HOWTO Install CoovaChilli On A Raspberry Pi Using Raspian, FreeRADIUS and MySQL v1
HOWTO Install CoovaChilli On A Raspberry Pi Using Raspian, FreeRADIUS and MySQL v1
At a very high level the following are the steps required to take your fresh Raspbian
install to a working CoovaChilli-powered hotspot.
Step 1:
Step 2:
Configure how your network is setup to get your WAN and LAN working
to support a hotspot.
Step 3:
Configure MySQL. This will be where you store your usernames and
any restrictions you will place upon any users, etc.
Step 4:
Configure FreeRADIUS. In this step we also need to configure
FreeRADIUS to work with MySQL so these two programs can work together.
Step 5:
Install and configure CoovaChilli. On the Raspberry Pi you need to
compile CoovaChilli from its source package and then install the resulting .deb file.
Once installed, well configure it to work together with the other installed software.
Step 6: Configure the firewall.
Step 7:
Set up your Access Point so your hotspot users can access it.
Obviously, you will need a Raspberry Pi Ive only tested this on a model B. I
havent tweaked the Pi in any way (i.e., no overclocking, etc). Its also
important to mention that Ive installed everything on my Pi. It is possible to
set this up on your router or on separate devices but this is beyond the scope
of this howto.
To make CoovaChilli work on any system you need to have two Network
Interface Controllers or NICs. Since the Pi only has one LAN port we need to
physically add another and in this case it is simple and inexpensive to use a
wireless dongle as our second NIC.
For the wireless dongle Im using the Edimax EW-7811un (however, check the
Raspberry Pi compatibility list for others). The only reason I chose this one is
that it was small and didnt require a powered USB hub to work but the
downside is it is slow.
The operating system I used was: 2013-07-26-wheezy-raspbian and it is
available to download at raspberrypi.org.
With the exception of a few packages which, Ill tell you about when we get to
it, I used the standard repository to download and install the required binary
packages (i.e., .deb files).
As a suggestion, before modifying any of the configuration files I would
encourage you to make a backup copy in case you need or want to go back
to them. For the most part the default configurations just work. You
obviously need to tweak them to your specific system but generally these are
fairly minor. If you want to have a more advanced set up then Ill leave that
to you to do further research.
A wireless router that is configurable to the required specs (defined below).
If you run into problems throughout this howto I would encourage you to run
the different programs in their debug mode to see what error is showing.
You will need to have root access to work through this process.
Some nomenclature: $ means a non-root user while # means a root user
The text editor Im using is nano as it comes preinstalled and is a fairly
lightweight basic editor that is easy to use and learn.
Create a root user as it will be required for this howto.
The following text, used throughout the document, means that you need to
enter this into the command line. So in keeping with the previous bullet lets
start by creating the root user:
$ sudo passwd root
The Steps
Step 1: Install the Required Software
The software you need to download and install in this section comes from the
repositories only. When we need to download and compile the source packages
well go through that in those sections. The only assumption at this point is that
you have a newly installed and working Raspbian command line with internet
access.
First, update the software that came with the standard install:
$ sudo apt-get update && sudo apt-get upgrade
Install the required packages used for building packages from source (well need
these later):
$ sudo apt-get install debhelper libssl-dev libcurl4-gnutls-dev
When installing MySQL you will be asked to enter a root password please
remember this as you will be using this several times throughout this FAQ.
During the installation process of FreeRADIUS there will come a point where it
generates Diffie-Hellman (DH) parameters the time it takes to compute
these is highly variable but typically this is a time to grab a coffee as it will
likely take a while.
With the exception of two packages (CoovaChilli and haserl) we now have
everything we need.
Step 2: Networking
The purpose of this section is to set up your network interfaces appropriately so that
one interface connects to the internet and the other interface is set up so that it can
be used by CoovaChilli to manage your hotspot clients.
As stated previously, CoovaChilli requires 2 NICs and therefore we need to setup our
networking for two NICs. In this case the assumption is that you have a wireless
dongle plugged in and recognized by your Pi that will serve as our second NIC.
Well set it up so your internet connection comes from the wireless dongle
represented by wlan0 and the wired interface (eth0) will be managed by
CoovaChilli. This is probably the simplest setup the reverse has other
complications that are beyond the scope of this howto.
$ sudo nano /etc/network/interfaces
Modify the file to look like this: (remember to back up your original file)
auto lo
iface lo inet loopback
# eth0 is the wired interface that will be managed by CoovaChilli
# The ip address listed below will be entered into the file /etc/chilli/defaults and
assigned to the variable # HS_UAMLISTEN=10.1.1.1 and the network address will be
assigned to $HS_NETWORK=10.1.1.0, HS_LANIF = eth0
# CoovaChilli isnt even installed yet so dont worry too much about this its more
for your information at this point and for reference when you look back to see how
everything fits together.
auto eth0
iface eth0 inet static
address 10.1.1.1
netmask 255.255.255.0
network 10.1.1.0
# The primary internet connection
# Given that wlan0 is the primary internet connection then later in the file
/etc/chilli/defaults we set the variable HS_WANIF=wlan0
auto wlan0
allow-hotplug wlan0
iface wlan0 inet manual
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf
iface wlan0 inet dhcp
wpa-ssid YourSSID
wpa-psk YourPassword
Now we need to edit the wpa_supplicant.conf file:
$ sudo nano /etc/wpa_supplicant/wpa_supplicant.conf
The following set up assumes you are connected to your router using WPA/2-PSK
mode. I use AES as it is more secure and faster so I would strongly encourage you
to use it over TKIP. Add this to the end of the file:
network={
ssid=YourSSID
psk=YourPassword
proto=RSN
key-mgmt=WPA-PSK
pairwise=CCMP
auth_alg=OPEN
}
When youre done you can restart the networking service:
$ sudo /etc/init.d/networking restart
$ ifconfig
You should see that wlan0 has an IP address from your wireless router (confirm this).
You should also see that the eth0 interface has been assigned an IP address of
10.1.1.1. If this is not the case then reboot your pi (for whatever reason I had to do
this once for it to pick up the change strange).
For most of this howto you can save yourself time from typing sudo before every
command by switching to the root user.
$ su root
Create a MySQL database called radius:
# echo create database radius; | mysql u root p
OR, you can do this
# mysql u root p
mysql> create database radius;
mysql> quit
The reason I showed you this alternative is because when you want to come back
later to check, edit, update, delete, or what have you, the contents of the tables in
the radius database then its easier to do it the second way. The first way is simple
and efficient as youre only using one line but you will need to get familiar with
MySQL if you want to build on this howto.
Create the tables in the new radius database you just set up. For this step (i.e.,
schema.sql) you must be the root user even sudo doesnt work.
# mysql u root p radius < /etc/freeradius/sql/mysql/schema.sql
# mysql u root p radius < /etc/freeradius/sql/mysql/admin.sql
Create a user. This is a test user who will login to your CoovaChilli hotspot account
later.
# echo insert into radcheck (username, attribute, op, value) values (user1,
Cleartext-Password, :=, password); | mysql u root p radius
Now you can close the extra terminal youve opened and in the first terminal hit
<ctrl-C> to stop freeradius in debug mode. Now restart the freeradius daemon:
# /etc/init.d/freeradius start
$ cd /usr/src/coova-chilli-1.3.0
Now we can configure the source files with the following options. It looks
intimidating doesnt it! Note that the dashes preceding the tags below are double
hyphens ( --) not singles; those joining two words are a single hyphen.
/usr/src/coova-chilli-1.3.0 $ ./configure --prefix=/usr
--mandir=\$${prefix}/share/man --infodir=\$${prefix}/share/info \
--sysconfdir=/etc --localstatedir=/var --enable-largelimits \
--enable-binstatusfile --enable-statusfile --enable-chilliproxy \
--enable-chilliradsec --enable-chilliredir --with-openssl --with-curl \
--with-poll --enable-dhcpopt --enable-sessgarden --enable-dnslog \
--enable-ipwhitelist --enable-redirdnsreq --enable-miniconfig \
--enable-libjson --enable-layer3 --enable-proxyvsa --enable-miniportal \
--enable-chilliscript --enable-eapol --enable-uamdomainfile \
--enable-modules --enable-multiroute
Dont worry it will come to the end in a bit.and when it does you need to set the
compatibility level for debhelper otherwise youll get something like:
: No compatibility level specified in debian/compat
:The package will soon FTBFS; time to fix it!
:Compatibility levels before 5 are deprecated (level 1 in use)
Failing to set the compatibility level may result in a .deb file thats incomplete,
unstable or unusable. Therefore lets set the compatibility level to 9:
/usr/src/coova-chilli-1.3.0 $ echo 9 > debian/compat
Now we need to modify the /usr/src/coova-chilli-1.3.0/debian/rules file:
$ sudo nano /usr/src/coova-chilli-1.3.0/debian/rules
On line 54 of the file (close to the bottom) under install: build, we need to replace
the following line:
$(MAKE) DESTDIR=$(CURDIR)/debian/tmp install
With:
$(MAKE) DESTDIR=/ install
This ensures the necessary files are put into /etc/chilli/ directory and not in the
directory specified in the original line. Failing to do this will cause an error.
Were now at the point where were ready to compile the source code into an
actual .deb file that you can install!
/usr/src/coova-chilli-1.3.0 $ sudo dpkg-buildpackage us uc
Now that you just hit enter, you can sit back and watch the Pi do some real work.
This takes about +/-20 minutes on my Pi (with no overclocking or tweaking). Once
finished, the resulting .deb file (including a few other files) will be located in the
/usr/src directory and will be called: coova-chilli_1.3.0_armhf.deb
Now we can install our new .deb file. Make sure you go up a level to the /usr/src
directory where the file is located.
/usr/src $ sudo dpkg i coova-chilli_1.3.0_armhf.deb
When this is finished youll be presented with the following options: (Just select the
default)
Configuration file `/etc/init.d/chilli'
==> File on system created by you or by a script.
==> File also in package provided by package maintainer.
What would you like to do about it ? Your options are:
Y or I : install the package maintainer's version
N or O : keep your currently-installed version
D
: show the differences between the versions
Z
: start a shell to examine the situation
The default action is to keep your current version.
*** chilli (Y/I/N/O/D/Z) [default=N] ? N
Now were ready to actually configure CoovaChilli. First we need to enable the
service so it will start. It is turned off by default. To enable it to start simply edit the
following file:
# nano /etc/default/chilli
Change the first line from a 0 to a 1:
START_CHILLI = 1
Okay, now were going to edit the main chilli configuration file:
# nano /etc/chilli/defaults
Note this is the file I referred to previously when we set up our networking. The first
few items were changing are to be consistent with whats in the
/etc/network/interfaces file.
HS_WANIF = wlan0
HW_LANIF = eth0
HS_UAMALLOW = 10.1.1.0/24
HS_RADSECRET = testing123
to change this later.
Remember we installed haserl? Well now edit the following file and add the path to
haserl:
$ sudo nano /etc/chilli/wwwsh
Go to the line where it says:
haserl = $(which haserl 2>/dev/null) and replace it with:
haserl = /usr/local/bin/haserl
Were nearly done. We only have to restart all of our services. Now this doesnt
have to be done (its not Windows) but Id suggest rebooting to ensure all changes
are made.
$ sudo reboot
Once youve logged back into the Pi, you will need to start chilli.
$ sudo /etc/init.d/chilli start
Okay. Your CoovaChilli Captive Portal should now be configured and, if the stars are
aligned, working.
If you check ifconfig you should see a new tun0 interface this is a good sign.
$ ifconfig
Disable
Auto
Your-Hotspot
Disabled
Disable
Now that weve modified this file we need to add some entries into the dictionary:
$ sudo nano /etc/freeradius/dictionary
Add the following lines:
ATTRIBUTE
Daily-Session-Time
3000
integer
ATTRIBUTE
Max-Daily-Session
3001
integer
ATTRIBUTE
Monthly-Session-Time
3002
integer
ATTRIBUTE
Max-Monthly-Session
3003
integer
ATTRIBUTE
Max-All-Session-Time
3004
integer
ATTRIBUTE
Max-All-Session
3005
integer
Now that weve got our system configured we can now proceed to add new users
along with restrictions:
If we want to add a new user called Sam with an associated password
SamsPassword we do the following:
# echo insert into radcheck (username, attribute, op, value) values (Sam,
Cleartext-Password, :=, SamsPassword); | mysql u root p radius
Now one of the benefits of using MySQL is that immediately after you added
Sam, you can now login as Sam without restarting any of your services.
You can add as many or as few (i.e., none) of the restrictions provided below to
any or all of your users. Add the desired restrictions to the appropriate users in
the MySQL database. Some examples follow:
Example 1:
This will set the maximum time that Sam can access the internet to 10800
seconds or 3 hours:
# echo insert into radcheck (username, attribute, op, value) values (Sam,
Max-Daily-Session, :=, 10800); | mysql u root p radius
Example 2:
The following will limit when user1 can logon to the internet. Note that user1
can only access the internet between 9.00am and 6.00pm in the example.
# echo insert into radcheck (username, attribute, op, value) values (user1,
Login-Time, :=, Al0900-1800); | mysql u root p radius
Example 3:
Sam is only allowed to be logged on the system once. If you set this to 2 then
Sam can logon to the system twice simultaneously. This prevents people from
sharing their user name and password with their friends and each of them to
login at the same time.
# echo insert into radcheck (username, attribute, op, value) values (Sam,
Simultaneous-Use, :=, 1); | mysql u root p radius
Example 4:
Sams access expires on August 1, 2013 at 8.00pm.
# echo insert into radcheck (username, attribute, op, value) values (Sam,
Expiration, :=, August 1 2013 20:00); | mysql u root p radius
Example 5:
Sam will be rejected no matter what.
# echo insert into radcheck (username, attribute, op, value) values (Sam,
Auth-Type, :=, Reject); | mysql u root p radius
Example 6:
Sam forgets to logout and therefore has an idle session and you want to
automatically log Sam off if the session is idle longer than 120 seconds:
# echo insert into radreply (username, attribute, op, value) values (Sam, IdleTimeout, =, 120); | mysql u root p radius
Note a couple things: the equal sign is an = sign and not a :=, the time is
listed in seconds and the entry is into the table radreply and not radcheck.
Example 7:
You want to limit Sams sessions to 10 minutes each. In other words, after Sam
has been logged in he will be automatically logged out after 10 minutes. If Sam
logs out and back in, he will get another 10 minutes.
# echo insert into radreply (username, attribute, op, value) values (Sam,
Session-Timeout, =, 600); | mysql u root p radius
See the note in example 6.
The final part which, is optional, is to get chilli to start at boot time. Edit the
following file:
$ sudo /etc/init.d/chilli