SMUS Wireless Configuration - Revision history

Chris.kloosterman: /* Software Used */

2012-10-10T18:02:31Z

Software Used

← Older revision		Revision as of 11:02, 10 October 2012
Line 39:		Line 39:
	== Software Used ==		== Software Used ==

	We use a combination of Freeradius (to do radius authentication ~~and accounting~~), and Samba (for active directory integration) on the backend. The wireless access points are configured using the Meraki cloud controller, although other wifi systems can also tap into the same radius configuration (we tested with Dlink access points as well). Whatever wifi system is selected must support 802.1x authentication through WPA2-Enterprise encryption.		We use a combination of Freeradius (to do radius authentication), and Samba (for active directory integration) on the backend. The wireless access points are configured using the Meraki cloud controller, although other wifi systems can also tap into the same radius configuration (we tested with Dlink access points as well). Whatever wifi system is selected must support 802.1x authentication through WPA2-Enterprise encryption.

	Bug-free support for the functions we're using arrived recently to Samba and Freeradius, and older versions definitely don't work properly. We are running Debian 6 with the stock versions of all packages. We were previously running Ubuntu 10.04 and the versions included there did not work. Freeradius 2.1.10 and Samba 3.5.6 are included with Debian 6, so those are the recommended versions.		Bug-free support for the functions we're using arrived recently to Samba and Freeradius, and older versions definitely don't work properly. We are running Debian 6 with the stock versions of all packages. We were previously running Ubuntu 10.04 and the versions included there did not work. Freeradius 2.1.10 and Samba 3.5.6 are included with Debian 6, so those are the recommended versions.

Chris.kloosterman at 18:02, 10 October 2012

2012-10-10T18:02:18Z

Show changes

Chris.kloosterman at 19:19, 21 June 2012

2012-06-21T19:19:06Z

← Older revision		Revision as of 12:19, 21 June 2012
Line 28:		Line 28:

	Our students are limited to one simultaneous wireless connection. This is to discourage password sharing (one student using another student's account will then stop the original student from being able to log in). As different grades have different access times, we didn't want grade 12 students sharing their credentials to students in lower grades. This is also potentially a bandwidth saving measure, as a single student can't have their iPod, iPhone, computer, etc. clogging up the same access point simultaneously. Again, these restrictions do not apply to staff.		Our students are limited to one simultaneous wireless connection. This is to discourage password sharing (one student using another student's account will then stop the original student from being able to log in). As different grades have different access times, we didn't want grade 12 students sharing their credentials to students in lower grades. This is also potentially a bandwidth saving measure, as a single student can't have their iPod, iPhone, computer, etc. clogging up the same access point simultaneously. Again, these restrictions do not apply to staff.

			'''Note:''' We have determined that the Meraki access points ignore the Session-Timeout parameter we are using to satisfy this requirement. Therefore, this does not work as expected. We have filed a ticket with Meraki support to get this parameter supported properly.

	=== Login times by grade ===		=== Login times by grade ===

	We apply different login hours by grade. Grade 12s can use the wireless longer into the evening than grade 11s, which can use it longer than grade 10s, etc.		We apply different login hours by grade. Grade 12s can use the wireless longer into the evening than grade 11s, which can use it longer than grade 10s, etc.

			'''Note:''' We have determined that the Meraki access points ignore the Session-Timeout parameter we are using to satisfy this requirement. Therefore, this does not work as expected. We have filed a ticket with Meraki support to get this parameter supported properly.

	=== Guest logins ===		=== Guest logins ===

Chris.kloosterman: /* Radius accounting/SQL Connection */

2012-01-04T00:09:53Z

Radius accounting/SQL Connection

← Older revision		Revision as of 17:09, 3 January 2012
Line 620:		Line 620:
	=== Radius accounting/SQL Connection ===		=== Radius accounting/SQL Connection ===

	cp /etc/freeradius/sql.conf /etc/freeradius/sql		sudo cp /etc/freeradius/sql.conf /etc/freeradius/modules/sql
	sudo vi /etc/freeradius/modules/sql		sudo vi /etc/freeradius/modules/sql

Chris.kloosterman: /* Packetshaper Integration */

2011-12-30T20:28:33Z

Packetshaper Integration

← Older revision		Revision as of 13:28, 30 December 2011
Line 812:		Line 812:
	=== Packetshaper Integration ===		=== Packetshaper Integration ===

	We use an application called Penaltybox: http://sourceforge.net/projects/penaltybox/ in combination with our packet shaper in order to restrict students to 7 GB of traffic per week. After this amount of traffic, the student is restricted to 32 Kbit/sec down and 32 Kbit/sec up for 7 days.		We use an application called Penaltybox: http://sourceforge.net/projects/penaltybox/ in combination with our packet shaper in order to restrict students to 10 GB of traffic per week. After this amount of traffic, the student is restricted to 64 Kbit/sec down and 64 Kbit/sec up for 7 days.

	In order to get this to work, you must set up port mirroring to a physical server that listens to the traffic in promiscuous mode. It then records how much bandwidth is used by each IP address in the eligible range and applies restrictions when thresholds are met.		In order to get this to work, you must set up port mirroring to a physical server that listens to the traffic in promiscuous mode. It then records how much bandwidth is used by each IP address in the eligible range and applies restrictions when thresholds are met.

Chris.kloosterman: /* Guest Virtual Host */

2011-12-30T20:23:33Z

Guest Virtual Host

← Older revision		Revision as of 13:23, 30 December 2011
Line 469:		Line 469:
	sudo vi /etc/freeradius/sites-enabled/guest		sudo vi /etc/freeradius/sites-enabled/guest

	* ~~Set~~ the ~~server alias to~~ "server guest" ~~rather than~~ "server ~~default~~"		* Wrap the entire config file into a block. At the top of the file, add "server guest {" and at the bottom, add "}". For ease of readability, you can indent the contents of the block one tab so that you can tell it's part of the "server guest {" block.
	* Add a listen block immediately under "server guest {"		* Add a listen block immediately under "server guest {"
	** The port is set to 0 as that makes it the default (1812 for radius and 1813 for accounting)		** The port is set to 0 as that makes it the default (1812 for radius and 1813 for accounting)

Chris.kloosterman: /* Student Virtual Host */

2011-12-30T20:23:06Z

Student Virtual Host

← Older revision		Revision as of 13:23, 30 December 2011
Line 408:		Line 408:
	sudo vi /etc/freeradius/sites-enabled/student		sudo vi /etc/freeradius/sites-enabled/student

	* ~~Set~~ the ~~server alias to~~ "server student" ~~rather than~~ "server ~~default~~"		* Wrap the entire config file into a block. At the top of the file, add "server student {" and at the bottom, add "}". For ease of readability, you can indent the contents of the block one tab so that you can tell it's part of the "server student {" block.
	* Add a listen block immediately under "server student {"		* Add a listen block immediately under "server student {"
	** The port is set to 0 as that makes it the default (1812 for radius and 1813 for accounting)		** The port is set to 0 as that makes it the default (1812 for radius and 1813 for accounting)

Chris.kloosterman: /* Staff Virtual Host */

2011-12-30T20:21:25Z

Staff Virtual Host

← Older revision		Revision as of 13:21, 30 December 2011
Line 330:		Line 330:
	sudo vi /etc/freeradius/sites-enabled/staff		sudo vi /etc/freeradius/sites-enabled/staff

	* Wrap the entire config file into a block. At the top of the file, add "server staff {" and at the bottom, add "}"		* Wrap the entire config file into a block. At the top of the file, add "server staff {" and at the bottom, add "}". For ease of readability, you can indent the contents of the block one tab so that you can tell it's part of the "server staff {" block.
	* Add a listen block immediately under "server staff {"		* Add a listen block immediately under "server staff {"
	** The port is set to 0 as that makes it the default (1812 for radius and 1813 for accounting)		** The port is set to 0 as that makes it the default (1812 for radius and 1813 for accounting)

Chris.kloosterman: /* Staff Virtual Host */

2011-12-30T20:20:31Z

Staff Virtual Host

← Older revision		Revision as of 13:20, 30 December 2011
Line 330:		Line 330:
	sudo vi /etc/freeradius/sites-enabled/staff		sudo vi /etc/freeradius/sites-enabled/staff

	* ~~Set~~ the ~~server alias to~~ "server staff" ~~rather than~~ "~~server default~~"		* Wrap the entire config file into a block. At the top of the file, add "server staff {" and at the bottom, add "}"
	* Add a listen block immediately under "server staff {"		* Add a listen block immediately under "server staff {"
	** The port is set to 0 as that makes it the default (1812 for radius and 1813 for accounting)		** The port is set to 0 as that makes it the default (1812 for radius and 1813 for accounting)

Chris.kloosterman at 20:17, 30 December 2011

2011-12-30T20:17:40Z

← Older revision		Revision as of 13:17, 30 December 2011
Line 83:		Line 83:

	* Change workgroup to your active directory short name (Ours is "SMUSLOCAL")		* Change workgroup to your active directory short name (Ours is "SMUSLOCAL")
			* Add a new line underneath with your Kerberos realm/Active Directory DNS name:

			realm = <AD DNS name>

	* Uncomment "security = user" and change to "security = ads"		* Uncomment "security = user" and change to "security = ads"
	* Immediately underneath, add the following lines:		* Immediately underneath, add the following lines:
Line 94:		Line 98:
	Then restart Samba and Winbind so that you can authenticate against the AD domain:		Then restart Samba and Winbind so that you can authenticate against the AD domain:

	sudo /etc/init.d/~~smbd stop; sudo /etc/init.d/nmbd~~ stop; sudo /etc/init.d/winbind stop		sudo /etc/init.d/samba stop; sudo /etc/init.d/winbind stop
	sudo /etc/init.d/~~smbd start; sudo /etc/init.d/nmbd~~ start; sudo /etc/init.d/winbind start		sudo /etc/init.d/samba start; sudo /etc/init.d/winbind start

	== Freeradius Configuration ==		== Freeradius Configuration ==