<div dir="ltr"><div><div><div><div><div><div>Hi,<br><br></div>I wanted to ask whether a captive portal + radius server + radius server gui would be a useful feature and wanted to discuss possible implementation routes as this affects other services on the XSCE. <br><br></div>A radius server allows to have controlled access to server resources, internet connectivity, and allows one to create users, groups, and set aside network bandwidth. i.e. it is quite useful in a medium to large setup. A captive portal alongside it allows for good UX with notifications in phones, tablets and not having users to type <a href="http://school.lan">http://school.lan</a>. <br><br></div>The existing captive portal PR (#771) is a very good step in that direction, but I believe we will eventually need to use some kind of standard implementations - radius + captive portal setups.<br><br></div>Now that 6.1 is out of the door, I would like to propose a captive portal feature for 6.2.<br><br></div>In the current setup I am testing, I am using freeradius[1] as the radius server, and CoovaChilli [2] as the captive portal. Coova does it's own dhcp so it will have to replace dhcpd if it is used. Also, starting/stopping the coova services affects iptables, so initially, having it run in conjunction with dansguardian and squid might be a little tricky (though it is certainly possible, just needs more time to test/develop). Also, while freeradius is available as a rpm package, coova, and a dependency needs to be complied from source. I can create the packages for it though - it did not seem complicated. <br><br></div><div>So, the current approach I am proposing is:<br></div><div>1. If captive + radius is enabled, dhcpd is disabled, squid and dansguardian are disabled. Later, we can just have dhcpd disabled and the other two enabled if need be<br></div><div>2. If captive + radius is enabled, either we include a few knobs and levers to manage radius in our admin console (more difficult), or include a radius admin console (easier)<br><br></div><div>At the same time I have a question, since my understanding of xsce networking is limited. When setup in LANcontroller mode with both the internal wifi + LAN being controlled by XSCE, does all the LAN side traffic flow through br0? Is it always the case? (in gateway mode too). If that is so, then I will configure coova to work on br0.<br><br>[1] <a href="http://freeradius.org/">http://freeradius.org/</a><br>[2] <a href="http://coova.github.io/CoovaChilli/">http://coova.github.io/CoovaChilli/</a><br><br></div><div>Best,<br></div><div>Anish<br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Sep 20, 2016 at 7:36 AM, Anish Mangal <span dir="ltr"><<a href="mailto:anishmg@umich.edu" target="_blank">anishmg@umich.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>I believe I am able to get the captive portal working as intended<br><br><a href="http://people.sugarlabs.org/anish/captive.webm" target="_blank">http://people.sugarlabs.org/<wbr>anish/captive.webm</a><br><br></div>Now will need to work in a branch on a playbook.<br><br></div>Another idea would be to have a web ui for radius to show all kids of user stats, control per user/group bandwidth, and accounting.<br></div><div class="gmail_extra"><div><div class="h5"><br><div class="gmail_quote">On Mon, Sep 19, 2016 at 8:54 PM, Anish Mangal <span dir="ltr"><<a href="mailto:anishmg@umich.edu" target="_blank">anishmg@umich.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><div><div><br><div class="gmail_quote">On Mon, Sep 19, 2016 at 8:54 PM, Anish Mangal <span dir="ltr"><<a href="mailto:anishmg@umich.edu" target="_blank">anishmg@umich.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div><div><div><div>Hi,<br><br></div>So I was able to setup freeradius and coovachilli on a centos x86 machine to setup a captive portal using the method below:<br><a href="https://www.howtoforge.com/tutorial/how-to-install-a-wireless-hotspot-with-captive-page-in-linux-using-coovachilli/" target="_blank">https://www.howtoforge.com/tut<wbr>orial/how-to-install-a-wireles<wbr>s-hotspot-with-captive-page-in<wbr>-linux-using-coovachilli/</a><br><br></div>Now, this is progress since the user experience is exactly how you would see in a coffee shop. Upon connecting, you will see a notification in your phone, and be prompted by a login prompt (where we can redirect the user to school.lan) or whatever afterwards. <br><br></div>However, there are some notes:<br></div>1. Coovachili does its own dhcp, so probably we might have to use that, if the captive portal is being enabled. <br></div>2. By default it does dhcp on a different subnet. and _maybe_ because of that, a bunch of iptables rules dont work. name resolution doesnt work. Will change the default subnet to what we currently use and disable dhcpd and see what happens<br><br></div>To setup coova and freeradius, they have to be compiled from source. The compiling was pretty straightforward on centos, so either the same can be done for ARM, but long term i think packages would be wonderful :-) <br><br></div>All in all, this definitely looks like an approach worth pursuing :) <br><br></div>Cheers,<br></div>Anish<br><div><div><div><div><div><div><div><div><div><div><div><div><div dir="ltr"><div><br></div></div></div>
</div></div></div></div></div></div></div></div></div></div></div></div>
</blockquote></div><br><br clear="all"><br></div></div><span><font color="#888888">-- <br><div data-smartmail="gmail_signature"><div dir="ltr"><div>Anish<br></div><div><br><br></div></div></div>
</font></span></div></div>
</blockquote></div><br><br clear="all"><br></div></div><span class="HOEnZb"><font color="#888888">-- <br><div data-smartmail="gmail_signature"><div dir="ltr"><div>Anish<br></div><div><br><br></div></div></div>
</font></span></div>
</blockquote></div><br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><br></div></div></div>
</div></div>