Re: splashd Not Redirecting

Caveat: I've not worked with nocatsplash, only the older nocatauth. I have
no experience with WRT54G/dd-wrt either...

When you follow the README to build nocat you make two pieces.

One runs on the router (the gateway) the other runs on the gateway
server (authentication, logging etc).

If you want to run nocat in "Open Mode" with no authenticaiton at all, I
believe you only need to install Nocat on the dd-wrt router and set the
nocat.conf to say "GatewayMode    Open".

You DO need to run  a nocat deamon on the dd-wrt. This is where the 'capture
and release' happens (through iptables).

Rgds

Colin


On Tue, Nov 18, 2008 at 5:52 PM, Wilson Hernandez - MSD, S. A. <[email protected]
> wrote:

>  Colin,
>
> I am running the gateway on Debian Etch, no radius server. Receiving
> wireless and wired connections from a Linksys Router (WRT54G) with dd-wrt
> but, this router is not running nocat, Can it be run like this?
>
> I do not need authentication of any type only a splash page where user must
> accept an agreement and proceed to the Internet.
>
> When I try to access the internet from the LAN I get this (It captures but
> it doesn't get redirected to the page the user first requested):
>
> Message: Read 42 config items from /usr/local/etc/nocat.conf
> Message: initializing static splash page
> Message: Got command /usr/local/libexec/NoCatSplash/initialize.fw from
> action ResetCmd
> Message: starting main loop
> Message: Captured peer 192.168.2.100
> Message: Splashed peer 192.168.2.100
> Message: Checking peers for expiration
> Message: Checking peers for expiration
> Message: Checking peers for expiration
> Message: Checking peers for expiration
> Message: Accepting peer 192.168.2.100
> Message: Got command /usr/local/libexec/NoCatSplash/access.fw permit
> 00:2A:78:3D:58:A7 192.168.2.100 Public from action PermitCmd
> Message: Captured peer 192.168.2.100
> Message: Splashed peer 192.168.2.100
>
> I created a splash.html:
>
> </p>
>   <input type="hidden" name="redirect" value="$redirect">
>   <input type="hidden" name="accept_terms" value="yes">
>   <input type="hidden" name="mode_login">
>   <input type="submit" value="enter">
> </form>
>  <p><img src="/images/auth_logo.gif" width="112" height="35">
> <p>
>
> Here's my nocat.conf file:
>
> ##########Nocat.conf file#############
> Verbosity       10
>
> ##### Gateway application settings.
> #
> # GatewayName -- The name of this gateway, to be optionally displayed
> #   on the splash and status pages. Any short string of text will do.
> #
> GatewayName    Trahersa NoCat Network
>
> ##
> #
> # GatewayMode -- Determines the mode of operation of the gateway. Possible
> #   values are:
> #  #   Open    - Simply require a user to view a splash page and accept
> #            a use agreement.
> #
> # Only Open mode is currently supported.
> #
> GatewayMode    Open
>
> ##
> # GatewayLog -- Optional.  If unset, messages will go to STDERR.
> # (currently unused!)
> #
> # GatewayLog    /var/log/nocat.log
>
> ##
> # LoginTimeout - Number of seconds after a client's last
> #   login/renewal to terminate their connection. Probably
> #   don't want to set this to less than 60 or a lot of
> #   bandwidth is likely to get consumed by the client's
> #   renewal attempts.
> #
> # For Open Mode portals, you probably want to comment out
> #   the preceding and set LoginTimeout to
> #   something large (like 86400, for one notification
> #   per day).
> #
> LoginTimeout    86400
>
> ###### Open Portal settings.
> #
> ##
> # HomePage -- The authservice's notion of a default
> #   redirect.
> #
> HomePage    http://nocat.net/
>
> # DocumentRoot -- Where all of the application templates (including
> #   SplashPage) are hiding. Can be different from Apache's DocumentRoot.
> #   Defaults to /usr/local/share/NoCatSplash/htdocs via compile-time
> option.
> #
> # DocumentRoot    /usr/local/share/NoCatSplash/htdocs
> # SplashForm -- Form displayed to users on capture.
> #
> SplashForm    splash.html
>
> # StatusForm -- Page displaying status of logged in users.
> #   NOT YET IMPLEMENTED.
> #
> StatusForm    status.html
>
> # SplashURL -- URL to fetch remote splash page from. You must compile
> #   with --with-remote-splash for this to work. SplashTimeout specifies
> #   the reload period of the remote splash page.
> #
> # SplashURL    http://example.com/get_splash_page.cgi?node=$NodeID
> #
> # SplashTimeout    21600
>
> ###### Active/Passive Portal settings.
> # None of these settings affect open mode operation.
> #
> # TrustedGroups - A list of groups registered with the auth server
> #   that a user may claim membership in order to gain Member-class
> #   access through this portal. The default magic value "Any" indicates
> #   that a member of *any* group is granted member-class access from
> #   this gateway. NOT YET IMPLEMENTED.
> #
> # TrustedGroups    NoCat NYCWireless PersonalTelco
> #
> TrustedGroups Any
>
> ##
> # Owners - Optional.  List all local "owner" class users here, separated
> #   by spaces.  Owners typically get full bandwidth, and unrestricted
> #   access to all network resources. NOT YET IMPLEMENTED.
> #
> # Owners [email protected] [email protected]
>
> ##
> # AuthServiceAddr - Required, for captive mode. Must be set to the address
> of
> #   your authentication service. You must use an IP address
> #   if DNS resolution isn't available at gateway startup.
> #
> # AuthServiceAddr 208.201.239.21
> #
> AuthServiceAddr    auth.nocat.net
>
> ##
> # AuthServiceURL - HTTPS URL to the login script at the authservice.
> #
> AuthServiceURL  https://auth.nocat.net/cgi-bin/login
>
> ##
> # LogoutURL - HTTP URL to redirect user after logout.
> #
> LogoutURL    https://auth.nocat.net/logout.html
>
> ##
> # PGPKeyPath -- The directory in which PGP keys are stored.
> #   NoCat tries to find this in the pgp/ directory above
> #   the bin/ parent directory. Set this only if you put it
> #   somewhere that NoCat doesn't expect.
> #
> # PGPKeyPath    /usr/local/share/NoCatSplash/pgp
>
>
> ### Network Topology
> #
> # FirewallPath - Where to find the firewall scripts.
> #   Defaults to /usr/local/libexec/NoCatSplash via compile-time option.
> #
> # FirewallPath    /usr/local/libexec/NoCatSplash
>
> #
> # ExternalDevice - Required if and only if NoCatAuth can't figure it out
> #   from looking at your routing tables and picking the interface
> #   that carries the default route. Must be set to the interface
> #   connected to the Internet. Usually 'eth0' or 'eth1'
> #   under Linux, or maybe even 'ppp0' if you're running
> #   PPP or PPPoE.
> #
> ExternalDevice    eth0
>
> ##
> # InternalDevice - Required if and only if your machine has more than two
> #   network interfaces. Must be set to the interface connected to your
> local
> #   network, normally your wireless card.
> #
> InternalDevice    eth1
>
> ##
> # LocalNetwork - Required if and only if NoCatSplash can't figure it out
> #   by polling the InternalDevice. Must be set to the network
> #   address and net mask of your internal network. You
> #   can use the number of bits in the netmask (e.g. /16, /24, etc.)
> #   or the full x.x.x.x specification.
> #
> # LocalNetwork    10.0.1.0/24
> LocalNetwork 192.168.2.0/24
> ##
> # DNSAddr - Optional. *If* you choose not to run DNS on your internal
> network,
> #   specify the address(es) of one or more domain name server on the
> Internet
> #   that wireless clients can use to get out. Should be the same DNS that
> your
> #   DHCP server hands out.
> #
> # DNSAddr 111.222.333.444
> DNSAddr 196.3.81.5 200.88.127.22
>
> ##
> # AllowedWebHosts - Optional.  List any domains that you would like to
> #   allow web access (TCP port 80 and 443) BEFORE logging in (this is the
> #   pre-'skip' stage, so be careful about what you allow.)
> #
> # AllowedWebHosts    nocat.net
>
> ##
> # RouteOnly - Required only if you DO NOT want your gateway to act as a
> NAT.
> #   Uncomment this only if you're running a strictly routed network, and
> #   don't need the gateway to enable NAT for you.
> #
> # RouteOnly    1
>
> ##
> # MembersOnly - Optional.  Uncomment this if you want to disable public
> #   access (i.e. unauthenticated 'skip' button access).  You'll also want
> to
> #   point AuthServiceURL somewhere that doesn't include a skip button (like
> #   at your own Auth server.)
> #
> # MembersOnly    1
>
> ##
> # IncludePorts - Optional.  Specify TCP ports to allow access to when
> #   public class users login.  All others will be denied.
> #
> #   For a list of common services and their respective port numbers, see
> #   your /etc/services file. Depending on your firewall, you might even
> #   be able to specify said services here, instead of using port numbers.
> #
> # IncludePorts    22 80 443
>
> ##
> # ExcludePorts - Optional.  Specify TCP ports to denied access to when
> #   public class users login.  All others will be allowed.
> #
> #   Note that you should use either IncludePorts or ExcludePorts, but not
> #   both.  If neither is specified, access is granted to all ports to
> #   public class users.
> #
> #   You should *always* exclude port 25, unless you want to run an portal
> #   for wanton spam sending. Users should have their own way of sending
> #   mail. It sucks, but that's the way it is. Comment this out *only if*
> #   you're using IncludePorts instead.
> #
> # ExcludePorts 23 25 111
> #
> ExcludePorts    25
>
> ####### Syslog Options -- alter these only if you want NoCat to log to the
> #        system log! NOT YET IMPLEMENTED.
> #
> # Log Facility - syslog or internal.  Internal sends log messages
> #    using the GatewayLog or STDERR if GatewayLog is unset.  Syslog
> #    sends all messages to the system log.
> #
> # LogFacility    internal
>
> ##
> # SyslogSocket - inet or unix.  Inet connects to an inet socket returned
> #    by getsrvbyname().  Unix connects to a unix domain socket returned by
> #    _PATH_LOG in syslog.ph (typically /dev/log).  Defaults to unix.
> #
> # SyslogSocket unix
>
> ##
> # SyslogOptions - Zero or more of the words pid, ndelay, cons, nowait
> #    Defaults to "cons,pid".
> #
> # SyslogOptions cons,pid
>
> ##
> # SyslogPriority - The syslog class of message to use:  In decreasing
> importance,
> #    the typical priorities are EMERG, ALERT, CRIT, ERR, WARNING, NOTICE,
> INFO,
> #    and DEBUG.  Defaults to INFO.
> #
> # SyslogPriority INFO
>
> ##
> # SyslogFacility - The facility used to log messages.  Defaults to user.
> # SyslogFacility user
>
> ##
> # SyslogIdent - The ident of the program that is calling syslog.  This will
> #    be prepended to every log entry made by NoCat.  Defaults to NoCat.
> #
> # SyslogIdent NoCat
>
> ###### Other Common Gateway Options. (stuff you probably won't have to
> change)
> #
> # ResetCmd, PermitCmd, DenyCmd -- Shell commands to reset,
> #   open and close the firewall. You probably don't need to
> #   change these.
> #
> # ResetCmd    initialize.fw
> # PermitCmd    access.fw permit $MAC $IP $Class
> # DenyCmd    access.fw deny $MAC $IP $Class
>
> ##
> # GatewayPort - The TCP port to bind the gateway
> #   service to. 5280 is de-facto standard for NoCatAuth.
> #   Change this only if you absolutely need to.
> #
> GatewayPort     5280
>
> ##
> #
> # IdleTimeout -- How often to check the ARP cache, in seconds,
> #   for expiration of idle clients. NOT YET IMPLEMENTED.
> #
> # MaxMissedARP -- How many times a client can be missing from
> #   the ARP cache before we assume they've gone away, and log them
> #   out. Set to 0 to disable logout based on ARP cache expiration.
> #
> MaxMissedARP 0
> #
> # IdleTimeout   300
>
> ### Fin!
>
>
>
> Colin White wrote:
>
>> Can't speak for nocatsplash but this was my approach for nocatauth...
>>  1. Make sure your gpg is the same version on the gateway AND the access
>> point. (I had to downgrade both versions of gpg).  2. Check location,
>> ownership and file perms (600) of  trustedkeys.gpg.
>>  3. Set/sync system time/date on both the access point and gateway (if the
>> system time is way out, you'll have problems with pgp keys).
>>  The mailing lists seems to suggest ~90% of login loops and redirect
>> failures stem from key or certificate problems.
>>  4. Turn on verbose logging on the AP and the gateway (from within the
>> nocat.conf)
>>  5.  tail -f, the apache access and ssl-error logs as well as the nocat
>> access point logs.
>>  6. Test, tweak and retest, while watching the logs. Then post any logged
>> error msgs back to this list.
>> Good luck
>>  Rgds
>> Colin
>>  On Mon, Nov 17, 2008 at 7:24 PM, Wilson Hernandez - MSD, S. A. <
>> [email protected] <mailto:[email protected]>> wrote:
>>
>>    Hello.
>>
>>    I'm glad I found a mailing list for NoCat, hopefully there are
>>    still some users here.
>>
>>    I've been trying to get configure nocatsplash for about a month
>>    now but, can't get it to work on a Etch. It captures the packet
>>    but it doesn't' redirect to the requested page. Can anyone help me
>>    with this please. Your assistance will be very appreciated.
>>
>>    Thanks in advanced for your help.
>>
>>    _______________________________________________
>>    NoCat mailing list
>>    [email protected] <mailto:[email protected]>
>>    http://lists.nocat.net/mailman/listinfo/nocat
>>
>>
>>
>>
>> --
>> Colin A. White
>> P : +1 605 940 5863
>>
>>
>>
> --
> *Wilson Hernandez*
> Presidente
> 829.848.9595
> 809.766.0441
> www.msdrd.com <http://www.msdrd.com>
> Conservando el medio ambiente
>
> _______________________________________________
> NoCat mailing list
> [email protected]
> http://lists.nocat.net/mailman/listinfo/nocat
>



-- 
Colin A. White
P : +1 605 940 5863