{"id":37065,"date":"2019-10-31T22:15:33","date_gmt":"2019-10-31T19:15:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/wifi-enterprise-freeradius-freeipa-ubiquiti\/"},"modified":"2019-10-31T22:15:33","modified_gmt":"2019-10-31T19:15:33","slug":"wifi-enterprise-freeradius-freeipa-ubiquiti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","title":{"rendered":"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4c045a0710e5eb14b73359afad484c3d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDisa ishin disa shembuj t\u00eb organizimit t\u00eb WiFi p\u00ebr korporata. K\u00ebtu do t\u00eb p\u00ebrshkruaj se si e realizova nj\u00eb zgjidhje t\u00eb till\u00eb dhe problemet me t\u00eb cilat u p\u00ebrballa gjat\u00eb lidhjes me pajisjet e ndryshme. Do t\u00eb p\u00ebrdorim LDAP-in ekzistues me p\u00ebrdoruesit e regjistruar, do t\u00eb ngrem\u00eb FreeRadius dhe do t\u00eb konfigurojm\u00eb WPA2-Enterprise n\u00eb kontrolluesin Ubnt. Duket mjaft e thjesht\u00eb. T\u00eb shohim\u2026<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Pak p\u00ebr metodat EAP<\/h2>\n<p>\nPara se t\u00eb fillojm\u00eb realizimin e detyr\u00ebs, duhet t\u00eb p\u00ebrcaktojm\u00eb se cil\u00ebn metod\u00eb autentikimi do t\u00eb p\u00ebrdorim n\u00eb zgjidhjen ton\u00eb.<\/p>\n<p><b>Nga Wikipedia:<\/b><\/p>\n<blockquote><p>EAP \u2014 nj\u00eb korniz\u00eb autentikimi, e cila p\u00ebrdoret shpesh n\u00eb rrjetet pa tel dhe lidhjet pik\u00eb-n\u00eb-pik\u00eb. Formati u p\u00ebrshkrua p\u00ebr her\u00eb t\u00eb par\u00eb n\u00eb RFC 3748 dhe u azhurnua n\u00eb RFC 5247.<br \/>\nEAP p\u00ebrdoret p\u00ebr zgjedhjen e metod\u00ebs s\u00eb autentikimit, transmetimin e \u00e7el\u00ebsave dhe p\u00ebrpunimin e k\u00ebtyre \u00e7el\u00ebsave nga modulet e lidhura t\u00eb quajtura metodat EAP. Ka shum\u00eb metoda EAP, disa t\u00eb p\u00ebrkufizuara s\u00eb bashku me vet\u00eb EAP-in dhe disa t\u00eb l\u00ebshuara nga prodhues t\u00eb ve\u00e7ant\u00eb. EAP nuk p\u00ebrcakton nivelin kanalesh, ai thjesht p\u00ebrcakton formatin e mesazheve. \u00c7do protokoll q\u00eb p\u00ebrdor EAP ka protokollin e vet t\u00eb inkapsulimit t\u00eb mesazheve EAP. <\/p><\/blockquote>\n<p>\n<b>Metodat vet\u00eb:<\/b><\/p>\n<ul>\n<li>LEAP \u2014 nj\u00eb protokoll pron\u00ebsor, i zhvilluar nga CISCO. Jan\u00eb gjetur vulnerabilitete. Aktualisht nuk rekomandohet t\u00eb p\u00ebrdoret. <\/li>\n<li> EAP-TLS \u2014 nj\u00eb protokoll i mb\u00ebshtetur mir\u00eb nga ofruesit e lidhjeve pa tel. \u00cbsht\u00eb nj\u00eb protokoll i sigurt, pasi \u00ebsht\u00eb pasues i standardeve SSL. Konfigurimi i klientit \u00ebsht\u00eb mjaft i komplikuar. K\u00ebrkohet nj\u00eb certifikat klienti p\u00ebrve\u00e7 fjal\u00ebkalimit. Mb\u00ebshtetet n\u00eb shum\u00eb sisteme. <\/li>\n<li> EAP-TTLS \u2014 mb\u00ebshtetet gjer\u00ebsisht n\u00eb shum\u00eb sisteme, ofron siguri t\u00eb mir\u00eb, duke p\u00ebrdorur certifikata PKI vet\u00ebm n\u00eb serverin e autentikimit. <\/li>\n<li> EAP-MD5 \u2014 nj\u00eb standard tjet\u00ebr i hapur. Ofron siguri minimale. I ndjesh\u00ebm, nuk mb\u00ebshtet autentikimin e nd\u00ebrsjell\u00eb dhe gjenerimin e \u00e7el\u00ebsave. <\/li>\n<li> EAP-IKEv2 \u2014 e bazuar n\u00eb Protokollin e K\u00ebmbimit t\u00eb \u00c7el\u00ebsit t\u00eb Internetit versioni 2. Siguron autentikimin e nd\u00ebrsjell\u00eb dhe krijimin e \u00e7el\u00ebsit t\u00eb seanc\u00ebs midis klientit dhe serverit. <\/li>\n<li> PEAP \u2014 nj\u00eb zgjidhje e p\u00ebrbashk\u00ebt nga CISCO, Microsoft dhe RSA Security si nj\u00eb standard i hapur. Disponohet gjer\u00ebsisht n\u00eb produkte, ofron siguri shum\u00eb t\u00eb mir\u00eb. \u00cbsht\u00eb i ngjash\u00ebm me EAP-TTLS, duke k\u00ebrkuar vet\u00ebm certifikat\u00ebn n\u00eb an\u00ebn e serverit. <\/li>\n<li> PEAPv0\/EAP-MSCHAPv2 \u2014 pas EAP-TLS, ky \u00ebsht\u00eb standardi i dyt\u00eb m\u00eb i p\u00ebrdorur n\u00eb bot\u00eb. P\u00ebrdor lidhjen klient-server n\u00eb Microsoft, Cisco, Apple, Linux <\/li>\n<li> PEAPv1\/EAP-GTC \u2014 krijuar nga Cisco si nj\u00eb alternativ\u00eb ndaj PEAPv0\/EAP-MSCHAPv2. Nuk mbron t\u00eb dh\u00ebnat e autentikimit n\u00eb asnj\u00eb rast. Nuk mb\u00ebshtetet n\u00eb Windows OS <\/li>\n<li> EAP-FAST \u2014 nj\u00eb metod\u00eb e zhvilluar nga Cisco p\u00ebr t\u00eb adresuar disavantazhet e LEAP. P\u00ebrdor Credential t\u00eb Mbrojtur t\u00eb Qasjes (PAC). Plot\u00ebsisht e pap\u00ebrfunduar <\/li>\n<\/ul>\n<p>\nPavar\u00ebsisht k\u00ebtij diversiteti, zgjedhja nuk \u00ebsht\u00eb kaq e madhe. Metoda e autentikimit k\u00ebrkonte: siguri t\u00eb mir\u00eb, mb\u00ebshtetje n\u00eb t\u00eb gjith\u00eb pajisjet (Windows 10, macOS, Linux, Android, iOS) dhe, n\u00eb thelb, sa m\u00eb e thjesht\u00eb aq m\u00eb mir\u00eb. Prandaj, zgjedhja ra mbi EAP-TTLS n\u00eb lidhje me protokollin PAP. <br \/>\nMund t\u00eb lind\u00eb pyetja \u2014 Pse t\u00eb p\u00ebrdorim PAP? Ajo transmeton fjal\u00ebkalimet n\u00eb form\u00eb t\u00eb hapur? <\/p>\n<p>Po, \u00ebsht\u00eb e v\u00ebrtet\u00eb. Komunikimi midis FreeRadius dhe FreeIPA do t\u00eb kaloj\u00eb pik\u00ebrisht k\u00ebshtu. N\u00eb modin debug mund t\u00eb ndjekim sesi d\u00ebrgohen username dhe password. Dhe le t\u00eb d\u00ebrgohen, vet\u00ebm se ju keni akses n\u00eb serverin FreeRadius.<\/p>\n<p>P\u00ebr m\u00eb shum\u00eb informacion n\u00eb lidhje me funksionimin e EAP-TTLS, mund t\u00eb lexoni <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.bmstu.wiki\/EAP-TTLS_(Tunneled_Transport_Layer_Security)\">k\u00ebtu<br \/>\n<\/a><\/noindex><\/p>\n<h2>FreeRADIUS<\/h2>\n<p>\nDo t\u00eb ngrem\u00eb FreeRadius n\u00eb CentOS 7.6. Nuk ka asgj\u00eb t\u00eb komplikuar, e instalojm\u00eb n\u00eb m\u00ebnyr\u00ebn normale.<\/p>\n<pre><code class=\"bash\">yum install freeradius freeradius-utils freeradius-ldap -y<\/code><\/pre>\n<p>\n<i>Nga paketat instalohet versioni 3.0.13. T\u00eb fundit mund ta merrni k\u00ebtu <noindex><a rel=\"nofollow\" href=\"https:\/\/freeradius.org\/\">https:\/\/freeradius.org\/<\/a><\/noindex><\/i><\/p>\n<p>Pasi kjo, FreeRadius tashm\u00eb \u00ebsht\u00eb n\u00eb pun\u00eb. Mund t\u00eb shkruani n\u00eb \/etc\/raddb\/users duke shk\u00ebmbyer komentin p\u00ebr rreshtin<\/p>\n<pre><code class=\"bash\">steve   Cleartext-Password := \"testing\"<\/code><\/pre>\n<p>\nNisni serverin n\u00eb modin debug<\/p>\n<pre><code class=\"bash\">freeradius -X<\/code><\/pre>\n<p>\nDhe b\u00ebjm\u00eb nj\u00eb lidhje provuese me localhost<\/p>\n<pre><code class=\"bash\">radtest steve testing 127.0.0.1 1812 testing123<\/code><\/pre>\n<p>\nMora p\u00ebrgjigjen <i>Received Access-Accept Id 115 from 127.0.0.1:1812 to 127.0.0.1:56081 length 20<\/i>, k\u00ebshtu q\u00eb gjith\u00e7ka \u00ebsht\u00eb n\u00eb rregull. Shkela m\u00eb tej.<\/p>\n<p>Lidhim modul <i><b>ldap<\/b><\/i>.<\/p>\n<pre><code class=\"bash\">ln -s \/etc\/raddb\/mods-available\/ldap \/etc\/raddb\/mods-enabled\/ldap<\/code><\/pre>\n<p>\nDhe menj\u00ebher\u00eb do ta ndryshojm\u00eb at\u00eb. Na nevojitet q\u00eb FreeRadius t\u00eb mund t\u00eb qaset n\u00eb FreeIPA<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/ldap<\/b><\/p>\n<pre><code class=\"bash\">ldap {\nserver=\"ldap:\/\/ldap.server.com\"\nport=636\nstart_tls=yes\nidentity=\"uid=admin,cn=users,dc=server,dc=com\"\npassword=**********\nbase_dn=\"cn=users,dc=server,dc=com\"\nset_auth_type=yes\n...\nuser {\nbase_dn=\"${..base_dn}\"\nfilter=\"(uid=%{%{Stripped-User-Name}:-%{User-Name}})\"\n}\n...<\/code><\/pre>\n<p>Rinisni serverin radius dhe kontrolloni sinkronizimin e p\u00ebrdoruesve LDAP:<\/p>\n<pre><code class=\"bash\">radtest user_ldap password_ldap localhost 1812 testing123<\/code><\/pre>\n<p>\nRedaktoni eap n\u00eb <i><b>mods-enabled\/eap<\/b><\/i><br \/>\nK\u00ebtu do t\u00eb shtojm\u00eb dy instanca t\u00eb eap. Ato do t\u00eb ndryshojn\u00eb vet\u00ebm n\u00eb certifikatat dhe \u00e7el\u00ebsat. Pak m\u00eb posht\u00eb do t\u00eb shpjegoj, pse ashtu.<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/eap<\/b><\/p>\n<pre><code class=\"bash\">eap eap-client {                                                                                                                                                                                                                           default_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_file = ${certdir}\/fisrt.key\n           certificate_file = ${certdir}\/first.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}\neap eap-guest {\ndefault_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_passwotd=blablabla\n           private_key_file = ${certdir}\/server.key\n           certificate_file = ${certdir}\/server.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = \"HIGH\"\n           cipher_server_preference = no\n           ecdh_curve = \"prime256v1\"\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = \"inner-tunnel\"\n           }\n}<\/code><\/pre>\n<p>Pastaj redaktoni <i><b>site-enabled\/default<\/b><\/i>. Na interesojn\u00eb seksionet authorize dhe authenticate.<\/p>\n<p><b class=\"spoiler_title\">site-enabled\/default<\/b><\/p>\n<pre><code class=\"bash\">autorizo {\n  filtro_kusername\n  p\u00ebrpunim\n  n\u00ebse (&amp;User-Name == &quot;guest&quot;) {\n   eap-guest {\n       mir\u00eb = kthehu\n   }\n  }\n  p\u00ebrndryshe n\u00ebse (&amp;User-Name == &quot;client&quot;) {\n    eap-client {\n       mir\u00eb = kthehu \n    }\n  }\n  p\u00ebrndryshe {\n    eap-guest {\n       mir\u00eb = kthehu\n    }\n  }\n  ldap\n  n\u00ebse ((mir\u00eb || p\u00ebrdit\u00ebsuar) &amp;&amp; User-Password) {\n    p\u00ebrdit\u00ebso {\n        kontrollo:Auth-Type := ldap\n    }\n  }\n  skadenca\n  logintime\n  pap\n  }\n\nautentiko {\n  Auth-Type LDAP {\n    ldap\n  }\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  pap\n}<\/code><\/pre>\n<p>N\u00eb seksionin authorize hiqni t\u00eb gjitha modulet q\u00eb nuk na duhen. L\u00ebni vet\u00ebm ldap. Shtoni verifikimin e klientit sipas username. Pik\u00ebrisht p\u00ebr k\u00ebt\u00eb e kemi shtuar m\u00eb lart dy ekzemplar\u00eb eap.<\/p>\n<p><b class=\"spoiler_title\">Multi EAP<\/b>\u00c7\u00ebshtja \u00ebsht\u00eb se duke lidhur disa pajisje do t\u00eb p\u00ebrdorim certifikatat sistemike dhe do t\u00eb tregojm\u00eb domenin. Ne kemi nj\u00eb certifikat\u00eb dhe \u00e7el\u00ebs nga nj\u00eb qend\u00ebr besimi. Personalish mendoj se kjo procedur\u00eb lidhjeje \u00ebsht\u00eb m\u00eb e thjesht\u00eb se sa t\u00eb d\u00ebrgojm\u00eb nj\u00eb certifikat\u00eb t\u00eb vet\u00eb-n\u00ebnshkruar n\u00eb \u00e7do pajisje. Por edhe pa certifikatat e vet\u00eb-n\u00ebnshkruara nuk kemi mundur t\u00eb shkojm\u00eb pa to. Pajisjet Samsung dhe Android &lt;= 6 nuk din\u00eb t\u00eb p\u00ebrdorin certifikata sistemike. Prandaj p\u00ebr ta krijojm\u00eb nj\u00eb ekzemplar t\u00eb ve\u00e7ant\u00eb eap-guest me certifikata t\u00eb vet\u00eb-n\u00ebnshkruara. P\u00ebr t\u00eb gjitha pajisjet e tjera do t\u00eb p\u00ebrdorim eap-client me certifikat t\u00eb besueshme. User-Name p\u00ebrcaktohet nga fusha Anonymous gjat\u00eb lidhjes s\u00eb pajisjes. Lejohet t\u00eb p\u00ebrdoren vet\u00ebm 3 vlera: Guest, Client dhe fusha e zbraz\u00ebt. T\u00eb gjitha t\u00eb tjera jan\u00eb hedhur posht\u00eb. Kjo konfigurohet n\u00eb politika. Do jap nj\u00eb shembull pak m\u00eb von\u00eb.<\/p>\n<p>Do t\u00eb redaktojm\u00eb seksionet authorize dhe authenticate n\u00eb <i><b>site-enabled\/inner-tunnel<\/b><\/i><\/p>\n<p><b class=\"spoiler_title\">site-enabled\/inner-tunnel<\/b><\/p>\n<pre><code class=\"bash\">autorizo {\n  filtro_kusername\n  filtro_identiteti_i_brendsh\u00ebm\n  p\u00ebrdit\u00ebso kontrollin {\n   &amp;Proxy-To-Realm := LLOCAL\n  }\n  ldap\n  n\u00ebse ((mir\u00eb || p\u00ebrdit\u00ebsuar) &amp;&amp; User-Password) {\n    p\u00ebrdit\u00ebso {\n        kontrollo:Auth-Type := ldap\n    }\n  }\n  skadenca\n  digest\n  logintime\n  pap\n  }\n\nautentiko {\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  Auth-Type PAP {\n    pap\n  }\n  ldap\n}<\/code><\/pre>\n<p>M\u00eb pas duhet t\u00eb specifikojm\u00eb n\u00eb politika se cil\u00ebt emra mund t\u00eb p\u00ebrdoren p\u00ebr hyrjen anonime. Redaktoni <b><i>policy.d\/filter<\/i><\/b>.<\/p>\n<p>Duhet t\u00eb gjeni rreshtat t\u00eb ngjash\u00ebm me k\u00ebt\u00eb:<\/p>\n<pre><code class=\"bash\">n\u00ebse (&amp;outer.request:User-Name !~ \/^(anon|@)\\\/\/) {\n  p\u00ebrdit\u00ebso k\u00ebrkes\u00ebn {\n    Mesazhi i D\u00ebshtimit t\u00eb Modulit = &quot;User-Name nuk \u00ebsht\u00eb anonimizuar&quot;\n  }\n  refuzo\n}<\/code><\/pre>\n<p>\nDhe m\u00eb posht\u00eb n\u00eb elsif shtoni vlerat e nevojshme:<\/p>\n<pre><code class=\"bash\">p\u00ebrndryshe n\u00ebse (&amp;outer.request:User-Name !~ \/^(guest|client|@)\\\/\/) {\n  p\u00ebrdit\u00ebso k\u00ebrkes\u00ebn {\n    Mesazhi i D\u00ebshtimit t\u00eb Modulit = &quot;User-Name nuk \u00ebsht\u00eb anonimizuar&quot;\n  }\n  refuzo\n}<\/code><\/pre>\n<p>\nTani duhet t\u00eb kalojm\u00eb n\u00eb drejtorin\u00eb <b><i>certs<\/i><\/b>. K\u00ebtu duhet t\u00eb vendosim \u00e7el\u00ebsin dhe certifikat\u00ebn nga qendra e besueshme e certifikimit q\u00eb e kemi tashm\u00eb dhe duhet t\u00eb gjenerojm\u00eb certifikata t\u00eb vet\u00eb-n\u00ebnshkruara p\u00ebr eap-guest.<\/p>\n<p>Modifikoni parametrat n\u00eb skedarin <b><i>ca.cnf<\/i><\/b>.<\/p>\n<p><b class=\"spoiler_title\">ca.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndita_default = 3650\ndita_default_md = sha256\n...\npassword_input = blablabla\npassword_output = blablabla\n...\ncountryName = RU\nstateOrProvinceNmae = Shteti\nlocalityNmae = Qyteti\norganizationName = NONAME\nemailAddress = admin@admin.ru\ncommonName = &quot;CA FreeRadius&quot;<\/code><\/pre>\n<p>Vlera t\u00eb tilla shkruhen gjithashtu n\u00eb skedarin <b><i><i>server.cnf<\/i><\/i><\/b>. Ndryshojm\u00eb vet\u00ebm <br \/>\n<b>commonName<\/b>:<\/p>\n<p><b class=\"spoiler_title\">server.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndita_default = 3650\ndita_default_md = sha256\n...\npassword_input = blablabla\npassword_output = blablabla\n...\ncountryName = RU\nstateOrProvinceNmae = Shteti\nlocalityNmae = Qyteti\norganizationName = NONAME\nemailAddress = admin@admin.ru\ncommonName = &quot;Server Certificate FreeRadius&quot;<\/code><\/pre>\n<p>Krijojm\u00eb:<\/p>\n<pre><code class=\"bash\">make<\/code><\/pre>\n<p>\nGati. T\u00eb marr\u00eb <b><i>server.crt<\/i><\/b> dhe <b><i>server.key<\/i><\/b> jan\u00eb shkruar m\u00eb lart n\u00eb eap-guest.<\/p>\n<p>Dhe m\u00eb n\u00eb fund, do t\u00eb shtojm\u00eb pikat tona t\u00eb qasjes n\u00eb skedarin <b><i>client.conf<\/i><\/b>. Kam 7 prej tyre. P\u00ebr t\u00eb mos shtuar \u00e7do pik\u00eb ve\u00e7 e ve\u00e7, do t\u00eb shkruajm\u00eb vet\u00ebm rrjetin ku ndodhen ato (pikat e qasjes ndodhen n\u00eb nj\u00eb VLAN t\u00eb ve\u00e7ant\u00eb).<\/p>\n<pre><code class=\"bash\">client APs {\nipaddr = 192.168.100.0\/24\npassword = password_AP\n}<\/code><\/pre>\n<p><\/p>\n<h2>Kontrolluesi Ubiquiti<\/h2>\n<p>\nN\u00eb kontrollues krijojm\u00eb nj\u00eb rrjet t\u00eb ve\u00e7ant\u00eb. Le t\u00eb jet\u00eb 192.168.2.0\/24<br \/>\nShkojm\u00eb n\u00eb cil\u00ebsimet -&gt; profili. Krijojm\u00eb nj\u00eb t\u00eb ri:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/57d97f7ef2db1a62633aa16131435065.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nShkruajm\u00eb adres\u00ebn dhe portin e serverit radius dhe fjal\u00ebkalimin q\u00eb kemi shkruar n\u00eb skedarin <b><i>clients.conf<\/i><\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/edab8e5ef03897c88bb45b2912e577ec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKrijojm\u00eb nj\u00eb em\u00ebr t\u00eb ri p\u00ebr rrjetin wireless. Si metod\u00eb autentifikimi zgjedhim WPA-EAP (Enterprise) dhe specifikojm\u00eb profilin radius t\u00eb krijuar:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9dc918b734cac3d7382db796feb6b7a2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGjith\u00e7ka ruajm\u00eb, e aplikojm\u00eb dhe shkojm\u00eb m\u00eb tej.<\/p>\n<h2>Konfigurimi i klient\u00ebve<\/h2>\n<p>\nT\u00eb nisim me gj\u00ebn\u00eb m\u00eb t\u00eb v\u00ebshtir\u00eb!<\/p>\n<h3>Windows 10<\/h3>\n<p>\nV\u00ebshtir\u00ebsia \u00ebsht\u00eb se Windows ende nuk di t\u00eb lidhet me WiFi-n\u00eb korporative p\u00ebrmes domain-it. Prandaj duhet t\u00eb hedhim manualisht certifikat\u00ebn ton\u00eb n\u00eb depozitat e certifikatave t\u00eb besuara. K\u00ebtu mund t\u00eb p\u00ebrdorim si certifikata t\u00eb vet\u00eb-n\u00ebnshkruara ashtu edhe nga qendra e certifikimit. Un\u00eb do t\u00eb p\u00ebrdor t\u00eb dyt\u00ebn. <\/p>\n<p>M\u00eb pas, duhet t\u00eb krijojm\u00eb nj\u00eb lidhje t\u00eb re. P\u00ebr k\u00ebt\u00eb shkojm\u00eb n\u00eb cil\u00ebsimet e rrjetit dhe Internetit -&gt; Qendra e menaxhimit t\u00eb rrjeteve dhe ndarjes s\u00eb p\u00ebrgjithshme -&gt; Krijimi dhe konfigurimi i nj\u00eb lidhjeje t\u00eb re ose rrjeti:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/406e515cff889ea70e226116f1dc0521.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f88e592920e43d42cc7fed34423f09ea.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1d7c045e02eb8e3b14016aacfa00da4c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nManualisht shkruajm\u00eb emrin e rrjetit dhe ndryshojm\u00eb tipin e siguris\u00eb. Pas k\u00ebsaj klikojm\u00eb n\u00eb <i>ndrysho parametrat e lidhjes<\/i> dhe n\u00eb tab-in Siguria zgjedhim verifikimin e autentikimit t\u00eb rrjetit \u2014 EAP-TTLS.<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/7e736b4cffd6dca5fdd9df70cedd7988.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/6c328ff8b4a434ed488c46b594aa5108.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d4a3d2883088a06592addae770a12a16.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nShkkojm\u00eb n\u00eb parametrat, shkruajm\u00eb privat\u00ebsin\u00eb e autentikimit \u2014 <b>client<\/b>. Si qendr\u00ebn e besuar t\u00eb certifikimit zgjedhim certifikat\u00ebn q\u00eb kemi shtuar, vendosim zogun \"Mos k\u00ebrko p\u00ebrdoruesit t\u00eb autorizohet n\u00ebse serveri nuk autorizohet\" dhe metod\u00ebn e verifikimit zgjedhim \u2014 fjal\u00ebkalim t\u00eb paenkriptuar (PAP).<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb4897493f805f0d8869c22a1b706dec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00eb pas kalojm\u00eb te parametrat shtes\u00eb, vendosim shenj\u00ebn n\u00eb \"Specifikoni modin e verifikimit t\u00eb autenticitetit\". Zgjedhim opsionin \"Verifikimi i p\u00ebrdoruesit\" dhe klikojm\u00eb n\u00eb <i>ruaj t\u00eb dh\u00ebnat e identifikimit<\/i>. K\u00ebtu duhet t\u00eb shkruajm\u00eb username_ldap dhe password_ldap<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/469bb4337e4e601a80de1021a48bc101.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/999dc6c41a69b22c8de2b49398c9a613.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/75347f2f7140cac58a181a325ab0f3ad.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00eb gjitha i ruajm\u00eb, i aplikojm\u00eb, mbyllim. Mund t\u00eb lidhemi me rrjetin e ri.<\/p>\n<h3>Linux<\/h3>\n<p>\nE kam provuar n\u00eb Ubuntu 18.04, 18.10, Fedora 29, 30.<\/p>\n<p>S\u00eb pari, shkarkojm\u00eb certifikatin. Nuk e gjeta n\u00eb Linux n\u00ebse ka mund\u00ebsi t\u00eb p\u00ebrdoren certifikatat sistemike dhe a ka ndonj\u00eb depozit\u00eb t\u00eb till\u00eb. <\/p>\n<p>Do t\u00eb lidhemi p\u00ebrmes domainit. Prandaj, na nevojitet certifikati i institucioneve t\u00eb besueshm\u00ebris\u00eb, nga i cili kemi bler\u00eb certifikatin ton\u00eb.<\/p>\n<p>T\u00eb gjith\u00eb lidhjet b\u00ebhen n\u00eb nj\u00eb dritare. Zgjedhim rrjetin ton\u00eb:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e05f44a52ee7290921b5b74df718a0c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>anonymous \u2014 klienti<br \/>\ndomain \u2014 domeni, p\u00ebr t\u00eb cilin \u00ebsht\u00eb l\u00ebshuar certifikati<br \/>\n<\/i><\/p>\n<h3>Android<\/h3>\n<p><\/p>\n<h4>non-Samsung<\/h4>\n<p>\nQ\u00eb nga versioni 7, gjat\u00eb lidhjes WiFi, mund t\u00eb p\u00ebrdoren certifikatat sistemike, duke specifikuar vet\u00ebm domenin:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f935493cbe35f5a19c4da8bb5632604f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>domain \u2014 domeni, p\u00ebr t\u00eb cilin \u00ebsht\u00eb l\u00ebshuar certifikati<br \/>\nanonymous \u2014 klienti<br \/>\n<\/i><\/p>\n<h4>Samsung<\/h4>\n<p>\nSi\u00e7 e p\u00ebrmenda m\u00eb sip\u00ebr, pajisjet Samsung nuk mund t\u00eb p\u00ebrdorin certifikatat sistemike gjat\u00eb lidhjes WiFi, dhe nuk kan\u00eb mund\u00ebsi t\u00eb lidhen p\u00ebrmes domenit. Prandaj, duhet t'i shtojm\u00eb dorazi certifikatin rr\u00ebnj\u00ebsor t\u00eb institucionit t\u00eb certifikimit (ca.pem, e marrim n\u00eb serverin Radius). K\u00ebtu do t\u00eb p\u00ebrdorim nj\u00eb certifikat\u00eb t\u00eb vet\u00eb-n\u00ebnshkruar.<\/p>\n<p>Shkarkojm\u00eb certifikatin n\u00eb pajisjen ton\u00eb dhe e instalojm\u00eb at\u00eb.<\/p>\n<p><b class=\"spoiler_title\">Instalimi i certifikat\u00ebs<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d02770f35c44a618f2f6243085c258b8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb9ec984d5e68824ebd0b138551a87c2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/2c5c95c339b00085845470fdff56932e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1561758abad60a168e067f1ecb0b94f5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGjat\u00eb k\u00ebsaj, do t\u00eb kemi nevoj\u00eb t\u00eb vendosim nj\u00eb vizatim p\u00ebr t\u00eb zhbllokuar ekranin, nj\u00eb PIN ose fjal\u00ebkalim, n\u00ebse nuk \u00ebsht\u00eb vendosur ende:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eeb9189ecdb8c255f2b76918ec1954b5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/741c2f6df3e50c5ebb94c76e907efb33.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>T\u00eb tregoj nj\u00eb variant t\u00eb komplikuar t\u00eb instalimit t\u00eb certifikat\u00ebs. N\u00eb shumic\u00ebn e pajisjeve, mjafton thjesht t\u00eb klikoni mbi certifikat\u00ebn e shkarkuar.<\/i><\/p>\n<p>Kur certifikata \u00ebsht\u00eb instaluar, mund t\u00eb kaloni te lidhja:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4e2a8716b30634b3effdb0f2cbf781af.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>certifikata \u2014 specifikoni at\u00eb q\u00eb kemi instaluar<br \/>\np\u00ebrdorues anonim \u2014 guest<br \/>\n<\/i><\/p>\n<h3>macOS<\/h3>\n<p>\nPajisjet Apple n\u00eb kutin\u00eb mund t\u00eb lidhen vet\u00ebm me EAP-TLS, por gjithsesi duhet t'u d\u00ebrgoni atyre certifikat\u00ebn. P\u00ebr t\u00eb specifikuar nj\u00eb metod\u00eb tjet\u00ebr lidhjeje, duhet t\u00eb p\u00ebrdorni Apple Configurator 2. N\u00eb p\u00ebrputhje, duhet t\u00eb shkarkoni at\u00eb n\u00eb Mac, t\u00eb krijoni nj\u00eb profil t\u00eb ri dhe t\u00eb shtoni t\u00eb gjitha konfigurimet e nevojshme WiFi.<\/p>\n<p><b class=\"spoiler_title\">Apple Configurator<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1864dedc371b851dbf2594eff3ec7fc7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0847466b361f681bcfcabee92f1ac885.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>K\u00ebtu specifikoni emrin e rrjetit tuaj<br \/>\nLloji i Siguris\u00eb \u2014 WPA2 Enterprise<br \/>\nLlojet e pranuara EAP \u2014 TTLS<br \/>\nEmri i P\u00ebrdoruesit dhe Fjal\u00ebkalimi \u2014 i l\u00ebm\u00eb bosh<br \/>\nAutentikimi i Brendsh\u00ebm \u2014 PAP<br \/>\nIdentiteti i Jasht\u00ebm \u2014 klient <br \/>\n<\/i><\/p>\n<p><i>Tabi Trust. K\u00ebtu specifikoni domenin ton\u00eb<\/i><\/p>\n<p>E gjith\u00eb. Profili mund t\u00eb ruhet, t\u00eb n\u00ebnshkruhet dhe t\u00eb shp\u00ebrndahet n\u00eb pajisje<\/p>\n<p>Pasi q\u00eb profili t\u00eb jet\u00eb gati, duhet ta shkarkoni n\u00eb Mac dhe ta instaloni. Gjat\u00eb procesit t\u00eb instalimit, do t\u00eb duhet t\u00eb jepni username_ldap dhe password_ldap t\u00eb p\u00ebrdoruesit:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d7cb1cbcfd1de930d0718c1596bc60d7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/dd2e90a77fd9b64f6a98b0c0b21a080c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/c1cb62ec60fc835353c5e409a138f0be.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>iOS<\/h3>\n<p>\nProcesi \u00ebsht\u00eb i ngjash\u00ebm me macOS. Duhet t\u00eb p\u00ebrdorni profilin (mund ta p\u00ebrdorni t\u00eb nj\u00ebjtin si p\u00ebr macOS. Si t\u00eb krijoni nj\u00eb profil n\u00eb Apple Configurator, shihni m\u00eb sip\u00ebr).<\/p>\n<p>Shkarkoni profilin, instaloni, futur t\u00eb dh\u00ebnat e akountit, lidheni:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e2be411c0dfb427bfd54ad0b1f42dcb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d637fa93c0bcf09d1a5eb3701f769d4f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0908737918cd81cbf3e1ebf9ba0d9820.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/3821dc0bd6f866730575c6ceb3d5bbfb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/b4b0bf189ac037345e33e7864bfb2ad8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f5f9b7168ac14b67d6f4753d050a742e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00ebtu \u00ebsht\u00eb gjith\u00e7ka. Ne kemi konfiguruar serverin RADIUS, e kemi sinkronizuar me FreeIPA dhe i kemi treguar pikave t\u00eb qasjes Ubiquiti t\u00eb p\u00ebrdorin WPA2-EAP.<\/p>\n<h2>Pyetje t\u00eb mundshme<\/h2>\n<p>\n<b>P:<\/b> si t\u00eb transmetoj profilin \/ certifikat\u00ebn te punonj\u00ebsi?<\/p>\n<p><b>P:<\/b> T\u00eb gjitha certifikatat \/ profilet i ruaj n\u00eb FTP me qasje p\u00ebrmes uebit. Kam ngritur nj\u00eb rrjet mysafir me kufizim n\u00eb shpejt\u00ebsi dhe qasje vet\u00ebm n\u00eb internet, p\u00ebrve\u00e7 FTP. <br \/>\nAutentikimi q\u00ebndron 2 dit\u00eb, pas s\u00eb cil\u00ebs ri-setohet dhe klienti mbetet pa internet. Pra, kur punonj\u00ebsi d\u00ebshiron t\u00eb lidhet me WiFi, s\u00eb pari ai lidhet me rrjetin mysafir, hyn n\u00eb FTP, shkarkon certifikat\u00ebn ose profilin q\u00eb i nevojitet, i instalon ato, dhe pastaj mund t\u00eb lidhet me rrjetin korporativ.<\/p>\n<p><b>P:<\/b> pse nuk ta p\u00ebrdorim skem\u00ebn me MSCHAPv2? ajo \u00ebsht\u00eb m\u00eb e sigurt!<\/p>\n<p><b>P:<\/b> s\u00eb pari, nj\u00eb skem\u00eb e till\u00eb funksionon mir\u00eb n\u00eb NPS (Windows Network Policy System), n\u00eb implementimin ton\u00eb \u00ebsht\u00eb e nevojshme t\u00eb konfigurohet shtes\u00eb LDAP (FreeIpa) dhe t\u00eb ruajm\u00eb hash-t\u00eb e fjal\u00ebkalimeve n\u00eb server. Nuk \u00ebsht\u00eb e d\u00ebshirueshme t\u00eb b\u00ebhen konfigurations t\u00eb tjera, pasi kjo mund t\u00eb sjell\u00eb probleme t\u00eb ndryshme sinkronizimi t\u00eb p\u00ebrdoruesve. S\u00eb dyti, hashi p\u00ebrb\u00ebhet nga MD4, k\u00ebshtu q\u00eb kjo nuk e rrit ndjesh\u00ebm sigurin\u00eb.<\/p>\n<p><b>P:<\/b> a mund t\u00eb autorizohen pajisjet sipas adresave MAC?<\/p>\n<p><b>P:<\/b> JO, kjo nuk \u00ebsht\u00eb e sigurt, nj\u00eb sulmues mund t\u00eb manipuloj\u00eb adresat MAC, dhe p\u00ebr m\u00eb tep\u00ebr, autorizimi sipas adresave MAC nuk mb\u00ebshtetet n\u00eb shum\u00eb pajisje. <\/p>\n<p><b>P:<\/b> p\u00ebrse t\u00eb p\u00ebrdorim t\u00eb gjitha k\u00ebto certifikata? mund t\u00eb lidhemi edhe pa to.<\/p>\n<p><b>P:<\/b> Certifikatat p\u00ebrdoren p\u00ebr t\u00eb autorizuar serverin. Pra, pajisja gjat\u00eb lidhjes kontrollon n\u00ebse \u00ebsht\u00eb ky serveri q\u00eb mund t\u00eb besohet apo jo. N\u00ebse po, autentikimi vazhdon m\u00eb tej; n\u00ebse jo, lidhja mbyllet. Mund t\u00eb lidhesh pa certifikata, por n\u00ebse nj\u00eb sulmues ose fqinj ngrit nj\u00eb server radius dhe nj\u00eb pik\u00eb qasjeje me emrin e nj\u00ebjt\u00eb si i yni, ai mund t\u00eb kap\u00eb leht\u00ebsisht akreditimet e p\u00ebrdoruesit (mos harroni, sepse ato d\u00ebrgohen n\u00eb m\u00ebnyr\u00eb t\u00eb hapur). Kur p\u00ebrdoret nj\u00eb certifikat\u00eb, armiku do t\u00eb shoh\u00eb n\u00eb log-et e tij vet\u00ebm emrin ton\u00eb t\u00eb shpikur t\u00eb p\u00ebrdoruesit \u2014 guest ose client dhe nj\u00eb gabim t\u00eb tipit \u2014 Unknown CA Certificate.<\/p>\n<p><b class=\"spoiler_title\">pak m\u00eb shum\u00eb p\u00ebr macOS<\/b>Zakonisht, n\u00eb macOS, riparimi i sistemit b\u00ebhet n\u00ebp\u00ebrmjet internetit. N\u00eb modalitetin e rikuperimit, Mac-u duhet t\u00eb lidhet me WiFi, dhe k\u00ebtu nuk do t\u00eb funksionoj\u00eb as WiFi yn\u00eb korporativ, as rrjeti i mysafir\u00ebve. Personalish, ngrita nj\u00eb rrjet tjet\u00ebr, t\u00eb zakonsh\u00ebm me WPA2-PSK, t\u00eb fshehur, vet\u00ebm p\u00ebr operacione teknike. Ose gjithashtu mund t\u00eb krijosh paraprakisht nj\u00eb USB bootable me sistemin. Por n\u00ebse Mac-u \u00ebsht\u00eb pas vitit 2015, do t\u00eb duhet t\u00eb gjesh nj\u00eb adaptues p\u00ebr k\u00ebt\u00eb USB.)<\/p>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/463225\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0423\u0436\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e WiFi. \u0417\u0434\u0435\u0441\u044c \u044f \u0440\u0430\u0441\u043f\u0438\u0448\u0443 \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0411\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0439\u0441\u044f LDAP \u0441 \u0437\u0430\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u043f\u043e\u0434\u043d\u0438\u043c\u0435\u043c FreeRadius \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043c WPA2-Enterprise \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 Ubnt. \u0412\u0440\u043e\u0434\u0435 \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c\u2026 \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 EAP \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u0442\u044c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27785,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37065","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:33+00:00","article:modified_time":"2019-10-31T19:15:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37065","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:36:42","updated":"2026-01-22 05:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/37065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=37065"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/37065\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/27785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=37065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=37065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=37065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}