Network and Firewall Setup<\/strong> \nWe are assuming 2 network interfaces,<\/p>\n* eth0 is connected to the internet and should be configured for this purpose (use ifconfig, \/etc\/network\/interfaces, or the graphical network configuration tool under System->Administration->Networking). \n* eth1 is the interface that other computers should connect to. This interface should not be configured, but should be brought up.<\/p>\n
$ sudo ifconfig eth1 up<\/p>\n
or if it’s been previously configured use:<\/p>\n
$ sudo ifconfig 0.0.0.0 up<\/p>\n
In order to enable packet forwarding you should change the following line in \/etc\/network\/options:<\/p>\n
ip_forward=yes<\/p>\n
Then you have to restart networking:<\/p>\n
$ sudo \/etc\/init.d\/network restart<\/p>\n
In order to enable firewall and NAT you can use the firewall script in “\/usr\/share\/doc\/chillispot\/firewall.iptables” as a starting point. After you have reviewed the firewall rules you execute the script by issuing the command:<\/p>\n
$ sudo sh \/usr\/share\/doc\/chillispot\/firewall.iptables<\/p>\n
The firewall script needs to be executed every time the computer is restarted. One way to make sure this happens is to copy the file to \/etc\/init.d\/<\/p>\n
$ sudo cp \/usr\/share\/doc\/chillispot\/firewall.iptables \/etc\/init.d\/chili.iptables \n$ sudo chmod u+x \/etc\/init.d\/chilli.iptables \n$ ln -s \/etc\/init.d\/chilli.iptables \/etc\/rcS.d\/S40chilli.iptables<\/p>\n
Configuring the chillispot conf file<\/p>\n
You need to tell Chilli about the location of the authentication server (which in this scenario is on the same machine as chillispot). This is done by uncommenting and editing the following line in “\/etc\/chilli.conf”:<\/p>\n
uamserver https:\/\/192.168.182.1\/cgi-bin\/hotspotlogin.cgi<\/p>\n
192.168.182.1 is the default IP address that chillispot gives the tun0 interface. For added password security, we need to add a shared secret between the hotspotlogin.cgi and chilli. Find the line in “\/etc\/chilli.conf” that reads<\/p>\n
#uamsecret ht2eb8ej6s4et3rg1ulp<\/p>\n
Uncomment this line (remove the #) and CHANGE the secret to something equally weird but different. Remember the secret as it needs to also go into the hotspotlogin.cgi script (we will do this later). \nSince we are also running the radius server (freeradius) on the same machine, we need to find and edit the lines that point to the radius server in “\/etc\/chilli.conf”. They should read:<\/p>\n
radiusserver1 127.0.0.1 \nradiusserver2 127.0.0.1<\/p>\n
You should also change the line in “\/etc\/chilli.conf” that starts radiussecret, so that it does not use the default secret to encrypt traffic between chilli and radius.<\/p>\n
radiussecret somethingReallyDifficultToGuess<\/p>\n
Remember this secret, as it needs to be added to the freeradius configuration files as well.<\/p>\n
Configuring freeradius<\/strong> \nThe freeradius configuration files are all in the \/etc\/freeradius\/ directory. To start with, and for testing purposes, we will use the “\/etc\/freeradius\/users” text file, to enable a single test user (steve). Later we can change the configuration to use mysql for storing usernames and passwords, but first we want to make sure that the whole thing works in the simplest possible setup.<\/p>\nEdit “\/etc\/freeradius\/clients.conf”. \nFind the section that contains the line<\/p>\n
client 127.0.0.1 {<\/p>\n
make sure it is uncommented, and then, in the section between the { and the following }, change the following lines:<\/p>\n
secret = testing123<\/p>\n
change testing123 to match the radiussecret you chose for “\/etc\/chilli.conf” (somethingReallyDifficultToGuess)<\/p>\n
Edit “\/etc\/freeradius\/users” \nUncomment the following line in the file<\/p>\n
#steve Auth-Type := Local, User-Password == “testing”<\/p>\n
This will be the test user and password we will use to make sure everything works.<\/p>\n
Customizing hotspotlogin script \nTo improve password security, we need to add the “uamsecret” from “\/etc\/chilli.conf” to the hotspotlogin script. Edit “\/usr\/lib\/cgi-bin\/hotspotlogin.cgi”. \nFind the line that reads:<\/p>\n
#$uamsecret = “ht2eb8ej6s4et3rg1ulp”;<\/p>\n
Uncomment this line and edit the secret to match the one in “\/etc\/chilli.conf” (The uamsecret, NOT the radiussecret).<\/p>\n
Also uncomment the line that reads:<\/p>\n
#$userpassword=1;<\/p>\n
Now, just to be sure all these changes have taken effec, restart apache2, freeradius and chilli<\/p>\n
$ \/etc\/init.d\/apache2 force-reload \n$ \/etc\/init.d\/freeradius restart \n$ \/etc\/init.d\/chilli restart<\/p>\n
Using chillispot<\/strong> \nYou should now have a simple authentication server that allows a computer to log in and gain access to the network. Plug a computer into the eth1 interface on the chillispot machine, either via a switch or hub, or using a crossover utp cable (or by plugging a transparent bridge wireless access point into the eth1 interface). We will call this machine the “client” machine.<\/p>\nOn the client machine, bring up the network interface with DHCP. Chillispot should give you an ip address in the 192.168.182.0\/24 network.<\/p>\n
Open your browser, and try to go to any webpage like google.com<\/p>\n
You should be redirected to a login page with a field for username and password. Log in using “steve” and “testing”, and you should get a message that says you have successfully logged in. You should now have full access to the internet until you click the logout link in the chillispot webpage.<\/p>\n","protected":false},"excerpt":{"rendered":"
I wrote this howto on setting up a hotspot system on ubuntu with user authentication about a year ago, but the site that hosted it seems to have gone down. Here’s the original link: http:\/\/140.105.28.77:3455\/1\/62 And here’s the text as stolen from google cache (please excuse the horrible formatting):<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[1,17],"tags":[],"yoast_head":"\n
Chillispot Howto • krag.be<\/title>\n \n \n \n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n