From f7ec209aca76927640c415a5f9a962e1e129d269 Mon Sep 17 00:00:00 2001 From: watanaby <> Date: Tue, 25 Aug 2009 03:35:18 +0000 Subject: [PATCH] Ver.1.4.38: Modified english document. --- opengate/doc/Changes.html | 1317 +++++++++---------- opengate/doc/en/install.html | 2603 ++++++++++++++++++++----------------- opengate/doc/progflow.html | 309 +++-- opengate/opengatesrv/comm-ip6fw.c | 2 +- 4 files changed, 2213 insertions(+), 2018 deletions(-) diff --git a/opengate/doc/Changes.html b/opengate/doc/Changes.html index 733319b..c844ad5 100644 --- a/opengate/doc/Changes.html +++ b/opengate/doc/Changes.html @@ -1,675 +1,642 @@ - - -
- -+Please see CVS on SourceForge.net to check the differences between +versions. +
+ + diff --git a/opengate/doc/en/install.html b/opengate/doc/en/install.html index dae82f1..81c21ce 100644 --- a/opengate/doc/en/install.html +++ b/opengate/doc/en/install.html @@ -1,1200 +1,1403 @@ - - -In this document, we use the system configuration as follows. The network connecting terminals is called as lower-side network and the network having servers is called upper-side network.
- - --upper-side network:192.168.0.0/24, 2001:1:2:3/64 -Gateway to upper-side network:fxp1, 192.168.0.124, 2001:1:2:3::4 -Gateway to lower-side network:fxp0, 192.168.1.1, 2001:5:6:7::1 -lower-side network:192.168.1.0/24, 2001:5:6:7/64 - |
Opengate recognizes the both addresses of IPv4 and IPv6, and controles the both firewalls. It can be used for IPv4 control only under the FreeBSD system that does not set up IPv6 environments.
- - - -Following is the proceddure of Opengate. The '*'mark means the mandatory items.
- -- http://www.cc.saga-u.ac.jp/opengate/index-e.html - |
Use FreeBSD4.x or later. FreeBSD6.1 or later is desirable. -Choose distribution Developer(Full sources, binaries and doc) or all, because we have to prepare a kernel.
-Add next line to "/etc/rc.conf", because you enable the gateway function.
- -gateway_enable="YES" |
Prepare kernel having ipfw and ip6fw functions.
- -Copy kernel options file.
- --# cd /usr/src/sys/i386/conf -# cp GENERIC MYKERNEL - |
Add next lines to the kernel.
- -(For FreeBSD6.0 or earlier)
- --options IPDIVERT - -options IPFIREWALL -options IPFIREWALL_FORWARD -options IPFIREWALL_VERBOSE -options IPFIREWALL_VERBOSE_LIMIT=100 - -options IPV6FIREWALL -options IPV6FIREWALL_VERBOSE -options IPV6FIREWALL_VERBOSE_LIMIT=100 - -options IPSEC -options IPSEC_ESP -options TCP_DROP_SYNFIN - |
(For FreeBSD6.1 or later)
- --options IPDIVERT - -options IPFIREWALL -options IPFIREWALL_FORWARD -options IPFIREWALL_VERBOSE -options IPFIREWALL_VERBOSE_LIMIT=100 - -options IPSEC -device crypto - |
compile and install kernel having ipfw (and ip6fw) supports.
- - --# config MYKERNEL -# cd ../compile/MYKERNEL -# make depend -# make -# make install - |
"make clean" might be requested before "make depend".
- -Add next lines to "/etc/rc.conf".
- -(For FreeBSD6.0 or earlier)
- --firewall_enable="YES" -firewall_script="/etc/rc.firewall" -firewall_type="open" - -ipv6_firewall_enable="YES" -ipv6_firewall_script="/etc/rc.firewall6" -ipv6_firewall_type="open" - -natd_enable="YES" -natd_interface="fxp1" - |
(For FreeBSD6.1 or later)
--firewall_enable="YES" -firewall_script="/etc/rc.firewall" -firewall_type="open" - -natd_enable="YES" -natd_interface="fxp1" - |
When setting the ipfw(and ip6fw) enable, be care to set the type 'OPEN' as to prevent mysteryous system behavior in installing procedure. For NAT, Enable natd and setup natd interface(Upper-side interface).
- -Connect PC to the lower-side network and check the IPv4 behavior.
- -As the DHCP does not setup yet, The PC network must be setup manually.
- - - - - - -If you need IPv4 only, this section can be skipped. Though explanation is omitted, many pareameters like the following sample might be set in /etc/rc.conf. You must study about IPv6 and setup carefully.
- --##ENABLE IPv6 -ipv6_enable="YES" -ipv6_network_interfaces="gif0 fxp0" - -##TUNNELLING INTERFACE -gif_interfaces="gif0" -gifconfig_gif0="192.168.0.124 192.168.0.126" - -##IPv6 ADDRESS -ipv6_prefix_fxp0="2001:5:6:7" -ipv6_ifconfig_fxp0="2001:5:6:7::1 prefixlen 64" - -##ADVERTISE -rtadvd_enable="YES" -rtadvd_interfaces="fxp0" - -##DEFAULT GATEWAY -ipv6_default_interface="gif0" -ipv6_defaultrouter="fe80::a:b:c:d%gif0" - -##ROUTING(RIPv6) -ipv6_gateway_enable="YES" -ipv6_router_enable="YES" -ipv6_router="/usr/sbin/route6d" -ipv6_router_flags="-O 2001:5:6:7::/64,gif0" - |
Connect a PC to the lower-side network and check the behavior of IPv6
-In WindowsPC, a command "ipv6 install" might be needed to activate IPv6.
- - - - -You can ignore the DNS setting, if you control with IP address base or use existing DNS servers.
- -Installing BIND9 from ports is as follows. The "sysinstall" command can also be used for installation.
- - --# cd /usr/ports/dns/bind9/ -# make clean -# make install clean ; rehash - |
The directory "/etc/namedb(/var/named/etc/namedb)" is made in the installation.
- - - - - -For security, BIND9 is controlled by rndc command.
- -Create the rndc key as follows.
- --# cd /etc/namebd/ -# rndc-confgen -b 512 > rndc.conf - |
By the command, following "rndc.conf" file is generated.
- --# Start of rndc.conf -key "rndc-key" { - algorithm hmac-md5; - secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA=="; -}; - -options { - default-key "rndc-key"; - default-server 127.0.0.1; - default-port 953; -}; -# End of rndc.conf - -# Use with the following in named.conf, adjusting the allow list as needed: -# key "rndc-key" { -# algorithm hmac-md5; -# secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA=="; -# }; -# -# controls { -# inet 127.0.0.1 port 953 -# allow { 127.0.0.1; } keys { "rndc-key"; }; -# }; -# End of named.conf - |
There is "/etc/namedb/named.conf" after installation.
- -Copy later half of "rndc.conf" file, remove comment, and add IPv6 configuration(if required).
- --# Use with the following in named.conf, adjusting the allow list as needed: -key "rndc-key" { - algorithm hmac-md5; - secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA=="; -}; - -controls { - inet ::1 port 953 allow { ::1; } keys { "rndc-key"; }; - inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndc-key"; }; -}; -# End of named.conf - |
For security, it is better to write the "key" directive in the other file.
- -Edit "options" directive in "named.conf".
- --options { - directory "/etc/namedb"; - pid-file "/var/run/named/pid"; - auth-nxdomain yes; - listen-on-v6 { any; }; -}; - |
Make the corresponding directory to put "pid".
- - - - - -Edit "view" and "zone" directive in "named.conf".
- -The "view" directive is implemented in BIND9. Replying to the inquiry from matched-clients, BIND9 sends the information described in the corresponding view.
- - - --view "og" { - match-clients - { - 192.168.1.0/24; - }; - - recursion yes; - - zone "." { - type hint; - file "named.root"; - }; - - zone "og.saga-u.ac.jp" { - type master; - file "og.saga-u.ac.jp"; - }; - - zone "0.0.127.IN-ADDR.ARPA" { - type master; - file "master/localhost.rev"; - }; - - // RFC 3152 - zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\ - 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA" { - type master; - file "master/localhost-v6.rev"; - }; - - // RFC 1886 -- deprecated - zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\ - 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.INT" { - type master; - file "master/localhost-v6.rev"; - }; -}; - |
Make a "zone" file for the domain as "og.saga-u.ac.jp". -The domain name and IPv4/6 addresses should be modified properly. -If you don't need IPv6, the line "AAAA ...." should be removed.
- --$TTL 3600 -$ORIGIN og.saga-u.ac.jp. - -@ IN SOA ns.og.saga-u.ac.jp. postmaster ( - 2005051702 ; - 3600 - 1200 - 2419200 - 86400 ) - IN NS ns.og.saga-u.ac.jp. - IN A 192.168.1.1 - IN MX 10 opengate.og.saga-u.ac.jp. - -ns IN A 192.168.1.1 - -opengate IN A 192.168.1.1 - AAAA 2001:5:6:7::1 - |
Confirm starting of "named" after setting was completed.
- --# /usr/local/sbin/named -u bind -c /etc/namedb/named.conf - |
If "named" starts without problems, Add next lines to "/etc/rc.conf" for auto start.
- -named_enable="YES" -named_program="/usr/local/sbin/named" -named_flags="-u bind -c /etc/namedb/named.conf" - |
Because the management of a DNS server is complicated, You need to read manual of BIND9 carefully, and refer other document.
- - - -Many client PCs are connected. Thus the DHCP might be a desireble solution for assginment of IP addresses to these clients.
- -Installing isc-dhcp3 from ports is as follows. The "sysinstall" command can also be used for intallation.
- --# cd /usr/ports/net/isc-dhcp3-server -# make clean -# make install clean ; rehash - |
There is a configuration file "/usr/local/etc/dhcpd.conf.sample" after instalation. Copy "dhcpd.conf.sample" to "dhcpd.conf" and edit the file. Following is an example setup. The lease time must be greater than the maximum usage duration (Duration/Max in opengatesrv.conf).
-The domain name and IP addresses should be modified.
- --option domain-name "og.saga-u.ac.jp"; -option domain-name-servers 192.168.1.1; -option subnet-mask 255.255.255.0; -option broadcast-address 192.168.1.255; -option routers 192.168.1.1; - -default-lease-time 86400; -max-lease-time 604800; -ddns-update-style none; -log-facility local7; - -subnet 192.168.55.0 netmask 255.255.255.0 { - range 192.168.1.10 192.168.1.250; -} - |
Add next lines to "/etc/rc.conf" for auto start.
- --dhcpd_enable="YES" -dhcpd_ifaces="fxp0" -dhcpd_conf="/usr/local/etc/dhcpd.conf" - |
In this description, the value of "dhcpd_ifaces" is the interface for DHCP service(the lower-side network).
- - - -When using IPv6 function, Opengate needs Apache2 supporting IPv6. In default, Apache2 supports SSL which is desirable for secure authentication.
- - -Installing Apache2 from ports is as follows. The "sysinstall" command can also be used for installation.
- --# cd /usr/ports/www/apache22 -# make clean -# make install clean ; rehash - |
It is better to obtain a formal key from some CA. But we shows the procedure to make a self-signed private key and certificate.
- - -Make a private key as follows.
- --# cd /usr/local/etc/apache22 -# mkdir ssl.key ssl.crt -# chmod 700 ssl.key ssl.crt - -# /usr/bin/openssl genrsa -out /usr/local/etc/apache22/server.key 1024 - |
Make a certificate from the key as follows.
- --# /usr/bin/openssl req -new -x509 -days 365 \ - -key /usr/local/etc/apache22/server.key \ - -out /usr/local/etc/apache22/server.crt - -You are about to be asked to enter information that will be incorporated -into your certificate request. -What you are about to enter is what is called a Distinguished Name or a DN. -There are quite a few fields but you can leave some blank -For some fields there will be a default value, -If you enter '.', the field will be left blank. ------ -Country Name (2 letter code) [AU]:JP -State or Province Name (full name) [Some-State]:Saga -Locality Name (eg, city) []:Saga-city -Organization Name (eg, company) [Internet Widgits Pty Ltd]:Saga-university -Organizational Unit Name (eg, subsection) []:Opengate Management -Common Name (eg, YOUR name) []:opengate.og.saga-u.ac.jp -Email Address []:administrator@opengate.og.saga-u.ac.jp - -Please enter the following 'extra' attributes -to be sent with your certificate request -A challenge password []: -An optional company name []: - - |
Edit "/usr/local/etc/apache22/extra/httpd-ssl.conf" like the following example.
- -ssl.conf - |
-<VirtualHost _default_:443> - DocumentRoot "/usr/local/www/apache22/data" - ServerName opengate.og.saga-u.ac.jp:443 - ServerAdmin administrator@opengate.og.saga-u.ac.jp - ErrorLog "|/usr/bin/logger -p local6.info" - CustomLog "|/usr/bin/logger -p local5.info" combined - - SSLEngine on - SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL - SSLCertificateFile /usr/local/etc/apache22/server.crt - SSLCertificateKeyFile /usr/local/etc/apache22/server.key -</VirtualHost> - |
As Apache2 has many settings, be familiar with Apache2 configuration for adequate control.
- - - - - - -Edit "/usr/local/etc/apache22/httpd.conf" as follows.
- -Opengate send back the authentication page for any kind of HTTP request. To do so, add next line to httpd.conf. This means that the top page is sent back at HTTP_ERROR 404(file not found) error.
- - - --ErrorDocument 404 / - |
Add ExecCGI to execute CGI program in cgi-bin directory.
--<Directory "/usr/local/www/cgi-bin"> - ... - Options ExecCGI - ... -</Directory> - |
-Remove the comment mark to enable the following setting -
-AddHandler cgi-script .cgi -AddHandler type-map .var - |
-Add "index.html.var" into DirectoryIndex. -
-DirectoryIndex index.html.var index.html - |
-Include ssl conf file. -
-Include etc/apache22/extra/httpd-ssl.conf - |
-Set Server name. -
-ServerName opengate.og.saga-u.ac.jp - |
Start Apache2 with "apachectl start" and check the normal action. -Then add next lines to "/etc/rc.conf" for auto start.
- --apache22_enable="YES" -apache22ssl_enable="YES" - |
-If the system shows "Failed to enable the 'httpready' Accept Filter", -add following into /boot/loader.conf -
-accf_http_load="YES" - |
Unfold the package of Opengate.
- --# tar xzvf opengatexxxx.tar.gz - |
It have following directorys.
- --doc: Documentations -conf: Configuration file and firewall control perl script sample -javahtml: Client Java Programs and HTML files -opengatesrv: Server CGI programs -tools: Some related tools -ezxml: XML parser (Copyright Aaron Voisine) -- |
Check setting in "opengatesrv/Makefile" and modify properly.
- --HTMLTOP = /usr/local/www/apache22 -DOCDIR = /data -CGIDIR = /cgi-bin -OPENGATEDIR = /opengate -CONFIGPATH = /etc/opengate -- |
Compile and Install.
- --# make clean -# make install - |
Copy sample config file "/etc/opengate/opengatesrv.conf.sample" to "/etc/opengate/opengatesrv.conf" and modify. Following settings must be changed.
- -- <OpengateServerName>opengate.og.saga-u.ac.jp</OpengateServerName> - - <AuthServer> - <Protocol>pop3s</Protocol> - <Address>192.168.0.2</Address> - </AuthServer> - |
In <OpengateServerName>, set HOSTNAME(FQDN) or IP address of opengate gateway server. If you -want to use IPv6 function, you need to set FQDN corresponding to IPv4 and IPv6 both addresses.
-In <AuthServer>, set the information of authentication server. Opengate support various auth protocols. See the config file for details. To separate the problem between auth server and opengate server, try the following setting firstly. This means that any userid and password are accepted.
- - -- ****Do not use this setting in real service**** - <AuthServer> - <Protocol>accept</Protocol> - <AuthServer> - |
The config file is XML form. The # mark in the file does not mean the start of a comment. Use XML-formed comment as <!-- Comment String --> to disable description.
- -Opengate can switch auth setting with "userid@extid" pattern. See the config file for details. By this function, you can divide the authentication servers for many sections or guests.
- -When default auth server is not replied, Opengate can re-request to other auth servers. See the config file for details.
- -Caution: Do not delete the IPv6 related setting in config file. The IPv6 access is executed when the FQDN for IPv6 is prepared.
- - - - - -Write ipfw rules for Opengate. - - -
(For FreeBSD6.0 or earlier)
- -IPv4 packets are controlled by ipfw, and IPv6 packets by ip6fw.
-Sample setup scripts for both commands are prepared as "/etc/opengate/rc.firewall4.sample" and "/etc/opengate/rc.firewall6.sample"
-Copy these script and modify properly.
- --# cd /etc/opengate -# cp rc.firewall4.sample rc.firewall4 -# cp rc.firewall6.sample rc.firewall6 -# vi rc.firewall4 -# vi rc.firewall6 - |
Modify firewall setting in /erc/rc.conf as follows. Be care that accesses after this setting might be denied by the firewall.
- --firewall_enable="YES" -firewall_script="/etc/opengate/rc.firewall4" - -ipv6_firewall_enable="YES" -ipv6_firewall_script="/etc/opengate/rc.firewall6" - |
Then modify "/etc/opengatesrv.conf" from <Ip6fwPath>/sbin/ipfw</Ip6fwPath> to <Ip6fwPath>/sbin/ip6fw</Ip6fwPath>
- - -(For FreeBSD6.1 or later)
- -Both of IPv4 and IPv6 packets are controlled by ipfw.
-Sample setup scripts for the system are prepared as "/etc/opengate/rc.firewall.sample"
-Copy the script and modify properly. If you don't know IPv6, set IPv6 addresses as localhost(*net6="0", *ip6="::1").
- --# cd /etc/opengate -# cp rc.firewall.sample rc.firewall -# vi rc.virewall - |
Modify firewall setting in /erc/rc.conf as follows. Be care that accesses after this setting might be denied by the firewall.
- --firewall_enable="YES" -firewall_script="/etc/opengate/rc.firewall" - |
Be familiar with the ipfw command. Opengate is a software to send out ipfw add/delete command.
- -Opengate adds/removes the allow rule (rule number:10000-40000) for the authenticated terminals. And the forward rule is exists in less priority position(rule number:60000) in the initial setting. Thus the packets for authenticated terminals pass the gateway, and the Web access from other terminals results the authentication page. -
- - - - -Edit /etc/syslog.conf to save log file for Opengate.
- -- | Separeted by TAB code - V -local1.* /var/log/opengate.log - |
Make the log file as follows. Be care to control the size of this log file.
- --# touch /var/log/opengate.log - |
Connect a PC to the lower-side network and access to a site in the upper-side network. If it does not work properly, refer doc/progflow.html and doc/protocol.txt to understand the procedure. And see the log file for Opengate, httpd, system and others. To dump more information from Opengate, set the <Debug> switch "2" in opengatesrv.conf. Check also the functions of related software. The error checking document(errcheck.html) and Q and A document (qa.html, recentqa.html in web) might be used for problem solving.
- - - - --If you want to modify the contents of web pages, edit the html files in Opengate directories. The relative path cannot use in httpkeep.html. Use the URL of full description. The descriptions such as %%XXX%% are variables replaced with some proper values in CGI.
- - - - -This is optional. When you want to watch the state of Opengate, MRTG can be used but is not required usually.
- -MRTG(Multi Router Traffic Grapher) is system to watch network traffic. -MRTG makes graphic images and HTML files.
- -You can install MRTG to gateway server or another server. If you must watch plural Opengate, you -had better install MRTG to another server.
- --# cd /usr/ports/net-mgmt/mrtg/ -# make clean -# make install clean ; rehash - |
There is "/usr/local/etc/mrtg/mrtg.cfg.sample" as configuration file after instalation. -Copy mrtg.cfg.sample to opengate.cfg and edit configuration file.
- --################################################## -# opengate user counter - -WorkDir: /usr/home/user/public_html/mrtg/opengate/ - -##### Options -Options[^]: growright,gauge,nopercent,integer - -Target[opengate]:`/usr/home/user/bin/input.sh` -Title[opengate]: Opengate user counter - -PageTop[opengate]: <h1>Opengate user counter</h1> - <p>Show the number of people using Opengate</p> - -# Max Number -MaxBytes[opengate]: 200 - -# Title of Y axis -YLegend[opengate]: Opengate User -# unit -ShortLegend[opengate]: s -# Title of graph LegendI: first line LegendO: second line -LegendI[opengate]: IPv6 Users -LegendO[opengate]: Total Users - |
make a directory which you appointed in "WorkDir". MRTG makes graphic images and HTML files in WorkDir.
- -"Target[opengate]" is path to program to hand data to MRTG. explain below th details.
- - - -Put this shellscript as "/usr/home/user/bin/input.sh".
- --#!/bin/sh - -####################################### -## -## show opengate status for MRTG -## -## 1 line : IPv6 Users -## 2 line : Total Users -## 3 line : uptime -## 4 line : comment for data -## -####################################### - -LANG=C -COLUMNS=256 - -export LANG -export COLUMNS - -### IPv6 prefix -prefix="2001:2f8:22:801:" -###opengateprocessname -process="opengatesrv.cgi" - -###tmp file name -tmp_all="/tmp/og_count_all.tmp" -tmp_6="/tmp/og_count_6.tmp" - -###################################################### -psax | grep $process > $tmp_all -COUNT = `wc-l $tmp_all | awk '{print $1}'` -grep $prefix $tmp_all > $tmp_6 -COUNT6=`wc -l $tmp_6 | awk '{print $1}'` -UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"` - -rm $tmp_all -rm $tmp_6 - -echo "$COUNT6" -echo "$COUNT" -echo "$UPTIME" -echo "Opengate User Counter" - |
carry out this shell script alone and confirm that you can acquire the following data.
- -5 -48 -10days -Opengate User Counter - |
Put this shellscript as "/usr/home/user/bin/input.sh" on another server.
- --#!/bin/sh - -####################################### -## -## input data for MRTG -## -## 1 line : IPv6 Users -## 2 line : Total Users -## 3 line : uptime -## 4 line : comment for data -## -####################################### - -# tmp file name -file="/tmp/opengate.tmp" - -# URL of output.sh at opengate -url="http://opengate.saga-u.ac.jp/cgi-bin/output.sh" - -fetch -o $file $url &> /dev/null - -more $file - |
Put this shell script as "/usr/local/apache2/cgi-bin/output.sh" on Opengate server. -And set this URL to $url in script explained by the above.
- --#!/bin/sh - -####################################### -## -## show opengate status for MRTG -## -## 1 line : IPv6 Users -## 2 line : Total Users -## 3 line : uptime -## 4 line : comment for data -## -####################################### - -LANG=C -COLUMNS=256 - -export LANG -export COLUMNS - -### IPv6 prefix -prefix="2001:2f8:22:801:" -###opengateprocessname -process="opengatesrv.cgi" - -###tmp file name -tmp_all="/tmp/og_count_all.tmp" -tmp_6="/tmp/og_count_6.tmp" - -###################################################### -psax | grep $process > $tmp_all -COUNT = `wc-l $tmp_all | awk '{print $1}'` -grep $prefix $tmp_all > $tmp_6 -COUNT6=`wc -l $tmp_6 | awk '{print $1}'` -UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"` -rm $tmp_all -rm $tmp_6 - -echo "Content-type: text/plain; charset=iso-8859-1" -echo - -echo "$COUNT6" -echo "$COUNT" -echo "$UPTIME" -echo "Opengate User Counter" - |
carry out "input.sh" shell script on another server and confirm that you can acquire the following data.
- -5 -48 -10days -Opengate User Counter - |
Confirm after setting was completed.
- --# /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg - |
Various WARNING is output the first and second time.
- -There is some files in "WorkDir".
- -> ls -l --rw-r--r-- 1 root wheel 538 12 14 04:40 mrtg-l.png --rw-r--r-- 1 root wheel 414 12 14 04:40 mrtg-m.png --rw-r--r-- 1 root wheel 1759 12 14 04:40 mrtg-r.png --rw-r--r-- 1 root wheel 2941 12 20 15:15 opengate-day.png --rw-r--r-- 1 root wheel 2146 12 20 14:35 opengate-month.png --rw-r--r-- 1 root wheel 2867 12 20 14:55 opengate-week.png --rw-r--r-- 1 root wheel 1897 12 20 05:00 opengate-year.png --rw-r--r-- 1 root wheel 5961 12 20 15:15 opengate.html --rw-r--r-- 1 root wheel 48786 12 20 15:15 opengate.log --rw-r--r-- 1 root wheel 48784 12 20 15:10 opengate.old - |
Add next line to "/etc/crontab".
- --*/5 * * * * root /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg - |
This is optional. At the abnormal termination of Opengate process, superfluous rule might be left bihind. -Though it is very rare, a script dealing with the case is prepared in tools/rulechk. This script is compatible with Opengate Ver1.3.1 or later. -This script compares the Opengate process list and the firewall rule list, and deletes the superfluous rules. -
- - - - + + + + +In this document, we use the system configuration as follows. The +network connecting terminals is called "lower-side network" and +the network having servers is called "upper-side network".
+
+ upper-side network:192.168.0.0/24, 2001:1:2:3/64 +Gateway to upper-side network:fxp1, 192.168.0.124, 2001:1:2:3::4 +Gateway to lower-side network:fxp0, 192.168.1.1, 2001:5:6:7::1 +lower-side network:192.168.1.0/24, 2001:5:6:7/64+ |
+
Opengate recognizes both IPv4 and IPv6 addresses, and controls +both firewalls. It can be used for IPv4 control only if the FreeBSD +environment is not set up for IPv6.
+ + +The following steps are necessary to complete the installation of
+Opengate.
Items marked with '*' are mandatory.
The Opengate support page can be +consulted at: +
+
+ http://www.cc.saga-u.ac.jp/opengate/index-e.html+ |
+
Use FreeBSD4.x or later. FreeBSD6.1 or later is preferred.
Choose
+distribution "Developer (Full sources, binaries and doc)" or
+"all" because we have to compile a custom kernel.
Add the following line to "/etc/rc.conf", to enable the +gateway function:
+
+
|
+
Preparing the kernel to include IPFW and IP6FW functionality.
+Copy the kernel configuration file:
+
+ # cd /usr/src/sys/i386/conf +# cp GENERIC MYKERNEL+ |
+
Add the following lines to the kernel configuration file:
+A. FreeBSD6.0 or earlier
+
+ options IPDIVERT + +options IPFIREWALL +options IPFIREWALL_FORWARD +options IPFIREWALL_VERBOSE +options IPFIREWALL_VERBOSE_LIMIT=100 + +options IPV6FIREWALL +options IPV6FIREWALL_VERBOSE +options IPV6FIREWALL_VERBOSE_LIMIT=100 + +options IPSEC +options IPSEC_ESP +options TCP_DROP_SYNFIN+ |
+
B. FreeBSD6.1 or later
+
+ options IPDIVERT + +options IPFIREWALL +options IPFIREWALL_FORWARD +options IPFIREWALL_VERBOSE +options IPFIREWALL_VERBOSE_LIMIT=100 + +options IPSEC +device crypto+ |
+
compile and install the new kernel (incl. added support for IPFW +and IP6FW).
+
+#cd /usr/src +#make buildkernel KERNCONF=MYKERNEL +#make installkernel KERNCONF=MYKERNEL ++ |
It might be failed in old FreeBSD. In the case, execute the following.
+
+# config MYKERNEL +# cd ../compile/MYKERNEL +# make depend +# make +# make install+ |
"make clean" might be requested before "make +depend". +
+Add the following lines to "/etc/rc.conf":
+a. FreeBSD6.0 or earlier
+
+ firewall_enable="YES" +firewall_script="/etc/rc.firewall" +firewall_type="open" + +ipv6_firewall_enable="YES" +ipv6_firewall_script="/etc/rc.firewall6" +ipv6_firewall_type="open" + +natd_enable="YES" +natd_interface="fxp1"+ |
+
b. FreeBSD6.1 or later
+
+ firewall_enable="YES" +firewall_script="/etc/rc.firewall" +firewall_type="open" + +natd_enable="YES" +natd_interface="fxp1"+ |
+
When enabling IPFW (and IP6FW), make sure
+to also set the firewall_type to 'OPEN', to prevent unpredictable
+system behavior during installation.
To enable NAT, set
+natd_enable to 'YES' and define the natd interface (Upper-side
+interface).
Connect a client pc to the lower-side
+network and check the IPv4 behavior.
Since DHCP is not yet set up,
+the client's network settings must be configured manually.
If you need IPv4 only, this section can
+be skipped.
Though explanation is omitted, many parameters, like
+the ones used in the following sample, can be set in /etc/rc.conf.
+
It is advised to read up on IPv6 and carefully set up its
+parameters.
+
+ ##ENABLE IPv6 +ipv6_enable="YES" +ipv6_network_interfaces="gif0 fxp0" + +##TUNNELLING INTERFACE +gif_interfaces="gif0" +gifconfig_gif0="192.168.0.124 192.168.0.126" + +##IPv6 ADDRESS +ipv6_prefix_fxp0="2001:5:6:7" +ipv6_ifconfig_fxp0="2001:5:6:7::1 prefixlen 64" + +##ADVERTISE +rtadvd_enable="YES" +rtadvd_interfaces="fxp0" + +##DEFAULT GATEWAY +ipv6_default_interface="gif0" +ipv6_defaultrouter="fe80::a:b:c:d%gif0" + +##ROUTING(RIPv6) +ipv6_gateway_enable="YES" +ipv6_router_enable="YES" +ipv6_router="/usr/sbin/route6d" +ipv6_router_flags="-O 2001:5:6:7::/64,gif0"+ |
+
Connect a client pc to the lower-side
+network and check the behavior of IPv6.
On a Windows pc, the
+command "ipv6 install" might be needed to activate IPv6.
You can ignore DNS +settings, if you control with IP address base +or use existing DNS servers.
+ Installing BIND9 from
+ports:
+Note: The "sysinstall" command can also be used.
+ # cd /usr/ports/dns/bind9/ +# make clean +# make install clean ; rehash+ |
+
During installation the directory "/etc/namedb +(/var/named/etc/namedb)" is created.
+ + + +Use the "rndc" command to further secure BIND9.
+Create the rndc key as follows:
+
+ # cd /etc/namebd/ +# rndc-confgen -b 512 > rndc.conf+ |
+
This will generate the "rndc.conf" file.
+
+ # Start of rndc.conf +key "rndc-key" { + algorithm hmac-md5; + secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA=="; +}; + +options { + default-key "rndc-key"; + default-server 127.0.0.1; + default-port 953; +}; +# End of rndc.conf + +# Use with the following in named.conf, adjusting the allow list as needed: +# key "rndc-key" { +# algorithm hmac-md5; +# secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA=="; +# }; +# +# controls { +# inet 127.0.0.1 port 953 +# allow { 127.0.0.1; } keys { "rndc-key"; }; +# }; +# End of named.conf+ |
+
After installation, look for the +"/etc/namedb/named.conf" file and copy the last half of the +"rndc.conf" file to it, making sure to remove comments, and +add IPv6 configuration where/if required.
+
+ # Use with the following in named.conf, adjusting the allow list as needed: +key "rndc-key" { + algorithm hmac-md5; + secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA=="; +}; + +controls { + inet ::1 port 953 allow { ::1; } keys { "rndc-key"; }; + inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndc-key"; }; +}; +# End of named.conf+ |
+
For security reasons, it is better to write the "key" +directive in the other file.
+Edit the "options" directive in "named.conf":
+
+ options { + directory "/etc/namedb"; + pid-file "/var/run/named/pid"; + auth-nxdomain yes; + listen-on-v6 { any; }; +};+ |
+
Create the corresponding "pid" directory.
+ + + +Edit the "view" and "zone" directives in "named.conf".
+The "view" directive is implemented in BIND9. Replying +to the inquiries from matched-clients, BIND9 sends the information as +described in the corresponding "view"
+
+ view "og" { + match-clients + { + 192.168.1.0/24; + }; + + recursion yes; + + zone "." { + type hint; + file "named.root"; + }; + + zone "og.saga-u.ac.jp" { + type master; + file "og.saga-u.ac.jp"; + }; + + zone "0.0.127.IN-ADDR.ARPA" { + type master; + file "master/localhost.rev"; + }; + + // RFC 3152 + zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\ + 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA" { + type master; + file "master/localhost-v6.rev"; + }; + + // RFC 1886 -- deprecated + zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\ + 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.INT" { + type master; + file "master/localhost-v6.rev"; + }; +};+ |
+
Make a "zone" file for the domain "og.saga-u.ac.jp".
+
The domain name and IPv4/6 addresses should be modified properly.
+If you don't need IPv6, remove the line containing "AAAA ....".
+ $TTL 3600 +$ORIGIN og.saga-u.ac.jp. + +@ IN SOA ns.og.saga-u.ac.jp. postmaster ( + 2005051702 ; + 3600 + 1200 + 2419200 + 86400 ) + IN NS ns.og.saga-u.ac.jp. + IN A 192.168.1.1 + IN MX 10 opengate.og.saga-u.ac.jp. + +ns IN A 192.168.1.1 + +opengate IN A 192.168.1.1 + AAAA 2001:5:6:7::1+ |
+
Confirm starting of "named" after completings its +configuration.
+
+ # /usr/local/sbin/named -u bind -c /etc/namedb/named.conf+ |
+
If "named" starts without problems, add the following +lines to "/etc/rc.conf" to allow it to automatically start +on boot up.
+
+ named_enable="YES" +named_program="/usr/local/sbin/named" +named_flags="-u bind -c /etc/namedb/named.conf"+ |
+
Because the management of a DNS server +can be complicated, it is strongly advised to carefully read the +BIND9 manual, and/or consult other documentation.
+ + + +If many client PCs are going to be +connected, using the DHCP service might be a desirable solution for +assigning IP addresses to these clients.
+Installing isc-dhcp3 from ports:
Note:
+the "sysinstall" command can also be used.
+ # cd /usr/ports/net/isc-dhcp3-server +# make clean +# make install clean ; rehash+ |
+
The"/usr/local/etc/dhcpd.conf.sample"
+ configuration file is created during installation.
Copy
+"dhcpd.conf.sample" to "dhcpd.conf" and edit the
+file.
The following is an example setup:
The lease time
+must be greater than the maximum usage duration (Duration/Max in
+opengatesrv.conf).
The domain name and IP addresses should be
+modified.
+
+ option domain-name "og.saga-u.ac.jp"; +option domain-name-servers 192.168.1.1; +option subnet-mask 255.255.255.0; +option broadcast-address 192.168.1.255; +option routers 192.168.1.1; + +default-lease-time 86400; +max-lease-time 604800; +ddns-update-style none; +log-facility local7; + +subnet 192.168.55.0 netmask 255.255.255.0 { + range 192.168.1.10 192.168.1.250; +}+ |
+
Add the following lines to "/etc/rc.conf" to allow it to +automatically start on boot up.
+
+ dhcpd_enable="YES" +dhcpd_ifaces="fxp0" +dhcpd_conf="/usr/local/etc/dhcpd.conf"+ |
+
In this example, the value of
+"dhcpd_ifaces" is the interface providing the DHCP service
+
(to the lower-side network).
When using IPv6, Opengate needs Apache2
+to support IPv6.
By default, Apache2 supports SSL which is
+preferred for secure authentication.
Installing Apache2 from ports:
Note:
+The "sysinstall" command can also be used.
+ # cd /usr/ports/www/apache22 +# make clean +# make install clean ; rehash+ |
+
It is better to obtain a formal key from +some CA. But we will show you how to create a self-signed private key +and certificate. +
+Creating a private key:
+
+ # cd /usr/local/etc/apache22 +# mkdir ssl.key ssl.crt +# chmod 700 ssl.key ssl.crt + +# /usr/bin/openssl genrsa -out /usr/local/etc/apache22/server.key 1024+ |
+
Making a certificate from the created key:
+ # /usr/bin/openssl req -new -x509 -days 365 \ + -key /usr/local/etc/apache22/server.key \ + -out /usr/local/etc/apache22/server.crt + +You are about to be asked to enter information that will be incorporated +into your certificate request. +What you are about to enter is what is called a Distinguished Name or a DN. +There are quite a few fields but you can leave some blank +For some fields there will be a default value, +If you enter '.', the field will be left blank. +----- +Country Name (2 letter code) [AU]:JP +State or Province Name (full name) [Some-State]:Saga +Locality Name (eg, city) []:Saga-city +Organization Name (eg, company) [Internet Widgits Pty Ltd]:Saga-university +Organizational Unit Name (eg, subsection) []:Opengate Management +Common Name (eg, YOUR name) []:opengate.og.saga-u.ac.jp +Email Address []:administrator@opengate.og.saga-u.ac.jp + +Please enter the following 'extra' attributes +to be sent with your certificate request +A challenge password []: +An optional company name []:+ |
+
Edit "/usr/local/etc/apache22/extra/httpd-ssl.conf" as +shown in the following example:
+
+ ssl.conf + + |
+
+ <VirtualHost _default_:443> + DocumentRoot "/usr/local/www/apache22/data" + ServerName opengate.og.saga-u.ac.jp:443 + ServerAdmin administrator@opengate.og.saga-u.ac.jp + ErrorLog "|/usr/bin/logger -p local6.info" + CustomLog "|/usr/bin/logger -p local5.info" combined + + SSLEngine on + SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL + SSLCertificateFile /usr/local/etc/apache22/server.crt + SSLCertificateKeyFile /usr/local/etc/apache22/server.key +</VirtualHost>+ |
+
Since Apache2 has many settings, +familiarize yourself with the Apache2 configuration options for +adequate control.
+ + + +Edit "/usr/local/etc/apache22/httpd.conf" as follows:
+Opengate should send back the
+authentication page in response to any kind of HTTP request.
To
+do so, add the following line to httpd.conf:
(the top page will
+be sent back on an HTTP_ERROR 404 [file not found] error).
+ ErrorDocument 404 /+ |
+
Add "ExecCGI" to allow executing CGI programs in the
+cgi-bin directory.
+ <Directory "/usr/local/www/cgi-bin"> + ... + Options ExecCGI + ... +</Directory>+ |
+
Remove the comment mark ("#") to +enable the following setting: +
+
+ AddHandler cgi-script .cgi +AddHandler type-map .var+ |
+
Add "index.html.var" to +DirectoryIndex: +
+
+ DirectoryIndex index.html.var index.html+ |
+
Include ssl conf file:
+
+ Include etc/apache22/extra/httpd-ssl.conf+ |
+
Set ServerName: +
+
+ ServerName opengate.og.saga-u.ac.jp+ |
+
Start Apache2 with "apachectl start"
+and check for errors.
If no errors are displayed, add the
+following lines to "/etc/rc.conf" to allow Apache to start
+on boot up:
+ apache22_enable="YES" +apache22ssl_enable="YES"+ |
+
If the system shows "Failed to +enable the 'httpready' Accept Filter", add the following to +/boot/loader.conf :
+
+ accf_http_load="YES"+ |
+
Should the certificate require a PASSPHRASE, Apache will ask for it during
+boot up.
If you do not enter the passphrase (reboot due to
+power outage, remote reboot, ,...), this will prevent
the server from starting Apache normally,
+i.e. leaving you with a possible "crippled" server.
++ + + + ++Easy fix:
+1. create a simple script containing the following:
+#!/bin/sh
+echo "<passphrase goes here>"
+
2. add the following to httpd.conf:
+SSLPassPhraseDialog exec:/path/to/above/script +
Unpack the Opengate compressed file: +
+
+ # tar xzvf opengatexxxx.tar.gz+ |
+
It contains the following directories:
+
+ doc: Documentation +conf: Configuration files and firewall control Perl script sample +javahtml: Client Java Programs and HTML files +opengatesrv: Server CGI programs +tools: Some related tools +ezxml: XML parser (Copyright Aaron Voisine)+ |
+
Check the settings in "opengatesrv/Makefile" and modify +if needed:
+
+ HTMLTOP = /usr/local/www/apache22 +DOCDIR = /data +CGIDIR = /cgi-bin +OPENGATEDIR = /opengate +CONFIGPATH = /etc/opengate+ |
+
Compile and Install:
+
+ # make clean +# make install+ |
+
Copy the sample configuration file
+"/etc/opengate/opengatesrv.conf.sample" to
+"/etc/opengate/opengatesrv.conf" and modify.
The
+following settings must be changed:
+ <OpengateServerName>opengate.og.saga-u.ac.jp</OpengateServerName> + + <AuthServer> + <Protocol>pop3s</Protocol> + <Address>192.168.0.2</Address> + </AuthServer>+ |
+
In <OpengateServerName>, set the +HOSTNAME(FQDN) or IP address of the opengate gateway server. If you +want to use IPv6, you need to set the FQDN corresponding to both IPv4 +and IPv6 addresses.
+In <AuthServer>, set the
+information for the authentication server. Opengate supports various
+authentication protocols. See the config file for details.
To
+differentiate between erorrs caused by authentication server or those
+caused by the opengate server, try the following setting first. This
+means that any userid and password combination is accepted.
+ ****Do not use this setting in real service**** + <AuthServer> + <Protocol>accept</Protocol> + <AuthServer>+ |
+
The config file is XML. "#" marks in
+the file do not represent the start of a comment.
Use
+XML-formatted comments like <!-- Comment String --> to disable
+a description.
Opengate can pass authentication settings
+in the form of "userid@extid".
See the config file for
+more details.
By using this function, you can use different
+authentication servers for many sections or guests.
When the primary authentication server +does not reply, Opengate can resend the request to other +authentication servers. See the config file for more details.
+Caution: Do not delete the IPv6 related
+settings in the config file!
The IPv6 access is executed when
+the FQDN for IPv6 is prepared.
Write IPFW rules for Opengate. +
+a. For FreeBSD6.0 or earlier
+IPv4 and Ipv6 rules are controlled by IPFW and IP6FW respectively +.
+Sample rule sets for both firewall +types are prepared as "/etc/opengate/rc.firewall4.sample" +and "/etc/opengate/rc.firewall6.sample"
+Copy these scripts and modify according to your needs.
+
+ # cd /etc/opengate +# cp rc.firewall4.sample rc.firewall4 +# cp rc.firewall6.sample rc.firewall6 +# vi rc.firewall4 +# vi rc.firewall6+ |
+
Modify the firewall settings in /etc/rc.conf as follows:
Be
+careful not to lock yourself out of the system after reloading the
+firewall.
+ firewall_enable="YES" +firewall_script="/etc/opengate/rc.firewall4" + +ipv6_firewall_enable="YES" +ipv6_firewall_script="/etc/opengate/rc.firewall6"+ |
+
For Ipv6 support, change the path in "/etc/opengatesrv.conf" +from <Ip6fwPath>/sbin/ipfw</Ip6fwPath> to +<Ip6fwPath>/sbin/ip6fw</Ip6fwPath> +
+b. For FreeBSD6.1 or later
+Both IPv4 and IPv6 packets are controlled by IPFW.
+A sample rule set for IPFW can be found in +"/etc/opengate/rc.firewall.sample"
+Copy the script and modify to fit your needs.
If you are
+not familiar with Ipv6, set IPv6 addresses as localhost (*net6="0",
+*ip6="::1").
+ # cd /etc/opengate +# cp rc.firewall.sample rc.firewall +# vi rc.firewall+ |
+
Modify the firewall settings in /etc/rc.conf as follows:
Be
+careful not to lock yourself out of the system after reloading the
+firewall.
+ firewall_enable="YES" +firewall_script="/etc/opengate/rc.firewall"+ |
+
Familiarise yourself with the "ipfw" command.
The
+Opengate software sends out ipfw add/delete commands.
Edit /etc/syslog.conf to save log entries for Opengate.
+
+ | Separated by TAB code + V +local1.* /var/log/opengate.log+ |
+
Make the log file as follows:
Consider using log rotation to
+control the size of this log file.
+ # touch /var/log/opengate.log+ |
+
Connect a PC to the lower-side network
+and try to access a site in the upper-side network.
If it does
+not work properly, consult doc/progflow.html and doc/protocol.txt to
+better understand the procedure. Also check the log files for
+Opengate, httpd, system and others. To dump more information from
+Opengate, set the <Debug> switch to "2" in
+opengatesrv.conf. Also check the functions of related software. The
+error checking document (errcheck.html) and Q&A documents
+(qa.html, recentqa.html on the web) can be used for problem solving.
If you want to modify the contents of the +web pages, edit the html files in the Opengate directories. The +relative path cannot be used in httpkeep.html. Use the full URL +description. The descriptions such as %%XXX%% are variables replaced +by their proper values during CGI runtime. +
+ +This section is optional.
If you want to graphically
+monitor the state of Opengate, MRTG can be used but is not required.
MRTG +(Multi Router Traffic Grapher) is a system to monitor +network traffic. MRTG produces graphic images and HTML files. +
+You can install MRTG on the gateway +server or another server. If you need to monitor multiple Opengate +systems, it is advised to install MRTG on a separate server.
+
+ # cd /usr/ports/net-mgmt/mrtg/ +# make clean +# make install clean ; rehash+ |
+
MRTG creates +"/usr/local/etc/mrtg/mrtg.cfg.sample" as the sample +configuration file during installation. Copy mrtg.cfg.sample to +opengate.cfg and edit the file:
+
+ ################################################## +# opengate user counter + +WorkDir: /usr/home/user/public_html/mrtg/opengate/ + +##### Options +Options[^]: growright,gauge,nopercent,integer + +Target[opengate]:`/usr/home/user/bin/input.sh` +Title[opengate]: Opengate user counter + +PageTop[opengate]: <h1>Opengate user counter</h1> + <p>Show the number of people using Opengate</p> + +# Max Number +MaxBytes[opengate]: 200 + +# Title of Y axis +YLegend[opengate]: Opengate User +# unit +ShortLegend[opengate]: s +# Title of graph LegendI: first line LegendO: second line +LegendI[opengate]: IPv6 Users +LegendO[opengate]: Total Users+ |
+
Be sure to actually create the directory +which you appointed in "WorkDir". MRTG creates its graphic +images and HTML files in "WorkDir"
+"Target[opengate]" contains the
+path to the program that hands its data to MRTG.
(details
+explained below)
Create the shell script "/usr/home/user/bin/input.sh" +with the following contents:
+
+ #!/bin/sh + +####################################### +## +## show opengate status for MRTG +## +## 1 line : IPv6 Users +## 2 line : Total Users +## 3 line : uptime +## 4 line : comment for data +## +####################################### + +LANG=C +COLUMNS=256 + +export LANG +export COLUMNS + +### IPv6 prefix +prefix="2001:2f8:22:801:" +###opengateprocessname +process="opengatesrv.cgi" + +###tmp file name +tmp_all="/tmp/og_count_all.tmp" +tmp_6="/tmp/og_count_6.tmp" + +###################################################### +psax | grep $process > $tmp_all +COUNT = `wc-l $tmp_all | awk '{print $1}'` +grep $prefix $tmp_all > $tmp_6 +COUNT6=`wc -l $tmp_6 | awk '{print $1}'` +UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"` + +rm $tmp_all +rm $tmp_6 + +echo "$COUNT6" +echo "$COUNT" +echo "$UPTIME" +echo "Opengate User Counter"+ |
+
Run this shell script as standalone and confirm that you can +acquire the following data:
+
+ 5 +48 +10days +Opengate User Counter+ |
+
Create the shell script "/usr/home/user/bin/input.sh" on +a separate server.
+
+ #!/bin/sh + +####################################### +## +## input data for MRTG +## +## 1 line : IPv6 Users +## 2 line : Total Users +## 3 line : uptime +## 4 line : comment for data +## +####################################### + +# tmp file name +file="/tmp/opengate.tmp" + +# URL of output.sh at opengate +url="http://opengate.saga-u.ac.jp/cgi-bin/output.sh" + +fetch -o $file $url &> /dev/null + +more $file+ |
+
Create the shell script +"/usr/local/apache2/cgi-bin/output.sh" on the Opengate +(gateway) server, and set the URL to $url, as explained above.
+
+ #!/bin/sh + +####################################### +## +## show opengate status for MRTG +## +## 1 line : IPv6 Users +## 2 line : Total Users +## 3 line : uptime +## 4 line : comment for data +## +####################################### + +LANG=C +COLUMNS=256 + +export LANG +export COLUMNS + +### IPv6 prefix +prefix="2001:2f8:22:801:" +###opengateprocessname +process="opengatesrv.cgi" + +###tmp file name +tmp_all="/tmp/og_count_all.tmp" +tmp_6="/tmp/og_count_6.tmp" + +###################################################### +psax | grep $process > $tmp_all +COUNT = `wc-l $tmp_all | awk '{print $1}'` +grep $prefix $tmp_all > $tmp_6 +COUNT6=`wc -l $tmp_6 | awk '{print $1}'` +UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"` +rm $tmp_all +rm $tmp_6 + +echo "Content-type: text/plain; charset=iso-8859-1" +echo + +echo "$COUNT6" +echo "$COUNT" +echo "$UPTIME" +echo "Opengate User Counter"+ |
+
Run "input.sh" on another server and confirm that you +can acquire the following data:
+
+ 5 +48 +10days +Opengate User Counter+ |
+
Use the following command to confirm MRTG is working with your +config:
+
+ # /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg+ |
+
Various WARNING messages are output the
+first and second time, this is normal behavior
(as explained in
+the MRTG documentation)!
Some files are created in "WorkDir".
+ > ls -l +-rw-r--r-- 1 root wheel 538 12 14 04:40 mrtg-l.png +-rw-r--r-- 1 root wheel 414 12 14 04:40 mrtg-m.png +-rw-r--r-- 1 root wheel 1759 12 14 04:40 mrtg-r.png +-rw-r--r-- 1 root wheel 2941 12 20 15:15 opengate-day.png +-rw-r--r-- 1 root wheel 2146 12 20 14:35 opengate-month.png +-rw-r--r-- 1 root wheel 2867 12 20 14:55 opengate-week.png +-rw-r--r-- 1 root wheel 1897 12 20 05:00 opengate-year.png +-rw-r--r-- 1 root wheel 5961 12 20 15:15 opengate.html +-rw-r--r-- 1 root wheel 48786 12 20 15:15 opengate.log +-rw-r--r-- 1 root wheel 48784 12 20 15:10 opengate.old+ |
+
Add the following line to "/etc/crontab":
+
+ */5 * * * * root /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg+ |
+
This section is optional.
When the
+Opengate process is not exited normally, superfluous rules might be
+left behind.
Though it is
+very rare, the tools/rulechk script is made to handle such situations. This
+script compares the Opengate process list and the firewall rule list, and
+deletes the obsolete rules.
This script is compatible with Opengate Ver1.3.1 or above.
+
Following is the flow of the Opengate system: +
+A user on the client machine + accesses some URL such as http://www.some.site/ or + http://www.some.site/some/path. +
+Suppose that some URL has an IPv6 + address and an IPv4 address. The client machine gives priority to + IPv6 HTTP and uses it. But if ip6fw is closed. IPv6 HTTP will time + out. +
+The client machine retries to + access with IPv4 HTTP. +
+Ipfw checks the packet passing + though the gateway. For packets from the closed client, the forward + rule [ipfw add 60000 fwd localhost tcp from 192.168.1.0/16 to any + http] is applied. +
+The web server receives the packet + as [GET / or /some/path] +
+The root index file + [index.html.var] is accessed in both cases, because the httpd.conf + is set as [ErrorDocument 404 /] +
+The [index.html.var] file invokes + a CGI program [opengatefwd.cgi?en] where the option is the language + preferred by the client [en]. +
+The CGI program [opengatefwd.cgi] + gets the clients IPv4 address from [REMOTE_ADDR], encodes the + address, reads in [topindex.html], replaces keywords (encoded IPv4 + address and others) in the file, and sends back [topindex.html]. +
+The browser receives the reply + [topindex.html]. + At this point the browser (mis)interprets the reply as being + returned from www.some.site. +
+To circumvent this + misinterpretation, the [topindex.html] jumps to the gateway URL as + [META HTTP-EQUIV="Refresh" CONTENT="1; + URL=http://opengate.og.saga-u.ac.jp/cgi-bin/opengateauth.cgi?333333333-3-11111111&en"], + where option [333333333-3-11111111] is the encoded IPv4 address + (incl. check code) and [en] is the preferred language. Due to the + [refresh] code, the browser accesses the URL automatically. +
+The CGI program [opengateauth.cgi] + gets the options, reads in [index.html], replaces the keywords in + the file, and sends back the adapted [index.html]. +
+The browser receives the + authentication request page [index.html]. + The encoded IPv4 address and language are described within hidden + tags in the page. +
+The user enters the userid and + password for this page, and clicks the button to call the Opengate + main CGI [FORM METHOD="POST" + ACTION="http://opengate.saga-u.ac.jp/cgi-bin/opengate/opengatesrv.cgi"]. + If IPv6 is enabled, access is controlled by IPv6. If not, it's done + by IPv4. +
+The Opengate main CGI + [opengatesrv.cgi] starts and processes the following. +
+The CGI gets the userid [eg., + user1 or user1@id1], password, encoded IPv4 address [eg., + 333333333-3] , language and watchmode [J or H or T] from the POST + data. The CGI also gets the IPv6 address [eg., 2001:e38:10::111] + from [REMOTE_ADDR] and gets the MAC address from NDP or ARP. +
+CGI reads the configuration file + [opengatesrv.conf] and gets the information about the authentication + server [default](at [user1]) or [id1](at [user1@id1]). +
+CGI sends the userid[user1] and + password to the authentication server indexed as [default] (or + [id1]). +
+After passing authentication, CGI + inserts the IPv4 firewall rules [ipfw add 10000 allow ip from + 192.168.1.111 to any] and [ipfw add 10000 allow ip from any to + 192.168.1.111], and inserts IPv6 firewall rules [ip6fw add 10000 + allow ipv6 from 2001:e38:10::111 to any] and [ip6fw add 10000 allow + ipv6 from any to 2001:e38:10::111]. The rules allow passing packets + to/from the client. +
+CGI reports the firewall as being + opened to syslog: [Jun 16 19:14:11 ... START: user user1 use IPv6 + and IPv4 at 00:00:00:00:00:00], [Jun 16 19:14:11 ... OPEN: user + user1 from 192.168.1.111...] and [Jun 16 19:14:11 ... OPEN: user + user1 from 2001:e38:10::111]. +
+Depending on the watchmode, CGI + reads one of the accept reply pages + [accept-http.html/accept-java.html/accept-time.html], replaces + keywords, and sends it to the client. ([accept-java.html] + or [accept-http.html].) +
+In case of accept-http: the
+ page gets the http-keep page from the opengate port.
The
+ http-keep page includes the script to execute periodic
+ XMLHttpRequests to the opengate port. The periodic request keeps
+ alive a TCP connection with a watch process.
+
In case of accept-java: the + description to download the java applet + [appletcode='Opengate.class'...] is executed. The java applet keeps + alive a connection with a watch process. +
+In case of accept-time: the + link to terminate network access is displayed. +
CGI generates a watch process and + exits. +
+The watch process waits for the + java applet or http-keep script to connect. +
+If a connection cannot be + established during a specific time period (duration: seconds), CGI + removes the firewall rule [ipfw del 10000] and exits. To mitigate + against hijacking and notting, the + watch process executes periodic ARP checks and firewall packet + inquiries between waiting periods. (The watch process gets the + number of passed packets matched to the inserted rule from either + the IPv4 and/or the IPv6 firewall [ipfw -a list 10000], [ip6fw -a + list 10000] every ActiveCheckInterval seconds. If the packet count + does not increase in âNoPacketIntervalâ seconds, the watch + process removes the firewall rule and terminates. The watch process + also gets the list of MAC and IP addresses from the ARP command + every âActiveCheckIntervalâ seconds. If the correlation has + changed, the watch process removes the firewall rule and terminates.
+If the java applet or http-keep + script is connected, the watch process watches the TCP connection + linked to the client. When the TCP connection is closed, the watch + process removes the firewall rule and terminates. Thus disabling + network access in âreal timeâ.
+To check for cable disconnects, + the watch process ? using the java applet connection - sends a + 'hello' to the client every âActiveCheck/Intervalâ seconds. + Using the http-keep script connection, the watch process reads 'GET + /hello' and sends 'hello' after âActiveCheck/Intervalâ seconds. +
+When disconnecting from the network, the watch process + reports the firewall as being closed to syslog [Jun 16 22:11:55 ... + CLOS: user user1 from 192.168.0.111...], [Jun 16 22:11:55 ... CLOS: + user user1 from 2001:e38:10::111...] and [Jun 16 22:11:55 ... END: + user user1 at 00:00:00:00:00:00]. +