{"id":37065,"date":"2019-10-31T22:15:33","date_gmt":"2019-10-31T19:15:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/wifi-enterprise-freeradius-freeipa-ubiquiti\/"},"modified":"2019-10-31T22:15:33","modified_gmt":"2019-10-31T19:15:33","slug":"wifi-enterprise-freeradius-freeipa-ubiquiti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","title":{"rendered":"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4c045a0710e5eb14b73359afad484c3d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDisa ishin disa shembuj t\u00eb organizimit t\u00eb WiFi-s\u00eb p\u00ebr nd\u00ebrmarrje. K\u00ebtu do t\u00eb p\u00ebrshkruaj se si realizova nj\u00eb zgjidhje t\u00eb till\u00eb dhe problemet me t\u00eb cilat u p\u00ebrballa gjat\u00eb lidhjes n\u00eb pajisje t\u00eb ndryshme. Do t\u00eb p\u00ebrdorim LDAP-in ekzistues me p\u00ebrdorues tashm\u00eb t\u00eb regjistruar, do t\u00eb ngrem\u00eb FreeRadius dhe do t\u00eb konfigurojm\u00eb WPA2-Enterprise n\u00eb kontrollorin Ubnt. Duket e thjesht\u00eb. Le t\u00eb shohim\u2026<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Pak rreth metodave EAP<\/h2>\n<p>\nPara se t\u00eb v\u00ebm\u00eb n\u00eb pun\u00eb detyr\u00ebn, duhet t\u00eb p\u00ebrcaktojm\u00eb se cila metod\u00eb autentifikimi do t\u00eb p\u00ebrdorim n\u00eb zgjidhjen ton\u00eb.<\/p>\n<p><b>Nga Wikipedia:<\/b><\/p>\n<blockquote><p>EAP \u2014 \u00ebsht\u00eb nj\u00eb korniz\u00eb autentifikimi, q\u00eb p\u00ebrdoret shpesh n\u00eb rrjetet wireless dhe lidhjet pik\u00eb n\u00eb pik\u00eb. Formati u p\u00ebrshkrua p\u00ebr her\u00eb t\u00eb par\u00eb n\u00eb RFC 3748 dhe u azhurnua n\u00eb RFC 5247.<br \/>\nEAP p\u00ebrdoret p\u00ebr t\u00eb zgjedhur metod\u00ebn e autentikimit, transferimin e \u00e7el\u00ebsave dhe procesin e k\u00ebtyre \u00e7el\u00ebsave nga module t\u00eb quajtura metodat EAP. Ekzistojn\u00eb shum\u00eb metoda EAP, si ato t\u00eb p\u00ebrcaktuara s\u00eb bashku me EAP-n\u00eb, ashtu edhe ato t\u00eb l\u00ebshuara nga prodhues t\u00eb ndrysh\u00ebm. EAP nuk p\u00ebrcakton nivelin e kanalit, ai p\u00ebrcakton vet\u00ebm formatin e mesazheve. \u00c7do protokoll q\u00eb p\u00ebrdor EAP ka protokollin e vet t\u00eb inkapsulimit t\u00eb mesazheve EAP. <\/p><\/blockquote>\n<p>\n<b>Metodat vet\u00eb:<\/b><\/p>\n<ul>\n<li>LEAP \u2014 protokoll proprietar i zhvilluar nga CISCO. Jan\u00eb gjetur vulnerabilitete. Aktualisht nuk rekomandohet p\u00ebrdorimi. <\/li>\n<li> EAP-TLS \u2014 mir\u00ebpritet gjer\u00ebsisht nga ofruesit e lidhjeve wireless. \u00cbsht\u00eb nj\u00eb protokoll i sigurt, pasi \u00ebsht\u00eb pasardh\u00ebsi i standarteve SSL. Konfigurimi i klientit \u00ebsht\u00eb mjaft kompleks. Nevojitet nj\u00eb certifikat\u00eb klienti p\u00ebrve\u00e7 fjal\u00ebkalimit. Mb\u00ebshtetet n\u00eb shum\u00eb sisteme. <\/li>\n<li> EAP-TTLS \u2014 mb\u00ebshtetet gjer\u00ebsisht n\u00eb shum\u00eb sisteme, ofron nj\u00eb siguri t\u00eb mir\u00eb, duke p\u00ebrdorur certifikata PKI vet\u00ebm n\u00eb serverin e autentikimit. <\/li>\n<li> EAP-MD5 \u2014 nj\u00eb standard tjet\u00ebr i hapur. Ofron siguri minimale. \u00cbsht\u00eb vulnerab\u00ebl, nuk mb\u00ebshtet autentikimin e nd\u00ebrsjell\u00eb dhe gjenerimin e \u00e7el\u00ebsave. <\/li>\n<li> EAP-IKEv2 \u2014 bazohet n\u00eb protokollin e shk\u00ebmbimit t\u00eb \u00e7el\u00ebsave Internet versioni 2. Siguron autentikimin e nd\u00ebrsjellt\u00eb dhe vendosjen e \u00e7el\u00ebsit t\u00eb seanc\u00ebs midis klientit dhe serverit. <\/li>\n<li> PEAP \u2014 nj\u00eb zgjidhje e p\u00ebrbashk\u00ebt e CISCO, Microsoft dhe RSA Security si nj\u00eb standard i hapur. Gjat\u00eb p\u00ebrdorimit t\u00eb gjer\u00eb n\u00eb produkte, siguron siguri shum\u00eb t\u00eb mir\u00eb. \u00cbsht\u00eb e ngjashme me EAP-TTLS, duke k\u00ebrkuar vet\u00ebm nj\u00eb certifikat\u00eb n\u00eb an\u00ebn e serverit. <\/li>\n<li> PEAPv0\/EAP-MSCHAPv2 \u2014 pas EAP-TLS, kjo \u00ebsht\u00eb standardi i dyt\u00eb m\u00eb i p\u00ebrdorur n\u00eb bot\u00eb. P\u00ebrdor lidhjen klient-server n\u00eb Microsoft, Cisco, Apple, Linux. <\/li>\n<li> PEAPv1\/EAP-GTC \u2014 krijuar nga Cisco si nj\u00eb alternativ\u00eb p\u00ebr PEAPv0\/EAP-MSCHAPv2. Nuk mbron t\u00eb dh\u00ebnat e autentikimit n\u00eb asnj\u00eb rast. Nuk mb\u00ebshtetet n\u00eb Windows OS. <\/li>\n<li> EAP-FAST \u2014 nj\u00eb metod\u00eb e zhvilluar nga Cisco p\u00ebr t\u00eb riparuar dob\u00ebsit\u00eb e LEAP. P\u00ebrdor Credential t\u00eb Mbrojtur t\u00eb Qasjes (PAC). Nuk \u00ebsht\u00eb kompletuar plot\u00ebsisht. <\/li>\n<\/ul>\n<p>\nNga gjith\u00eb kjo shum\u00ebllojshm\u00ebri, zgjedhja nuk \u00ebsht\u00eb aq e madhe. Nga metoda e autentikimit k\u00ebrkohej: siguri e mir\u00eb, mb\u00ebshtetje n\u00eb t\u00eb gjitha pajisjet (Windows 10, macOS, Linux, Android, iOS) dhe, p\u00ebr m\u00eb tep\u00ebr, sa m\u00eb e thjesht\u00eb, aq m\u00eb mir\u00eb. Prandaj, zgjedhja ra n\u00eb EAP-TTLS n\u00eb lidhje me protokollin PAP. <br \/>\nMund t\u00eb lind nj\u00eb pyetje \u2014 Pse t\u00eb p\u00ebrdorim PAP? sepse ai transmeton fjal\u00ebkalimet n\u00eb form\u00eb t\u00eb hapur? <\/p>\n<p>Po, gjith\u00e7ka \u00ebsht\u00eb n\u00eb rregull. Komunikimi midis FreeRadius dhe FreeIPA do t\u00eb ndodhi pik\u00ebrisht k\u00ebshtu. N\u00eb modin edebugimit, mund t\u00eb monitoroni si d\u00ebrgohen emri i p\u00ebrdoruesit dhe fjal\u00ebkalimi. Dhe le t\u00eb d\u00ebrgohen, vet\u00ebm q\u00eb ju keni qasje n\u00eb serverin FreeRadius.<\/p>\n<p>Mund t\u00eb lexoni m\u00eb shum\u00eb rreth funksionimit t\u00eb EAP-TTLS <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.bmstu.wiki\/EAP-TTLS_(Tunneled_Transport_Layer_Security)\">k\u00ebtu<br \/>\n<\/a><\/noindex><\/p>\n<h2>FreeRADIUS<\/h2>\n<p>\nDo ta ngrem\u00eb FreeRadius n\u00eb CentOS 7.6. K\u00ebtu nuk ka asgj\u00eb t\u00eb komplikuar, e instalojm\u00eb n\u00eb m\u00ebnyr\u00eb t\u00eb zakonshme.<\/p>\n<pre><code class=\"bash\">yum install freeradius freeradius-utils freeradius-ldap -y<\/code><\/pre>\n<p>\n<i>Nga paketat, instalohet versioni 3.0.13. Mund t\u00eb merrni versionin m\u00eb t\u00eb fundit n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/freeradius.org\/\">https:\/\/freeradius.org\/<\/a><\/noindex><\/i><\/p>\n<p>Pas k\u00ebsaj, FreeRadius funksionon tashm\u00eb. Mund t\u00eb \u00e7aktivizoni rreshtin n\u00eb \/etc\/raddb\/users<\/p>\n<pre><code class=\"bash\">steve   Cleartext-Password := &quot;testing&quot;<\/code><\/pre>\n<p>\nNisni serverin n\u00eb modin e debugut<\/p>\n<pre><code class=\"bash\">freeradius -X<\/code><\/pre>\n<p>\nDhe b\u00ebjm\u00eb nj\u00eb test t\u00eb lidhjes nga localhost<\/p>\n<pre><code class=\"bash\">radtest steve testing 127.0.0.1 1812 testing123<\/code><\/pre>\n<p>\nMora p\u00ebrgjigjen <i>Received Access-Accept Id 115 from 127.0.0.1:1812 to 127.0.0.1:56081 length 20<\/i>, do t\u00eb thot\u00eb se gjith\u00e7ka \u00ebsht\u00eb mir\u00eb. Shkoi p\u00ebrpara.<\/p>\n<p>Lidhim modulin <i><b>ldap<\/b><\/i>.<\/p>\n<pre><code class=\"bash\">ln -s \/etc\/raddb\/mods-available\/ldap \/etc\/raddb\/mods-enabled\/ldap<\/code><\/pre>\n<p>\nDhe menj\u00ebher\u00eb do ta ndryshojm\u00eb at\u00eb. Na nevojitet q\u00eb FreeRadius t\u00eb mund t\u00eb qaset n\u00eb FreeIPA<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/ldap<\/b><\/p>\n<pre><code class=\"bash\">ldap {\nserver=&quot;ldap:\/\/ldap.server.com&quot;\nport=636\nstart_tls=yes\nidentity=&quot;uid=admin,cn=users,dc=server,dc=com&quot;\npassword=**********\nbase_dn=&quot;cn=users,dc=server,dc=com&quot;\nset_auth_type=yes\n...\nuser {\nbase_dn=&quot;${..base_dn}&quot;\nfilter=&quot;(uid=%{%{Stripped-User-Name}:-%{User-Name}})&quot;\n}\n...<\/code><\/pre>\n<p>Rinisni serverin radius dhe kontrolloni sinkronizimin e p\u00ebrdoruesve LDAP:<\/p>\n<pre><code class=\"bash\">radtest user_ldap password_ldap localhost 1812 testing123<\/code><\/pre>\n<p>\nPo redaktojm\u00eb eap n\u00eb <i><b>mods-enabled\/eap<\/b><\/i><br \/>\nK\u00ebtu do t\u00eb shtojm\u00eb dy ekzemplar\u00eb eap. Ata do t\u00eb ndryshojn\u00eb vet\u00ebm n\u00eb certifikat dhe \u00e7el\u00ebs. Pak m\u00eb posht\u00eb do t\u00eb shpjegoj pse pik\u00ebrisht k\u00ebshtu.<\/p>\n<p><b class=\"spoiler_title\">mods-enabled\/eap<\/b><\/p>\n<pre><code class=\"bash\">eap eap-client {                                                                                                                                                                                                                           default_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_file = ${certdir}\/fisrt.key\n           certificate_file = ${certdir}\/first.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = &quot;HIGH&quot;\n           cipher_server_preference = no\n           ecdh_curve = &quot;prime256v1&quot;\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = &quot;inner-tunnel&quot;\n           }\n}\neap eap-guest {\ndefault_eap_type = ttls                                                                                                                                                                                                                 timer_expire = 60                                                                                                                                                                                                                       ignore_unknown_eap_types = no                                                                                                                                                                                                          cisco_accounting_username_bug = no                                                                                                                                                                                                      max_sessions = ${max_requests}\n           tls-config tls-common {\n           private_key_passwotd=blablabla\n           private_key_file = ${certdir}\/server.key\n           certificate_file = ${certdir}\/server.crt\n           dh_file = ${certdir}\/dh\n           ca_path = ${cadir}\n           cipher_list = &quot;HIGH&quot;\n           cipher_server_preference = no\n           ecdh_curve = &quot;prime256v1&quot;\n           check_crl = no\n           }\n                                                                                                                                                                                                                                                                                                                                                                                                                                                 \n           ttls {\n           tls = tls-common\n           default_eap_type = md5\n           copy_request_to_tunnel = no\n           use_tunneled_reply = yes\n           virtual_server = &quot;inner-tunnel&quot;\n           }\n}<\/code><\/pre>\n<p>Pastaj editojm\u00eb <i><b>site-enabled\/default<\/b><\/i>. Interesohen seksionet authorize dhe authenticate.<\/p>\n<p><b class=\"spoiler_title\">site-enabled\/default<\/b><\/p>\n<pre><code class=\"bash\">authorize {\n  filter_username\n  preprocess\n  if (&User-Name == &quot;guest&quot;) {\n   eap-guest {\n       ok = return\n   }\n  }\n  elsif (&User-Name == &quot;client&quot;) {\n    eap-client {\n       ok = return \n    }\n  }\n  else {\n    eap-guest {\n       ok = return\n    }\n  }\n  ldap\n  if ((ok || updated) && User-Password) {\n    update {\n        control:Auth-Type := ldap\n    }\n  }\n  expiration\n  logintime\n  pap\n  }\n\nauthenticate {\n  Auth-Type LDAP {\n    ldap\n  }\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  pap\n}<\/code><\/pre>\n<p>N\u00eb seksionin authorize heqim t\u00eb gjitha modulet q\u00eb nuk na nevojiten. L\u00ebm\u00eb vet\u00ebm ldap. Shtojm\u00eb kontrollin e klientit sipas username-it. Pik\u00ebrisht p\u00ebr k\u00ebt\u00eb kemi shtuar dy instanca eap m\u00eb lart.<\/p>\n<p><b class=\"spoiler_title\">Multi EAP<\/b>E r\u00ebnd\u00ebsishme \u00ebsht\u00eb q\u00eb p\u00ebr lidhjen e disa pajisjeve do t\u00eb p\u00ebrdorim certifikatat sistemike dhe do t\u00eb caktom\u00eb domene. Ne kemi nj\u00eb certifikat\u00eb dhe \u00e7el\u00ebs nga nj\u00eb qend\u00ebr besimi p\u00ebr certifikim. Sipas mendimit tim, kjo procedur\u00eb lidhjeje \u00ebsht\u00eb m\u00eb e thjesht\u00eb se sa t\u00eb d\u00ebrgojm\u00eb \u00e7do pajisje nj\u00eb certifikat\u00eb t\u00eb vet\u00eb-n\u00ebnshkruar. Por gjithsesi nuk arrit\u00ebm pa certifikatat e vet\u00eb-n\u00ebnshkruara. Pajisjet Samsung dhe Android &lt;= versioni 6 nuk din\u00eb t\u00eb p\u00ebrdorin certifikatat sistemike. Prandaj, p\u00ebr to krijojm\u00eb nj\u00eb ekzemplar t\u00eb ve\u00e7ant\u00eb eap-guest me certifikata t\u00eb vet\u00eb-n\u00ebnshkruara. P\u00ebr t\u00eb gjitha pajisjet e tjera do t\u00eb p\u00ebrdorim eap-client me nj\u00eb certifikat\u00eb t\u00eb besuar. User-Name p\u00ebrcaktohet sipas fush\u00ebs Anonymous gjat\u00eb lidhjes s\u00eb pajisjes. Lejohet t\u00eb p\u00ebrdoren vet\u00ebm 3 vlera: Guest, Client dhe fusha e zbraz\u00ebt. T\u00eb gjitha t\u00eb tjerat do t\u00eb shp\u00ebrfillen. Kjo rregullohet n\u00eb politik\u00eb. Do t\u00eb jap nj\u00eb shembull pak m\u00eb von\u00eb.<\/p>\n<p>Do t\u00eb redaktojm\u00eb seksionet authorize dhe authenticate n\u00eb <i><b>site-enabled\/inner-tunnel<\/b><\/i><\/p>\n<p><b class=\"spoiler_title\">site-enabled\/inner-tunnel<\/b><\/p>\n<pre><code class=\"bash\">authorize {\n  filter_username\n  filter_inner_identity\n  update control {\n   &Proxy-To-Realm := LOCAL\n  }\n  ldap\n  if ((ok || updated) && User-Password) {\n    update {\n        control:Auth-Type := ldap\n    }\n  }\n  expiration\n  digest\n  logintime\n  pap\n  }\n\nauthenticate {\n  Auth-Type eap-guest {\n    eap-guest\n  }\n  Auth-Type eap-client {\n    eap-client\n  }\n  Auth-Type PAP {\n    pap\n  }\n  ldap\n}<\/code><\/pre>\n<p>M\u00eb pas, duhet t\u00eb p\u00ebrcaktojm\u00eb n\u00eb politika se cilat emra mund t\u00eb p\u00ebrdoren p\u00ebr hyrje anonime. Po editojm\u00eb <b><i>policy.d\/filter<\/i><\/b>.<\/p>\n<p>Duhet t\u00eb gjejm\u00eb rreshta t\u00eb ngjash\u00ebm me k\u00ebt\u00eb:<\/p>\n<pre><code class=\"bash\">if (&outer.request:User-Name !~ \/^(anon|@)\/) {\n  update request {\n    Module-Failure-Message = &quot;User-Name is not anonymized&quot;\n  }\n  reject\n}<\/code><\/pre>\n<p>\nDhe posht\u00eb te elsif, shtoni vlerat e nevojshme:<\/p>\n<pre><code class=\"bash\">elsif (&outer.request:User-Name !~ \/^(guest|client|@)\/) {\n  update request {\n    Module-Failure-Message = &quot;User-Name is not anonymized&quot;\n  }\n  reject\n}<\/code><\/pre>\n<p>\nTani na nevojitet t\u00eb kalojm\u00eb n\u00eb dosjen <b><i>certs<\/i><\/b>. K\u00ebtu duhet t\u00eb vendosim \u00e7el\u00ebsin dhe certifikat\u00ebn nga qendra e certifikimit t\u00eb besueshme q\u00eb e kemi tashm\u00eb, si dhe t\u00eb gjenerojm\u00eb certifikata t\u00eb vet\u00eb-n\u00ebnshkruara p\u00ebr eap-guest.<\/p>\n<p>Ndryshoni parametrat n\u00eb skedarin <b><i>ca.cnf<\/i><\/b>.<\/p>\n<p><b class=\"spoiler_title\">ca.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndefault_days = 3650\ndefault_md = sha256\n...\ninput_password = blablabla\noutput_password = blablabla\n...\ncountryName = RU\nstateOrProvinceNmae = State\nlocalityNmae = City\norganizationName = NONAME\nemailAddress = admin@admin.ru\ncommonName = &quot;CA FreeRadius&quot;<\/code><\/pre>\n<p>Vlera t\u00eb nj\u00ebjta vendosim n\u00eb skedarin <b><i><i>server.cnf<\/i><\/i><\/b>. Ndryshojm\u00eb vet\u00ebm <br \/>\n<b>commonName<\/b>:<\/p>\n<p><b class=\"spoiler_title\">server.cnf<\/b><\/p>\n<pre><code class=\"bash\">\n...\ndefault_days = 3650\ndefault_md = sha256\n...\ninput_password = blablabla\noutput_password = blablabla\n...\ncountryName = RU\nstateOrProvinceNmae = State\nlocalityNmae = City\norganizationName = NONAME\nemailAddress = admin@admin.ru\ncommonName = &quot;Server Certificate FreeRadius&quot;<\/code><\/pre>\n<p>Krijojm\u00eb:<\/p>\n<pre><code class=\"bash\">make<\/code><\/pre>\n<p>\nGati. T\u00eb marra <b><i>server.crt<\/i><\/b> dhe <b><i>server.key<\/i><\/b> jan\u00eb p\u00ebrmendur tashm\u00eb m\u00eb lart\u00eb n\u00eb eap-guest.<\/p>\n<p>Dhe e fundit, do t\u00eb shtojm\u00eb pikat tona t\u00eb qasjes n\u00eb skedarin <b><i>client.conf<\/i><\/b>. Kam i till\u00eb 7. P\u00ebr t\u00eb mos e shtuar \u00e7do pik\u00eb ve\u00e7mas, do t\u00eb shkruajm\u00eb vet\u00ebm rrjetin ku ndodhen ato (pikat e mia t\u00eb qasjes ndodhen n\u00eb VLAN t\u00eb ve\u00e7ant\u00eb).<\/p>\n<pre><code class=\"bash\">client APs {\nipaddr = 192.168.100.0\/24\npassword = password_AP\n}<\/code><\/pre>\n<p><\/p>\n<h2>Kontrolluesi Ubiquiti<\/h2>\n<p>\nN\u00eb kontrollues do t\u00eb ngrisim nj\u00eb rrjet t\u00eb ve\u00e7ant\u00eb. Le t\u00eb jet\u00eb 192.168.2.0\/24<br \/>\nShkoni te cil\u00ebsimet -&gt; profili. Krijoni nj\u00eb t\u00eb ri:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/57d97f7ef2db1a62633aa16131435065.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nShkruani adres\u00ebn dhe portin e serverit radius dhe fjal\u00ebkalimin q\u00eb shkruajt\u00ebt n\u00eb skedarin <b><i>clients.conf<\/i><\/b>:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/edab8e5ef03897c88bb45b2912e577ec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKrijoni nj\u00eb em\u00ebr t\u00eb ri p\u00ebr rrjetin pa tela. Si metod\u00eb autentikimi zgjidhni WPA-EAP (Enterprise) dhe sh\u00ebnoni profilin e krijuar radius:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9dc918b734cac3d7382db796feb6b7a2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00eb gjitha i ruajm\u00eb, i aplikojm\u00eb dhe vazhdojm\u00eb.<\/p>\n<h2>Cil\u00ebsimi i klient\u00ebve<\/h2>\n<p>\nT\u00eb fillojm\u00eb me m\u00eb t\u00eb v\u00ebshtir\u00ebn!<\/p>\n<h3>Windows 10<\/h3>\n<p>\nV\u00ebshtir\u00ebsia \u00ebsht\u00eb se Windows ende nuk di t\u00eb lidhet me WiFi-n\u00eb e korporat\u00ebs p\u00ebrmes domenit. Prandaj, duhet t'i hedhim manualisht certifikat\u00ebn ton\u00eb n\u00eb dyqanin e certifikatave t\u00eb besuara. K\u00ebtu mund t\u00eb p\u00ebrdorim si certifikat\u00eb t\u00eb vet\u00eb-n\u00ebnshkruar ashtu edhe nga qendra e certifikimit. Un\u00eb do t\u00eb p\u00ebrdor t\u00eb dyt\u00ebn. <\/p>\n<p>M\u00eb pas, duhet t\u00eb krijoni nj\u00eb lidhje t\u00eb re. P\u00ebr k\u00ebt\u00eb shkoni n\u00eb parametrat e rrjetit dhe Internetit -&gt; Qendra e menaxhimit t\u00eb rrjeteve dhe ndarjes s\u00eb p\u00ebrbashk\u00ebt -&gt; Krijoni dhe konfiguroni nj\u00eb lidhje ose rrjet t\u00eb ri:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/406e515cff889ea70e226116f1dc0521.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f88e592920e43d42cc7fed34423f09ea.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1d7c045e02eb8e3b14016aacfa00da4c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nManually enter the network name and change the security type. Then click on <i>change connection settings<\/i> and in the Security tab select network authentication \u2014 EAP-TTLS.<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/7e736b4cffd6dca5fdd9df70cedd7988.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/6c328ff8b4a434ed488c46b594aa5108.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d4a3d2883088a06592addae770a12a16.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGo to the settings, enter the authentication confidentiality \u2014 <b>client<\/b>. As the trusted certificate authority, select the certificate we added, check the box \"Do not prompt the user if server authorization fails\" and for the authentication method select \u2014 unencrypted password (PAP).<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb4897493f805f0d8869c22a1b706dec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNext, go to advanced settings, check the box for \"Specify authentication mode\". Choose the \"User authentication\" option and click on <i>save credentials<\/i>. Here, you will need to enter username_ldap and password_ldap<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/469bb4337e4e601a80de1021a48bc101.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/999dc6c41a69b22c8de2b49398c9a613.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/75347f2f7140cac58a181a325ab0f3ad.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEverything is saved, apply, and close. You can connect to the new network.<\/p>\n<h3>Linux<\/h3>\n<p>\nI tested it on Ubuntu 18.04, 18.10, Fedora 29, 30.<\/p>\n<p>To start, let's download the certificate. I did not find in Linux if there is a way to use system certificates and if there is even such a repository. <\/p>\n<p>Do t\u00eb lidhemi p\u00ebrmes domainit. Prandaj nevojitet nj\u00eb certifikat\u00eb e autoritetit t\u00eb certifikimit nga i cili u ble certifikata jon\u00eb.<\/p>\n<p>E gjith\u00eb lidhja b\u00ebhet n\u00eb nj\u00eb dritare. Zgjidhim rrjetin ton\u00eb:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e05f44a52ee7290921b5b74df718a0c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>anonim \u2014 klient<br \/>\ndomen \u2014 domeni p\u00ebr t\u00eb cilin \u00ebsht\u00eb l\u00ebshuar certifikata<br \/>\n<\/i><\/p>\n<h3>Android<\/h3>\n<p><\/p>\n<h4>non-Samsung<\/h4>\n<p>\nNga versioni C 7 mund t\u00eb p\u00ebrdorni certifikatat sistemore duke specifikuar vet\u00ebm domenin gjat\u00eb lidhjes WiFi:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f935493cbe35f5a19c4da8bb5632604f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>domen \u2014 domeni p\u00ebr t\u00eb cilin \u00ebsht\u00eb l\u00ebshuar certifikata<br \/>\nanonim \u2014 klient<br \/>\n<\/i><\/p>\n<h4>Samsung<\/h4>\n<p>\nSi\u00e7 e p\u00ebrmenda m\u00eb lart, pajisjet Samsung nuk e kan\u00eb kapacitetin t\u00eb p\u00ebrdorin certifikatat sistemore gjat\u00eb lidhjes WiFi dhe nuk kan\u00eb mund\u00ebsi t\u00eb lidhen p\u00ebrmes domainit. Prandaj duhen shtuar manualisht certifikat\u00ebn rr\u00ebnj\u00ebsore t\u00eb autoritetit t\u00eb certifikimit (ca.pem, e marra n\u00eb serverin Radius). K\u00ebtu do t\u00eb p\u00ebrdorim at\u00eb t\u00eb n\u00ebnshkruar vet\u00eb.<\/p>\n<p>Shkarkoni certifikat\u00ebn n\u00eb pajisjen tuaj dhe instaloje.<\/p>\n<p><b class=\"spoiler_title\">Instalimi i certifikat\u00ebs<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d02770f35c44a618f2f6243085c258b8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eb9ec984d5e68824ebd0b138551a87c2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/2c5c95c339b00085845470fdff56932e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1561758abad60a168e067f1ecb0b94f5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb k\u00ebt\u00eb rast, do t'ju duhet t\u00eb vendosni nj\u00eb model p\u00ebr \u00e7el\u00ebsin e hapjes, pin-kod ose fjal\u00ebkalim, n\u00ebse nuk \u00ebsht\u00eb vendosur ende:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/eeb9189ecdb8c255f2b76918ec1954b5.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/741c2f6df3e50c5ebb94c76e907efb33.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Tregova variantin e nd\u00ebrlikuar t\u00eb instalimit t\u00eb certifikat\u00ebs. N\u00eb shumic\u00ebn e pajisjeve mjafton thjesht t\u00eb shtypni n\u00eb certifikat\u00ebn e shkarkuar.<\/i><\/p>\n<p>Kur certifikata t\u00eb jet\u00eb instaluar, mund t\u00eb kaloni te lidhja:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/4e2a8716b30634b3effdb0f2cbf781af.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>certifikata \u2014 specifikoni at\u00eb q\u00eb keni instaluar<br \/>\np\u00ebrdorues anonim \u2014 guest<br \/>\n<\/i><\/p>\n<h3>macOS<\/h3>\n<p>\nPajisjet Apple nga kutia mund t\u00eb lidhen vet\u00ebm me EAP-TLS, por ende \u00ebsht\u00eb e nevojshme t\u00eb dor\u00ebzohet certifikata. P\u00ebr t\u00eb specifikuar nj\u00eb metod\u00eb tjet\u00ebr lidhjeje, nevojitet t\u00eb p\u00ebrdoret Apple Configurator 2. Prandaj, duhet s\u00eb pari ta shkarkoni at\u00eb n\u00eb Mac-in tuaj, t\u00eb krijoni nj\u00eb profil t\u00eb ri dhe t\u00eb shtoni t\u00eb gjitha cil\u00ebsimet e nevojshme p\u00ebr WiFi.<\/p>\n<p><b class=\"spoiler_title\">Apple Configurator<\/b><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/1864dedc371b851dbf2594eff3ec7fc7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0847466b361f681bcfcabee92f1ac885.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>K\u00ebtu specifikoni emrin e rrjetit tuaj<br \/>\nLloji i Siguris\u00eb \u2014 WPA2 Enterprise<br \/>\nLlojet e pranuara t\u00eb EAP \u2014 TTLS<br \/>\nEmri i p\u00ebrdoruesit dhe Fjal\u00ebkalimi \u2014 l\u00ebn\u00eb bosh<br \/>\nAutentikimi i Brendsh\u00ebm \u2014 PAP<br \/>\nIdentiteti Jasht\u00eb \u2014 klient <br \/>\n<\/i><\/p>\n<p><i>Skeda Trust. K\u00ebtu specifikoni domenin ton\u00eb<\/i><\/p>\n<p>E gjitha. Profili mund t\u00eb ruhet, t\u00eb n\u00ebnshkruhet dhe t\u00eb shp\u00ebrndahet n\u00eb pajisje.<\/p>\n<p>Pas p\u00ebrfundimit t\u00eb profilit, duhet ta shkarkoni n\u00eb Mac dhe ta instaloni. Gjat\u00eb procesit t\u00eb instalimit, do t'ju nevojitet t\u00eb jepni username_ldap dhe password_ldap t\u00eb p\u00ebrdoruesit:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d7cb1cbcfd1de930d0718c1596bc60d7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/dd2e90a77fd9b64f6a98b0c0b21a080c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/c1cb62ec60fc835353c5e409a138f0be.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>iOS<\/h3>\n<p>\nProcesi \u00ebsht\u00eb i nj\u00ebjt\u00eb me macOS. Duhet p\u00ebrdorur profili (mund t\u00eb jet\u00eb po ai si p\u00ebr macOS. Si t\u00eb krijoni profil n\u00eb Apple Configurator, shih mbi).<\/p>\n<p>Shkarkohet profili, instalohet, jepen kredencialet, lidhemi:<\/p>\n<p><img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/9e2be411c0dfb427bfd54ad0b1f42dcb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/d637fa93c0bcf09d1a5eb3701f769d4f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/0908737918cd81cbf3e1ebf9ba0d9820.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/3821dc0bd6f866730575c6ceb3d5bbfb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/b4b0bf189ac037345e33e7864bfb2ad8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti\" src=\"\/wp-content\/uploads\/2019\/08\/f5f9b7168ac14b67d6f4753d050a742e.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00ebtu p\u00ebrfundon. Ne e konfiguram serverin Radius, e sinkronizuam me FreeIPA dhe i tham\u00eb pikave t\u00eb aksesit Ubiquiti t\u00eb p\u00ebrdorin WPA2-EAP.<\/p>\n<h2>P\u00ebrdoruesit e mundsh\u00ebm<\/h2>\n<p>\n<b>M:<\/b> si t\u00eb d\u00ebrgoni profilin\/certifikat\u00ebn tek punonj\u00ebsi?<\/p>\n<p><b>O:<\/b> T\u00eb gjitha certifikatat\/profilat i mbaj n\u00eb FTP me qasje p\u00ebrmes webit. Kam ngritur nj\u00eb rrjet mysafir me kufizim n\u00eb shpejt\u00ebsi dhe akses vet\u00ebm n\u00eb internet, p\u00ebrve\u00e7 FTP-s\u00eb. <br \/>\nAutentikimi zgjat 2 dit\u00eb, pas s\u00eb cil\u00ebs konsiderohet i skaduar dhe klienti mbetet pa internet. K\u00ebshtu, kur nj\u00eb punonj\u00ebs d\u00ebshiron t\u00eb lidhet me WiFi, s\u00eb pari lidhet me rrjetin mysafir, hyn n\u00eb FTP, shkarkon certifikat\u00ebn ose profilin e nevojsh\u00ebm, i instalon ato, dhe pastaj mund t\u00eb lidhet me rrjetin korporativ.<\/p>\n<p><b>M:<\/b> P\u00ebrse nuk t\u00eb p\u00ebrdorim skem\u00ebn me MSCHAPv2? Ajo \u00ebsht\u00eb m\u00eb e sigurt!<\/p>\n<p><b>O:<\/b> S\u00eb pari, nj\u00eb skem\u00eb e till\u00eb funksionon mir\u00eb n\u00eb NPS (Windows Network Policy System), n\u00eb implementimin ton\u00eb \u00ebsht\u00eb e nevojshme t\u00eb konfigurohet p\u00ebr m\u00eb tep\u00ebr LDAP (FreeIpa) dhe t\u00eb ruhet hash-i i fjal\u00ebkalimeve n\u00eb server. Nuk \u00ebsht\u00eb e d\u00ebshirueshme t\u00eb b\u00ebnim konfigurime shtes\u00eb, pasi kjo mund t\u00eb \u00e7oj\u00eb n\u00eb probleme t\u00eb ndryshme sinkronizimi. S\u00eb dyti, hash-i p\u00ebrb\u00ebhet nga MD4, k\u00ebshtu q\u00eb kjo nuk e rrit ndjesh\u00ebm sigurin\u00eb.<\/p>\n<p><b>M:<\/b> A \u00ebsht\u00eb e mundur t\u00eb autorizoni pajisjet sipas adresave MAC?<\/p>\n<p><b>O:<\/b> JO, kjo nuk \u00ebsht\u00eb e sigurt, nj\u00eb sulmues mund t\u00eb manipuloj\u00eb adresat MAC, dhe p\u00ebr m\u00eb tep\u00ebr, autorizimi sipas adresave MAC nuk mb\u00ebshtetet nga shum\u00eb pajisje. <\/p>\n<p><b>M:<\/b> pse p\u00ebrdoren k\u00ebto certifikata? A nuk mund t\u00eb lidhemi edhe pa to?<\/p>\n<p><b>O:<\/b> Certifikatat p\u00ebrdoren p\u00ebr t\u00eb autentikuar serverin. Kjo do t\u00eb thot\u00eb se pajisja, gjat\u00eb lidhjes, kontrollon n\u00ebse ky \u00ebsht\u00eb serveri besnik apo jo. N\u00ebse po, autentikimi vazhdon; ndryshe, lidhja mbyllet. Mund t\u00eb lidhemi pa certifikata, por n\u00ebse nj\u00eb keqb\u00ebr\u00ebs ose fqinj ngrin nj\u00eb server radius dhe nj\u00eb pik\u00eb qasje me t\u00eb nj\u00ebjtin em\u00ebr si i yni, ai mund t\u00eb kap\u00eb leht\u00ebsisht t\u00eb dh\u00ebnat e p\u00ebrdoruesit (mos harrojm\u00eb se ato d\u00ebrgohen n\u00eb form\u00eb t\u00eb hapur). Kur p\u00ebrdoret certifikati, armiku do t\u00eb shoh\u00eb n\u00eb regjistrat e tij vet\u00ebm emrat tan\u00eb t\u00eb rreme \u2014 guest ose client dhe nj\u00eb gabim si \u2014 Certificate CA i Panjohur.<\/p>\n<p><b class=\"spoiler_title\">pak m\u00eb shum\u00eb p\u00ebr macOS<\/b>Zakonisht n\u00eb macOS, ribashkimi i sistemit b\u00ebhet p\u00ebrmes internetit. N\u00eb m\u00ebnyr\u00ebn e rikuperimit, Mac-i duhet t\u00eb lidhet me WiFi, dhe k\u00ebtu nuk do t\u00eb funksionoj\u00eb as WiFi yn\u00eb korporativ, as rrjeti mysafir. Personalish, ngrita nj\u00eb rrjet tjet\u00ebr, t\u00eb zakonsh\u00ebm me WPA2-PSK, t\u00eb fshehur, vet\u00ebm p\u00ebr operacione teknike. Ose mund t\u00eb krijoni nj\u00eb USB bootable me sistemin paraprakisht. Por n\u00ebse Mac-u \u00ebsht\u00eb pas vitit 2015, do t'ju nevojitet gjithashtu nj\u00eb adapter p\u00ebr k\u00ebt\u00eb USB)<\/p>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/463225\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0423\u0436\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e WiFi. \u0417\u0434\u0435\u0441\u044c \u044f \u0440\u0430\u0441\u043f\u0438\u0448\u0443 \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0411\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0439\u0441\u044f LDAP \u0441 \u0437\u0430\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u043f\u043e\u0434\u043d\u0438\u043c\u0435\u043c FreeRadius \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043c WPA2-Enterprise \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 Ubnt. \u0412\u0440\u043e\u0434\u0435 \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c\u2026 \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 EAP \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u0442\u044c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27785,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37065","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0423\u0436\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e WiFi. \u0417\u0434\u0435\u0441\u044c \u044f \u0440\u0430\u0441\u043f\u0438\u0448\u0443 \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0411\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0439\u0441\u044f LDAP \u0441 \u0437\u0430\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u043f\u043e\u0434\u043d\u0438\u043c\u0435\u043c FreeRadius \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043c WPA2-Enterprise \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 Ubnt. \u0412\u0440\u043e\u0434\u0435 \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c\u2026 \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 EAP \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u0442\u044c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0423\u0436\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e WiFi. \u0417\u0434\u0435\u0441\u044c \u044f \u0440\u0430\u0441\u043f\u0438\u0448\u0443 \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0411\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0439\u0441\u044f LDAP \u0441 \u0437\u0430\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u043f\u043e\u0434\u043d\u0438\u043c\u0435\u043c FreeRadius \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043c WPA2-Enterprise \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 Ubnt. \u0412\u0440\u043e\u0434\u0435 \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c\u2026 \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 EAP \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u0442\u044c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","description":"Disa shembuj t\u00eb organizimit t\u00eb WiFi korporativ tashm\u00eb jan\u00eb p\u00ebrshkruar. K\u00ebtu do t\u00eb shkruaj se si realizova nj\u00eb zgjidhje t\u00eb ngjashme dhe problemet me t\u00eb cilat u p\u00ebrballa gjat\u00eb lidhjes n\u00eb pajisje t\u00eb ndryshme. Do t\u00eb p\u00ebrdorim LDAP-in ekzistues me p\u00ebrdoruesit e regjistruar, do t\u00eb ngrem\u00eb FreeRadius dhe do t\u00eb konfigurojm\u00eb WPA2-Enterprise n\u00eb kontrollorin Ubnt. Duket gjith\u00e7ka e thjesht\u00eb. Le t\u00eb shohim\u2026 Pak p\u00ebr metodat EAP Para se t\u00eb fillojm\u00eb ekzekutimin","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47WiFi Enterprise. FreeRadius + FreeIPA + Ubiquiti | ProHoster","og:description":"\u0423\u0436\u0435 \u0431\u044b\u043b\u0438 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u044b \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e WiFi. \u0417\u0434\u0435\u0441\u044c \u044f \u0440\u0430\u0441\u043f\u0438\u0448\u0443 \u043a\u0430\u043a \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445. \u0411\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0436\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0439\u0441\u044f LDAP \u0441 \u0437\u0430\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438, \u043f\u043e\u0434\u043d\u0438\u043c\u0435\u043c FreeRadius \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u043c WPA2-Enterprise \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 Ubnt. \u0412\u0440\u043e\u0434\u0435 \u0432\u0441\u0435 \u043f\u0440\u043e\u0441\u0442\u043e. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c\u2026 \u041d\u0435\u043c\u043d\u043e\u0433\u043e \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 EAP \u041f\u0440\u0435\u0436\u0434\u0435 \u0447\u0435\u043c \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u0442\u044c \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/wifi-enterprise-freeradius-freeipa-ubiquiti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:33+00:00","article:modified_time":"2019-10-31T19:15:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37065","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 05:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:36:42","updated":"2026-01-22 05:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/37065","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=37065"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/37065\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/27785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=37065"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=37065"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=37065"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}