{"id":37065,"date":"2019-10-31T22:15:33","date_gmt":"2019-10-31T19:15:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/wifi-enterprise-freeradius-freeipa-ubiquiti\/"},"modified":"2019-10-31T22:15:33","modified_gmt":"2019-10-31T19:15:33","slug":"wifi-enterprise-freeradius-freeipa-ubiquiti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","title":{"rendered":"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4c045a0710e5eb14b73359afad484c3d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBoli u\u017e op\u00edsan\u00e9 niektor\u00e9 pr\u00edklady organiz\u00e1cie firemn\u00e9ho WiFi. Tu pop\u00ed\u0161em, ako som implementoval podobn\u00e9 rie\u0161enie a probl\u00e9my, s ktor\u00fdmi som sa stretol pri pripojen\u00ed na r\u00f4znych zariadeniach. Budeme pou\u017e\u00edva\u0165 existuj\u00faci LDAP so zaregistrovan\u00fdmi pou\u017e\u00edvate\u013emi, spust\u00edme FreeRadius a nastav\u00edme WPA2-Enterprise na kontrol\u00e9ri Ubnt. Zd\u00e1 sa, \u017ee to je jednoduch\u00e9. Po\u010fme sa pozrie\u0165\u2026<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Trochu o met\u00f3dach EAP<\/h2>\n<p>\nPredt\u00fdm, ne\u017e za\u010dneme plni\u0165 \u00falohu, mus\u00edme si uvedomi\u0165, ak\u00fa met\u00f3du autentifik\u00e1cie budeme pou\u017e\u00edva\u0165 v na\u0161om rie\u0161en\u00ed.<\/p>\n<p><b>Z Wikip\u00e9die:<\/b><\/p>\n<blockquote><p>EAP \u2014 r\u00e1mec autentifik\u00e1cie, ktor\u00fd sa \u010dasto pou\u017e\u00edva v bezdr\u00f4tov\u00fdch sie\u0165ach a spojeniach bod-bod. Form\u00e1t bol prv\u00fdkr\u00e1t op\u00edsan\u00fd v RFC 3748 a aktualizovan\u00fd v RFC 5247.<br \/>\nEAP sa pou\u017e\u00edva na v\u00fdber met\u00f3dy autentifik\u00e1cie, prenos k\u013e\u00fa\u010dov a spracovanie t\u00fdchto k\u013e\u00fa\u010dov pripojen\u00fdmi modulmi naz\u00fdvan\u00fdmi met\u00f3dy EAP. Existuje mnoho met\u00f3d EAP, ako s\u00fa definovan\u00e9 spolu s EAP samotn\u00fdm, tak aj vydan\u00e9 jednotliv\u00fdmi v\u00fdrobcami. EAP nedefinuje kan\u00e1lov\u00fa vrstvu, iba definuje form\u00e1t spr\u00e1v. Ka\u017ed\u00fd protokol, ktor\u00fd pou\u017e\u00edva EAP, m\u00e1 svoj vlastn\u00fd protokol enkapsul\u00e1cie spr\u00e1v EAP. <\/p><\/blockquote>\n<p>\n<b>Samotn\u00e9 met\u00f3dy:<\/b><\/p>\n<ul>\n<li>LEAP \u2014 propriet\u00e1rny protokol, vyvinut\u00fd spolo\u010dnos\u0165ou CISCO. Boli n\u00e1jden\u00e9 zranite\u013enosti. V s\u00fa\u010dasnosti sa neodpor\u00fa\u010da pou\u017e\u00edva\u0165. <\/li>\n<li> EAP-TLS \u2014 dobre podporovan\u00fd medzi dod\u00e1vate\u013emi bezdr\u00f4tov\u00fdch spojen\u00ed. Je to bezpe\u010dn\u00fd protokol, ke\u010f\u017ee je n\u00e1stupcom SSL \u0161tandardov. Nastavenie klienta je dos\u0165 zlo\u017eit\u00e9. Je potrebn\u00fd klientsky certifik\u00e1t okrem hesla. Podporuje ho mnoho syst\u00e9mov. <\/li>\n<li> EAP-TTLS \u2014 \u0161iroko podporovan\u00fd v mnoh\u00fdch syst\u00e9moch, pon\u00faka dobr\u00fa bezpe\u010dnos\u0165 pomocou PKI certifik\u00e1tov iba na serveri autentifik\u00e1cie. <\/li>\n<li> EAP-MD5 \u2014 \u010fal\u0161\u00ed otvoren\u00fd \u0161tandard. Pon\u00faka minim\u00e1lnu bezpe\u010dnos\u0165. Je zranite\u013en\u00fd, nepodporuje vz\u00e1jomn\u00fa autentifik\u00e1ciu a gener\u00e1ciu k\u013e\u00fa\u010dov. <\/li>\n<li> EAP-IKEv2 \u2014 zalo\u017een\u00fd na protokole Internet Key Exchange Protocol version 2. Zabezpe\u010duje vz\u00e1jomn\u00fa autentifik\u00e1ciu a vytvorenie rel\u00e1cie k\u013e\u00fa\u010da medzi klientom a serverom. <\/li>\n<li> PEAP \u2014 spolo\u010dn\u00e9 rie\u0161enie spolo\u010dnost\u00ed CISCO, Microsoft a RSA Security ako otvoren\u00fd \u0161tandard. \u0160iroko dostupn\u00fd v produktoch, zabezpe\u010duje ve\u013emi dobr\u00fa bezpe\u010dnos\u0165. Je podobn\u00fd EAP-TTLS, vy\u017eaduje iba certifik\u00e1t na serverovej strane. <\/li>\n<li> PEAPv0\/EAP-MSCHAPv2 \u2014 po EAP-TLS je to druh\u00fd najroz\u0161\u00edrenej\u0161\u00ed \u0161tandard na svete. Pou\u017e\u00edva sa klient-server vz\u0165ah v Microsofte, Ciscu, Apple, Linuxe <\/li>\n<li> PEAPv1\/EAP-GTC \u2014 vytvoren\u00fd Ciscom ako alternat\u00edva k PEAPv0\/EAP-MSCHAPv2. Nechr\u00e1ni autentifika\u010dn\u00e9 \u00fadaje v \u017eiadnom pr\u00edpade. Nie je podporovan\u00fd v opera\u010dn\u00fdch syst\u00e9moch Windows <\/li>\n<li> EAP-FAST \u2014 met\u00f3da vyvinut\u00e1 Ciscom na n\u00e1pravu nedostatkov LEAP. Pou\u017e\u00edva Protected Access Credential (PAC). Nie je \u00faplne dokon\u010den\u00e1 <\/li>\n<\/ul>\n<p>\nZ celej tejto rozmanitosti v\u00fdber predsa len nie je ve\u013ek\u00fd. Od met\u00f3dy autentifik\u00e1cie sa po\u017eadovalo: dobr\u00e1 bezpe\u010dnos\u0165, podpora na v\u0161etk\u00fdch zariadeniach (Windows 10, macOS, Linux, Android, iOS) a, vlastne, \u010d\u00edm jednoduch\u0161ie, t\u00fdm lep\u0161ie. Preto v\u00fdber padol na EAP-TTLS v spojen\u00ed s protokolom PAP. <br \/>\nM\u00f4\u017ee vznikn\u00fa\u0165 ot\u00e1zka \u2014 Pre\u010do teda pou\u017e\u00edva\u0165 PAP? ve\u010f on pren\u00e1\u0161a hesl\u00e1 v otvorenej forme? <\/p>\n<p>\u00c1no, je to pravda. Komunik\u00e1cia medzi FreeRadius a FreeIPA bude prebieha\u0165 presne takto. V debug re\u017eime mo\u017eno sledova\u0165, ako sa odosielaj\u00fa meno pou\u017e\u00edvate\u013ea a heslo. A nech sa odosielaj\u00fa, ve\u010f len vy m\u00e1te pr\u00edstup k serveru FreeRadius.<\/p>\n<p>Viac inform\u00e1ci\u00ed o pr\u00e1ci EAP-TTLS si m\u00f4\u017eete pre\u010d\u00edta\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.bmstu.wiki\/EAP-TTLS_(Tunneled_Transport_Layer_Security)\">tu<br \/>\n<\/a><\/noindex><\/p>\n<h2>FreeRADIUS<\/h2>\n<p>\nFreeRadius spust\u00edme na CentOS 7.6. Tu nie je ni\u010d zlo\u017eit\u00e9, nain\u0161talujeme ho be\u017en\u00fdm sp\u00f4sobom.<\/p>\n<pre><code class=\"bash\">yum install freeradius freeradius-utils freeradius-ldap -y<\/code><\/pre>\n<p>\n<i>Z bal\u00edkov sa in\u0161taluje verzia 3.0.13. Posledn\u00fa mo\u017eno z\u00edska\u0165 na <noindex><a rel=\"nofollow\" href=\"https:\/\/freeradius.org\/\">https:\/\/freeradius.org\/<\/a><\/noindex><\/i><\/p>\n<p>Po tomto u\u017e FreeRadius funguje. M\u00f4\u017eete v \/etc\/raddb\/users odkomentova\u0165 riadok<\/p>\n<pre><code class=\"bash\">steve   Cleartext-Password := \"testing\"<\/code><\/pre>\n<p>\nSpust\u00edme server v debug re\u017eime<\/p>\n<pre><code class=\"bash\">freeradius -X<\/code><\/pre>\n<p>\nA urob\u00edme testovacie pripojenie s localhostom<\/p>\n<pre><code class=\"bash\">radtest steve testing 127.0.0.1 1812 testing123<\/code><\/pre>\n<p>\nDostali sme odpove\u010f <i>Received Access-Accept Id 115 from 127.0.0.1:1812 to 127.0.0.1:56081 length 20<\/i>, znamen\u00e1 to, \u017ee v\u0161etko je v poriadku. Ideme \u010falej.<\/p>\n<p>Pripoj\u00edme modul <i><b>ldap<\/b><\/i>.<\/p>\n<pre><code class=\"bash\">ln -s \/etc\/raddb\/mods-available\/ldap \/etc\/raddb\/mods-enabled\/ldap<\/code><\/pre>\n<p>\nA hne\u010f ho zmen\u00edme. Potrebujeme, aby FreeRadius mohol komunikova\u0165 s FreeIPA<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/ldap<\/b><\/p>\n<pre><code class=\"bash\">ldap {\nserver=\"ldap:\/\/ldap.server.com\"\nport=636\nstart_tls=yes\nidentity=\"uid=admin,cn=users,dc=server,dc=com\"\npassword=**********\nbase_dn=\"cn=users,dc=server,dc=com\"\nset_auth_type=yes\n...\nuser {\nbase_dn=\"${..base_dn}\"\nfilter=\"(uid=%{%{Stripped-User-Name}:-%{User-Name}})\"\n}\n...<\/code><\/pre>\n<p>Re\u0161tartujeme radius server a kontrolujeme synchroniz\u00e1ciu pou\u017e\u00edvate\u013eov LDAP:<\/p>\n<pre><code class=\"bash\">radtest user_ldap password_ldap localhost 1812 testing123<\/code><\/pre>\n<p>\nUpravujeme eap v <i><b>mods-enabled\/eap<\/b><\/i><br \/>\nTu prid\u00e1me dve in\u0161tancie eap. Bud\u00fa sa l\u00ed\u0161i\u0165 len certifik\u00e1tmi a k\u013e\u00fa\u010dmi. O chv\u00ed\u013eu vysvetl\u00edm, pre\u010do presne takto<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/eap<\/b><\/p>\n<pre><code class=\"bash\">eap eap-client {                                                                                                                                                                                                                           default_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_file = ${certdir}\/fisrt.key\n           certificate_file = ${certdir}\/first.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}\neap eap-guest {\ndefault_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_passwotd=blablabla\n           private_key_file = ${certdir}\/server.key\n           certificate_file = ${certdir}\/server.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}<\/code><\/pre>\n<p>\u010ealej editujeme <i><b>site-enabled\/default<\/b><\/i>. Zauj\u00edmaj\u00fa n\u00e1s sekcie authorize a authenticate.<\/p>\n<p><b class=\"spoiler_title\">site-enabled\/default<\/b><\/p>\n<pre><code class=\"bash\">autoriz\u00e1cia {\n  filter_username\n  preprocess\n  ak (&amp;User-Name == \"guest\") {\n   eap-guest {\n       ok = return\n   }\n  }\n  inak (&amp;User-Name == \"client\") {\n    eap-client {\n       ok = return \n    }\n  }\n  inak {\n    eap-guest {\n       ok = return\n    }\n  }\n  ldap\n  ak ((ok || updated) &amp;&amp; User-Password) {\n    update {\n        control:Auth-Type := ldap\n    }\n  }\n  expiration\n  logintime\n  pap\n  }\n\nautentifikova\u0165 {\n  Auth-Type LDAP {\n    ldap\n  }\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  pap\n}<\/code><\/pre>\n<p>V sekcii authorize odstra\u0148ujeme v\u0161etky moduly, ktor\u00e9 nepotrebujeme. Nech\u00e1vame len ldap. Prid\u00e1vame kontrolu klienta pod\u013ea username. Pr\u00e1ve preto sme vy\u0161\u0161ie pridali dva in\u0161tancie eap.<\/p>\n<p><b class=\"spoiler_title\">Multi EAP<\/b>Ide o to, \u017ee pri prip\u00e1jan\u00ed niektor\u00fdch zariaden\u00ed budeme pou\u017e\u00edva\u0165 syst\u00e9mov\u00e9 certifik\u00e1ty a uv\u00e1dza\u0165 dom\u00e9nu. M\u00e1me certifik\u00e1t a k\u013e\u00fa\u010d od d\u00f4veryhodn\u00e9ho certifika\u010dn\u00e9ho centra. Z m\u00f4jho poh\u013eadu je tento sp\u00f4sob prip\u00e1jania jednoduch\u0161\u00ed, ako posiela\u0165 samopodp\u00edsan\u00fd certifik\u00e1t na ka\u017ed\u00e9 zariadenie. Ale ani bez samopodp\u00edsan\u00fdch certifik\u00e1tov to nakoniec ne\u0161lo. Zariadenia Samsung a Android &lt; 6 verzie nedok\u00e1\u017eu pou\u017e\u00edva\u0165 syst\u00e9mov\u00e9 certifik\u00e1ty. Pre tieto zariadenia vytv\u00e1rame samostatn\u00fa in\u0161tanciu eap-guest so samopodp\u00edsan\u00fdmi certifik\u00e1tmi. Pre v\u0161etky ostatn\u00e9 zariadenia budeme pou\u017e\u00edva\u0165 eap-client s d\u00f4veryhodn\u00fdm certifik\u00e1tom. User-Name sa ur\u010duje pod\u013ea po\u013ea Anonymous pri pripojen\u00ed zariadenia. Povolen\u00e9 s\u00fa len 3 hodnoty: Guest, Client a pr\u00e1zdne pole. V\u0161etko ostatn\u00e9 bude odmietnut\u00e9. Toto sa nastavuje v politik\u00e1ch. Pr\u00edklad uvediem nesk\u00f4r.<\/p>\n<p>Uprav\u00edme sekcie authorize a authenticate v <i><b>site-enabled\/inner-tunnel<\/b><\/i><\/p>\n<p><b class=\"spoiler_title\">site-enabled\/inner-tunnel<\/b><\/p>\n<pre><code class=\"bash\">autoriz\u00e1cia {\n  filter_username\n  filter_inner_identity\n  update control {\n   &amp;Proxy-To-Realm := LOCAL\n  }\n  ldap\n  ak ((ok || updated) &amp;&amp; User-Password) {\n    update {\n        control:Auth-Type := ldap\n    }\n  }\n  expiration\n  digest\n  logintime\n  pap\n  }\n\nautentifikova\u0165 {\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  Auth-Type PAP {\n    pap\n  }\n  ldap\n}<\/code><\/pre>\n<p>\u010ealej je potrebn\u00e9 v politik\u00e1ch predp\u00edsa\u0165, ak\u00e9 men\u00e1 je mo\u017en\u00e9 pou\u017ei\u0165 pre anonymn\u00fd vstup. Upravujeme <b><i>policy.d\/filter<\/i><\/b>.<\/p>\n<p>Mus\u00edme n\u00e1js\u0165 riadky podobn\u00e9 tomuto:<\/p>\n<pre><code class=\"bash\">ak (&amp;outer.request:User-Name !~ \/^(anon|@)\/) {\n  update request {\n    Module-Failure-Message = \"User-Name nie je anonymizovan\u00fd\"\n  }\n  zamietnu\u0165\n}<\/code><\/pre>\n<p>\nA ni\u017e\u0161ie v elsif prida\u0165 po\u017eadovan\u00e9 hodnoty:<\/p>\n<pre><code class=\"bash\">inak (&amp;outer.request:User-Name !~ \/^(guest|client|@)\/) {\n  update request {\n    Module-Failure-Message = \"User-Name nie je anonymizovan\u00fd\"\n  }\n  zamietnu\u0165\n}<\/code><\/pre>\n<p>\nTeraz sa mus\u00edme presun\u00fa\u0165 do adres\u00e1ra <b><i>certs<\/i><\/b>. Sem je potrebn\u00e9 umiestni\u0165 k\u013e\u00fa\u010d a certifik\u00e1t od d\u00f4veryhodn\u00e9ho certifika\u010dn\u00e9ho centra, ktor\u00fd u\u017e m\u00e1me, a vygenerova\u0165 samopodp\u00edsan\u00e9 certifik\u00e1ty pre eap-guest.<\/p>\n<p>Men\u00edme parametre v s\u00fabore <b><i>ca.cnf<\/i><\/b>.<\/p>\n<p><b class=\"spoiler_title\">ca.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndefault_days = 3650\ndefault_md = sha256\n...\ninput_password = blablabla\noutput_password = blablabla\n...\ncountryName = RU\nstateOrProvinceNmae = Kraj\nlocalityNmae = Mesto\norganizationName = NONAME\nemailAddress = admin@admin.ru\ncommonName = \"CA FreeRadius\"<\/code><\/pre>\n<p>Tieto ist\u00e9 hodnoty uv\u00e1dzame v s\u00fabore <b><i><i>server.cnf<\/i><\/i><\/b>. Men\u00edme iba <br \/>\n<b>commonName<\/b>:<\/p>\n<p><b class=\"spoiler_title\">server.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndefault_days = 3650\ndefault_md = sha256\n...\ninput_password = blablabla\noutput_password = blablabla\n...\ncountryName = RU\nstateOrProvinceNmae = Kraj\nlocalityNmae = Mesto\norganizationName = NONAME\nemailAddress = admin@admin.ru\ncommonName = \"Server Certificate FreeRadius\"<\/code><\/pre>\n<p>Vytv\u00e1rame:<\/p>\n<pre><code class=\"bash\">make<\/code><\/pre>\n<p>\nHotovo. Z\u00edskan\u00e9 <b><i>server.crt<\/i><\/b> a <b><i>server.key<\/i><\/b> u n\u00e1s u\u017e s\u00fa uveden\u00e9 vy\u0161\u0161ie v eap-guest.<\/p>\n<p>A nakoniec, prid\u00e1me na\u0161e pr\u00edstupov\u00e9 body do s\u00faboru <b><i>client.conf<\/i><\/b>. M\u00e1m ich 7. Aby som nemusel prid\u00e1va\u0165 ka\u017ed\u00fd bod osobitne, uvedieme iba sie\u0165, v ktorej sa nach\u00e1dzaj\u00fa (m\u00f4j bod pr\u00edstupu sa nach\u00e1dza v samostatnom VLAN).<\/p>\n<pre><code class=\"bash\">client APs {\nipaddr = 192.168.100.0\/24\npassword = password_AP\n}<\/code><\/pre>\n<p><\/p>\n<h2>Kontrol\u00e9r Ubiquiti<\/h2>\n<p>\nNa kontrol\u00e9ri vytv\u00e1rame samostatn\u00fa sie\u0165. Nech to bude 192.168.2.0\/24<br \/>\nPrejdeme do nastaven\u00ed -&gt; profil. Vytv\u00e1rame nov\u00fd:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/57d97f7ef2db1a62633aa16131435065.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUvedieme adresu a port radius-servera a heslo, ktor\u00e9 sme uviedli v s\u00fabore <b><i>clients.conf<\/i><\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/edab8e5ef03897c88bb45b2912e577ec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVytvor\u00edme nov\u00e9 meno bezdr\u00f4tovej siete. Ako met\u00f3du autentifik\u00e1cie vyberieme WPA-EAP (Enterprise) a uvedieme vytvoren\u00fd radius-profil:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9dc918b734cac3d7382db796feb6b7a2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u0161etko ulo\u017e\u00edme, pou\u017eijeme a ideme \u010falej.<\/p>\n<h2>Nastavenie klientov<\/h2>\n<p>\nZa\u010dneme s naj\u0165a\u017e\u0161\u00edm!<\/p>\n<h3>Windows 10<\/h3>\n<p>\nZlo\u017eitosti spo\u010d\u00edvaj\u00fa v tom, \u017ee Windows zatia\u013e nevie pripoji\u0165 sa k firemn\u00e9mu WiFi prostredn\u00edctvom dom\u00e9ny. Preto mus\u00edme manu\u00e1lne prida\u0165 n\u00e1\u0161 certifik\u00e1t do \u00falo\u017eiska d\u00f4veryhodn\u00fdch certifik\u00e1tov. M\u00f4\u017eeme pou\u017ei\u0165 ako samopodp\u00edsan\u00fd, tak aj od certifika\u010dn\u00e9ho centra. Ja budem pou\u017e\u00edva\u0165 druh\u00fd. <\/p>\n<p>\u010ealej treba vytvori\u0165 nov\u00e9 pripojenie. Na to prejdeme do nastaven\u00ed siete a internetu -&gt; Centrum spr\u00e1vy siet\u00ed a zdie\u013eania -&gt; Vytvorenie a nastavenie nov\u00e9ho pripojenia alebo siete:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/406e515cff889ea70e226116f1dc0521.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f88e592920e43d42cc7fed34423f09ea.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1d7c045e02eb8e3b14016aacfa00da4c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nRu\u010dne uvedieme n\u00e1zov siete a zmen\u00edme typ zabezpe\u010denia. Potom klikneme na <i>zmeni\u0165 nastavenia pripojenia<\/i> a na karte Bezpe\u010dnos\u0165 vyberieme overenie siete \u2014 EAP-TTLS.<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/7e736b4cffd6dca5fdd9df70cedd7988.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/6c328ff8b4a434ed488c46b594aa5108.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d4a3d2883088a06592addae770a12a16.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDostaneme sa do nastaven\u00ed, uvedieme d\u00f4vernos\u0165 autentifik\u00e1cie \u2014 <b>client<\/b>. Ako d\u00f4veryhodn\u00e9 certifika\u010dn\u00e9 centrum vyberieme certifik\u00e1t, ktor\u00fd sme pridali, za\u0161krt\u00e1vame \u201eNevy\u017eadova\u0165 od pou\u017e\u00edvate\u013ea v\u00fdzvu, ak sa server ned\u00e1 overi\u0165\u201c a met\u00f3du overenia vol\u00edme \u2014 ne\u0161ifrovan\u00e9 heslo (PAP).<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb4897493f805f0d8869c22a1b706dec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPotom prejdeme do roz\u0161\u00edren\u00fdch nastaven\u00ed, za\u0161krtneme mo\u017enos\u0165 \u201eUve\u010fte re\u017eim overovania\u201c. Vyberieme polo\u017eku \u201eOverenie pou\u017e\u00edvate\u013ea\u201c a klikneme na <i>ulo\u017ei\u0165 prihlasovacie \u00fadaje<\/i>. Tu bude potrebn\u00e9 zada\u0165 username_ldap a password_ldap<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/469bb4337e4e601a80de1021a48bc101.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/999dc6c41a69b22c8de2b49398c9a613.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/75347f2f7140cac58a181a325ab0f3ad.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u0161etko ulo\u017e\u00edme, aplikujeme, zatvor\u00edme. M\u00f4\u017eeme sa pripoji\u0165 k novej sieti.<\/p>\n<h3>Linux<\/h3>\n<p>\nTestoval som to na Ubuntu 18.04, 18.10, Fedora 29, 30.<\/p>\n<p>Najprv si stiahneme certifik\u00e1t. Nena\u0161iel som v Linuxe, \u010di je mo\u017en\u00e9 pou\u017e\u00edva\u0165 syst\u00e9mov\u00e9 certifik\u00e1ty a \u010di tam v\u00f4bec tak\u00e9 \u00falo\u017eisko existuje. <\/p>\n<p>Budeme sa prip\u00e1ja\u0165 cez dom\u00e9nu. Preto je potrebn\u00fd certifik\u00e1t certifika\u010dnej autority, od ktorej bol n\u00e1\u0161 certifik\u00e1t zak\u00fapen\u00fd.<\/p>\n<p>Cel\u00e9 pripojenie prebieha v jednom okne. Vyberieme na\u0161u sie\u0165:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e05f44a52ee7290921b5b74df718a0c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>anonymous \u2014 client<br \/>\ndomain \u2014 dom\u00e9na, na ktor\u00fa bol certifik\u00e1t vydan\u00fd<br \/>\n<\/i><\/p>\n<h3>Android<\/h3>\n<p><\/p>\n<h4>non-Samsung<\/h4>\n<p>\nOd verzie 7 pri pripojen\u00ed WiFi je mo\u017en\u00e9 pou\u017e\u00edva\u0165 syst\u00e9mov\u00e9 certifik\u00e1ty, ak uvedieme iba dom\u00e9nu:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f935493cbe35f5a19c4da8bb5632604f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>domain \u2014 dom\u00e9na, na ktor\u00fa bol certifik\u00e1t vydan\u00fd<br \/>\nanonymous \u2014 client<br \/>\n<\/i><\/p>\n<h4>Samsung<\/h4>\n<p>\nAko som u\u017e spom\u00ednal, zariadenia Samsung nevedia pou\u017e\u00edva\u0165 syst\u00e9mov\u00e9 certifik\u00e1ty pri pripojen\u00ed WiFi a nemaj\u00fa mo\u017enos\u0165 pripoji\u0165 sa cez dom\u00e9nu. Preto je potrebn\u00e9 ru\u010dne prida\u0165 kore\u0148ov\u00fd certifik\u00e1t certifika\u010dnej autority (ca.pem, berieme na Radius serveri). Tu bude pou\u017eit\u00fd vlastnoru\u010dne podp\u00edsan\u00fd.<\/p>\n<p>Stiahneme si certifik\u00e1t na zariadenie a nain\u0161talujeme ho.<\/p>\n<p><b class=\"spoiler_title\">In\u0161tal\u00e1cia certifik\u00e1tu<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d02770f35c44a618f2f6243085c258b8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb9ec984d5e68824ebd0b138551a87c2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/2c5c95c339b00085845470fdff56932e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1561758abad60a168e067f1ecb0b94f5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPri tom bude potrebn\u00e9 nastavi\u0165 obrazovku na odomknutie, PIN k\u00f3d alebo heslo, ak e\u0161te nebolo nastaven\u00e9:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eeb9189ecdb8c255f2b76918ec1954b5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/741c2f6df3e50c5ebb94c76e907efb33.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Uk\u00e1zal som zlo\u017eit\u00fa verziu in\u0161tal\u00e1cie certifik\u00e1tu. Na v\u00e4\u010d\u0161ine zariaden\u00ed sta\u010d\u00ed jednoducho klikn\u00fa\u0165 na stiahnut\u00fd certifik\u00e1t.<\/i><\/p>\n<p>Ke\u010f je certifik\u00e1t nain\u0161talovan\u00fd, m\u00f4\u017eeme prejs\u0165 k pripojeniu:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4e2a8716b30634b3effdb0f2cbf781af.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>certifik\u00e1t \u2014 uvedieme ten, ktor\u00fd sme nain\u0161talovali<br \/>\nanonymn\u00fd pou\u017e\u00edvate\u013e \u2014 guest<br \/>\n<\/i><\/p>\n<h3>macOS<\/h3>\n<p>\nJablkov\u00e9 zariadenia m\u00f4\u017eu zo z\u00e1kladne prihlasova\u0165 iba k EAP-TLS, ale aj tak je potrebn\u00e9 im doda\u0165 certifik\u00e1t. Aby ste uviedli in\u00fd sp\u00f4sob pripojenia, mus\u00edte pou\u017ei\u0165 Apple Configurator 2. Samozrejme je potrebn\u00e9 ho najsk\u00f4r stiahnu\u0165 na Mac, vytvori\u0165 nov\u00fd profil a prida\u0165 v\u0161etky potrebn\u00e9 nastavenia WiFi.<\/p>\n<p><b class=\"spoiler_title\">Apple Configurator<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1864dedc371b851dbf2594eff3ec7fc7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0847466b361f681bcfcabee92f1ac885.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Tu uvedieme n\u00e1zov na\u0161ej siete<br \/>\nTyp zabezpe\u010denia \u2014 WPA2 Enterprise<br \/>\nAkceptovan\u00e9 typy EAP \u2014 TTLS<br \/>\nPou\u017e\u00edvate\u013esk\u00e9 meno a heslo \u2014 nech\u00e1me pr\u00e1zdne<br \/>\nVn\u00fatorn\u00e9 overenie \u2014 PAP<br \/>\nVonku identita \u2014 client <br \/>\n<\/i><\/p>\n<p><i>Z\u00e1lo\u017eka D\u00f4vera. Tu uvedieme na\u0161u dom\u00e9nu<\/i><\/p>\n<p>V\u0161etko. Profil m\u00f4\u017eeme ulo\u017ei\u0165, podp\u00edsa\u0165 a distribuova\u0165 na zariadenia<\/p>\n<p>Po dokon\u010den\u00ed profilu je potrebn\u00e9 ho stiahnu\u0165 na Mac a nain\u0161talova\u0165. Po\u010das in\u0161tal\u00e1cie bude potrebn\u00e9 zada\u0165 username_ldap a password_ldap pou\u017e\u00edvate\u013ea:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d7cb1cbcfd1de930d0718c1596bc60d7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/dd2e90a77fd9b64f6a98b0c0b21a080c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/c1cb62ec60fc835353c5e409a138f0be.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>iOS<\/h3>\n<p>\nProces je rovnak\u00fd ako na macOS. Je potrebn\u00e9 pou\u017ei\u0165 profil (m\u00f4\u017ee by\u0165 presne ten ist\u00fd ako pre macOS. Ako vytvori\u0165 profil v Apple Configurator, pozrite vy\u0161\u0161ie).<\/p>\n<p>S\u0165ahujeme profil, in\u0161talujeme, zad\u00e1vame prihlasovacie \u00fadaje, pripojujeme sa:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e2be411c0dfb427bfd54ad0b1f42dcb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d637fa93c0bcf09d1a5eb3701f769d4f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0908737918cd81cbf3e1ebf9ba0d9820.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/3821dc0bd6f866730575c6ceb3d5bbfb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/b4b0bf189ac037345e33e7864bfb2ad8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f5f9b7168ac14b67d6f4753d050a742e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTo je v\u0161etko. Nastavili sme Radius server, synchronizovali ho s FreeIPA a ur\u010dili sme pr\u00edstupov\u00fdm bodom Ubiquiti, aby pou\u017e\u00edvaj\u00fa WPA2-EAP.<\/p>\n<h2>Mo\u017en\u00e9 ot\u00e1zky<\/h2>\n<p>\n<b>A:<\/b> ako posla\u0165 profil\/ certifik\u00e1t zamestnancovi?<\/p>\n<p><b>O:<\/b> V\u0161etky certifik\u00e1ty\/profily uchov\u00e1vam na ftp s pr\u00edstupom cez web. Vytvoril som hos\u0165ovsk\u00fa sie\u0165 s obmedzen\u00edm r\u00fdchlosti a pr\u00edstupom len do internetu, s v\u00fdnimkou ftp. <br \/>\nAutentifik\u00e1cia trv\u00e1 2 dni, po \u010dom sa resetuje a klient zost\u00e1va bez internetu. Teda, ke\u010f sa zamestnanec chce pripoji\u0165 k WiFi, najprv sa pripoj\u00ed k hos\u0165ovskej sieti, prejde na ftp, stiahne potrebn\u00fd certifik\u00e1t alebo profil, nain\u0161taluje ich a potom sa m\u00f4\u017ee pripoji\u0165 k firemnej sieti.<\/p>\n<p><b>A:<\/b> pre\u010do nepou\u017ei\u0165 sch\u00e9mu s MSCHAPv2? je predsa bezpe\u010dnej\u0161ia!<\/p>\n<p><b>O:<\/b> Po prv\u00e9, tak\u00e1 sch\u00e9ma dobre funguje na NPS (Windows Network Policy System), v na\u0161ej implement\u00e1cii je potrebn\u00e9 dodato\u010dne nakonfigurova\u0165 LDAP (FreeIPA) a uchov\u00e1va\u0165 hash hesiel na serveri. Dodato\u010dn\u00e9 nastavenia nie s\u00fa \u017eiaduce, preto\u017ee to m\u00f4\u017ee vies\u0165 k r\u00f4znym probl\u00e9mom so synchroniz\u00e1ciou pou\u017e\u00edvate\u013esk\u00fdch \u00fa\u010dtov. Po druh\u00e9, hash predstavuje MD4, tak\u017ee to v\u00fdrazne nezvy\u0161uje bezpe\u010dnos\u0165.<\/p>\n<p><b>A:<\/b> je mo\u017en\u00e9 autorizova\u0165 zariadenia pod\u013ea MAC adries?<\/p>\n<p><b>O:<\/b> NIE, to nie je bezpe\u010dn\u00e9, \u00fato\u010dn\u00edk m\u00f4\u017ee zmeni\u0165 MAC adresy, a navy\u0161e autoriz\u00e1cia pod\u013ea MAC adries nie je podporovan\u00e1 na mnoh\u00fdch zariadeniach. <\/p>\n<p><b>A:<\/b> na\u010do vlastne pou\u017e\u00edva\u0165 v\u0161etky tieto certifik\u00e1ty? d\u00e1 sa predsa pripoji\u0165 aj bez nich.<\/p>\n<p><b>O:<\/b> Certifik\u00e1ty sa pou\u017e\u00edvaj\u00fa na autoriz\u00e1ciu servera. T.j. zariadenie pri pripojen\u00ed kontroluje, \u010di ide o server, ktor\u00e9mu sa d\u00e1 d\u00f4verova\u0165, alebo nie. Ak \u00e1no, autentifik\u00e1cia pokra\u010duje, ak nie, spojenie sa uzavrie. M\u00f4\u017eete sa pripoji\u0165 aj bez certifik\u00e1tov, ale ak \u00fato\u010dn\u00edk alebo sused spust\u00ed doma radius-server a pr\u00edstupov\u00fd bod so rovnak\u00fdm menom ako m\u00e1me my, m\u00f4\u017ee \u013eahko zachyti\u0165 autentiza\u010dn\u00e9 \u00fadaje pou\u017e\u00edvate\u013ea (nezab\u00fadajme, \u017ee s\u00fa odosielan\u00e9 v otvorenej forme). A ke\u010f sa pou\u017e\u00edva certifik\u00e1t, nepriate\u013e uvid\u00ed vo svojich logoch iba na\u0161e vymyslen\u00e9 User-Name \u2014 guest alebo client a chybu typu \u2014 Unknown CA Certificate.<\/p>\n<p><b class=\"spoiler_title\">E\u0161te nie\u010do o macOS.<\/b>Obvykle sa na macOS reinstal\u00e1cia syst\u00e9mu rob\u00ed cez internet. Pri obnove mus\u00ed by\u0165 Mac pripojen\u00fd k WiFi a tu nefunguje ani na\u0161a firemn\u00e1 WiFi, ani hos\u0165ovsk\u00e1 sie\u0165. Osobne som vytvoril \u010fal\u0161iu sie\u0165, be\u017en\u00fa s WPA2-PSK, skryt\u00fa, len pre technick\u00e9 oper\u00e1cie. Alebo je mo\u017en\u00e9 vopred vytvori\u0165 bootovate\u013en\u00fa USB k\u013e\u00fa\u010d so syst\u00e9mom. Ak je to Mac z roku 2015 a nov\u0161\u00ed, bude potrebn\u00e9 e\u0161te n\u00e1js\u0165 adapt\u00e9r pre tento USB k\u013e\u00fa\u010d.)<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/463225\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0423\u0436\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e WiFi. \u0417\u0434\u0435\u0441\u044c \u044f \u0440\u0430\u0441\u043f\u0438\u0448\u0443 \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0411\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0439\u0441\u044f LDAP \u0441 \u0437\u0430\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u043f\u043e\u0434\u043d\u0438\u043c\u0435\u043c FreeRadius \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043c WPA2-Enterprise \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 Ubnt. \u0412\u0440\u043e\u0434\u0435 \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c\u2026 \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 EAP \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u0442\u044c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27785,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37065","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:33+00:00","article:modified_time":"2019-10-31T19:15:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37065","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:36:42","updated":"2026-01-22 05:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/37065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=37065"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/37065\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/27785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=37065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=37065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=37065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}