easyhotspot install guide for 0 2

7/22/2019 Easyhotspot Install Guide for 0 2

1/26

Easyhotspot 0.2 Install Guide

This document version is 0.1 and is intended for Easyhotspot version 0.2 though it should be finefor other versions.

Date: 19thAugust 2009

This document copyright is reative ommons Attribution!"hare Ali#e 2.0 $%: England & 'ales(icence.

Author and Attribution: (incoln )hipps*+pen ,utual (td---.openmutual.net

'ith special than#s to afee/ul ahman A-an -ho has developed Easyhotspot.
http://www.openmutual.net/http://www.openmutual.net/


2/26

Table of Contents

1 nstall +rder......................................................................................................................................1.1 "oft-are (ist.............................................................................................................................1.2 )hysical net-or# interface cards..............................................................................................1. Apache2....................................................................................................................................

1..1 hilli ! Avoiding use of "elf!signed certificates...............................................................1. ,y"3(.....................................................................................................................................1.4 5reeadius................................................................................................................................4

1.4.1 nitial adius Database setup............................................................................................41.4.2 Easyhotspot Database additions........................................................................................61.4. adius Database users.......................................................................................................61.4. 5reeradius Dictionary issues 7hilli"pot attributes8.........................................................1.4.4 Defining hilli"pot as a 5reeadius lient......................................................................1.4.6 Telling 5reeadius to use "3(.........................................................................................

1.4. 5reeadius "3( counter.conf settings needed..................................................................1.4. 5reeadius doesn;t start < using Debug mode..................................................................9

1.6 hill"pot ! onfiguration.......................................................................................................101.6.1 hilli ! 5i=es to allo- disconnections from Easyhotspot >$.......................................10

1. )reliminary lient Testing......................................................................................................111. Easyhotspot "etup...................................................................................................................1

1..1 Easyhotspot )atches........................................................................................................11..2 +btaining and opying Easyhotspot...............................................................................11.. ,andatory onfiguration "ettings..................................................................................11.. +ther onfiguration "ettings..........................................................................................1

2 +ther ?otes.....................................................................................................................................1

2.1 $sing Easyhotspot to edit the @[email protected] file...................................................................12.2 (anguage.................................................................................................................................14

)atches............................................................................................................................................14.1 ,issing limits in radgroupchec# and radgroupreply..............................................................14.2 )ostpaid nvoice )rinting fails due to null stop time..............................................................1. +nline $sers not listed in Easyhotspot >$...........................................................................1

..1 emoving phantom online users 7stuc# radacct records8...............................................1. hilli Disconnect via Easyhotspot >$..................................................................................1.4 Easyhotspot incorrect editing of @etc@chilli.conf.....................................................................19.6 ouchers displaying Euro symbol as B mar#..........................................................................19. Easyhotspot postpaid decimal handling..................................................................................19

..1 Decimals ! 5ile hanges +vervie-................................................................................20. ompany Ta= ode < onfiguration option...........................................................................21.9 Typo in (anguage )arameters ! durationCammount...............................................................21.10 Typo in onfig )arameters ! ((")+TC+5>C5(E.................................................21.11 Easyhotspot not setting Acct!nterim!nterval......................................................................21.12 '")r band-idths do not use bits per second values..........................................................22.1 adius reply message Four ma=imum never usage time has been reachedG is confusing. 2

+ther $seful "oft-are....................................................................................................................2.1 ,onitoring ") Hand-idth A)s...........................................................................................2

.1.1 nstalling vnstat for ") A) monitoring.......................................................................2.1.2 nstalling vn"tat )) frontend........................................................................................2.1. nterpreting vn"tat results...............................................................................................2.1. Additional monitoring -ith band-idthd.........................................................................24

.2 5ire-alling..............................................................................................................................24


3/26

4 ?otes on using Easyhotspot............................................................................................................244.1 Altering postpaid settings........................................................................................................244.2 Hilling )lans............................................................................................................................24

6 T+D+.............................................................................................................................................266.1 Avoiding persistent ,y"3( onnections...............................................................................266.2 Account Edit and Add interface feedbac# /uir#s....................................................................26

6. adacct records persist forever...............................................................................................266. Ta=ation handling....................................................................................................................26

1 Install Order

1. )hysical net-or# interface card7s82. nstall the +perating "ystem. +bviously prefer >?$@(inu= distribution. Apache2 7-ith ""( or not8. ,ys/l 7if not already -or#ing84. 5reeadius and default adius database 7-ithout Easyhotspot additions8

6. hillispot. nitial lient Testing. Easyhotspot database9. Easyhotspot patches10. Easyhotspot configuration and acceptance testing.

1.1 Software List

The follo-ing is the reference soft-are that used. The main issue -ould be -ith 5reeadius.There is a dramatic difference bet-een version 1.I and 2.I in the -ay that 5reeadius organisesconfiguation files. Fou need hilli"pot 1.0 to get the hilli"pot!,a=!TotalC+ctets chec#s.

/usr/sbin/freeradius -v FreeRADIUS v2.1.0

/usr/sbin/chilli version Chilliso! 1.0

/usr/sbin/aache2 -v Aache/2.2.11 "Ubun!u#

/usr/sbin/$%s&ld version 'er (.0.)(-0ubun!u10.2

h version *+* (.2.,-ubun!u.2 i!h Suhosin-*a!ch 0..,.2"cli# and end n3ine v2.2.0.

as%ho!so! 0.2 revie

4% reference 5S de!ails Ubun!u Server .0 runnin3 6ernel 2.,.27-1(-server

1.2 Physical network interface cards

Fou need a machine -ith a minimum of t-o ethernet cards. >iven ho- cheap ethernet cards are andho- -ell (inu= supports these chipsets then this shouldn;t be a problem.

At the end of installing the hilli"pot then you -ill also end up -ith a virtual and a tunnel* here isan e=ample of a typical machine -ith the relevant ?et-or# )orts*

) Address ?ame omments

192.16.12.1 tun0 reated automatically by hilli"pot

$sually eth0 To nternet router


4/26

) Address ?ame omments

Dynamic

unnumbered e.g. eth1 nstalled and set according to your machine and as set in the@[email protected] in the dhcpifparameter. an be A?F physicallyinstalled ethernet port.

n my test machine have ethernet cards* eth0 for the +fficeG or administration* eth1 for nternetand eth2 for '5 but this isn;t essential. emember that you can;t run another D) server on themachine. am running $buntu 9.0 server edition on a ompa/ Evo -ith a ) 1.6 >hJ bought onEbay 72ndhand8 -ith a 10 >ig hard dis# found in the rubbish and 412 ,egabytes of memory and00 ,eg of s-ap. 'ith this machine the typical memory use is 44K and )$ is lo- so probablycould do -ith more memory if you plan to run a >?+,E des#top on the server.

1.3 Apache2

'e -ill not cover ho- to do this and there should be nothing special you need to do to ma#e it

-or# other than that you may not have ""( -or#ing due to no installed certificate.

"o you can either generate a self!signed certificate and enable ""( or Lust patch the hotspotlogin.cgito avoid mandating the need for ""( as described belo-.

1.3.1 Chilli - Avoiding use of Self-signed certificates

Fou need to do this after you have installed the hill"pot soft-are. f you -ant to avoid using aself!signed certificates 7-hich can cause many bro-sers to pop!up a confusing messages8 and youthin# it unli#ely that anyone can snoop the (A? traffic bet-een the '5 router and theEasyhotspot machine then you need to do t-o steps*

a8 edit the /etc/chilli.confand alter the uamhomepageand the uamserverparameters to not referto https:@@ style locations.

b8 edit the/cgi-bin/hotspotlogin.cgi file -hich chec#s for if a ""( connection is used tocommunicate -ith it and around line 42 comment out that chec# so that it no- says something li#e*

8if "9":;'"+


5/26

-ill be addressed at a later stage after the adius is installed. The Easyhotspot needs a database userthat is able to update the adius database as Easyhotspot inserts user and pass-ord records into thisdatabase. The Easyhotspot database tables are actually a bit of a mess in their naming and shouldhave used table prefi=es to allo- you to easily pic# out the default radius and the Easyhotspot e=tratables. )erhaps in a future release -e can split these apart.

1.5 Freeadi!s

This is installed as normal but you need to customise it to specify*

1. a client 7-hich is actually the hilli"pot soft-are82. to use "3(. -hich database. "3( counters

1.5.1 Initial Radius Database setuThe first thing to do is setup the database used by 5reeadius. ?ever use the Easyhotspot.s/l filethat maybe provided to do this as it is a table dump and it -ill not be fully compatible to the preciseadius soft-are you are using.

"tep 18 reate a adius database. $sually called radiusG but could be called anything e.g.easyhotspot.

n a console do*$%s&lad$in -u roo! -assord crea!e radius

if you -anted to create a database called radius. )ut in the correct pass-ord -here it sayspass-ord e.g.*

$%s&lad$in -u roo! -%BB% crea!e radius

"tep 28 Fou can no- s#ip to the ne=t section and use the scheme that have created that has theadius tables or you can no- populate the adius database -ith the default 5reeradius providedschema*

$%s&l -uroo! -assord da!abase sche$afile

replace pass-ord -ith the right pass-ord and the database -ith the database name e.g.*

cd /e!c/freeradius/s&l/$%s&l/$%s&l -uroo! -%BB% radius sche$a.s&l

Fou should not need to add the nas.s/l or ippool.s/l as these are not used. Fou -ill no- have thefollo-ing tables*

radacc!radchec6rad3rouchec6rad3roudrel%rados!au!hradrel%raduser3rou

These are all ,y"A, -hereas Easyhotspot is mainly uses nnoDH as it runs transactions. +ncethat is done then you can no- add the contents of the Easyhotspot that are only related toEasyhotspot and the vie-s that it needs.


6/26

1.5.! "as#hotsot Database additions

Easyhotspot doesn;t have its o-n database but uses tables in -hatever adius database you haveadded plus has a fe- of its o-n tables and more importantly it has vie-s that it sets up.

To this end have created a reference s/l schema -hich you can use. The schema names havecreated are in files 7using MradiusM as a database name8*

ehsEi!hradE0.2.s&l contains all of the tables including the adius tables and vie-sand test data 7admin@admin128. $se this if you didn;t -ant todo adius "etup "tep 28 above.

ehsEnoradE 0.2.s&l contains only the Easyhotspot tables and vie-s and test voucherdata and admins 7admin@admin128. $se this if you have ane=isting -or#ing adius database or you did do adius "etup"tep 28 above.

ehsEnoradda!aE 0.2.s&l contains only the Easyhotspot tables and vie-s and adminaccounts data 7admin@admin128. $se this if you have ane=isting -or#ing adius database or you did do adius "etup"tep 28 above but do not -ant the trial data due theehsCnoradC0.2p.s/l failing to -or#. Fou -ill be able to logon

but -ill have no test data. Add this manually.

)ic# the file you -ant above update your database -ith the ne- file e.g.*

$%s&l -uroo! -%BB% radius ehsEnoradE 0.2.s&l

+bviously =yJJy is my root pass-ord and the MradiusM is my suggested database but that could beanything. Delete any residual "3( files from your -or#ing area as they may contain pass-ords. >etcopies of these schema from the developer -eb site.

1.5.3 Radius Database users

There are t-o users*

5reeadius needs to -rite to the radacct and radpostauth tables

Easyhotspot needs to -rite to its o-n tables plus radchec#* radgroupchec#* radreply*radgroupreply

t is up to you if you -ant to have one all po-erful user or t-o ,ys/l user accounts.

5reeadius server* login* pass-ord* radiusCdb @etc@freeradius@s/l.conf

Easyhotspot database* username and pass-ord system@application@[email protected]

+bviously the 5reeadius radiusCdb must be the same as Easyhotspot database setting.

reate a file -ith the follo-ing mys/l commands substituting the radiusNlocalhostandeasyhotspotNlocalhostand the database name to suite your site*

CRA


7/26

S< *ASSH5RD F5R @radius@@localhos!@ = *ASSH5RD"@a assord@#GCRA


8/26

ignore everything e=cept around about line 60 in the modules section uncomment or ma#e surethat you have*

:I;CJUD s&l.conf

and then further do-n ma#e sure you have*:I;CJUD s&l/$%s&l/coun!er.conf

Then further around line 10 in the instantiatesection ma#e sure you have*

chilliso!E$aEb%!esnorese!coun!er

-hich are our counters -hich -e define in the ne=t section.

Then in /etc/freeradius/sites-enabled/defaultin the authorisesection after it has the M(oo# in an"3( database...M it has an Ms/lM entry that may be commented out so uncomment it and add the ne-counters so that it is no-*

s&lchilliso!E$aEb%!esnorese!coun!er

and then later in /etc/freeradius/sites-enabled/defaultin the accountingsection uncomment thes/l about line *

s&l

and then later in /etc/freeradius/sites-enabled/defaultin the sessionsection uncomment the s/l

about line 0*

s&l

and then finally in /etc/freeradius/sites-enabled/defaultin the post-authsection uncomment thes/l about line 0*

s&l

That should be it. ?o- update the counter.conf in the ne=t section.

1.5.+ %reeRadius S)* counter.conf settings needed

To match the radchec# and radgroupchec#s -e use then you also need to add t-o matchingcounter.conf chec#s as follo-s. Edit the @etc@freeradius@s/l@mys/[email protected] file and in that at theend 7unless the counter is already defined in that8* add the follo-ing*

s&lcoun!er norese!coun!er ?coun!er-na$e = Session-


9/26

s&lcoun!er chilliso!E$aEb%!es ?coun!er-na$e = ChilliSo!-4a-


10/26

1." #hillSpot $ #onfi%!ration

This all -or#s via a single configuration file*

/e!c/chilli.conf

of -hich you do not need to alter much. The follo-ing parameters are the typical ones you change*

radiusserver1 12.0.0.1 $sually unless you have a lotmore complicated setup than onemachine

radiuserver2 12.0.0.1 $sually unless you have a lotmore complicated setup than onemachine

radiussecret Four radius secret This is the same as secretin the@etc@[email protected] in theMclient localhost OPM section.

dhcpif ethI The physical port you -ant to usethat connects to the '5 router

uamserver http:@@192.16.12.1@[email protected] $sually this.

uamhomepage http:@@[email protected] $sually this.

uamsecret "ame secret that is in the hotspotlogin.cgi "ee the hotspotlogin.cgi changes

uamallo-ed 192.16.12.0@2* 192.16. "et this to the local tunnel

allocation and the D?" serverrange that the D) result has init.

coaport 99 $D) port 7see 5 468 neededto disconnect users.

1.(.1 Chilli - %i0es to allo disconnections fro/ "as#hotsot 2I

Hy default the chillspot -on;t disconnect users unless you do a fe- little t-ea#s. Edit@[email protected]@chillispot and loo# for the DAE,+?CA>" and ma#e sure it is set to*

DA45;EARS=M--coaor! ) --conf /e!c/chilli.confM

Edit @[email protected] and add the follo-ing line at the end of file*

coaor! )

estart hillispot -ith /etc/init.d/chillispot restartand then do a sudo netstat -anp , grep chillito ma#e sure that the t-o e=pected port are -or#ing i.e. The ne- 99 and the original 990. Fou-ill also need to add the hilli disconnect patch to the Easyhotspot code to correctly call this portfrom the -eb >$. This patch is detailed later in this document.
https://ipaddress/cgi-bin/hotspotlogin.cgihttp://ipaddress/welcomewebpage.htmlhttps://ipaddress/cgi-bin/hotspotlogin.cgihttp://ipaddress/welcomewebpage.html


11/26

1.& Preli'inary #lient (estin%

Hefore you start testing and installing Easyhotspot then you should have the follo-ing netstatresults. f you do a sudo netstat -anp7as root to get the process names8 then you -ill see many

ports in use but you must see these at least*

tcp 0.0.0.0:0 apache2

tcp 0.0.0.0: Apache2 7assuming ""( enabled8

tcp 0.0.0.0:06 mys/l

tcp 192.16.12.1:990 chilli

udp 0.0.0.0:6 dnsmas/

udp 0.0.0.0:112 freeradius



udp 0.0.0.0:99 hilli 7see note belo-8

?ote on the 99 port < you must edit the /etc/init.d/chillispotscript to get this to -or#. "ee laterdetails.

The basic flo- for a client is*

a8 lient ) is setup for D) and either connects via '5 or is plugged into the appropriate porton the Easyhotspot machine

b8 The lient ) does a D) re/uest 7or then D( Discover8 from 0.0.0.0 to 244.244.244.244on $D) port 6 as normalc8 This is pic#ed up by the dnsmasprocess that is part of hilli"pot but if chillispot has notstarted then you -ill never see a D) reply if you loo# on the '5 ethernet port.

"o if you use 'ireshar# and loo# on the '5 ethernet port and see D) re/uests coming into themachine and your fire-all is not sho-ing any dropped 7using dmesg8 and you never see a D)reply then chec# that both the dnsmas/ is listening and that the chillispot process is running andlistening on port 990 on the e=pected ) of 192.16.12.1

netstat !anp Q grep 990 should havetcp 0 192.16.12.1:990 0.0.0.0:R ("TE? Spid@chillior something li#e that.

f all -or#s then the flo- is*5rom lient 5rom hill "erverD) Discover ! D) +fferD) e/uest ! D) Ac#

or for an e=isting returning client -here it already #no-s an ) address*5rom lient 5rom hill "erver

D) e/uest ! D) Ac#

'hen the hilli fails to run then you probably have something -rong -ith your @[email protected] file


12/26

configuration e.g. you have ambitiously uncommented too much U. ?ote that the adius need not becorrectly -or#ing to get the D) -or#ing. adius handles the logons not the D) and initialredirection -eb page.

'hat happens ne=t B

Assuming that the lient ) has an ) address successful then -hen you open a bro-ser on theclient and try to connect to a -eb page then the hilli -ill reply bac# -ith a redirect message ofTT)@1.0 02 ,oved Temporarily and provide a location -hich is the uamhomepagesetting fromthe @[email protected] file e.g. http:@@[email protected] actually -hatever you provided.

Fou can ma#e that -eb page as fancy as you li#e but you mustprovide at least one lin# to *

http:@@192.16.12.1:990@prelogin

else your clients -ill never #no- ho- to logon U Do not use https:@@ in your lin# to the port 990 asthe hilli"pot doesn;t understand ""( on port 990 and that -ill fail -ith an error message li#e the

connection -as interrupted.

f chilli is -or#ing on port 990 then it -ill redirect you again to the uamserverlocation 7from thechilli.conf file e.g. https:@@192.16.12.1@[email protected] but it -ill provide lots of e=tra

bits in that uamserver $(. f you try to connect to the uamserverdirectly -ithout all the e=tra bitsin the $( that the hilli"pot has added then it -ill complain -ith M(ogin must be performedthrough hilli"pot daemonM

+ur basic testing is pretty much finished no- and nothing more can be done unless you haveinstalled the Easyhotspot soft-are. Hefore you do that though you must chec# as much as possibleof the shared secrets bet-een all the parts. Fou must verify that these are correct manually*

)hilli.conf $"# ! "A$! A"

radiussecret secretin the @etc@[email protected] in the Mclient localhost OPM section

uamsecret uamsecretin @[email protected]

A manual -ay of testing if the radius is -or#ing is to use a shell and enter in*

radtest a a 12.0.0.1 1 myradiussecret

and if the myradiussecret is -rong then it -ill fail telling you that 7shared secret is incorrect8. TheMaM andMaM may not e=ist. f you had already installed Easyhotspot then there is a default usernameof MaM and a pass-ord of MaM. f not then proceed -ith the Easyhotspot sections belo-.

Even if you have the uamsecretor the radiussecret-rong then you -ill get as far as the hilli"potlogon screen and -ill be able to enter your username@pass-ord but then after a fe- seconds chillitries your username@pass-ord but it fails but it -on;t advise you -hich is -rong.

f you are at the logon page then you are nearly finished and you can proceed to installing or testingthe Easyhotspot soft-are. This is /uite separate from the adius and hilli"pot in that theEasyhotspot is only ever run to alter the accounts in the adius database. f you have not got the

D) and are at the hilli"pot logon page then don;t bother starting to install the Easyhotspot. >etthose first t-o bits fi=ed first.
https://192.168.182.1/welcome.htmlhttp://192.168.182.1:3990/preloginhttps://192.168.182.1/welcome.htmlhttp://192.168.182.1:3990/prelogin


13/26

1.) *asyhotspot Set!p

?o- that you have a -or#ing Apache* ,y"3(* adius* and hilli"pot you can safely add theEasyhotspot soft-are. This setup needs doing in this order*

1. )atch the release of Easyhotspot if you -ish*2. opy or nstall to correct location on 'eb "erver*. Edit configuration files to suit your personal site*. Testing

1.,.1 "as#hotsot 4atches

nitial testing -as -ith version 0.2 and though the soft-are loo#s great a number of issues arose outof that*

Easyhotspot database unable to be created properly for ne-er adius servers*

hec#ing for ?$((s in data*

"ome minor language string errors 7in English8*

,issing company business registration 7legally mandatory in some countries8*

Hugs in setting ma=imum session and byte counts*

5ormatting of numbers 7ma=imum decimal places and separators8*

+ther minor bugs and enhancements

A list of these patches can be obtained from the developer and you do not really need them to getstarted but the more important ones are listed later in this document. 'hy does there appear to be somany little patches B. Easy < ;ve have spent 0 years testing soft-are and can pretty much brea#anything and love testing +pen "ource soft-are. f you use 0.2 V the patches or -ait for 0. of

Easyhotspot then you can be pretty confident that Easyhotspot is very robust.

1.,.! Obtaining and Co#ing "as#hotsot

The Easyhotspot version 0.2 previe- or above is available from the developers -eb site at this lin#http:@@rafee/ul.com@easyhotspot!0.2!previe-.Jip7the "ourceforge has the old version8.

t is a W) file so you -ill need the unJip if you are unJipping on a (inu= machine 7gunJip -on;tdo8. There is a Jip and unJip program available e.g.

a!-3e! ins!all Bia!-3e! ins!all unBi

n the 0.2 version W) file you -ill find t-o directory trees* a C,A+"I and the desiredeasyhotspot!lastest 7note the possible spelling mista#e8.

"o do-nload the W) file and then do*

unBi eas%ho!so!-0.2-revie.Bic -r eas%ho!so!-las!es! /var//eas%ho!so!

or -hatever path you -ant to use. t is fine to unJip it straight into your default 'eb directory at this

time e.g.@var@--- though in the future if Easyhotspot becomes a distro pac#aged it may reside in@usr@share@ and then you -ould put in a softlin# from your -eb documents location or use aApache2 virtual directory. The laJy -ay is a copy as above. The developer has -rapped the scripts
http://rafeequl.com/easyhotspot-0.2-preview.ziphttp://rafeequl.com/easyhotspot-0.2-preview.zip


14/26

so that they can;t be directly accessed so you do not need to protect the directory -ith a .htaccessfile < though you might any-ay on a public site or any-here that people have too much time ontheir hands.

1.,.3 andator# Configuration Settings

Fou must set the follo-ing Easyhotspot configuration settings to get you going -ith the minimumeffort*

n /eas+hotspot/s+stem/application/config/config.phpand set the baseCurl to somethingmeaningful. This is -here the Easyhotspot administration interface redirects you to no matter ho-you access it so it can be the same $( as -hat you use to access your -eb server -ith the e.g.http:@@192.16.4.1@easyhotspot

n /eas+hotspot/s+stem/application/config/database.phpand set the username* pass-ord anddatabase to the correct values -hich you have already defined previously.

f this is done and the ,y"3( is -or#ing then you can connect to your -eb server and path andyou -ill get the Easyhotspot logon page.

f you have the default administration settings then use the username of admin and a pass-ord ofadmin12 to get you going. hange this once you have logged on.

1.,.$ Other Configuration Settings

+bviously you ideally need to change some other parameters but these are not needed to get youstarted. These are*

n /eas+hotspot/s+stem/application/config/eas+hotspot.phpset the companyCname*companyCaddress* companyCaddress2* companyCaddress* companyCphone* currencyCsymbol as aminimum.

f you have added the ompany Ta= ode patch then enter in the compan+0ta*0codedetails asyour legal adviser specifies e.g. your AT * A* >"T or other ta= code that you are legally obligedto add to all invoices.

f you have added the Access nstructions patch then add the access0instructions-ith the suitablete=t.

f you have added the number format patch then add the decimal0places* decimal0separator*thousands0separator* and admin0price0inputsettings.

! Other 6otes

2.1 +sin% *asyhotspot to edit the ,etc,chilli.conf file

Though provide a patch to help fi= -hat it does* ideally don;t use Easyhotspot but edit the

@etc.chilli.conf file manually.
http://192.168.5.1/easyhotspothttp://192.168.5.1/easyhotspot


15/26

2.2 Lan%!a%e

The language strings are located under...

system@application@language@[email protected]

e.g. system@application@language@[email protected]

The language is set in* s+stem/application/config/config.phpas the 1config23language34setting. fyou -ant create a ne- translation then copy the e=isting English 7ideally8 easyhotspotClang.php toyour language director .g.*

system@application@language@ [email protected]

and set the system@application@[email protected] as the XconfigY;language;Z [ ;latin;\

?ote that not everything is translated and in some cases English is used in the interface but it is

nearly all done by the developer.

3 4atches

+nly coding patches that cause problems are listed here. The companyCta=Ccode changes amsuggesting affects too many files to easily list so please contact the developer for a updated archive.Easyhotspot -ill still -or# -ithout the companyCta=Ccode H$T it -on;t -or# e=actly right -ithoutthe follo-ing patches list belo-.

3.1 Missin% li'its in rad%ro!pcheck and rad%ro!preply

The Easyhotspot 0.2 code doesn;t add the hilli"pot!,a=!Total!+ctets nor "ession!Timeout intothe radgroupchec# or radgroupreply table. Therefore though you can create an s/lcounter setting-ith this* it is never verified and neither does hilli"pot logout an e=isting logged in user.

The current settings are*

Hilling )lan Type Table Attribute +p alue


16/26

Hilling )lanType

Table Attribute +p alue


17/26

)lease also set the counter.conf correctly in the nstall "ection of the 5reeadius at the start of thisdocument.

3.2 Postpaid -noice Printin% fails d!e to n!ll stop ti'e

Edit the system@application@[email protected] and around line 6 Lust before the Xthis!db!insert add a line*

if ":accEusa3e@s!o@V == null# ? :accEusa3e@s!o@V = :accEusa3e@s!ar!@V G O

-hat this does is if an accounting record has been poorly created -ith a null stop time then theinvoice printing fails.

3.3 /nline +sers not listed in *asyhotspot 0+-

There are multiple problems -ith this in the "3( command. 'hat it is trying to do is rathercomplicated but the best shortest ,y"3( command have found that correctly pic#s up -hat it

-ants to do is *

selec! userna$e 4AQ"acc!s!ar!!i$e# as s!ar! 4AQ"acc!s!o!i$e# as s!osu$"acc!session!i$e# as !i$e su$"acc!ou!u!oc!es!s P acc!inu!oc!es!s# asac6e! fro$ radacc! 3rou b% userna$e havin3 "s!ar! L s!o# or "s!o IS ;UJJ#

'hy this needs to be done is that a username can have multiple starts and stops and so you -ill notLust get one record per username -ith a ?$(( but you may get many records -ith ?$(( usuallydue to your radius server being rebooted. 'e only -ant to display the start time of the most recentrecord but not if it -as a record that -as disconnected thus the need for the ,AI7acctstarttime8 and,AI7acctstoptime8 and the chec# to see if the start is greater than the stop. These values that the

select produces actually come from different records in the database.Then the final MhavingM chec# is -hen you have a single entry in the radacct for a logged on user. nthat case there is only one radacct record and it has a start and a stop that is ?$((. Fou can;tcompare these so -e chec# if the stop is ?$((. t never is -hen you have multiple radacct records.

"o that pretty much traps all the -eird possibilities that the adius server can put into the radaccttable.

'e actually ignore the acctstoptime in the )) 'eb >$ 7though potentially a vie- could becreated that sho-ed the M(ast (ogged out timeM though the select needs it to filter the results -ith

the MhavingM command. The aggregate functions on the acctstoptime and pac#ets are selfe=planitory e=cept to note that the database records -ith an acctstoptime in them are al-ays Jeros.

18 Edit the system@application@[email protected] and loo# for the db!/uery7select...8 and loo# at the select and locate*

selec! userna$e acc!s!ar!s!i$e ......

28 opy and paste in the ne- select command as above.

3.3.1 Re/oving hanto/ online users &stuc7 radacct records'The Easyhotspot needs a cleanup administration feature that removes stuc# accounting records leftin the radacct table if there is no voucher for that. ight no- the accounting records hang around


18/26

forever.

This can happen if you change attributes and reboot the server 7actually reboot 5reeadius8 and doother odd things. Fou can end up -ith radacct entries that never go a-ay as MonlineM users.

'ith a postpaid account then this is cleared up -hen they ne=t logon but -ith a voucher that hase=pired 7time or pac#ets8 or you have deleted it then -hat you must do is very simple.

reate a postpaid account that has the same name 7any pass-ord that is easy8 as the orphanentry and then logon from a -eb bro-ser and then disconnect that ne- session 7via logoutor manual discconnect8.

Then delete you temporary postpaid account.

The radacct is no- cleaned up.

3.4 #hilli isconnect ia *asyhotspot 0+-

18 Add the follo-ing to the easyhotspot.php config file*

:confi3@radiusco$$and@V = Wradclien! -& -d /e!c/freeradiusXG:confi3@radiussecre!@V = W%our radius secre!XG:confi3@radiusserver@V = W12).0.0.1)XG

28 Edit system@application@[email protected] and ma#e the call in function disconnect78

freeradiusEdisconnec!user":!his-Luri-Lse3$en!"# :!his-Lconfi3-Li!e$"@radiusco$$and@#:!his-Lconfi3-Li!e$"@radiusserver@#:!his-Lconfi3-Li!e$"@radiussecre!@##G

?+TE to change the segment from 2 to else it -ill never -or#.

8 Edit system@[email protected] and ma#e the system call*

:resul! = s%s!e$"@echo MUser-;a$e=Y@@.:userna$e.@Y@M Z @. :radiusco$$and.@ @.:radiusserver.@ disconnec! @ .:radiussecre!#G

t is #ind of obvious -hat it is doing as it is sending the shell command. f you are having problems-ith the user still logged on then try the command from a bash shell -ithout the /G for /uiets-itch e.g.

echo MUser-;a$e=@%uc6!,,@M Z radclien! -d /e!c/freeradius 12).0.0.1)disconnec! $%radsecre!

7all on one line8.

And then also close this file -ith the php close*

[L

as the developer has not added that. have got around e=tra content messing up )) by passing the!/G to the radclient command so it is /uiet.

f that doesn;t -or# -ith a short disconnect message then something is not right e.g. the hilli.confand chilli have not got the settings right to get the 99 port -or#ing 7the coaport8.


19/26

?ote that the radclient ,$"T have the !d setting as it uses @etc@radiusd or something as a defaultconfiguration path and -on;t find the freeradius location and it ,$"T have the !/ else the systemcall sends data bac# to the 'eb bro-ser that messes -ith the >$.

f you -ant to debug the radchec# then you can remove the !/ in the XconfigY;radiuscommand;Z andon a disconnect then you -ill see a disconnect message splatted onto your -eb bro-ser -ith result

of 1 7if the user -as actually connected8 or 2 7if the user session -as not actually -or#ing8 andthen you -ill see a )) error message 7-hich you can ignore8.

f you get nothing then your radchec# parameters are bro#en in some -ay. $se a shell and identifyif it is actually -or# as e=pected and that there is a server on the coaport.

3.5 *asyhotspot incorrect editin% of ,etc,chilli.conf

This patch comes in t-o parts and as it is /uite cumbersome to describe here unessential have sentthis to the developer. The files you change are*

system@application@[email protected]

system@application@vie-s@admin@[email protected]

and basically add coaport and fi= the brea#s in the first file and in the second put in isset78 ternarychec#s to display default data if it is not set.

3." o!chers displayin% *!ro sy'ol as 'ark.

This patch is a partial fi= for the moment until -e can trac# do-n the correct setting for dompdffont handling in that have added a ne- config setting of currencyCsymbolCpdf and insystem@application@vie-s@[email protected] have used this instead of currencyCsymbol.

"et the currencyCsymbolCpdf to be the currency as plain A" te=t e.g. E$+ rather than using ahtml entity.

T+D+: orrectly use the right symbol by setting the font and also allo- via change to set the papersiJe.

3.& *asyhotspot postpaid deci'al handlin%

This patch has numerous fi=es related to invoice calculations. Easyhotspot 0.2 doesn;t actuallydisplay any decimals at all 7uses numberCformat -ith hard!coded 0 for decimals8. 'e;ll addressta=ation in a later version of Easyhotspot so right no- assume all payments are ta= inclusive and

there are no pre!ta= displayed.

f you need to display pre!ta= and ta=es paid or have compounding ta=es 7e.g. anada8 then contactthe developer or me for details and in the meantime you should Lust consider the voucherG to be astoc# item -ith a variable price 7e.g. li#e loose fruit8 and use your e=isting till to calculate the ta=rates and proper invoice for this sale item rather than relying on Easyhotspot to be a legallycompliant billing system.

n addition to the e=isting currency symbol configuration code there is no- these that are used -iththe php numberCformat78 function. have avoided using locale. )erhaps in the future*

deci$alElaces = a nu$berL e.3. 2deci$alEseara!or = @@ or @.@ hich chan3es er coun!r% conven!ion!housandsEseara!or = @@ @ @ or .@.@ad$inEriceEinu! = @conver!ed@G


20/26

These are used through out the code. n addition if the adminCpriceCinput is set to convertedG thenthe prices that are entered by the admin for vouchers are preprocessed by stripping theXC)+"TY;price;Z of any thousandsCseparator and then substituting the decimalCseparator -ith a

period 7.8 symbol used in floating point data. Thus a European pricing input e.g. 1*60 for 1 Euro and60 cents ends up as 1.60

'here a country uses decimal places in the currency e.g.* dollar* Euro or "terling then you need atleast 2 decimal places of resolution -hen you display your final bill. Fou can calculate the bill toany decimal place resolution that you li#e but it should be rounded to the nearest legal money value-hen it is displayed to the customer according to the usual rules of rounding e.g. ban#ers roundingor floor or for Australia and ?e- Wealand a method called "-edish ounding.

At this time -e D+ ?+T +$?D according to a legal convention but the mathematics oftruncating floating numbers 7-hich is round half up thin#8. ts not perfect and a ne- patch is being-or#ed on to correctly round and handle ta=es. t doesn;t affect your database* Lust the displayedresults.

+verall this numberCformat patch is too large to display here and doesn;t affect your Easyhotspottesting. "ee the developer for more details.

3.+.1 Deci/als - %ile Changes Overvie

5ile omment

system@application@vie-s@admin@[email protected]

$se all parameters for numberCformat.

system@application@vie-s@[email protected]



$se currencyCsymbolCpdf and all parameters fornumberCformat.











system@application@vie-s@voucher@voucherC

print.php

$se currencyCsymbolCpdf and all parameters for

numberCformat.

system@application@models@ f adminCpriceCinput is set to convertedG then parse


21/26

billingplanmodel.php XC)+"TY;price;Z -ith thousandsCseparator anddecimalCseparator.

3.) #o'pany (a #ode 6 #onfi%!ration option

have added a ne- configuration option of

;companyCta=Ccode; [ ;IIIIIIIII; e.g. the ta= registration number.

'hich is printed on every invoice. n many countries it is mandatory to display this and it is illegalto issue any invoice or receipt -ithout such a number.

?ote that at this time -e do not calculate ta=es inside Easyhotspot 7and truthfully it -ould ma#e itharder to administer8. )lease use your e=isting teller till to do this by creating an appropriate "%$for the types of vouchers or payments.

+verall this patch is too large to display here and doesn;t affect your Easyhotspot testing. "ee the

developer for more details.

3.7 (ypo in Lan%!a%e Para'eters $ d!ration8a''o!nt

The durationCammount parameter is clearly spelt -rong and should be durationCamount. This isused in*

easyhotspotClang.php files for all languages*

invoiceCdetail.php

invoiceCprint.php postpaidCbill.php

postpaidCprintCbill.php

To change you need to set the language files first and then edit each of the other files in turn. t isnot service affecting so not a high priority to change.

3.19 (ypo in #onfi% Para'eters $ #:-LL-SP/(8#/F-08F-L*

The ((")+TC+5>C5(E parameter has that little typo in it should be((")+TC+?5>C5(E. This is only used in*

s%s!e$/alica!ion/libraries/as%ho!so!Echilliso!.h

so edit the easyhotspot.php configuration file and that one above.

3.11 *asyhotspot not settin% Acct$-nteri'$-nteral

There are t-o fi=es needed here\ by default Easyhotspot 0.2 uses a table called usergroupG -hereasby default most adius installations in their @etc@freeradius@s/l.conf -ill have the usergroupCtable asradusergroupG.

f you do this change then you should delete all prepaid and vouchers plans prior to doing thischange as the radacct table is never correctly updated 7or manually e=port@import8.

deally -e should e=pose the table names to the configuration file but pending that then -here


22/26

usergroupG appears in*

s%s!e$/alica!ion/$odels/billin3lan$odel.h abou! line 1(1 and 1()s%s!e$/alica!ion/$odels/voucher$odel.h abou! line 2(

then change this to radusergroup.

The Acct!nterim!nterval is then set in either the radreply for postpaid users or radgroupreply forvouchers.

The patch is /uite large but basically there are no- t-o ne- configuration parameters*

confi3@os!aidEacc!Ein!eri$Ein!erval@V = @,00@Gconfi3@voucherEacc!Ein!eri$Ein!erval@V = @,0@G

"ee the developer for the patch.

3.12 ;-SPr andwidths do not !se its per second al!esThere are a fe- fi=es needed. f you add a voucher or billingplan user then the '")r band-idth upand do-n values they get given are not in bps but in #ilobits per second and also the 6#bps valueis totally -rong at 60G. The value that the database must get given should be in bps.

The code tries to get this right e.g. billingplanmodel.php multiplies the )+"T value it gets given by1000 to get a bps value but thin# it is safer to #eep it as bps every-here because later the codedoesn;t divide the database values by 1000. "o it is a bit of a mess. f -e only ever po#e into thedatabase the ra- bps values that the '")r needs then -e -on;t get messed up.

Thus propose that -e only ever display and use bits per second every-here this band-idth limit isset.

The values that have to be there have to be e.g. ;6000; [ ;6 #bps; not 6. Edit the*

system@application@vie-s@admin@[email protected] about line 40 and 42*

system@application@vie-s@[email protected] about line and *

system@application@vie-s@admin@[email protected] about line 1 and 4.

and alter the string as you see fit. am suggesting the follo-ing to the developer*

16000 16 %bps 2000 2 %bps 000 %bps 6000 6 %bps

96000 96 %bps 12000 12 %bps 192000 192 %bps 246000 246 %bps

412000 412%bps 102000 1 ,bps 20000 2 ,bps

And so remove the R1000 from the band-idth calculations at*

system@application@[email protected] about line 9 and 106

system@application@[email protected] about line 9 and

There are still a fe- places -hereby the value is set but editing the voucher or pre!paid plan doesn;tdisplay the current value but this is a lo- priority to fi=.

"ee the developer for the patch.


23/26

3.13 adi!s reply 'essa%e is conf!sin%

This comes bac# from adius 7rlmCs/lcounter8 -hen you e=ceed the hilli"pot!,a=!Total!+ctets7 guess if you have reply!name [ hilli"pot!,a=!Total!+ctets in the s/lcounter7s/l@mys/[email protected] and then try and login -ith that account. thin# you can change this

message in adius but couldn;t find out -here so did it in hotspotlogin.cgi. Edit hotspotlogin.cgiand around line 1 Lust after if 7Xresult [[ 28 O -here it prints the failure message then add in*

if ":rel% => /\our $ai$u$ never usa3e !i$e has been reached:/ # ?:rel% = Wour credi! has eired.XG

O

or a similar -ording as you see fit. f anyone #no-s ho- to change this in 5reeadius then pleaseemail the developer or me.

$ Other seful Softare

4.1 Monitorin% -SP ?andwidth #APs"ometimes your ") may A) your band-idth to a contract limit. This certainly is true if you use"AT 7%u Hand or similar "atellite or similar8 nternet access in remote locations.

'ith only one ) you can easily monitor your o-n personal band-idth use 7on single 'indo-s ) use ?etmeter !http:@@---.metal!machine.de@readerror@8 and you can only blame yourself if youe=ceed this A) but if you have customers using your '5 then you must closely monitor this toma#e sure that*

you are correctly pricing your access for your customers to remover your costs*

are not issuing too many tic#ets 7that is you are not e=cessively overboo#ing your

band-idth A)8* or if you can better set your band-idth limits 7to use the band-idth8*

or if you really need to move to a different tariff -ith your ").

To chec# this use a program called vnstatand there is a separate -eb interface called vn"tat P5P6rontend. also thin# that Easyhotspot could reuse some of the vn"tat )) 7or vn"tat ">8 frontend code and add this as a feature in Easyhotspot but it is not urgent.

The version am describing is vnstat 1.6!1 built for $buntu and is nicely pac#aged already plus thevnstat )) front end version 1..1 that is do-nloaded from ---.s/-ee#.com

$.1.1 Installing vnstat for IS4 CA4 /onitoring

nstall vnstat as per normal 7apt!get or use your pac#age manager8.

+n the first da+ of useyou need to do*

vns!a! -u -i e!hQ

-here ethI is your ") facing ethernet port. That;s it. f you have other (A?s that you -ant to

-atch e.g. the '5 or a private +ffice (A? then do that for each e.g. on my test system havethree (A?s*

vns!a! -u -i e!h0
http://www.metal-machine.de/readerror/http://www.metal-machine.de/readerror/http://www.metal-machine.de/readerror/


24/26

vns!a! -u -i e!h1vns!a! -u -i e!h2

-here eth0 is my +ffice* eth1 is the ") and eth2 is the '5 facing.

$.1.! Installing vnStat 484 frontendn addition to the vnstat there is a nice front end. This simply calls the vnstat application anddisplays the result in graphs. t uses >D to dra- the graphs.

To install this then do-nload it from the---.s/-ee#.com-eb site and unpac# it to a suitablelocation on your -eb server. e.g. /var/777/vnstat

Again you might -ant to protect this -ith a .htaccessto stop people observing your stats.

Edit the config.php that comes -ith it*

5ind the XifaceClist

and set that to a suitable list of ports you -ant to displayin the order +ou 7ant them listede.g.

:ifaceElis! = arra%"@e!h1@@e!h0@@e!h2@#G

Then locate further do-n -here the XifaceCtitles are and for each add a XifaceCtitle e.g.*

:ifaceE!i!le@e!h0@V =@5ffice JA;@G:ifaceE!i!le@e!h1@V =@In!erne!@G:ifaceE!i!le@e!h2@V =@HIFI *h%sical JA;@G

$.1.3 Interreting vnStat results

nstat installs a cron file 7@etc@crond@d@vnstat8 that causes it to run every 4 minutes.Hy loo#ing at the various in and out traffic you can identify -hich part is generating the traffic. The") ethernet ? is the sum of the +ffice and '5 ethernet +$T and the ") ethernet +$T is thesum of the +ffice and '5 ethernet ?. Any e=cess in the ") ? and +$T -ill usually be the(inu= machine itself do-nloading ne- pac#ages or remote nternet connections terminating on the(inu= machine e.g. "" connections.

nstat -ill not allo- you to identify the type of traffic or )s < to do that you need to do pac#etinspection and that is much more comple= and only needs to be done if you are getting problems.As far as your ") is concerned* your traffic is all the same and once you hit the A) then theyeither start billing you more or cut your access. nstat helps you avoid this problem not identify-ho to blame.

f you only issue enough vouchers that have pac#et volumes that add up to your band-idth A)7e.g. you issue 100 vouchers per month each -ith 100 ,egabytes thus a 10 >igabyte total8 then youshould not have problems unless something has managed to use your '5 -ithout using a vouchere.g. your personal +ffice (A? 7-hich vnstat can monitor8* someone -ho is accessing theEasyhotspot machine remotely 7-ithout using adius@hilli < -hich you could trace by adding

logging to iptables for connections terminating on the Easyhotspot machine8.

f you really also need to -atch -hich ) addresses are using traffic then a suitable program is
http://www.sqweek.com/http://www.sqweek.com/http://www.sqweek.com/


25/26

called band-idthd -hich ;ll also describe.

$.1.$ Additional /onitoring ith bandidthd

This comes in t-o versions* a band-idthd that doesn;t use a database and a )ostgres/l basedversion. ;ll describe the normal version as fe- sites -ould have installed postgres/l.

nstall the pac#age and then edit the /etc/band7idthd/band7idthd.conf file and set the subnet to0.0.0.0@0 and the dev to ethIG -here the I is your ") facing ethernet port e.g. eth1.

Add a soft lin# to your -eb location e.g.

cd /var/ln -s /var/lib/band!hd/h!docs bandid!hd

ideally add a .htaccessto that directory to protect it from non!administrators from -atching it.

'hat this no- gives you is a more detailed list of the traffic usage on the ") port. t is not toodetails but may help you Lust that little e=tra -ithout resorting to using 'ireshar# or EtherApe orsome other more sophisticated monitoring tool.

,ost people should find that vnstatis fine for monitoring ") Hand-idth A) on a regular basis.

4.2 Firewallin%

This is very complicated and can;t tell you -hat to use e=cept that you do need to have something.The iptables in (inu= is very good but it is /uite ra- so the -ay that handle this is -ith a program

called f-builder.

,ore later on this in a separate document.

5 6otes on using "as#hotsot

To login point your bro-ser at the e=pected $( e.g. on the server itself you can use12.0.0.1@easyhotspot or use -hatever path you stored Easyhotspot.

Fou -ill be met -ith a logon page. Enter in the default username of admin and the pass-ord of

admin12

5.1 Alterin% postpaid settin%s

'hen you set this then it applies to all ?E' postpaid users that are defined. The fields in the priceper ,H or price per minute are ?+T locale adLusted. Enter them in as floating point.

5.2 ?illin% Plans

Fou cannot edit a billing plan. This is used for vouchers. To create a different plan then simply add

the ne- details and then generate vouchers -ith that plan.

That;s all for no-.


26/26

( TODO

".1 Aoidin% persistent MySQL #onnections

Easyhotspot uses persistent connections 7see its database.php config file8. f you brea# EasyhotspotS ,y"3( -ith too many connections then this can Lam ,y"3( from accepting connections fromadius -hich pretty much ma#es your server useless. 'e need to turn this off.

".2 Acco!nt *dit and Add interface feedack @!irks

'hen you are editing cashier or admin@superadmin records then if you enter in data -rong then itputs you bac# onto the same edit form page but fails to indicate -hich field has failed its chec#s andit also thro-s you at the admin cashier vie- page.

f you had actually entered in the data correctly then it -ould have closed the screen fine and

correctly updated the database.

"o you;ll Lust have to guess -hich field is bad. Fou must put in a valid email e.g. =Ny.Jnot Lust=Ny

Fou can;t also easily delete the admin records. To delete admin records 7e.g. if you are cleaning up adatabase8 then use a ,y"3( editor and remove the record in faCuser and faCuserCprofile -here theid are the same.

".3 adacct records persist foreer

The radacct records need t-o cleanups:

the logic used to see if a username is connected using the radacct record displays records that -erein place -hen the radisus process -as #illed as al-ays connected even though you have done adisconnect. The fi= is to manually touch the acctstoptime 7using the acctstarttime8.

)lus once the billing has been done for postpaid accounts then the radacct entries for that need to beremoved.

".4 (aation handlin%.

?othing fancy here but ideally a brea#do-n of pre!ta= results. ,ore of this in a separate document.

E?D.
mailto:[email protected]:x@ymailto:x@ymailto:[email protected]:x@y

easyhotspot install guide for 0 2

Documents