noastr\u0103 este necesar\u0103 configurarea suplimentar\u0103 a LDAP (FreeIPA) \u0219i stocarea hash-urilor parolelor pe server. Configur\u0103rile suplimentare sunt de evitat, deoarece pot duce la diverse probleme de sincronizare a utilizatorilor. \u00cen al doilea r\u00e2nd, hash-ul este de tip MD4, a\u0219a c\u0103 nu m\u0103re\u0219te semnificativ securitatea.<\/p>\n<p><b>M:<\/b> se pot autoriza dispozitivele dup\u0103 adresele MAC?<\/p>\n<p><b>R:<\/b> NU, nu este sigur, un atacator poate falsifica adresele MAC, \u0219i \u00een plus, autorizarea pe baza adreselor MAC nu este acceptat\u0103 pe multe dispozitive. <\/p>\n<p><b>M:<\/b> de ce s\u0103 folosim toate aceste certificate? nu putem s\u0103 ne conect\u0103m \u0219i f\u0103r\u0103 ele?<\/p>\n<p><b>R:<\/b> Certificatul este utilizat pentru a autoriza serverul. Adic\u0103, c\u00e2nd un dispozitiv se conecteaz\u0103, verific\u0103 dac\u0103 acesta este serverul de \u00eencredere sau nu. Dac\u0103 este, autentificarea continu\u0103; dac\u0103 nu, conexiunea se \u00eenchide. Este posibil s\u0103 te conectezi f\u0103r\u0103 certificatul, dar dac\u0103 un atacator sau un vecin \u00ee\u0219i configureaz\u0103 un server RADIUS \u0219i un punct de acces cu acela\u0219i nume ca al nostru, va putea intercepta cu u\u0219urin\u021b\u0103 acreditivele utilizatorului (s\u0103 nu uit\u0103m c\u0103 acestea sunt transmise \u00een mod deschis). C\u00e2nd se utilizeaz\u0103 certificatul, inamicul va vedea \u00een logurile sale doar numele de utilizator fictiv - guest sau client \u0219i o eroare de tip - Certificat CA necunoscut.<\/p>\n<p><b class=\"spoiler_title\">\u00eenc\u0103 pu\u021bin despre macOS<\/b>De obicei, pe macOS, reinstalarea sistemului se face prin internet. \u00cen modul de recuperare, Macul trebuie s\u0103 fie conectat la WiFi, iar re\u021beaua noastr\u0103 corporativ\u0103 sau re\u021beaua de oaspe\u021bi nu va func\u021biona. Personal, am creat o alt\u0103 re\u021bea, obisnuit\u0103 pe WPA2-PSK, ascuns\u0103, doar pentru opera\u021biuni tehnice. De asemenea, se poate crea din timp un stick USB bootabil cu sistemul. Dar, dac\u0103 Macul este din 2015 sau mai recent, va trebui s\u0103 g\u0103se\u0219ti un adaptor pentru acest stick).<\/p>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/463225\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0423\u0436\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e WiFi. \u0417\u0434\u0435\u0441\u044c \u044f \u0440\u0430\u0441\u043f\u0438\u0448\u0443 \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0411\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0439\u0441\u044f LDAP \u0441 \u0437\u0430\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u043f\u043e\u0434\u043d\u0438\u043c\u0435\u043c FreeRadius \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043c WPA2-Enterprise \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 Ubnt. \u0412\u0440\u043e\u0434\u0435 \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c\u2026 \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 EAP \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u0442\u044c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27785,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37065","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:33+00:00","article:modified_time":"2019-10-31T19:15:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37065","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:36:42","updated":"2026-01-22 05:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=37065"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37065\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/27785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=37065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=37065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=37065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}