forked from jaysoffian/eap_proxy
-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathREADME
292 lines (215 loc) · 10.8 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
EAP_PROXY(1) EAP Proxy EAP_PROXY(1)
NAME
eap_proxy - EAP Proxy
SYNOPSIS
eap_proxy [-h|--help] [--ping-gateway] [--ignore-when-wan-up]
[--ignore-start]
[--ignore-logoff] [--restart-dhcp] [--set-mac] [--daemon]
[--pidfile [[PIDFILE]] [--syslog] [--promiscuous] [--debug]
[--debug-packets]
IF_WAN IF_ROUTER
DESCRIPTION
eap_proxy proxies 802.1X EAPOL (Extensible Authentication Protocol over
LAN) frames between the Ethernet interfaces IF_WAN and IF_ROUTER.
OPTIONS
Required options
IF_WAN Physical interface to which the AT&T ONT/WAN is connected.
A VLAN named IF_WAN.0 configured to get its IP address automati-
cally via DHCP must also exist on it (e.g. as eth0.0 on an
interface named eth0).
See CONFIGURATION, EXAMPLES, and interfaces(5) for more informa-
tion on how to configure a VLAN interface.
IF_ROUTER
Physical interface to which the AT&T Residential Gateway is con-
nected.
Help message
-h, --help
Print a help message.
Checking whether WAN is up
--ping-gateway
Normally the WAN is considered up if IF_WAN.0 has an IP address.
This option additionally requires that there is a default route
gateway that responds to a ping.
Ignoring router packets
--ignore-when-wan-up
Do not proxy any EAPOL traffic from the router when the WAN is
up (see --ping-gateway).
--ignore-start
Always ignore EAPOL-Start from the router.
A new device on a network with EAP access control is not allowed
to use the network for any non-EAP traffic. To start the
authentication process, it replies with a EAP-Response Identity
packet to periodic EAP-Request Identity transmissions made by an
authenticator. Although not required, devices can also send
EAPOL-Start frames on their own to ask any available authentica-
tor to immediately transmit EAP-Request Identity.
--ignore-logoff
Always ignore EAPOL-Logoff from the router.
Once a device sends EAPOL-Logoff, it must authenticate again
before using the network for any non-EAP traffic.
Configuring the IF_WAN.0 VLAN interface
--restart-dhcp
Check whether WAN is up after receiving EAP-Success on IF_WAN
(see --ping-gateway).
If not, restart the system's DHCP client on the IF_WAN.0 VLAN
interface.
--set-mac
Set IF_WAN.0's MAC (Ethernet) address to the router's MAC
address.
Matching MAC addresses is probably required, but you may prefer
to do it manually.
Daemonization
--daemon
Become a daemon. Implies --syslog.
--pidfile
[PIDFILE] Record eap_proxy's process identifier to PIDFILE.
If --pidfile is given, but PIDFILE is not, PIDFILE will default
to /var/run/eap_proxy.pid.
--syslog
Log messages to syslog instead of to the standard error stream
stderr.
Debugging
--promiscuous
Place the IF_WAN and IF_ROUTER interfaces into promiscuous mode
instead of multicast mode.
--debug
Enable debug-level logging.
--debug-packets
Print packets in a hexdump-like format to assist with debugging.
Implies --debug.
CONFIGURATION
eap_proxy is installed as a daemon. An initscript is placed at
/etc/init.d/eap-proxy and a default configuration file at
/etc/eap_proxy.conf. The configuration file is not used by the proxy
itself. Instead, the proxy is configured when it is launched by the
initscript, which parses the configuration file to pass on the proper
options.
Note that the package and initscript are named eap-proxy. Everything
else is named with an underscore as eap_proxy.
/etc/eap_proxy.conf
The default configuration file is a standard text file. Each line con-
tains one option or a comment. Lines beginning with "#" are considered
comments and will not be parsed.
The first two options (lines that are not comments) must contain IF_WAN
and IF_ROUTER, the device names of the physical network interfaces con-
nected to the AT&T ONT and the AT&T Residential Gateway. Most users
will only need to edit these two lines in the configuration file.
If PIDFILE is specified in addition to --pidfile, and PIDFILE contains
spaces, it must be enclosed in quotes.
If eap_proxy is run as a daemon via the initscript (or by systemd's
systemctl, which itself runs the initscript), --daemon is implied and
its setting in the configuration file is ignored.
See the OPTIONS section for more information about options.
Interfaces and VLAN
Both IF_WAN and IF_ROUTER must be physical network interfaces. There
must also be a VLAN interface named IF_WAN.0 on top of IF_WAN that has
VLAN ID 0.
For --restart-dhcp to work, at least IF_WAN and IF_WAN.0 should be man-
aged in /etc/network/interfaces instead of by NetworkManager, and
IF_WAN.0 should be configured to get its IP via DHCP.
For more information on configuring network interfaces, VLANs, and
DHCP, see EXAMPLES and interfaces(5).
EXAMPLES
These examples are for a system running a typical Debian-based Linux
distribution, and should be followed only with consideration for indi-
vidual circumstances. If everything is configured perfectly, issuing
sudo systemctl enable eap-proxy from a command line and restarting the
system will fulfill various hopes and dreams.
Firewalling, routing, DNS, IPv6, VPNs, and local DHCP assignments are
beyond this document's scope.
Assumptions
* The network interface to be used as IF_WAN is named eth0 (imply-
ing that IF_WAN.0 would be named eth0.0),
* the interface to be used as IF_ROUTER is named eth1, and
* the MAC address of the AT&T Residential Gateway is
DE:AD:8B:AD:F0:0D.
Desired behavior
* We would like to disable NetworkManager (see Disabling Network-
Manager below) on eth0 and eth1,
* change eth0's MAC address to DE:AD:8B:AD:F0:0D,
* create a VLAN (see Creating VLANs below) named eth0.0 on top of
eth0 with VLAN ID 0 that gets its IP via DHCP,
* and bring eth0, eth0.0, and eth1 up automatically when the sys-
tem starts.
/etc/network/interfaces
Place the following lines in /etc/network/interfaces.
allow-hotplug eth0
iface eth0 inet manual
hwaddress de:ad:8b:ad:f0:0d
auto eth0.0
iface eth0.0 inet dhcp
vlan-raw-device eth0
allow-hotplug eth1
iface eth1 inet manual
Some systems will hang for several minutes during boot while eth0.0
tries and fails to get a DHCP assignment. To fix this, either edit the
configuration file for your DHCP client so that it uses a sane value
for DHCP timeout, and/or (if using systemd) edit /etc/systemd/sys-
tem/network-online.target.wants to do the same by adding something like
TimeoutStartSec=10sec to the [Service] section.
/etc/eap_proxy.conf
Edit the first two noncommented lines in /etc/eap_proxy.conf, substi-
tuting the actual names of your interfaces.
[ ... ]
# Required options
# IF_WAN
eth0
# IF_ROUTER
eth1
[ ... ]
Disabling NetworkManager
The surest way to stop using NetworkManager is to uninstall it. It
will also will not manage interfaces listed in /etc/network/interfaces,
if the following is present (which is likely) in /etc/NetworkMan-
ager/NetworkManager.conf:
[main]
plugins=ifupdown,keyfile
[ifupdown]
managed=false
Creating VLANs
VLAN support is provided by the vlan package. VLAN autocreation is
handled by the /etc/network/if-pre-up.d/vlan script, which will almost
certainly need to be edited to add a special case for IF_WAN.0, explic-
itly specifying the parameters that it normally guesses from reading
/etc/network/interfaces for the VLAN name type, ID, and underlying
interface:
case "$IFACE" in
[ ... ]
# for eap_proxy: special case to create eth0.0 properly
eth0.0)
vconfig set_name_type DEV_PLUS_VID_NO_PAD
VLANID=0
IF_VLAN_RAW_DEVICE=eth0
;;
[ ... ]
USAGE
The preferred method of running eap_proxy is through systemd by issuing
sudo systemctl start eap-proxy from the command line.
Issue sudo systemctl stop eap-proxy to stop the proxy.
Issue sudo systemctl enable eap-proxy to make the proxy run at every
boot.
Directly call the proxy from the command line by issuing eap_proxy
[options].
Issue man eap_proxy to read the manual page.
Setting up routing between IF_WAN.0 and another network interface is
likely the next step, but will be left as an exercise for the reader.
See the CONFIGURATION and EXAMPLES sections for more information.
FILES
/etc/eap_proxy.conf
Default configuration file. See CONFIGURATION and EXAMPLES for
more information.
/etc/init.d/eap-proxy
Default initscript. See CONFIGURATION for more information.
ERRATA
The package and initscript are named eap-proxy.
Everything else is named with an underscore as eap_proxy.
An initscript is used instead of a modern systemd .service file to
parse /etc/eap_proxy.conf and pass on the correct options to the proxy.
(Backward compatibility, too, for what that's worth.)
AUTHOR
Jay Soffian <[email protected]> (original)
kangtastic <[email protected]> (modifications, documentation, and
packaging for Debian)
SEE ALSO
interfaces(5)
eap_proxy November 20, 2017 EAP_PROXY(1)