ืขืืืขืืข ืืืืฉืคืืื ืคืื ืึธืจืืึทื ืืืืื ื ืคึฟืืจืืข WiFi ืืึธืื ืฉืืื ืืืกืงืจืืืื. ืืึธ ืืื ืืืขื ืืึทืฉืจืืึทืื ืืื ืืื ืืืคึผืืึทืืขื ืึทื ืึท ืขื ืืขื ืืืืืื ื ืืื ืื ืคึผืจืึธืืืขืืก ืืื ืืขืคึผืืึธื ืืขืจื ืืืขื ืงืึทื ืขืงืืื ื ืืืืฃ ืคืึทืจืฉืืืขื ืข ืืขืืืืกืขืก. ืืืจ ืืืขืื ื ืืฆื ืื ืืืืืกืืื ื LDAP ืืื ืืขืืจืื ืืขื ืืืืขืจื, ืื ืกืืึทืืืจื FreeRadius ืืื ืงืึทื ืคืืืืขืจ WPA2-Enterprise ืืืืฃ ืื Ubnt ืงืึธื ืืจืึธืืืขืจ. ืึทืืฅ ืืืื ื ืคึผืฉืื. ืืืืืจ ืืขืืโฆ
ื ืืืกื ืืืขืื EAP ืืขืืืึธืืก
ืืืืืขืจ ืืืจ ืึธื ืืืืื ืื ืึทืจืืขื, ืืืจ ืืึทืจืคึฟื ืฆื ืืึทืฉืืืกื ืืืึธืก ืึธืืขื ืืึทืงืืืฉืึทื ืืืคึฟื ืืืจ ืืืขืื ื ืืฆื ืืื ืืื ืืืขืจ ืืืืืื ื.
ืคึฟืื ืืืืงืืคึผืขืืืข:
EAP ืืื ืึท ืึธืืขื ืืึทืงืืืฉืึทื ืคืจืืืืืืขืจืง ืืืึธืก ืืื ืึธืคื ืืขื ืืฆื ืืื ืืืืืจืืืก ื ืขืืืืึธืจืงืก ืืื ืคืื ื-ืฆื-ืคืื ื ืงืึทื ืขืงืฉืึทื ื. ืืขืจ ืคึฟืึธืจืืึทื ืืื ืืขืืืขื ืขืจืฉืืขืจ ืืืกืงืจืืืื ืืื RFC 3748 ืืื ืืขืจืืืึทื ืืืงื ืืื RFC 5247.
EAP ืืื ืืขื ืืฆื ืฆื ืืืืกืงืืืึทืื ืึทื ืึธืืขื ืืึทืงืืืฉืึทื ืืืคึฟื, ืึทืจืืืขืจืคืืจื ืฉืืืกืืขื ืืื ืคึผืจืึธืฆืขืก ืื ืฉืืืกืืขื ืืืจื ืคึผืืืืื ืก ืืขืจืืคื EAP ืืขืืืึธืืก. ืขืก ืืขื ืขื ืคืืืข EAP ืืขืืืึธืืก, ืืืืืข ืืืคืืื ื ืืื EAP ืืื ืืื ืื ืจืขืืขืึทืกืขื ืืืจื ืืืื ืืืขื ืืึธืจืก. EAP ืืขืคืื ืืจื ื ืืฉื ืื ืืื ืง ืฉืืืืข, ืขืก ืืืคืืื ื ืืืืื ืื ืึธื ืืึธื ืคึฟืึธืจืืึทื. ืืขืืขืจ ืคึผืจืึธืืึธืงืึธื ืืืึธืก ื ืืฆื EAP ืืื ืืืื ืืืืืขื ืข EAP ืึธื ืืึธื ืขื ืงืึทืคึผืกืืืึทืืืึธื ืคึผืจืึธืืึธืงืึธื.
ืื ืืขืืืึธืืก ืืื:
- LEAP ืืื ืึท ืคึผืจืึทืคึผืจืืืึทืืขืจื ืคึผืจืึธืืึธืงืึธื ืืขืืืขืืึธืคึผืขื ืืืจื CISCO. ืืืึทืื ืขืจืึทืืืืืืื ืืขืคืื ืขื. ืืขืจืืืืึทื ื ืื ืจืขืงืึทืืขื ืืื ืคึฟืึทืจ ื ืืฆื
- EAP-TLS ืืื ืืขืืื ื ืืขืฉืืืฆื ืฆืืืืฉื ืืืืืจืืืก ืืืขื ืืึธืจืก. ืขืก ืืื ืึท ืืืืขืจ ืคึผืจืึธืืึธืงืึธื ืืืืึทื ืขืก ืืื ืืขืจ ืกืึทืงืกืขืกืขืจ ืฆื ืื SSL ืกืืึทื ืืึทืจืืก. ืืึทืฉืืขืืืงื ืืขื ืงืืืขื ื ืืื ืืึทื ืฅ ืงืึธืืคึผืืืฆืืจื. ืืืจ ืืึทืจืคึฟื ืึท ืงืืืขื ื ืืึทืืืืึทืื ืืื ืึทืืืฉืึทื ืฆื ืื ืคึผืึทืจืึธื. ืืขืฉืืืฆื ืืืืฃ ืคืืืข ืกืืกืืขืืขื
- EAP-TTLS - ืืืืืืื ืืขืฉืืืฆื ืืืืฃ ืคืืืข ืกืืกืืขืืขื, ืึธืคืคืขืจืก ืืื ืืืืขืจืืืื ื ืืฆื PKI ืกืขืจืืืคืืงืึทืฅ ืืืืื ืืืืฃ ืื ืึธืืขื ืืึทืงืืืฉืึทื ืกืขืจืืืขืจ
- EAP-MD5 ืืื ืื ืื ืืขืจ ืึธืคึฟื ื ืึธืจืืึทื. ืึธืคืคืขืจืก ืืื ืืืึทื ืืืืขืจืืืึทื. ืฉืคึผืืจืขืืืืืง, ืืื ื ืืฉื ืฉืืืฆื ืงืขืื ืฆืืึทืืืง ืึธืืขื ืืึทืงืืืฉืึทื ืืื ืฉืืืกื ืืืจ
- EAP-IKEv2 - ืืืืืจื ืืืืฃ ืืื ืืขืจื ืขื ืืืจืืคึฟืึทื ืขืงืกืืฉืึทื ืืข ืคึผืจืึธืืึธืงืึธื ืืืขืจืกืืข 2. ืคึผืจืึธืืืืืขืก ืงืขืื ืฆืืึทืืืง ืึธืืขื ืืึทืงืืืฉืึทื ืืื ืกืขืกืืข ืฉืืืกื ืคืึทืจืืืืื ืฆืืืืฉื ืงืืืขื ื ืืื ืกืขืจืืืขืจ
- PEAP ืืื ืึท ืฉืืึธืก ืืืืืื ื ืฆืืืืฉื CISCO, Microsoft ืืื RSA Security ืืื ืึทื ืึธืคึฟื ื ืึธืจืืึทื. ืืืืืืื ืื ืืืฆื ืืื ืคึผืจืึธืืืงืื, ืืื ืืืืขืจ ืืื ืืืืขืจืงืืึทื. ืขื ืืขื ืฆื EAP-TTLS, ืจืืงืืืืืจืื ื ืืืืื ืึท ืกืขืจืืืขืจ ืืืึทื ืืึทืืืืึทืื
- PEAPv0/EAP-MSCHAPv2 - ื ืึธื EAP-TLS, ืืึธืก ืืื ืืขืจ ืฆืืืืื ืืืืืืื ืืขืืืืื ื ื ืึธืจืืึทื ืืื ืืขืจ ืืืขืื. ืืขืืืืื ื ืงืืืขื ื-ืกืขืจืืืขืจ ืฉืืืืืช ืืื ืืืืงืจืึธืกืึธืคึฟื, ืกืืกืงืึธ, ืขืคึผื, ืืื ืืงืก
- PEAPv1/EAP-GTC - ืืืฉืืคื ืืืจื Cisco ืืื ืึทื ืึธืืืขืจื ืึทืืืื ืฆื PEAPv0/EAP-MSCHAPv2. ืืื ื ืืฉื ืืึทืฉืืฆื ืึธืืขื ืืึทืงืืืฉืึทื ืืึทืื ืืื ืงืืื ืืืขื. ื ืื ืืขืฉืืืฆื ืืืืฃ Windows OS
- EAP-FAST ืืื ืึท ืืขืืึธื ืืขืืืขืืึธืคึผืขื ืืืจื Cisco ืฆื ืคืึทืจืจืืืื ืื ืฉืึธืจืืงืึธืืื ืืก ืคืื LEAP. ื ืืฆื ืคึผืจืึธืืขืงืืขื ืึทืงืกืขืก ืงืจืขืืขื ืืืึทื (PAC). ืืึธืจ ืึทื ืคืื ืืฉื
ืคืื ืึทืืข ืืขื ืคืึทืจืฉืืืื ืงืืึทื, ืื ืืจืืจื ืืื ื ืึธื ื ืืฉื ืืจืืืก. ืื ืึธืืขื ืืึทืงืืืฉืึทื ืืืคึฟื ืคืืจืืื ืื: ืืื ืืืืขืจืืืื, ืฉืืืฆื ืืืืฃ ืึทืืข ืืขืืืืกืขืก (ืืืื ืืึธืื 10, ืืึทืงืึธืก, ืืื ืืงืก, ืึทื ืืจืืื, ืืึธืก) ืืื, ืืื ืคืึทืงื, ืื ืกืืืคึผืืขืจ ืื ืืขืกืขืจ. ืืขืจืืืขืจ, ืื ืืจืืจื ืืื ืืขืคืืื ืืืืฃ EAP-TTLS ืืื ืงืึทื ืืืฉืึทื ืืงืฉืึทื ืืื ืื PAP ืคึผืจืึธืืึธืงืึธื.
ืื ืงืฉืื ืงืขื ืืืืคืฉืืืื - ืคืืจืืืืก ื ืืฆื PAP? ื ืึธื ืึทืืข, ืขืก ืืจืึทื ืืืืฅ ืคึผืึทืกืืืขืจืื ืืื ืงืืึธืจ ืืขืงืกื?
ืื ืืืก ืืื ืืืืจ. ืงืึธืืื ืืงืึทืฆืืข ืฆืืืืฉื FreeRadius ืืื FreeIPA ืืืขื ืคึผืึทืกืืจื ืคึผืื ืงื ืืื ืืึธืก. ืืื ืืืืึทื ืืึธืืข, ืืืจ ืงืขื ืขื ืฉืคึผืืจ ืืื ืื ื ืืืขื ืืื ืคึผืึทืจืึธื ืืขื ืขื ืืขืฉืืงื. ืืึธ, ืืื ืืึธืื ืืื ืืืื, ื ืึธืจ ืืืจ ืืึธืื ืึทืงืกืขืก ืฆื ืื FreeRadius ืกืขืจืืืขืจ.
ืืืจ ืงืขื ื ืืืืขื ืขื ืืขืจ ืืืขืื ืืื EAP-TTLS ืึทืจืืขื
FreeRADIUS
ืืืจ ืืืขืื ืึทืคึผืืจืืื FreeRadius ืฆื CentOS 7.6. ืขืก ืืื ืืึธืจื ืืฉื ืงืึธืืคึผืืืฆืืจื ืืึธ, ืืืจ ืื ืกืืึทืืืจื ืขืก ืืื ืื ืืขืืืืื ืืืขื ืืืขื.
yum install freeradius freeradius-utils freeradius-ldap -yืคืื ืื ืคึผืึทืงืึทืืืฉืึทื, ืืืขืจืกืืข 3.0.13 ืืื ืืื ืกืืึทืืืจื. ืื ืืขืฆืืข ืงืขื ืขื ืืืื ืืขื ืืืขื ืืืึท
ื ืึธื ืืขื, FreeRadius ืืื ืฉืืื ืืจืืขืื. ืืืจ ืงืขื ืขื ืื ืงืึธืืืขื ื ืื ืฉืืจื ืืื /etc/raddb/users
steve Cleartext-Password := "testing"ืงืึทืืขืจ ืืื ืื ืกืขืจืืืขืจ ืืื ืืืืึทื ืืึธืืข
freeradius -Xืืื ืืึทืื ืึท ืคึผืจืึธืืข ืงืฉืจ ืคึฟืื ืืึธืงืึทืืืึธืกื
radtest steve testing 127.0.0.1 1812 testing123ืืืจ ืืืื ืืืงืืืขื ืื ืขื ืืคืขืจ ืืืงืืืขื ืึทืงืกืขืก - ืึธื ื ืขืืขื ืฉืืึทื 115 ืคึฟืื 127.0.0.1:1812 ืฆื 127.0.0.1:56081 ืืขื ื 20, ืขืก ืืืื ืึทืืฅ ืืื ืืื. ืืื ืืืืืืขืจ.
ืงืึทื ืขืงืืื ื ืื ืืึธืืืืข ldap.
ln -s /etc/raddb/mods-available/ldap /etc/raddb/mods-enabled/ldapืืื ืืืจ ืืืขืื ืขืก ืืื ืืืืฉื. ืืืจ ืืึทืจืคึฟื FreeRadius ืฆื ืงืขื ืขื ืึทืงืกืขืก FreeIPA
ืืึธืืก-ืขื ืืืืึทืื/ืืืึทืคึผ
ldap {
server="ldap://ldap.server.com"
port=636
start_tls=yes
identity="uid=admin,cn=users,dc=server,dc=com"
password=**********
base_dn="cn=users,dc=server,dc=com"
set_auth_type=yes
...
user {
base_dn="${..base_dn}"
filter="(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
}
...ืจืืกืืึทืจื ืื ืจืึทืืืืก ืกืขืจืืืขืจ ืืื ืงืึธื ืืจืึธืืืจื ืื ืกืื ืืงืจืึทื ืึทืืืืฉืึทื ืคืื LDAP ื ืืฆืขืจืก:
radtest user_ldap password_ldap localhost 1812 testing123
ืจืขืืึทืืืจื ืขืึทืคึผ ืืื ืืึธืืก-ืขื ืืืืึทืื / ืขืึทืคึผ
ืืึธ ืืืจ ืืืขืื ืืืืื ืฆืืืื ืื ืกืืึทื ืกืื ืคืื ืขืึทืคึผ. ืืื ืืขื ืขื ืึทื ืืขืจืฉ ืืืืื ืืื ืกืขืจืืืคืืงืึทืฅ ืืื ืฉืืืกืืขื. ืืื ืืืขื ืืขืจืงืืขืจื ืืืึธืก ืืึธืก ืืื ืืืช ืืื ืื.
ืืึธืืก-ืขื ืืืืึทืื / ืขืึทืคึผ
eap eap-client { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests}
tls-config tls-common {
private_key_file = ${certdir}/fisrt.key
certificate_file = ${certdir}/first.crt
dh_file = ${certdir}/dh
ca_path = ${cadir}
cipher_list = "HIGH"
cipher_server_preference = no
ecdh_curve = "prime256v1"
check_crl = no
}
ttls {
tls = tls-common
default_eap_type = md5
copy_request_to_tunnel = no
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
}
}
eap eap-guest {
default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests}
tls-config tls-common {
private_key_passwotd=blablabla
private_key_file = ${certdir}/server.key
certificate_file = ${certdir}/server.crt
dh_file = ${certdir}/dh
ca_path = ${cadir}
cipher_list = "HIGH"
cipher_server_preference = no
ecdh_curve = "prime256v1"
check_crl = no
}
ttls {
tls = tls-common
default_eap_type = md5
copy_request_to_tunnel = no
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
}
}ืืืืึทืืขืจ ืืืจ ืจืขืืึทืืืจื ืคึผืืึทืฅ-ืขื ืืืืึทืื / ืคืขืืืงืืึทื. ืืื ืืื ืืื ืืขืจืขืกืืจื ืืื ืืขืจ ืึธืืขืจืืื ืืื ืึธืืขื ืืึทืงืืื ืกืขืงืฉืึทื ื.
ืคึผืืึทืฅ-ืขื ืืืืึทืื / ืคืขืืืงืืึทื
authorize {
filter_username
preprocess
if (&User-Name == "guest") {
eap-guest {
ok = return
}
}
elsif (&User-Name == "client") {
eap-client {
ok = return
}
}
else {
eap-guest {
ok = return
}
}
ldap
if ((ok || updated) && User-Password) {
update {
control:Auth-Type := ldap
}
}
expiration
logintime
pap
}
authenticate {
Auth-Type LDAP {
ldap
}
Auth-Type eap-guest {
eap-guest
}
Auth-Type eap-client {
eap-client
}
pap
}ืืื ืืขืจ ืึธืืขืจืืื ืึธืคึผืืืืืื ื ืืืจ ืืึทืืืึทืืืงื ืึทืืข ืืึทืืืฉืืื ืืืึธืก ืืืจ ืืึธื ื ืื ืืึทืจืคึฟื. ืืืจ ืืึธืื ืืืืื ืืืึทืคึผ. ืืืื ืงืืืขื ื ืืืขืจืึทืคืึทืงืืืฉืึทื ืืืจื ื ืืืขื. ืืึธืก ืืื ืืืึธืก ืืืจ ืฆืืืขืืขืื ืฆืืืื ืื ืกืืึทื ืกืื ืคืื ืขืึทืคึผ ืืืืื.
ืืืืื ืขืึทืคึผืืขืจ ืคืึทืงื ืืื ืึทื ืืืขื ืงืึทื ืขืงืืื ื ืขืืืขืืข ืืขืืืืกืขืก ืืืจ ืืืขืื ื ืืฆื ืกืืกืืขื ืกืขืจืืืคืืงืึทืฅ ืืื ืกืคึผืขืฆืืคืืฆืืจื ืื ืคืขืื. ืืืจ ืืึธืื ืึท ืืึทืืืืึทืื ืืื ืฉืืืกื ืคืื ืึท ืืจืึทืกืืื ืืึทืืืืึทืื ืืืืืึธืจืืืขื. ืคึผืขืจืกื ืึทืื, ืืื ืืืื ืืืื ืื ื, ืืขื ืงืฉืจ ืคึผืจืึธืฆืขืืืจ ืืื ืกืืืคึผืืขืจ ืืื ืคืืจืืืืจืคื ืึท ืืื-ืืขืืชืืขื ืืึทืืืืึทืื ืืืืฃ ืืขืืขืจ ืืืื. ืืืข ืจ ืืคืื ื ื ื ืืขืืืกืึพืืขืืชืืืืข ืจ ืกืขืจืืืคืืงืื ื ืื ื ื ื ื ื ืืฉ ื ืืขืืืข ื ืืขืฐืข ื ืฆ ื ืืฐืขืงืืฒื . ืกืึทืืกืื ื ืืขืืืืกืขืก ืืื ืึทื ืืจืืื =<6 ืืืขืจืกืืขืก ืงืขื ืขื ื ืืฉื ื ืืฆื ืกืืกืืขื ืกืขืจืืืคืืงืึทืฅ. ืืขืจืืืขืจ, ืืืจ ืืึทืื ืึท ืืึทืืื ืืขืจ ืืืึทืฉืคึผืื ืคืื ืขืึทืคึผ-ืืึทืกื ืคึฟืึทืจ ืืื ืืื ืืื-ืืขืืชืืขื ืกืขืจืืืคืืงืึทืฅ. ืคึฟืึทืจ ืึทืืข ืื ืืขืจืข ืืขืืืืกืขืก ืืืจ ืืืขืื ื ืืฆื eap-client ืืื ืึท ืืจืึทืกืืื ืืึทืืืืึทืื. ืืึทื ืืฆืขืจ ื ืึธืืขื ืืื ืืืฉืืืกื ืืืจื ืื ืึทื ืึธื ืืืข ืืึทื ืืฆืขืจืก ืคืขืื ืืืขื ืงืึทื ืขืงืืื ื ืื ืืืื. ืืืืื 3 ืืืึทืืืขืก ืืขื ืขื ืขืจืืืืื: ืืึทืกื, ืงืืืขื ื ืืื ืึท ืืืืืืง ืคืขืื. ืื ืื ืืื ืืื ืึทืืข ืึทืืืขืงืืขื ืืืขื. ืืขื ืงืขื ืขื ืืืื ืงืึทื ืคืืืืขืจื ืืื ืคึผืึทืืึทืกืื. ืืื ืืืขื ืืขืื ืึท ืืืึทืฉืคึผืื ืึท ืืืกื ืฉืคึผืขืืขืจ.
ืืื ืก ืจืขืืึทืืืจื ืื ืึธืืขืจืืื ืืื ืึธืืขื ืืึทืงืืื ืกืขืงืฉืึทื ื ืืื ืคึผืืึทืฅ-ืขื ืืืืึทืื / ืื ืขืจ-ืืื ืขื
ืคึผืืึทืฅ-ืขื ืืืืึทืื / ืื ืขืจ-ืืื ืขื
authorize {
filter_username
filter_inner_identity
update control {
&Proxy-To-Realm := LOCAL
}
ldap
if ((ok || updated) && User-Password) {
update {
control:Auth-Type := ldap
}
}
expiration
digest
logintime
pap
}
authenticate {
Auth-Type eap-guest {
eap-guest
}
Auth-Type eap-client {
eap-client
}
Auth-Type PAP {
pap
}
ldap
}ืืืืึทืืขืจ, ืืืจ ืืึทืจืคึฟื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืืื ืื ืคึผืึทืืึทืกืื ืืืึธืก ื ืขืืขื ืงืขื ืขื ืืืื ืืขืืืืื ื ืคึฟืึทืจ ืึทื ืึธื ืืืข ืืึทื ืืฆืขืจืก ืืึธืืื. ืขืืืืื ื policy.d/filter.
ืืืจ ืืึทืจืคึฟื ืฆื ืืขืคึฟืื ืขื ืฉืืจืืช ืขื ืืขื ืฆื ืืขื:
if (&outer.request:User-Name !~ /^(anon|@)/) {
update request {
Module-Failure-Message = "User-Name is not anonymized"
}
reject
}ืืื ืืื ืื ืืื elsif ืืืื ืื ื ืืืืืง ืืืึทืืืขืก:
elsif (&outer.request:User-Name !~ /^(guest|client|@)/) {
update request {
Module-Failure-Message = "User-Name is not anonymized"
}
reject
}ืืืฆื ืืืจ ืืึทืจืคึฟื ืฆื ืืึทื ืฆื ืื ืืืขืืืืืึทืืขืจ ืกืขืจืฅ. ืืึธ ืืืจ ืืึทืจืคึฟื ืฆื ืฉืืขืื ืื ืฉืืืกื ืืื ืืึทืืืืึทืื ืคืื ืึท ืืจืึทืกืืื ืกืขืจืืึทืคืึทืงืืืฉืึทื ืืืืืึธืจืืืขื, ืืืึธืก ืืืจ ืืึธืื ืฉืืื, ืืื ืืืจ ืืึทืจืคึฟื ืฆื ืืืฉืขื ืขืจืืื ืืื-ืืขืืชืืขื ืกืขืจืืืคืืงืึทืฅ ืคึฟืึทืจ ืขืึทืคึผ-ืืึทืกื.
ืืฉืึทื ืืื ื ืื ืคึผืึทืจืึทืืขืืขืจืก ืืื ืืขืจ ืืขืงืข ca.cnf.
ca.cnf
...
default_days = 3650
default_md = sha256
...
input_password = blablabla
output_password = blablabla
...
countryName = RU
stateOrProvinceNmae = State
localityNmae = City
organizationName = NONAME
emailAddress = [email protected]
commonName = "CA FreeRadius"ืืืจ ืฉืจืืึทืื ืื ืืขืืืข ืืืึทืืืขืก ืืื ืืขืจ ืืขืงืข server.cnf. ืืืจ ื ืึธืจ ืืืืฉื
commonName:
server.cnf
...
default_days = 3650
default_md = sha256
...
input_password = blablabla
output_password = blablabla
...
countryName = RU
stateOrProvinceNmae = State
localityNmae = City
organizationName = NONAME
emailAddress = [email protected]
commonName = "Server Certificate FreeRadius"ืืืจ ืฉืึทืคึฟื:
makeืืจืืื. ืืืงืืืขื server.crt ะธ server.key ืืืจ ืืึธืื ืฉืืื ืจืขืืืกืืจืืจื ืืืืื ืืื eap-guest.
ืืื ืืขืกืึธืฃ, ืืึธืื ืืื ืื ืืืืื ืืื ืืืขืจ ืึทืงืกืขืก ืคืื ืงืื ืฆื ืืขืจ ืืขืงืข client.conf. ืืื ืืึธืื 7 ืคืื ืืื ืืื ืกืืจ ื ืืฉื ืฆื ืืืืื ืืขืืขืจ ืคืื ื ืกืขืคึผืขืจืึทืืื, ืืืจ ืืืขืื ืคืึทืจืฉืจืืึทืื ืืืืื ืื ื ืขืฅ ืืื ืืืึธืก ืืื ืืขื ืขื ืืืื (ืืืื ืึทืงืกืขืก ืคืื ืงืื ืืขื ืขื ืืื ืึท ืืึทืืื ืืขืจ ืืืืึทื).
client APs {
ipaddr = 192.168.100.0/24
password = password_AP
}Ubiquiti ืงืึธื ืืจืึธืืืขืจ
ืืืจ ืืึทืคึผื ืึท ืืึทืืื ืืขืจ ื ืขืฅ ืืืืฃ ืื ืงืึธื ืืจืึธืืืขืจ. ืืื ืขืก ืืืื 192.168.2.0/24
ืืืื ืฆื ืกืขืืืื ืืก -> ืคึผืจืึธืคืื. ืืึธืืืจ ืฉืึทืคึฟื ืึท ื ืืึทืข:
ืืืจ ืฉืจืืึทืื ืื ืึทืืจืขืก ืืื ืคึผืึธืจื ืคืื ืื ืจืึทืืืืก ืกืขืจืืืขืจ ืืื ืื ืคึผืึทืจืึธื ืืืึธืก ืืื ืืขืืืขื ืืขืฉืจืืื ืืื ืืขืจ ืืขืงืข clients.conf:
ืฉืึทืคึฟื ืึท ื ืืึท ืืืืืจืืืก ื ืขืฅ ื ืึธืืขื. ืกืขืืขืงืืืจื WPA-EAP (ืขื ืืขืจืคึผืจืืื) ืืื ืื ืึธืืขื ืืึทืงืืืฉืึทื ืืืคึฟื ืืื ืกืคึผืขืฆืืคืืฆืืจื ืื ืืืฉืืคื ืจืึทืืืืก ืคึผืจืึธืคืื:
ืืืจ ืจืึทืืขืืืขื ืึทืืฅ, ืฆืืืืืื ืขืก ืืื ืืืื ืืืืฃ.
ืืึทืฉืืขืืืงื ืงืืืืึทื ืฅ
ืืื ืก ืึธื ืืืืื ืืื ืื ืืึทืจืืึทืกื ืืืื!
ืคึฟืขื ืฆืืขืจ ืงืกื ืืืงืก
ืื ืฉืืืขืจืืงืืื ืงืืื ืึทืจืึธืคึผ ืฆื ืื ืคืึทืงื ืึทื Windows ืงืขื ื ืืฉื ื ืึธื ืืืืกื ืืื ืฆื ืคืึทืจืืื ืื ืฆื ืคึฟืืจืืข WiFi ืืืืขืจ ืึท ืคืขืื. ืืขืจืืืขืจ, ืืืจ ืืึธืื ืฆื ืืึทื ืืืึทืื ืืคึผืืึธืึทื ืืื ืืืขืจ ืืึทืืืืึทืื ืฆื ืื ืืจืึทืกืืื ืืึทืืืืึทืื ืงืจืึธื. ืืึธ ืืืจ ืงืขื ืขื ื ืืฆื ืึท ืืื-ืืขืืชืืขื ืืืื ืขืจ ืึธืืขืจ ืืืื ืขืจ ืคืื ืึท ืกืขืจืืึทืคืึทืงืืืฉืึทื ืืืืืึธืจืืืขื. ืืื ืืืขื ื ืืฆื ืืขื ืฆืืืืืื.
ืืืืึทืืขืจ ืืืจ ืืึทืจืคึฟื ืฆื ืฉืึทืคึฟื ืึท ื ืืึทืข ืงืฉืจ. ืฆื ืืึธื ืืึธืก, ืืืื ืฆื ื ืขืฅ ืืื ืืื ืืขืจื ืขื ืกืขืืืื ืืก -> ื ืขืฅ ืืื ืืึทื ืืืืืื ื ืฆืขื ืืขืจ -> ืฉืึทืคึฟื ืืื ืงืึทื ืคืืืืขืจ ืึท ื ืืึทืข ืงืฉืจ ืึธืืขืจ ื ืขืฅ:
ืืืจ ืืึทื ืืืึทืื ืึทืจืืึทื ืื ื ืขืฅ ื ืึธืืขื ืืื ืืืืฉื ืื ืืืืขืจืืืื ืืืคึผ. ืืขืจื ืึธื ืืจืืงื ืืืืฃ ืืืืฉื ืงืฉืจ ืกืขืืืื ืืก ืืื ืืื ืื ืืืืขืจืืืื ืงืืืืื, ืกืขืืขืงืืืจื ื ืขืฅ ืึธืืขื ืืึทืงืืืฉืึทื - EAP-TTLS.
ืืืื ืฆื ืื ืกืขืืืื ืืก, ืฉืืขืื ืื ืงืึทื ืคืึทืืขื ืฉืืึทืืึทืื ืคืื ืึธืืขื ืืึทืงืืืฉืึทื - ืงืืืขื ื. ืืื ืึท ืืจืึทืกืืื ืกืขืจืืึทืคืึทืงืืืฉืึทื ืืืืืึธืจืืืขื, ืกืขืืขืงืืืจื ืืขื ืืึทืืืืึทืื ืืืจ ืฆืืืขืืขืื, ืืฉืขืง ืื ืงืขืกืื "ืื ืืืืกื ื ืืฉื ืึทืจืืืกืืขืื ืึท ืคืึทืจืืขืืื ื ืฆื ืืขืจ ืืึทื ืืฆืขืจ ืืืื ืืขืจ ืกืขืจืืืขืจ ืงืขื ื ืืฉื ืืืื ืึธืืขืจืืืื" ืืื ืกืขืืขืงืืืจื ืืขื ืึธืืขื ืืึทืงืืืฉืึทื ืืืคึฟื - ืงืืึธืจ ืืขืงืกื ืคึผืึทืจืึธื (PAP).
ืืืืึทืืขืจ, ืืืื ืฆื ื ืึธื ืคึผืึทืจืึทืืขืืขืจืก, ืืฉืขืง ืื ืงืขืกืื "ืกืคึผืขืฆืืคืืฆืืจื ืึธืืขื ืืึทืงืืืฉืึทื ืืึธืืข." ืกืขืืขืงืืืจื "User Authentication" ืืื ืืื ืืืืฃ ืจืึทืืขืืืขื ืงืจืึทืืขื ืืฉืึทืื. ืืึธ ืืืจ ืืืขื ืืึทืจืคึฟื ืฆื ืึทืจืืึทื username_ldap ืืื password_ldap
ืืืจ ืจืึทืืขืืืขื, ืฆืืืืืื, ื ืึธืขื ื ืึทืืฅ. ืืืจ ืงืขื ืขื ืคืึทืจืืื ืื ืฆื ืึท ื ืืึทืข ื ืขืฅ.
ืืื ืืงืก
ืืื ืืขืกืืขื ืืืืฃ Ubuntu 18.04, 18.10, Fedora 29, 30.
ืขืจืฉืืขืจ, ืืจืืคืงืืคืืข ืื ืืึทืืืืึทืื ืคึฟืึทืจ ืืื. ืืื ืืื ื ืืฉื ืืขืคืื ืขื ืืื ืืื ืืงืก ืฆื ืขืก ืืื ืืขืืืขื ืฆื ื ืืฆื ืกืืกืืขื ืกืขืจืืืคืืงืึทืฅ ืึธืืขืจ ืฆื ืขืก ืืื ืึทืืึท ืึท ืงืจืึธื ืืื ืึทืืข.
ืืืจ ืืืขืื ืคืึทืจืืื ืื ืืืจื ืคืขืื. ืืขืจืืืขืจ, ืืืจ ืืึทืจืคึฟื ืึท ืืึทืืืืึทืื ืคืื ืื ืกืขืจืืึทืคืึทืงืืืฉืึทื ืืืืืึธืจืืืขื ืคืื ืืืึธืก ืืื ืืืขืจ ืืึทืืืืึทืื ืืื ืืขืงืืืคื.
ืึทืืข ืงืึทื ืขืงืฉืึทื ื ืืขื ืขื ืืขืืืื ืืื ืืืื ืคึฟืขื ืฆืืขืจ. ืืืืกืงืืืึทืื ืืื ืืืขืจ ื ืขืฅ:
ืึทื ืึธื ืืืข ืืึทื ืืฆืขืจืก - ืงืืืขื ื
domain - ืื ืคืขืื ืคึฟืึทืจ ืืืึธืก ืื ืืึทืืืืึทืื ืืื ืืจืืืก
ืึทื ืืจืืื
ื ืื-ืกืึทืืกืื ื
ืคึฟืื ืืืขืจืกืืข 7, ืืืขื ืงืึทื ืขืงืืื ื WiFi, ืืืจ ืงืขื ืขื ื ืืฆื ืกืืกืืขื ืกืขืจืืืคืืงืึทืฅ ืืืจื ืกืคึผืขืฆืืคืืฆืืจื ืืืืื ืื ืคืขืื:
domain - ืื ืคืขืื ืคึฟืึทืจ ืืืึธืก ืื ืืึทืืืืึทืื ืืื ืืจืืืก
ืึทื ืึธื ืืืข ืืึทื ืืฆืขืจืก - ืงืืืขื ื
ืกืึทืืกืื ื
ืืื ืืื ืืขืฉืจืืื ืืืืื, ืกืึทืืกืื ื ืืขืืืืกืขืก ืืึธื ื ืื ืืืืกื ืืื ืฆื ื ืืฆื ืกืืกืืขื ืกืขืจืืืคืืงืึทืฅ ืืืขื ืงืึทื ืขืงืืื ื WiFi, ืืื ืืื ืืึธื ื ืื ืืึธืื ืื ืคืืืืงืืื ืฆื ืคืึทืจืืื ืื ืืืจื ืคืขืื. ืืขืจืืืขืจ, ืืืจ ืืึทืจืคึฟื ืฆื ืืึทื ืืืึทืื ืืืืื ืื ืืืึธืจืฆื ืืึทืืืืึทืื ืคืื ืื ืกืขืจืืึทืคืึทืงืืืฉืึทื ืืืืืึธืจืืืขื (ca.pem, ื ืขืืขื ืขืก ืคืื ืื ืจืึทืืืืก ืกืขืจืืืขืจ). ืืึธืก ืืื ืืื ืืื-ืืขืืชืืขื ืืืขื ืืืื ืืขืืืืื ื.
ืืจืืคืงืืคืืข ืื ืืึทืืืืึทืื ืฆื ืืืื ืืืื ืืื ืื ืกืืึทืืืจื ืขืก.
ืื ืกืืึธืืื ื ืึท ืืึทืืืืึทืื
ืืื ืืขื ืคืึทื, ืืืจ ืืึทืจืคึฟื ืฆื ืฉืืขืื ืึท ืคืึทืจืฉืืขืื ืืคืฉืืืกื ืืืกืืขืจ, PIN ืงืึธื ืึธืืขืจ ืคึผืึทืจืึธื, ืืืื ืขืก ืืื ื ืืฉื ืฉืืื ืืึทืฉืืืื:
ืืื ืืขืืืืื ืึท ืงืึธืืคึผืืขืงืก ืึธืคึผืฆืืข ืคึฟืึทืจ ืื ืกืืึธืืื ื ืึท ืืึทืืืืึทืื. ืืืืฃ ืจืืึฟ ืืขืืืืกืขืก, ืคืฉืื ืืื ืืืืฃ ืื ืืึทืื ืืึธืืืื ืืึทืืืืึทืื.
ืืืขื ืื ืืึทืืืืึทืื ืืื ืืื ืกืืึทืืืจื, ืืืจ ืงืขื ืขื ืืืื ืืืืึทืืขืจ ืฆื ืื ืงืฉืจ:
ืืึทืืืืึทืื - ืึธื ืืืืึทืื ืื ืืืึธืก ืืืจ ืืึธื ืืื ืกืืึทืืืจื
ืึทื ืึธื ืืืข ืืึทื ืืฆืขืจืก - ืืึทืกื
ืืึทืงืึธืก
ืขืคึผื ืืขืืืืกืขืก ืงืขื ืขื ืืืืื ืคืึทืจืืื ืื ืฆื EAP-TLS ืืืืก ืคืื ืื ืงืขืกืื, ืึธืืขืจ ืืืจ ื ืึธื ืืึทืจืคึฟื ืฆื ืฆืืฉืืขืื ืืื ืืื ืึท ืืึทืืืืึทืื. ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืึท ืึทื ืืขืจืฉ ืงืฉืจ ืืืคึฟื, ืืืจ ืืึทืจืคึฟื ืฆื ื ืืฆื ืขืคึผื ืงืึธื ืคืืืืจืึทืืึธืจ 2. ืึทืงืงืึธืจืืื ืืื, ืืืจ ืืึทืจืคึฟื ืฆื ืขืจืฉืืขืจ ืืจืืคืงืืคืืข ืขืก ืฆื ืืืื ืืขืง, ืฉืึทืคึฟื ืึท ื ืืึทืข ืคึผืจืึธืคืื ืืื ืืืืื ืึทืืข ืื ื ืืืืืง WiFi ืกืขืืืื ืืก.
ืขืคึผื ืงืึธื ืคืืืืจืึทืืึธืจ
ืืึธ ืืืจ ืึธื ืืืืึทืื ืืขื ื ืึธืืขื ืคืื ืืื ืืืขืจ ื ืขืฅ
ืืืืขืจืืืื ืืืคึผ - WPA2 ืขื ืืขืจืคึผืจืืื
ืื ืืขื ืืืขื EAP ืืืืคึผืก - TTLS
ืืึทื ืืฆืขืจ ื ืึธืืขื ืืื ืคึผืึทืจืึธื - ืืึธืื ืืืืืืง
ืื ืขืจ ืึธืืขื ืืึทืงืืืฉืึทื - PAP
ืืืกืืืืื ืืงืกื ืืืืขื ืืืืขื - ืงืืืขื ื
Trust tab. ืืึธ ืืืจ ืึธื ืืืืึทืื ืืื ืืืขืจ ืคืขืื
ืึทืืข. ืืขืจ ืคึผืจืึธืคืื ืงืขื ืขื ืืืื ืืขืจืืืขืืืขื, ืืขืืชืืขื ืืื ืคืื ืื ืืขืจืืขืืืืื ืฆื ืืขืืืืกืขืก
ื ืึธื ืื ืคึผืจืึธืคืื ืืื ืืจืืื, ืืืจ ืืึทืจืคึฟื ืฆื ืึธืคึผืืึธืืืจื ืขืก ืฆื ืืืื ืืขืง ืืื ืื ืกืืึทืืืจื ืขืก. ืืขืฉืึทืก ืื ืืึทื ืืึธื ืืืจืื ื ืคึผืจืึธืฆืขืก, ืืืจ ืืึทืจืคึฟื ืฆื ืกืคึผืขืฆืืคืืฆืืจื ืื usernmae_ldap ืืื password_ldap ืคืื ืื ืืึทื ืืฆืขืจ:
ืืึธืก
ืืขืจ ืคึผืจืึธืฆืขืก ืืื ืขื ืืขื ืฆื macOS. ืืืจ ืืึทืจืคึฟื ืฆื ื ืืฆื ืึท ืคึผืจืึธืคืื (ืืืจ ืงืขื ื ื ืืฆื ืื ืืขืืืข ืคึผืจืึธืคืื ืืื ืคึฟืึทืจ ืืึทืงืึธืก. ืืขื ืืืืื ืคึฟืึทืจ ืืื ืฆื ืฉืึทืคึฟื ืึท ืคึผืจืึธืคืื ืืื ืขืคึผื ืงืึธื ืคืืืืจืึทืืึธืจ).
ืืจืืคืงืืคืืข ืื ืคึผืจืึธืคืื, ืื ืกืืึทืืืจื, ืึทืจืืึทื ืงืจืึทืืขื ืืฉืึทืื, ืคืึทืจืืื ืื:
ืึทื ืก ืึทืืข. ืืืจ ืฉืืขืื ืึทืจืืืฃ ืื ืจืึทืืืืก ืกืขืจืืืขืจ, ืกืื ืกืขื ืขืก ืืื FreeIPA ืืื ืืขืจืฆืืืื ืื Ubiquiti ืึทืงืกืขืก ืคืื ืงืื ืฆื ื ืืฆื WPA2-EAP.
ืืขืืืขื ืคืจืืืขืก
ืืื: ืืื ืฆื ืึทืจืืืขืจืคืืจื ืึท ืคึผืจืึธืคืื / ืืึทืืืืึทืื ืฆื ืึทื ืึธื ืืขืฉืืขืืืขืจ?
ืืืขืื: ืืื ืงืจืึธื ืึทืืข ืกืขืจืืืคืืงืึทืฅ / ืคึผืจืึธืืคืืืื ืืืืฃ ืคืืคึผ ืืื ืึทืงืกืขืก ืืืจื ืื ืืืขื. ืืื ืฉืืขืื ืึทืจืืืฃ ืึท ืืึทืกื ื ืขืฅ ืืื ืึท ืืืืงืืึทื ืฉืืขืืจ ืืื ืึทืงืกืขืก ืืืืื ืฆื ืื ืืื ืืขืจื ืขื, ืืื ืื ืืืกื ืขื ืคืื ืคืืคึผ.
ืึธืืขื ืืึทืงืืืฉืึทื ืืึทืกืฅ 2 ืืขื, ื ืึธื ืืืึธืก ืขืก ืืื ืืึทืฉืืขืืืง ืืื ืืขืจ ืงืืืขื ื ืืื ืืื ืงืก ืึธื ืื ืืื ืืขืจื ืขื. ืึทื. ืืืขื ืึทื ืึธื ืืขืฉืืขืืืขืจ ืืืื ืฆื ืคืึทืจืืื ืื ืฆื WiFi, ืขืจ ืขืจืฉืืขืจ ืงืึทื ืขืงืฅ ืฆื ืื ืืึทืกื ื ืขืฅ, ืืึธืืก ืืื ืคืืคึผ, ืืึทืื ืืึธืืื ืื ืืึทืืืืึทืื ืึธืืขืจ ืคึผืจืึธืคืื ืขืจ ืืึทืจืฃ, ืื ืกืืึธืื ืืื, ืืื ืืขืืึธืื ืงืขื ืขื ืคืึทืจืืื ืื ืฆื ืื ืคึฟืืจืืข ื ืขืฅ.
ืืื: ืคืืจืืืืก ื ืืฉื ื ืืฆื ืึท ืกืืขืืข ืืื MSCHAPv2? ืขืก ืืื ืืืืขืจืขืจ!
ืืืขืื: ืคืืจืกืืื, ืืขื ืกืืขืืข ืึทืจืืขื ืืขืืื ื ืืืืฃ NPS (Windows Network Policy System), ืืื ืืื ืืืขืจ ืืืคึผืืึทืืขื ืืืืฉืึทื, ืขืก ืืื ืืืื ื ืืืืืง ืฆื ืงืึทื ืคืืืืขืจ LDAP (FreeIpa) ืืื ืงืจืึธื ืคึผืึทืจืึธื ืืึทืฉืขืก ืืืืฃ ืื ืกืขืจืืืขืจ. ืืืื ืฆื. ืขืก ืืื ื ืืฉื ืงืขืืืึทืืง ืฆื ืืึทืื ืกืขืืืื ืืก, ืืืืึทื ืืึธืก ืงืขื ืคืืจื ืฆื ืคืึทืจืฉืืื ืคึผืจืึธืืืขืืก ืืื ืกืื ืืงืจืึทื ืึทืืืืฉืึทื ืคืื ืื ืึทืืืจืึทืกืึทืื ื ืกืืกืืขื. ืฆืืืืืื ืก, ืื ืืึทืฉ ืืื MD4, ืึทืืื ืขืก ืืื ื ืืฉื ืืืืื ืคืื ืืืืขืจืืืื
ืืื: ืืื ืขืก ืืขืืืขื ืฆื ืืขืจืืืืื ืืืืืืืกืึทื ืืื ืืขืง ืึทืืจืขืกืขืก?
ืืืขืื: ื ืืื, ืืึธืก ืืื ื ืืฉื ืืืืขืจ, ืึทื ืึทืืึทืงืขืจ ืงืขื ืขื ืคืึทืจืคืืจื MAC ืึทืืจืขืกืขืก, ืืื ืืคืืื ืืขืจ, ืืขืจืืืืืขื ืืฉ ืืืจื MAC ืึทืืจืขืกืขืก ืืื ื ืืฉื ืืขืฉืืืฆื ืืืืฃ ืคืืืข ืืขืืืืกืขืก
ืืื: ืคืืจืืืืก ื ืืฆื ืึทืืข ืื ืกืขืจืืืคืืงืึทืฅ? ืืืจ ืงืขื ืขื ืคืึทืจืืื ืื ืึธื ืืื
ืืืขืื: ืกืขืจืืืคืืงืึทืฅ ืืขื ืขื ืืขื ืืฆื ืฆื ืืขืจืืืืื ืื ืกืขืจืืืขืจ. ืืขื ืข. ืืืขื ืงืึทื ืขืงืืื ื, ืื ืืืื ืืฉืขืงืก ืฆื ืขืก ืืื ืึท ืกืขืจืืืขืจ ืืืึธืก ืงืขื ืขื ืืืื ืืจืึทืกืืื ืึธืืขืจ ื ืืฉื. ืืืื ืึทืืื, ืึธืืขื ืืึทืงืืืฉืึทื ืืืืืื ื ืืืื ื ืื, ืื ืงืฉืจ ืืื ืคืืจืืืื. ืืืจ ืงืขื ืขื ืคืึทืจืืื ืื ืึธื ืกืขืจืืืคืืงืึทืฅ, ืึธืืขืจ ืืืื ืึท ืึทืืึทืงืขืจ ืึธืืขืจ ืืืจ ืฉืืขืื ืึทืจืืืฃ ืึท ืจืึทืืืืก ืกืขืจืืืขืจ ืืื ืึท ืึทืงืกืขืก ืคืื ื ืืื ืื ืืขืืืข ื ืึธืืขื ืืื ืืื ืืืขืจ ืืื ืฉืืื, ืขืจ ืงืขื ืขื ืืืืื ืื ืืขืจืกืขืคึผื ืื ืืึทื ืืฆืขืจ ืก ืงืจืึทืืขื ืืฉืึทืื (ืืึธื ื ืื ืคืึทืจืืขืกื ืึทื ืืื ืืขื ืขื ืืจืึทื ืกืืืืืขื ืืื ืงืืึธืจ ืืขืงืกื) . ืืื ืืืขื ืึท ืกืขืจืืืคืืงืึทื ืืื ืืขื ืืฆื, ืืขืจ ืคืืึทื ื ืืืขื ืืขื ืืื ืืืื ืืึธืืก ืืืืื ืืื ืืืขืจ ืคืืงืืืืืข ืืึทื ืืฆืขืจ-ื ืึธืืขื - ืืึทืกื ืึธืืขืจ ืงืืืขื ื ืืื ืึท ืืืคึผ ืืขืืช - Unknown CA Certificate
ืึท ืืืกื ืืขืจ ืืืขืื macOSืืืคึผืืงืึทืืื, ืืืืฃ macOS, ืจืืื ืกืืึทื ืื ืกืืกืืขื ืืื ืืืจืืืขืงืึธืื ืืืจื ืื ืืื ืืขืจื ืขื. ืืื ืึธืคึผืืื ืืึธืืข, ืื ืืขืง ืืืื ืืืื ืงืึธื ื ืขืงืืขื ืฆื WiFi, ืืื ื ืื ืืื ืืืขืจ ืคึฟืืจืืข WiFi ืืื ื ืื ืื ืืึทืกื ื ืขืฅ ืืืขื ืึทืจืืขืื ืืึธ. ืคึผืขืจืกื ืึทืื, ืืื ืืื ืกืืึทืืืจื ืื ืื ืืขืจ ื ืขืฅ, ืื ืืขืืืืื ืืืขื WPA2-PSK, ืคืึทืจืืึธืจืื, ืืืืื ืคึฟืึทืจ ืืขืื ืืฉ ืึทืคึผืขืจืืืฉืึทื ื. ืึธืืขืจ ืืืจ ืงืขื ืขื ืืืื ืืึทืื ืึท ืืึธืึธืืึทืืืข ืืกื ืืืืฅ ืคืึธืจ ืืื ืื ืกืืกืืขื ืืื ืฉืืืึทืื. ืึธืืขืจ ืืืื ืืืื ืืขืง ืืื ื ืึธื 2015, ืืืจ ืืืขื ืืืื ืืึทืจืคึฟื ืฆื ืืขืคึฟืื ืขื ืึท ืึทืืึทืคึผืืขืจ ืคึฟืึทืจ ืืขื ืืืืฅ ืคืึธืจ)
ืืงืืจ: www.habr.com