Open Campus Network

Opengate and Open space
LAN in Saga University

 Request

Y. Watanabe, H. Eto, M. Otani, K.
Watanabe, S. tadaki

 In open space such as lecture room andlounge Public terminals used freely by students
 Network jack used freely by students
 Wireless LAN (spread later) Realization
 Settle separated open space LAN Develop user authentication system
Opengate2

jus symposium 2005 (translated from Japanese)

Network user authentication
systemHistory
 1999.8 Development of scratch version ofOpengate
 2000.6 Field test in the computer center 2000.9 Field test in a remote practice room
 2001.1 Start service in the Library 2001.4 Start campus wide service
 2001.１２ Publish a paper needs
 Occurrence of intrusion, disturbance, infringement
 Functions
 Restriction of users
 Record of usage
 Demand Can be used easily
 Can be controlled easily
 Can be applied to various terminals

IPSJ Journal, Vol.42, No.12, pp.2802-2809(2001) (In Japanese) 2005.４ Publish a paper Public terminals for free use, network jack,wireless LAN
 Windows,MacOS,Linux,...

IPSJ Journal, Vol.46, No.4, pp.922-929(2005) (In Japanese) 2005.5 Release Version 1.0, Add to SourceForge
34

Network user authentication
system - Opengate

Basic action:
add / delete firewall rules

 Control the firewall on the gatewayfrom a CGI

192.168.0.11………
10000 allow ip from 192.168.0.11 to any
Add at auth from
192.168.0.11
10000 allow ip from any to 192.168.0.11
Delete at disuse………
60000 fwd localhost tcp from any to any http65535 deny ip from any to any

Allow from/tomatching
priority
5All packets are denied(if not matched toprevious rules)

Forward web accessto local server(if not matched toprevious rules)

61How to detect disuse

Usage procedure By TCP connection remained => difficult at
mail and web usage
 By some physical detection=>difficult at
public terminals
 By an agent installed=>difficult at user
terminals (lots of users, variousenvironments)
 By TCP connection with Java Applet sent toclient other methods are combined for terminals
without Java

78910Action flow
gatewayterminal

Access to
any URL

Authentication server

Authentication
request page
User ID
PasswordOpenNetwork usage
End browser
End OSCut off wire
Leave it long time
11NetworkClose

122

Software structure

Process flow
ClientUser
Any URL

Gateway

Authserver

Web browser

ipfw
Web server

User ID

IP forward

Auth pagePassword

CGI
POST(user ID,password)

User ID,
password

POP/FTPserver,or other

ARP
MAC
User ID, password
Auth result

Open firewall
13

Process flow (continue)
User

ClientWeb browser

CGI Client machinefork Used by user. Preferable to run Java Applet

ipfw syslog

 Gateway

Allow page and Java Applet

 Control the communication. CGI program,firewall and web server are run.

Java Applet
startTCP connect

Hello exchange
Exitstop

TCP close

14

Elements of Opengate system

GatewayWeb server

syslogReport open

 Authentication server
 Hold user information and reply to auth request

 Log server

packetcount check Receive the usage log via syslog and record it

Close firewall
Report close

15

16

Client machine

Open the network (allow to use) Need Web browser. Preferable to run JavaApplet
 Need to use TCP/IP
 Need no address translation between
gateway and client Applicable to wired and wireless LAN.
 Applicable to mobile PCs and publicterminals
 Applicable to Windows, MacOS, Linux,FreeBSD, …

 At entering right ID and password

17 In default, all packets to/from theclient address are allowed By using higher priority rules, canallow/deny specific packets
 By editing Perl script, can control
more specific cases
18

3Close the network (deny to use)

Gateway When Java Applet is enabled OS

 Exit the web browser or OS(normal user action)
 Fail the periodic hello exchange(cut off wire) No packets in a long time(left public terminal as is) FreeBSD4.0 or later Hardware
 compatible to above OS, need 2 or more
Ether NICs

 When Java Applet is disabledTime limit passed(user can indicate it in auth page)No packets in a long time(left public terminal as is)
Command ‘arp’ reply varied MAC(PC is exchanged)
User clicks the link for termination

 Software(need) Apache、ipfw

 Software (optional)
 natd、DHCP、SSL、perl

19

20

Example setting ofauthentication servers

Authentication server protocols

When [user1] is entered in ID field

default:tc=rad POP3, POP3S, FTP, RADIUS, PAM

 configuration
 Describe server information in configuration file

hg:address=pop.hoge.jp:protocol=pop3s

 Selection of server

When [user1@lib] is entered in ID field When UserID only [user] is entered in ID field=>user [user] is authenticated by default server When UserID and serverID [user@serv]=> user[user] is authenticated by sever[serv]

lib:protocol=ftp:address=192.168.0.1
rad:protocol=radius
pam:protocol=pam

21

Installation

22

Syslog output

 Reconstruct kernel including firewall ipfw
 Install related softwares check theseAug 30 11:04:26 ce-gate opengatesrv.cgi[526]:
OPEN: user user1 from 192.168.0.11 at
12:34:56:78:9a:bc
Aug 30 11:05:48 ce-gate opengatesrv.cgi[533]:
CLOS: user user1 from 192.168.0.11 at
Close
12:34:56:78:9a:bc ( 00:01:22 )Open

 Apache、ipfw 、natd、DHCP、SSL、perl、、

 Check set/unset of firewall rules manually Configure Apache and ipfw to forward any
web pages matching to no priority rules
 Install opengatesvr.cgi and configure Set auth server and check the whole action

MAC address

User IDperiodIP address

Aug 30 11:07:36 ce-gate opengatesrv.cgi[1568]:
DENY: auth-err, user xxxx from 192.168.0.11
Aug 30 11:09:21 ce-gate opengatesrv.cgi[55572]:
ERR in auth-comm: Ftp server is not normal 4
Error

Deny

 Documents and test programs in archive
23244

Usage status displayed by UNIX
command ‘ps’Merits
 Easy to use Auth page is displayed with any URL request Network is closed with browser termination
 No client program is installed

ps -x | grep opengate
525 ?? I0:00.24 opengatesrv.cgi:
10000,user1,192.168.0.11

 Easy to manage
 only the gateway machine is needed to maintain Compatible to various authentication protocols(pop,pops,ftp,radius,pam) Can be added easily to existing network

533 ?? I
0:00.01 opengatesrv.cgi:
10002,user2,192.168.0.15
Firewall rulenumberUser ID

 Applicable to various clients

IP address
25

Open space LAN
server server

 Wired/wireless connection, public/mobile terminals,windows/macintosh,linux,freebsd,...
 Require Only a web browser (Java preferably) 26

Actual connection
Open space LAN

Authentication
gateways

Authterminal terminal
gatewayNormal LANInternet

Open space LANAuthgateway
terminal
terminal
terminal terminal terminal
terminal
Closed space (easy to identify
Open space (difficult touser from location)
identify user from location)
27

Size of our open space LAN

Each floor

firewallfirewallOpen space LANinternet
SwitchComputer center

VLAN

Normal LAN
SwitchEach building
28

Stacked authentication gateways 22 gateways: one for one or few buildings About 110 public terminals
 Take in existing terminals in library, exercise
room, employment bureau, …

 About 730 Network jacks
 All lecture rooms(two for each), library, studentroom, …

 About 87 wireless access points
 In or near lecture rooms, library, …

 About 10,000 users
 Students, teachers, officers, guests
29

30

5

Servers and wiring
Bootserver

Computercenter

Diskless bootAuthserver

Diskless machineLog
serverBoot server

NIC

DHCP server
Get boot info

Gateway

TFTP server
Get PXEBOOT

VLAN
Eachbuilding

Backbone LAN

PXEBOOT
ExecOpen spaceLAN

Get boot info

NFS
serverGet kernel
kernelNormal LAN

Exec
31

Wireless access points

Mount root partition
32

Lecture room

33

Passage way

34

Hall3536

6

Librarylibrary37

library

38

Employment bureau

39

40

Application form for library’s external user

Operation

DateAddress

 For user belonging to our university

Phone Use with ID of computer center No application form for usage
 No guidance without general computer literacy

Name(sign) For user visiting to our university
 Library guest, conference, short stay staff, et al.
 Prepare authentication server for guest
 Prepare application form including preprinted ID
and password
 If applied, allow to use network in some period,
but not to login to internal servers
41

Keep at acceptance desk
Cut off line
userIDPassword

Deliver to user

427

Change of user countUser count on each gateway
Network is wired
to student rooms
Building no.9
for science and engineering
Building no.9
for science and engineering
Department about IT
Every student has one
personal machine
Many public terminals
Library

2003.9.292005.6.2

43

Histogram of connecting period

44

Present state and performance Present state

Closed at every 10
minutes usage check Usage is centered to gateways connecting to publicterminals, student rooms, and note PCs
 First half of 2004:140,000 connections, 6,000 users(Our university has 10,000 men) Favorable comments on visitor’s service

 performance Gateway macchine: PemtiumIII 1GHz, 512MB memory,No HDD
 Usage in programming exercise with 100 note PCs
 DVTS video 40Mb,3hours
 Stopped by NAT overflow with virus

45

46

Techniques employed in daily
management

Causes of troubles

 Small remote sections are included into the LAN Client PC = majority

 Many students visit and want to use network
 No power for network administration
 No authentication request for staffs by firewall rules

 Miss setting of network(remain setting at home) Hardware malfunction
 Java is not installed (limited usage)

 Countermeasure to virus

 Network devices

 Virus infecting ports are closed using firewall At trouble of gateway machine Hardware malfunctions of switches and antennas

 The subnet is led to other gateway machine Server machine = minority

 To limit usage easier or harder temporally Executed by manual firewall setting

 To exchange a group to open space LAN
 The lines are connected to assignment port in switch

 To know risky usage47

 DHCP server is stopped NAT processing is overflowed by virus packets
 Hardware malfunction48

 Gateway logs are investigated8

CostsOur developments related money Key logger in a public terminal One PC for every subnet
 Distribute network wire and/or wireless access points

 Man power At starting: Install FreeBSD+Firewall, Apache, DHCP,CGI etc.
 At daily:No operation when no trouble Server is stopped: reboot server, or connect wire toother server and examine the server without hurry Finding wrong usage: checking logs
 Found security hole in system software: need toreconstruct the system when serious
 Maintenance of user authentication data properly
 very troublesome job =>Need to use existing data

 Authentication at booting with Opengate

 Easier interface
 Opengate client program by Java

 Compatible to IPv6
 Want to open IPv4 and IPv6 at once Develop Opengate compatible to IPv6

 Examine other environment fordevelopment
 Opengate on Java Servlet

49

Open source

50

Images of development sites

 Open to public with GNU PublicLicense
http://www.cc.saga-u.ac.jp/opengate
http://sourceforge.net/
projects/opengateproject

51

Other techniques
employed elsewhere52

Reference link sites

 Switching of VLAN =>Need many switches
 Usage of VPN=>Low performance, limited clients Registering MAC=>Need client data maintenance Hold SSH connection at usage=>Difficult to use Checking by HTTP REFRESH=>Closing delay
 IEEE802.1X=>Limited clients
 Various appliances=>Cost, flexibility53

 Practice of open access floor(tentativename) - Nagoya Univ. (in Japanese)
http://www.cc.hit-u.ac.jp/monban/ref.html
 PortalSoftware - Personal Telco
http://wiki.personaltelco.net/index.cgi/PortalSoftware
549