WRT54GL as an 802.1x client (aka wrt54gl@eduroam)

… after a quite long time (again), here comes a simple HOWTO describing the process of running a Linksys WRT54GL as a wifi client with 802.1x authentication+wpa encryption, in this case for the international wifi educational network initiative – eduroam.

The Linksys WRT54g brand of wifi routers have become quite popular in the past years as many non-Linksys, but open firmware became available for this device. If you own a WRT54g router, you might be familiar with firmware files from dd-wrt or openwrt.

Basically, after flashing and thus replacing the genuine Linksys provided firmware on the WRT54g with the dd-wrt or the openwrt firmware you can get additional functionality available on commercial $1000 routers out of the $60 router. Like, the original Linksys firmware does not contain functionality even for a basic wifi client mode. The dd-wrt firmware is a ready to use firmware available in different flavors – with vpn functionality, with voip or just “basic” functionality. Compared to openwrt firmware, openwrt is in its basic form not so powerful. Openwrt in its basic form does contain only basic stuff, no additional functionality. On the other hand, the advantage of openwrt is that it is nicely customizable and you can pretty easily install additional applications and functionality with a simple apt-get like utility. For this reason I am more used to use the openwrt firmware as it gives me more control of the box.

Well, a step into the $subject: a friend of mine has asked me to help him with connecting his WRT54GL router as a client to our university wireless network. Our university wifi network uses mandatory 802.1x authentication + wpa or wpa2 encryption. Few years ago, even standard computers and laptops had issues with connecting to a 802.1x secured wireless network so what to expect from a small wifi router? Well, a lot :-)

The basic Linksys firmware does not even support wifi client mode on the WRT54GL. Obviously, the next step is to upgrade the firmware to something better. dd-wrt or openwrt? dd-wrt supports wifi client mode, even with static wep keys (maybe even wpa-psk?) but not with 802.1x authentiocation :-/ openwrt in it’s basic form does not support 802.1x, but fortunately a wpa_supplicant package is available already precompiled for this platform. Wpa_supplicant is an EAP supplicant with 802.1x authentication + wpa/wpa2 support.

Few steps to make it work:

1. Download the openwrt firmware from openwrt.org. Make sure to download a firmware based on 2.6 kernel, as the 2.4 version uses the proprietary “nas” Broadcom utility to manage the wireless connection and it does not support 802.1x. I used the openwrt 8.09_RC1 based openwrt-wrt54g-squashfs.bin file.
2. Download and install the wpa_supplicant package:
   opkg install http://downloads.openwrt.org/kam...s/wpa-supplicant_0.6.3-1_mipsel.ipk
   (or opkg update && opkg install wpa-supplicant)
   (the 8+ version of openwrt will use the “opkg” package management utility, pre 8 versions of openwrt used “ipkg”)
3. Create a configuration file for the wpa_supplicant. The file may look like:
   

   root@OpenWrt:~# cat /etc/wpa_supplicant.conf
   ctrl_interface=/var/run/wpa_supplicant
   ctrl_interface_group=0
   
   network={
          ssid="eduroam"
          scan_ssid=1
          key_mgmt=WPA-EAP
          eap=PEAP
          #ca_cert="/etc/eduroam-ca.crt"
          anonymous_identity="user@domain"
          identity="user@domain"
          password="ThisMustBeAReallyStrongPassword"
          phase1="peaplabel=0"
          phase2="auth=MSCHAPV2"
   }

4. Try it with

   wpa_supplicant -Dwext -iwlan0 -c/etc/wpa_supplicant.conf

   This command will start the wpa_supplicant, will scan for the “eduroam” ssid, connect to AP and try to authenticate as user@domain. If everything is OK, at the end will show some OK messages and will also activate the wifi interface – wlan0. If you start a dhcp client (udhcpc -i wlan0), you should get an IP address now, and you can start pinging the Internet.
5. Wrap it up, create startup scripts that will at the bootup start the wpa_supplication, do the dhcp client, enable IP routing and NAT and there you go. Ready :-)

My startup scripts look like (not so cool but it works :):

root@OpenWrt:~# cat /etc/init.d/XStartEduroam
#!/bin/sh /etc/rc.common
#
# Jozef Janitor (c) 2008
#
# !!!
# make sure that this file has a +x (executable) flag
# enable this script with /etc/init.d/XStartEduroam enable
# dont't forget to disable the preinstalled openwrt firewall script
# !!!

START=99

start() {

# Basic filewall and SNAT
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i br-lan -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 4 -j ACCEPT
iptables -A INPUT -j DROP

# Set time - otherwise the default WRT's time makes problems
# with a certificate validation in wpa_supplicant
date "`cat /etc/dateToSet`"
date "`cat /etc/dateToSet.backup`"

# Start 802.1x authentication
wpa_supplicant -Dwext -iwlan0 -c/etc/wpa_supplicant.conf &

# wait some time till the interface is authenticated
# and activated
sleep 5

# get the IP address from the DHCP server
udhcpc -i wlan0 &

# start the WatchDog to check if we have access
# to the Internet
/watchGW &

# sync time with the NTP server and store the local
# time into a file for reboot use
/updateDate &

}

root@OpenWrt:~# cat /watchGW
#!/bin/sh
#
# Jozef Janitor (c) 2008
#
# This is a "watchdog" script that checks the IP connectivity to a specified destination.
# When it's not available, restart the device.
#

echo "Starting GW watchdog"
echo "If host (1.1.1.1) is down, reboot"

# root@OpenWrt:/# ping -c 5 1.1.1.1
# PING 1.1.1.1 (1.1.1.1): 56 data bytes
# 64 bytes from 1.1.1.1: seq=0 ttl=59 time=3.199 ms
# 64 bytes from 1.1.1.1: seq=1 ttl=59 time=7.602 ms
# 64 bytes from 1.1.1.1: seq=2 ttl=59 time=3.212 ms
# 64 bytes from 1.1.1.1: seq=3 ttl=59 time=4.804 ms
# 64 bytes from 1.1.1.1: seq=4 ttl=59 time=2.827 ms
#
# --- 1.1.1.1 ping statistics ---
# 5 packets transmitted, 5 packets received, 0% packet loss
# round-trip min/avg/max = 2.827/4.328/7.602 ms

while true; do

   sleep 300

   out=`ping -c 5 1.1.1.1 2>&1`

   isFrom=`echo $out|grep "from"`

   if [ "x$isFrom" = "x" ]; then
      echo "!!!!!! REBOOTING !!!!!!!!!!" > /dev/tty
      sleep 5
      reboot
   fi

done

root@OpenWrt:~# cat /updateDate
#!/bin/sh
#
# Jozef Janitor (c) 2008
#
# Sync the actual time and store it in a file to be used after the reboot.
#

while true; do
        sleep 3600
        ntpclient -c 1 -h ntp.ubuntu.com -s
        date "+%F %R" > /etc/dateToSet
        sleep 1
        date "+%F %R" > /etc/dateToSet.backup
done

Debian: Mark packages on hold

If you have installed some Debian/Ubuntu package, that you don’t wanna update trough apt-get upgrades, you can put a flag HOLD to that package.

The HOLD flag will prohibit accessing that package by regular apt-get upgrade_s. To put a package on HOLD, use the following command:

echo {PACKAGENAME} hold | dpkg --set-selections

root@recorder:~# echo vlc hold | dpkg --set-selections
root@recorder:~# apt-get upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages have been kept back:
  vlc vlc-nox
0 upgraded, 0 newly installed, 0 to remove and 2 not upgraded.

An amazing but unknown Linux command: apropos

When working in Linux, I read lot of man pages for different commands while looking for some helpful information on how to use the command. But sometimes it’s hard to find a correct man page, because you have to know the exact man page’s name. Apropos is a man page searcher that works like a little google search on your Linux box and let you find a man page that you are looking for.

I didn’t know about this amazing command while I haven’t found it in an article at http://www.debian-administration.org/articles/614

Run Linux (or Windows) in your Cisco ISR Router

Sounds good isn’t it? :) I remember the times when I flashed a Cisco 2500 series router with a ucLinux image. It was nice to see Linux booting on a Cisco router, even tho’ it was unusable :-( The interfaces didn’t work at all, the only thing that was working was a console access to the Linux CLI.

But this time I wanted to write about something different. Cisco was already using Linux as a base operating system on several products like Wireless LAN Controllers, ASA, etc. Cisco has lately announced a new Network Module (Cisco Application eXtension Platform (AXP)), available for Cisco ISR series routers, that contains a small motherboard with CPU, RAM, and a Hard Disk Drive.

The great thing about the AXP module is that there is preinstalled a fully functional Linux (and I have heard that there is also a Windows 2008 Server version) operating system with basic tools. What’s more, there is an API that allows you to create your own Linux applications that will directly interact with your Cisco ISR router. And as Cisco ISR routers are designed to be used in Branch Offices, now you can pretty easily integrate your email server, or whatever simple Linux (or perhaps Windows (Domain Controller)) application into a single box, thus saving space, electricity power and making your network services management much more simpler!

To find out more about AXP, please go to cisco.com/go/axp

URL filtering and redirection with squid proxy server

A friend of mine who is working at one high school asked me to help him with url filtering for student's PCs. Many times students are just chatting or looking at some nasty web pages which he wanted to block.

The school is connected to the Internet through a Linux server which acts as a router with NAT. For historical reasons there was also a squid proxy running in transparent mode on the server. This made the solution simpler. Without a proxy I would probably started to play with l7-filters and iptables.

Squid offers different methods to filter urls. You can customize the squid.conf file where the configuration is stored and create ACLs to block some urls. Or you can use external applications which will redirect the URL based on different settings.

First I tried the external redirector. SquidGuard is one option but it sounded like a hammer to a fly. So I refreshed my perl coding skills and created a perl redirector script. The script allows to store the blocked URLs list in a file, as well as the list of source addresses which have full Internet access.

redirector script:

$ cat /usr/local/bin/squid_blocker.pl
#!/usr/bin/perl -w

$db_block="/usr/local/lib/squid_blocker.list";
$db_white="/usr/local/lib/squid_blocker_white.list";

$|=1;
while (<>) {
        my @X = split;
        my $url = $X[0];
        my $src = $X[1];

        open(DAT, $db_white) || die($url);
        @white_data=;
        close(DAT);

        $found=0;
        foreach $wip (@white_data) {
                $wip =~ s/\s+$//;
                if ($src =~ m/$wip/) {
                        print "$url\n";
                        $found=1;
                        last;
                }
        }
        if ($found == 0) {
                open(DAT, $db_block) || die($url);
                @blocked_data=;
                close(DAT);
                foreach $burl (@blocked_data) {
                        $burl =~ s/\s+$//;
                        if ($url =~ m/$burl/i) {
                                print "302:http://www.jozjan.net\n";
                                $found=1;
                                last;
                        }
                }
                if ($found == 0) {
                        print "$url\n";
                }
        }


blacklist file:

$ cat /usr/local/lib/squid_blocker.list
http(s?):\/\/[^\/]*pokec\.sk


whitelist file:

$ cat /usr/local/lib/squid_blocker_white.list
10\.0\.0\.1


squid configuration for redirector:

$ grep squid_blocker /etc/squid/squid.conf
redirect_program /usr/local/bin/squid_blocker.pl


Unfortunately this solution turned out to be slow. It took for a standard web page 3 times more time to load when the redirector was used. And for some weird reasons, some parts of web pages didn't load at all :-( The advantages of this solution were that after updating the blocked urls and allowed source IPs files it was not necessary to restart the proxy server and the blocked URLs were redirected to an another website. Next time I will try to write the redirector in C. It should has better performance then :)

I moved to the first mentioned option - ACL in squid.conf. You can define an ACL which contents will be stored in an external file. So you don't have to write the blocked URLs directly into the squid.conf file.

squid configuration with ACL:

$ grep black /etc/squid/squid.conf
acl blacksites url_regex "/etc/squid/blacksites"
acl blacksites_wip src "/etc/squid/blacksites_wip"
http_access deny blacksites !blacksites_wip

blacklist file:

$ cat /etc/squid/blacksites
[^/]*pokec.sk

whitelist file:

$ cat /etc/squid/blacksites_wip
10.0.0.1
10.0.0.51

This solution works with the best performance, but after each update in the blacklist or the whitelist file it is necessary to restart the squid proxy server.

Skype into Pidgin

Eion Robb has created a plugin for Pidgin which integrates Skype contacts into Pidgin. After installing and setting up the plugin in Pidgin, you can use Pidgin to talk with your friends on Skype. I love it!

Download.

andLinux

No, there is no space missing between the "and" and the "Linux". The andLinux is a Ubuntu based Linux distribution which is very special in one way - it runs directly on Windows. How? Well, here is the answer: the project is based on coLinux (cooperative Linux).

CoLinux is an older project which has ported the Linux kernel to a windows executable file. So you can start the Linux kernel as a standard win32 file, and with some special additions you can add disk storage, networking, etc. Sounds good, doesn't it? :-) In this way you can start your Linux system whenever you want, while you are in Widnows. No need to reboot to Linux (e.g. dualboot), or start vmware or other virtualization technique.

Well, so the guys behind the andLinux project has created a Ubuntu installation which runs on top of coLinux. But not just that. They have also added some additional tools from their own garage, like they have added sound and graphics support (x11) and even more - you can for example open PDF files on your Windows's My Documents folder with a xpdf started trough andLinux. And the best thing is that it's all packaged into a nice, user-friendly windows installation package so even a non computer geek can install it without bigger issues. It's really amazing! Guys, you have done a really great job!

You can access andLinux at andlinux.org.

.htaccess - Authentication from File and LDAP or other sources at the same time

Sometimes you may need to authenticate a user against different credentials stores, like standard files (.htpasswd), databases, ldap, ...
With Apache, you can use these more authentication sources by defining them in the AuthBasicProvider property.

The configuration bellow will authenticate a user first against a file (.htpasswd) and then against an LDAP accounts.

AuthName 'Enter your Username and Password:'
AuthType Basic

# Authenticate against file and then against ldap
AuthBasicProvider file ldap

# auth file
AuthUserFile /var/www/.htpasswd

# LDAP auth fallback to other auth mechanisms
AuthzLDAPAuthoritative off
AuthLDAPURL ldap://10.0.0.1:6361/ou=web,dc=top?cn?sub?(objectClass=*)

# File auth
Require valid-user
# LDAP auth
Require ldap-attribute objectClass=simpleSecurityObject

You can use it in your Apache's configuration and in the .htaccess as well.

.htaccess - Redirect to SSL (HTTPS) before Basic Authentication

I prefer running a site in HTTP only mode when there are no confidential information transferred (username, password, credit card number, etc.). It saves some of the CPU time because there is no need to do data encryption. But I strongly recommend to use HTTPS mode for confidential information exchange between a web browser and a web server.

I was facing a situation where I had to authenticate a user on a Apache web server, which provided HTTP as well as HTTPS connection. By default a web application running on that server was accessed only by HTTP. I had no access to the Apache's configuration (no root access), what would not be a problem, if I wanted to do just a .htaccess and a .htpasswd based basic HTTP authentication without anything else. It's pretty easy then. Just create a .htaccess file, with contents like this:

AuthName 'Enter your Username and Password:'
AuthType Basic
AuthUserFile /var/www/myweb/.htpasswd
Require valid-user

and a .htpasswd file (man htpasswd) which will contain usernames and particular passwords.

Then put the .htaccess file into a directory which you want to be protected by username/password.

You can even customize it by adding a FileMatch property to require credentials validation only when accessing some files:

AuthName 'Enter your Username and Password:'
AuthType Basic
AuthUserFile /var/www/myweb/.htpasswd
Require valid-user
<FilesMatch "(attach|edit|manage|rename|save|upload|mail|logon|.*auth).*">
      Require valid-user
</FilesMatch>

As I said above, I preffer HTTPS connection when confidential information are transfered over an IP network (in this case username and password). So the thing I wanted to do, was first to redirect a web browser to the HTTPS site and just then request the credentials. This was a point where I've got into a botleneck. If an authentication procedure is defined for a directory or a file, the authentication has higher priority then a redir command (mod_rewrite - redir). So the user is first authenticated, then moved to the HTTPS site and then authenticated once again. The problem is that the first athetincation is transferred in HTTP cleartext which is definitelly not secure.

AuthName 'Enter your Username and Password:'
AuthType Basic
AuthUserFile /var/www/myweb/.htpasswd
Require valid-user
<FilesMatch "(attach|edit|manage|rename|save|upload|mail|logon|.*auth).*">
      RewriteEngine on
      RewriteCond %{HTTPS} !=on    # If the connection is not HTTPS then apply the next Rewrite rule
      RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI}  [R,L]
      Require valid-user
</FilesMatch>

After some hours spent with configuration and RTFM, I found a hack which is maybe not the ideal solution, but it's pretty good and it's working.

There is an Apache configuration command which can be used in .htaccess as well. If the "SSLRequireSSL" command is specified for a directory or a file and it's accessed with a connection which is not SSL secured (HTTPS), it will generate a 403 error code and an error message will be sent to a web broswer. The "SSLRequireSSL" command has higher priority then the authentication itself, so it will generate this error code always when the connection is not SSL secured.
So far it looks good, the problem is that a user will just see an error page and he is still not automatically redirected to the HTTPS connection. A workaround is a bit tricky. You can define your own custom error documents, which are displayed when an error code is thrown. You have definitely seen these fancy custom error documents for the 404 - Page Not Found error code.

So the workaround was to use the ErrorDocument property in the .htaccess file. A custom page defined in ErrorDocument is called when the error code is thrown. The page itself gets information about the original request, so you can write a custom error page in some server side scripting language and generate some "special" events. I created a perl cgi script (there was no PHP support for that site) which redirects a browser to the HTTPS site which is exactly what I wanted in the beginning. So here is the .htaccess file:

AuthName 'Enter your Username and Password:'
AuthType Basic
AuthUserFile /var/www/myweb/.htpasswd
Require valid-user
<FilesMatch "(attach|edit|manage|rename|save|upload|mail|logon|.*auth).*">
      SSLRequireSSL
      ErrorDocument 403 /bin/move.pl
      Require valid-user
</FilesMatch>

and the move.pl file goes here:

#!/usr/bin/perl -T
use CGI qw(:standard);

$path = "https://$ENV{'SERVER_NAME'}$ENV{'REQUEST_URI'}";
if ( $ENV{'SERVER_PORT'} == 80) {
    print "Status: 302 Moved\n";
    print "Location: $path\n\n";
}
else {
    print "Content-type: text/html\n\n";
    print "How did you get here???";
}

With this combination, if the files defined in the FilesMatch directive are accessed with the HTTP only connection, an 403 error code is thrown by the SSLRequireSSL, which is handled by the ErrorDocument property. The /bin/move.pl cgi perl script is called which will then redirect a web browser to the HTTPS site. Furthermore, if the files defined in the FilesMatch directive are accessed with the HTTPS connection, a user is requested to authenticate himself with his username/password.

It's maybe not the best solution, but it's working, and it's enough to have .htaccess definitions enabled.

Enjoy!

Xen 3.1 @ Debian 4.0 - VNC domain console does not work

I have installed Xen 3.1 binaries on a Debian 4.0 R2 based server. The server is Intel VT enabled so I was just waiting to see Windows running in Xen. Unfortunately even with a good looking configuration I was not able to connect to a VNC console. After some troubleshooting I found a missing library reference error message in logs:

xeon2:/home# tail -1 /var/log/xen/xend-debug.log
/usr/lib/xen/bin/qemu-dm: error while loading shared libraries: libSDL-1.2.so.0: cannot open shared object file: No such file or directory

After installing the SDL package (apt-get install libsdl1.2debian) the VNC console has finally started to work and I was able to install my first Windows@Xen :-D

Putty feature - Putty authentication agent

Using RSA/DSA key pairs (public and private key) for SSH connection authentication has many advantages. It makes the authentication process more secure (especially when someone can see what are you typing on your keyboard), it enables using automated scripts for backup, etc. Under Windows you can generate RSA/DSA key pairs for ssh connection with the PuTTYgen application.

If you already have your RSA/DSA key pair generated, you copy-pasted the public key to the server to ~/.ssh/authorized_keys, then you can use the private key as an authentication mechanism instead of a password. If you have generated your RSA/DSA keys with a passphrase (I recommend to generate it with passphrase enabled) then you will be requested to enter it while authenticating.

Sometimes you have to connect to more servers at once, and have to enter the passphrase or a password as many times as many ssh session are you creating. To overcome the need of entering the passphrase, you can use the Putty authentication agent.

Start pageant.exe. A new Pageant icon will be added to the system tray:

Doubleclick on the Pageant icon and a window similar to the following figure should be displayed:

 

The Pageant window contains a list of enabled RSA/DSA keys which are automatically provided to putty or scp applications for RSA/DSA keys based authentication of the SSH session.

Click on Add Key and search for your private RSA/DSA key which you are using for SSH. If you are using a passphrase in your private RSA/DSA key (I highly recommend to use it) then just enter the password and the private key will be added to your enabled keys list.

That's all. Now if you try to connect to your ssh enabled host, your ssh connection authentication may look like this:

and a scp file copy may look like this:

!!!BEWARE!!!

Do not forget to lock your computer screen when you are leaving it and you have RSA/DSA keys enabled in Pageant! Otherwise anyone who has physical access to your computer can connect to your servers with ssh without having to know your passphrase.

Close your frozen ssh session

I am working with Linux quite a lot and sometimes I face this situation: I have a terminal with ssh connected to a remote server and after a while the ssh connection gets frozen on a remote side for some reasons. Now what? I used to find the PID of the ssh process in another terminal and then used kill -9 PID. This method looked a bit too "brute force" just for closing the broken ssh session and I was looking for a more "elegant" solution. Like when I am telnet_ed somewhere, I can use the CRTL+] key sequence as a escape character to break the connection. I found a similar solution for ssh: [enter]~. First press the Enter key, then tilde, and then add a dot and your ssh session will be closed and you can continue your work in back in freed terminal.