<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>In the radius+ solution am I required to create users? Seems like overkill if all I want is a redirect to the home page when I first connect. If I want named accounts then it is a good approach.</p>
<p><br>
</p>
<p>I think the answer to br0 is yes.</p>
<p><br>
</p>
<p>I worry that switching dhcp providers could get tricky.</p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Anish Mangal <anishmg@umich.edu><br>
<b>Sent:</b> Sunday, September 25, 2016 4:07 AM<br>
<b>To:</b> Tim Moody; George Hunt; A Holt; xsce-devel; server-devel<br>
<b>Subject:</b> Re: Captive portal updates</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>
<div>Hi,<br>
<br>
</div>
I wanted to ask whether a captive portal + radius server + radius server gui would be a useful feature and wanted to discuss possible implementation routes as this affects other services on the XSCE.
<br>
<br>
</div>
A radius server allows to have controlled access to server resources, internet connectivity, and allows one to create users, groups, and set aside network bandwidth. i.e. it is quite useful in a medium to large setup. A captive portal alongside it allows for
good UX with notifications in phones, tablets and not having users to type <a href="http://school.lan" id="LPlnk621774" previewremoved="true">
http://school.lan</a>. <br>
<br>
</div>
The existing captive portal PR (#771) is a very good step in that direction, but I believe we will eventually need to use some kind of standard implementations - radius + captive portal setups.<br>
<br>
</div>
Now that 6.1 is out of the door, I would like to propose a captive portal feature for 6.2.<br>
<br>
</div>
In the current setup I am testing, I am using freeradius[1] as the radius server, and CoovaChilli [2] as the captive portal. Coova does it's own dhcp so it will have to replace dhcpd if it is used. Also, starting/stopping the coova services affects iptables,
so initially, having it run in conjunction with dansguardian and squid might be a little tricky (though it is certainly possible, just needs more time to test/develop). Also, while freeradius is available as a rpm package, coova, and a dependency needs to
be complied from source. I can create the packages for it though - it did not seem complicated.
<br>
<br>
</div>
<div>So, the current approach I am proposing is:<br>
</div>
<div>1. If captive + radius is enabled, dhcpd is disabled, squid and dansguardian are disabled. Later, we can just have dhcpd disabled and the other two enabled if need be<br>
</div>
<div>2. If captive + radius is enabled, either we include a few knobs and levers to manage radius in our admin console (more difficult), or include a radius admin console (easier)<br>
<br>
</div>
<div>At the same time I have a question, since my understanding of xsce networking is limited. When setup in LANcontroller mode with both the internal wifi + LAN being controlled by XSCE, does all the LAN side traffic flow through br0? Is it always the case?
(in gateway mode too). If that is so, then I will configure coova to work on br0.<br>
<br>
[1] <a href="http://freeradius.org/" id="LPlnk415868" previewremoved="true">http://freeradius.org/</a>
<div id="LPBorder_GT_14748168114720.926372857414393" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14748168114600.7524894687256944" cellspacing="0" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="TextCell_14748168114650.31731713262992267" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14748168114660.29414663194369206"></div>
<div id="LPTitle_14748168114660.8107183952869463" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14748168114670.18997125910878454" href="http://freeradius.org/" target="_blank" style="text-decoration: none;">FreeRADIUS: The world's most popular RADIUS Server</a></div>
<div id="LPMetadata_14748168114680.5011151617208838" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
freeradius.org</div>
<div id="LPDescription_14748168114700.6739979594178014" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
The FreeRADIUS Project. FreeRADIUS includes a RADIUS server, a BSD licensed client library, a PAM library, and an Apache module. In most cases, the word FreeRADIUS ...</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
[2] <a href="http://coova.github.io/CoovaChilli/" id="LPlnk892911" previewremoved="true">
http://coova.github.io/CoovaChilli/</a>
<div id="LPBorder_GT_14748168684800.5778613881179513" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14748168684740.5548240439879006" cellspacing="0" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="TextCell_14748168684750.3332268329923671" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_14748168684750.04695370558775447"></div>
<div id="LPTitle_14748168684750.07201061882690518" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14748168684760.9513227008897269" href="http://coova.github.io/CoovaChilli/" target="_blank" style="text-decoration: none;">CoovaChilli, an open source captive portal access controller</a></div>
<div id="LPMetadata_14748168684760.36734575350663046" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
coova.github.io</div>
<div id="LPDescription_14748168684780.28395722942435864" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
CoovaChilli. CoovaChilli is an open-source software access controller, based on the popular, but now defunct, ChilliSpot project, and is actively maintained by an ...</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
<br>
</div>
<div>Best,<br>
</div>
<div>Anish<br>
<br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Sep 20, 2016 at 7:36 AM, Anish Mangal <span dir="ltr">
<<a href="mailto:anishmg@umich.edu" target="_blank">anishmg@umich.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">
<div>
<div>I believe I am able to get the captive portal working as intended<br>
<br>
<a href="http://people.sugarlabs.org/anish/captive.webm" target="_blank">http://people.sugarlabs.org/<wbr>anish/captive.webm</a><br>
<br>
</div>
Now will need to work in a branch on a playbook.<br>
<br>
</div>
Another idea would be to have a web ui for radius to show all kids of user stats, control per user/group bandwidth, and accounting.<br>
</div>
<div class="gmail_extra">
<div>
<div class="h5"><br>
<div class="gmail_quote">On Mon, Sep 19, 2016 at 8:54 PM, Anish Mangal <span dir="ltr">
<<a href="mailto:anishmg@umich.edu" target="_blank">anishmg@umich.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr"><br>
<div class="gmail_extra">
<div>
<div><br>
<div class="gmail_quote">On Mon, Sep 19, 2016 at 8:54 PM, Anish Mangal <span dir="ltr">
<<a href="mailto:anishmg@umich.edu" target="_blank">anishmg@umich.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>Hi,<br>
<br>
</div>
So I was able to setup freeradius and coovachilli on a centos x86 machine to setup a captive portal using the method below:<br>
<a href="https://www.howtoforge.com/tutorial/how-to-install-a-wireless-hotspot-with-captive-page-in-linux-using-coovachilli/" target="_blank">https://www.howtoforge.com/tut<wbr>orial/how-to-install-a-wireles<wbr>s-hotspot-with-captive-page-in<wbr>-linux-using-coovachilli/</a><br>
<br>
</div>
Now, this is progress since the user experience is exactly how you would see in a coffee shop. Upon connecting, you will see a notification in your phone, and be prompted by a login prompt (where we can redirect the user to school.lan) or whatever afterwards.
<br>
<br>
</div>
However, there are some notes:<br>
</div>
1. Coovachili does its own dhcp, so probably we might have to use that, if the captive portal is being enabled.
<br>
</div>
2. By default it does dhcp on a different subnet. and _maybe_ because of that, a bunch of iptables rules dont work. name resolution doesnt work. Will change the default subnet to what we currently use and disable dhcpd and see what happens<br>
<br>
</div>
To setup coova and freeradius, they have to be compiled from source. The compiling was pretty straightforward on centos, so either the same can be done for ARM, but long term i think packages would be wonderful :-)
<br>
<br>
</div>
All in all, this definitely looks like an approach worth pursuing :) <br>
<br>
</div>
Cheers,<br>
</div>
Anish<br>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div dir="ltr">
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
</div>
</div>
<span><font color="#888888">-- <br>
<div>
<div dir="ltr">
<div>Anish<br>
</div>
<div><br>
<br>
</div>
</div>
</div>
</font></span></div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
</div>
</div>
<span class="HOEnZb"><font color="#888888">-- <br>
<div>
<div dir="ltr">
<div>Anish<br>
</div>
<div><br>
<br>
</div>
</div>
</div>
</font></span></div>
</blockquote>
</div>
<br>
<div class="gmail_signature">
<div dir="ltr">
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>