Stephen John Smoogen wrote:
On 1 March 2018 at 12:26, hw <h...@gc-24.de> wrote:
Stephen John Smoogen wrote:
On 1 March 2018 at 08:42, hw <h...@gc-24.de> wrote:
I didn´t say I want that, and I don´t know yet what I want. A captive
portal may
be nice, but I haven´t found a way to set one up yet, and I don´t have an
access
point controller which would provide one, so I can´t tell if that´s the
right
solution.
This is the problem with this entire thread in a nutshell. You don't
know what you want but what you have articulated at various points is
that you do know what you want. You then state something that won't
work because of some factor or another. People then correct you on
that, and you then get hostile because you were just thinking out loud
but no one knew that. Thinking out loud works ok in real life because
we give special queues like looking abstractly or being able to say
"Oh no I am just thinking out loud" right away. Instead in email none
of that happens and people get more and more hostile and angry
thinking the other side is trying to make them do completely opposite.
Let us try starting over. You may have answered these in other places,
but people need to see them in one place at one time versus trying to
look through cache of other emails.
What do you want?
I was asking for documentation telling me how RADIUS can be used, not only
that it can be used.
What are your constraints? [AKA what have you been told to do.]
The task is to provide wireless coverage for employees and customers on
company premises. It is desirable to be able to keep track of customers,
as in knowing where exactly on the premises they currently are (within
like 3--5 feet, which is apparently tough), and simpler things like knowing
how long they stay and if they have been on the premises before. To avoid
legal issues, it is probably advisable that customers need to agree to
some sort of terms of usage.
Oh yeah. Who ever gave you those marching orders needs to talk with
all kinds of lawyers... even researching for it might be problematic
in some countries due to a multitude of laws. You are walking out of
setting up a wireless environment into full-scale surveillance.
That´s not my problem to solve, but think about it: You can get a lot more
information using CCTV cameras, and those are everywhere. Unfortunately,
nobody cares, and it´s not like you have a choice. So why would there
be any legal issues?
That said, what you are looking for is not going to be accomplished
with simple radius without a large amount of development. It is also
going to need a lot of wireless sensors running at different
frequencies through out the building. Most of that is done usually
with special commercial hardware/software and falls outside of scope
of this list by a mile.
RADIUS would only be a tool to use for authentication and perhaps accounting.
Figuring out where users are is an entirely different problem.
RADIUS may be something that is done with all of this but only far way
back in the chain of tools needed. It might be something that the
specialized hardware, scanners, sensors, etc might tie into if they
don't have their own specialized tool. Worrying about it before those
are researched, etc is to use an English idiom: putting the cart
before the horse.
I´m surprised that wireless access point controllers, by default, do not
use the strength of the signal received from a device by three or more access
points to simply triangulate the position of the device. Of course, you
only get the positions of devices relative to access points, but once you
have that, you only need to use a map of the place that shows all the access
points and the positions of devices relative to them to figure out where
everyone is.
That´s a rather simple thing to do, isn´t it? Some documentation of HPs MSRs
stated that the controller can distribute the wireless devices between access
points to even out the bandwidth, and if it can do that, it could as well
distribute them for triangulation.
It is desirable to be able to know where employees currently are, though
it doesn´t neeed to be as precise.
When do you need it?
There´s no given time frame; it´s as soon as possible and preferably
this year.
It is necessary to (re-)do the entire network infrastructure before wireless
coverage can be achieved, one of the reasons being that it is currently
impossible to use VLANs all over the place.
What is the environment that it is to run in?
a shopping area
Some of the wireless access points may need to take part in what is
apparently called a mesh to be able to supply remote parts of the premises.
What research have you done (with references)?
I searched for documenation about how to actually use RADIUS and didn´t
find any. I´ve asked for pointers to such documentation here.
I´ve read the RADUIS admin guide. I´ve done a test setup by installing
RADIUS and configuring a switch to use it to authenticate users logging
into the switch via ssh and found it works fine. I have set up a couple
access points in a test setup which currently provide wireless access for
employees and wireless internet access for customers around some points
of the premises. I found out what a captive portal is.
Then people will have a better ability to answer:
What have others done to meet those needs?
How have they implemented it?
Then ask
What other things do you need for me to help?
People can then ask questions about things you didn't fully explain.
This is helpful because going from the previous emails your phrasing
made it sound like you needed unknown people to not be able to get
onto the network until they were authenticated, but authentication
requires them to be on a network, but you can't allow them to be on
any network until they are authenticated. That may not be what you
mean (on the other hand, I have had that conundrum given to me at a
job and we had to spend 3 months convincing the boss(es) that was
impossible with the tools we had (and probably impossible without)).
That is what using RADIUS apparently leads to when you have devices using
PXE boot. Maybe they need to be considered as a security risk and be
replaced.
OK I think this is where we are also getting confusion. PXE booting is
a multistep process to get a hardware device onto the network and
running a provided kernel. It is also something which usually only
works on wireless in controlled situations (aka magic).
Oh I never thought of using it for wireless devices.
So people aren't sure why you are wanting to PXE boot something a
customer would carry (aka a cell phone/tablet) since that does not PXE
boot at all. You might be meaning DHCP instead but maybe you are
meaning something else.
When there´s a RADIUS server on the network, not only wireless devices
could/should use it.
So the normal tools are to set up different LANs for different access.
On wired or wireless this is usually done with a dedicated network
which only devices which a) have a proven mac, b) use WPA-Enterprise
with radius to log in. For untrusted devices that might be looking for
any open lan, you have an open net which has a captive portal which
can 'kick' certain devices to a semi-trusted lan. [This is device
dependent so don't expect it to work for everyone.] Then you have a
semi-trusted lan which may have a guest password. It is still a
captive portal so that people on it are only able to get out after
they provided a second allowed password. The captive portals may be
backed by Radius, but it will depend on what software they are using.
[The above comes from doing this a decade ago.. things have changed so
please follow any new guidance/books on commercial wireless design.]
Well, I don´t want to trust MAC addresses because they can be faked.
Unauthenticated people are easier to handle because people can provide
credentials for authentication without PXE booting them first and do not
access the network without a device (unless they mess with the very network
hardware, using cables to create loops or accidentially cutting them or
unplugging them or whatever --- people do all kinds of things, with
authentication and without ...).
Devices with network access are much more dangerous than unauthenticated
people because such devices could be used by such people to also gain
network
access, or they could try to have bad effects on the network.
So everthing is dangerous, authenticated or not.
Everything is always dangerous :). It is good to recognize that
because a lot of times people just assume there is a magical
non-dangerous way and then spend all their time trying to find it. The
best we can do is find how to respond to the danger.
hm
Is sleeping dangerous?
_______________________________________________
CentOS mailing list
CentOS@centos.org
https://lists.centos.org/mailman/listinfo/centos
