-
Notifications
You must be signed in to change notification settings - Fork 119
/
pihotspot.sh
1255 lines (1035 loc) · 44.6 KB
/
pihotspot.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/bin/bash
# PLEASE EDIT NEXT LINES TO DEFINE YOUR OWN CONFIGURATION
# Name of the log file
LOGNAME="kupiki_hotspot.log"
# Path where the logfile will be stored
# be sure to add a / at the end of the path
LOGPATH="/var/log/"
# Password for user root (MySql/MariaDB not system)
MYSQL_PASSWORD="pihotspot"
# Name of the hotspot that will be visible for users/customers
HOTSPOT_NAME="kupikihotspot"
# IP of the hotspot
HOTSPOT_IP="192.168.10.1"
# Wi-fi code country. Use above link to find yours
# https://www.cisco.com/c/en/us/td/docs/wireless/wcs/3-2/configuration/guide/wcscfg32/wcscod.html
WIFI_COUNTRY_CODE="FR"
# Use HTTPS to connect to web portal
# Set value to Y or N
HOTSPOT_HTTPS="N"
# Network where the hotspot is located
HOTSPOT_NETWORK="192.168.10.0"
# Secret word for FreeRadius
FREERADIUS_SECRETKEY=`cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1`
# WAN interface (the one with Internet - default 'eth0' or long name for Debian 9+)
WAN_INTERFACE=`ip link show | grep '^[1-9]' | awk -F ':' '{print $2}' | awk '{$1=$1};1' | grep '^e'`
# LAN interface (the one for the hotspot)
LAN_INTERFACE="wlan0"
# Wifi driver
LAN_WIFI_DRIVER="nl80211"
# Install Haserl (required if you want to use the default Coova Portal)
# Set value to Y or N
HASERL_INSTALL="N"
# Password used for the generation of the certificate
CERT_PASSWORD="pihotspot"
# Number of days to certify the certificate for (default 2 years)
CERT_DAYS="730"
# Make Avahi optional
# Set value to Y or N
AVAHI_INSTALL="Y"
# Install Daloradius Portal (compatible with FR2 only in theory)
# Set value to Y or N
DALORADIUS_INSTALL="Y"
# Enable/Disable Bluetooth
# Set value to Y or N
BLUETOOTH_ENABLED="N"
# Enable/Disable fail2ban to protect server from unwanted access
# Set value to Y or N
FAIL2BAN_ENABLED="N"
# Enable/Disable Netflow logs to log all traffic requests. Must be crossed checked with assigned IP in the radius tables
# Set value to Y or N
NETFLOW_ENABLED="Y"
# Define how long Netflow logs will be stored
# Sets the max life time for files generated for Netflow monitoring. The supplied maxlife_time accepts values such as 31d, 240H 1.5d etc.
# Accepted time scales are w (weeks) d (days) H (hours).
# A value of 0 disables the max lifetime limit. If no scale is given, H (hours) are assumed.
# By default data are stored 365 days (value set to 365d)
NETFLOW_LOGS_DAYS="365d"
# Enable/Disable MAC authentication
# Set value to Y or N
MAC_AUTHENTICATION_ENABLED="N"
# Password for MAC authentication. Could/Should be changed within the web administration interface
MAC_AUTHENTICATION_PASSWORD="123456"
# Install web frontend of Kupiki Hotspot
# Set value to Y or N
INSTALL_KUPIKI_ADMIN=N
# Install Cron job for the hotspot updater. Will be executed every sunday at 8am (system time)
# Set value to Y or N
ADD_CRON_UPDATER=Y
# Install additional counters
# Set value to Y or N
KUPIKI_SQL_COUNTERS=Y
# Allow users to register in the Portal
# Set value to Y or N
KUPIKI_ALLOW_REGISTER=Y
# *************************************
#
# PLEASE DO NOT MODIFY THE LINES BELOW
#
# *************************************
# Current script version
KUPIKI_VERSION="2.1.3"
# Updater location
KUPIKI_UPDATER_ARCHIVE="https://raw.githubusercontent.com/pihomeserver/Kupiki-Hotspot-Script/master/kupiki_updater.sh"
# Default Portal port
HOTSPOT_PORT="80"
HOTSPOT_PROTOCOL="http:\/\/"
# If we need HTTPS support, change port and protocol
if [ "$HOTSPOT_HTTPS" = "Y" ]; then
HOTSPOT_PORT="443"
HOTSPOT_PROTOCOL="https:\/\/"
fi
# Minimal version for Debian
DEBIAN_MINIMAL_VERSION=9.0
# Default version of MariaDB
MARIADB_VERSION='10.1'
# CoovaChilli GIT URL
COOVACHILLI_ARCHIVE="https://github.com/coova/coova-chilli.git"
# Kupiki SQL counters
KUPIKI_SQL_COUNTERS_URL="https://raw.githubusercontent.com/pihomeserver/Kupiki-Hotspot-Script/master/updates/sqlcounter"
# Daloradius URL
DALORADIUS_ARCHIVE="https://github.com/lirantal/daloradius.git"
# Captive Portal URL
HOTSPOTPORTAL_ARCHIVE="https://github.com/Kupiki/Kupiki-Hotspot-Portal.git"
# Captive Portal URL
HOTSPOTPORTAL_BACKEND_ARCHIVE="https://github.com/Kupiki/Kupiki-Hotspot-Portal-Backend.git"
# Kupiki Admin Web UI URL
KUPIKI_WEBUI_ARCHIVE="https://github.com/Kupiki/Kupiki-Hotspot-Admin-Install.git"
# Haserl URL
HASERL_URL="http://downloads.sourceforge.net/project/haserl/haserl-devel/haserl-0.9.35.tar.gz"
# Haserl archive name based on the URL (keep the same version)
HASERL_ARCHIVE="haserl-0.9.35"
### PKG Vars ###
PKG_MANAGER="apt-get"
PKG_CACHE="/var/lib/apt/lists/"
UPDATE_PKG_CACHE="${PKG_MANAGER} update"
PKG_INSTALL="${PKG_MANAGER} --yes install"
PKG_UPGRADE="${PKG_MANAGER} --yes upgrade"
#PKG_DIST_UPGRADE="apt dist-upgrade -y --force-yes"
PKG_DIST_UPGRADE="apt dist-upgrade -y --allow-remove-essential --allow-change-held-packages"
PKG_COUNT="${PKG_MANAGER} -s -o Debug::NoLocking=true upgrade | grep -c ^Inst || true"
WAN_INTERFACE_IP=`ifconfig $WAN_INTERFACE | grep "inet " | cut -d ' ' -f 10`
WAN_INTERFACE_IP_MASK=`ifconfig $WAN_INTERFACE | grep "inet " | cut -d ' ' -f 13`
IFS=. read -r i1 i2 i3 i4 <<< "$WAN_INTERFACE_IP"
IFS=. read -r m1 m2 m3 m4 <<< "$WAN_INTERFACE_IP_MASK"
WAN_INTERFACE_NETWORK_MASK=`printf "%d.%d.%d.%d\n" "$((i1 & m1))" "$((i2 & m2))" "$((i3 & m3))" "$((i4 & m4))"`
check_returned_code() {
RETURNED_CODE=$@
if [ $RETURNED_CODE -ne 0 ]; then
display_message ""
display_message "Something went wrong with the last command. Please check the log file"
display_message ""
exit 1
fi
}
display_message() {
MESSAGE=$@
# Display on console
echo "::: $MESSAGE"
# Save it to log file
echo "::: $MESSAGE" >> $LOGPATH$LOGNAME
}
execute_command() {
display_message "$3"
COMMAND="$1 >> $LOGPATH$LOGNAME 2>&1"
eval $COMMAND
COMMAND_RESULT=$?
if [ "$2" != "false" ]; then
check_returned_code $COMMAND_RESULT
fi
}
prepare_logfile() {
echo "::: Preparing log file"
if [ -f $LOGPATH$LOGNAME ]; then
echo "::: Log file already exists. Creating a backup."
execute_command "mv $LOGPATH$LOGNAME $LOGPATH$LOGNAME.`date +%Y%m%d.%H%M%S`"
fi
echo "::: Creating the log file"
execute_command "touch $LOGPATH$LOGNAME"
display_message "Log file created : $LOGPATH$LOGNAME"
display_message "Use command 'tail -f $LOGPATH$LOGNAME' in a new console to get installation details"
}
prepare_install() {
# Prepare the log file
prepare_logfile
# Force IPv4 on APT resources
execute_command "echo 'Acquire::ForceIPv4 \"true\";' | sudo tee /etc/apt/apt.conf.d/99force-ipv4" true "Updating APT config to force IPv4"
display_message "Configuring localepurge"
cat > /tmp/localepurge.conf << EOF
localepurge localepurge/quickndirtycalc boolean false
localepurge localepurge/none_selected boolean false
localepurge localepurge/mandelete boolean true
localepurge localepurge/dontbothernew boolean true
localepurge localepurge/verbose boolean false
localepurge localepurge/use-dpkg-feature boolean false
localepurge localepurge/remove_no note
localepurge localepurge/showfreedspace boolean true
localepurge localepurge/nopurge multiselect en, en_US.UTF-8
EOF
check_returned_code $?
debconf-set-selections < /tmp/localepurge.conf
check_returned_code $?
rm -f /tmp/localepurge.conf
check_returned_code $?
}
check_root() {
# Must be root to install the hotspot
echo ":::"
if [[ $EUID -eq 0 ]];then
echo "::: You are root - OK"
else
echo "::: sudo will be used for the install."
# Check if it is actually installed
# If it isn't, exit because the install cannot complete
if [[ $(dpkg-query -s sudo) ]];then
export SUDO="sudo"
export SUDOE="sudo -E"
else
echo "::: Please install sudo or run this as root."
exit 1
fi
fi
}
jumpto() {
label=$1
cmd=$(sed -n "/$label:/{:a;n;p;ba};" $0 | grep -v ':$')
eval "$cmd"
exit
}
verifyFreeDiskSpace() {
# Needed free space
local required_free_megabytes=1024
# If user installs unattended-upgrades we will check for 1GB free
echo ":::"
echo -n "::: Verifying free disk space ($required_free_megabytes Mb)"
local existing_free_megabytes=$(df -Pk | grep -m1 '\/$' | awk '{print $4}')
# - Unknown free disk space , not a integer
if ! [[ "${existing_free_megabytes}" =~ ^([0-9])+$ ]]; then
echo ""
echo "::: Unknown free disk space!"
echo "::: We were unable to determine available free disk space on this system."
echo "::: You may continue with the installation, however, it is not recommended."
read -r -p "::: If you are sure you want to continue, type YES and press enter :: " response
case $response in
[Y][E][S])
;;
*)
echo "::: Confirmation not received, exiting..."
exit 1
;;
esac
# - Insufficient free disk space
elif [[ ${existing_free_megabytes} -lt ${required_free_megabytes} ]]; then
echo ""
echo "::: Insufficient Disk Space!"
echo "::: Your system appears to be low on disk space. Pi-HotSpot recommends a minimum of $required_free_megabytes MegaBytes."
echo "::: You only have ${existing_free_megabytes} MegaBytes free."
echo ":::"
echo "::: If this is a new install on a Raspberry Pi you may need to expand your disk."
echo "::: Try running 'sudo raspi-config', and choose the 'expand file system option'"
echo ":::"
echo "::: After rebooting, run this installation again."
echo "Insufficient free space, exiting..."
exit 1
else
echo " - OK"
fi
}
update_package_cache() {
echo "::: Updating packages list"
if command -v debconf-apt-progress &> /dev/null; then
$SUDO debconf-apt-progress -- ${UPDATE_PKG_CACHE}
else
$SUDO ${UPDATE_PKG_CACHE} &> /dev/null
fi
echo ":::"
}
notify_package_updates_available() {
echo ":::"
echo -n "::: Checking ${PKG_MANAGER} for upgraded packages...."
updatesToInstall=$(eval "${PKG_COUNT}")
echo " done!"
echo ":::"
if [[ ${updatesToInstall} -eq "0" ]]; then
echo "::: Your system is up to date! Continuing with Pi-Hotspot installation..."
else
echo "::: There are ${updatesToInstall} updates available for your system!"
echo ":::"
execute_command "apt-get upgrade -y --allow-remove-essential --allow-change-held-packages" true "Upgrading the packages. Please be patient."
fi
}
download_all_sources() {
echo ":::"
execute_command "cd /usr/src && rm -rf coova-chilli*" true "Removing any previous sources of CoovaChilli project"
execute_command "cd /usr/src && git clone $COOVACHILLI_ARCHIVE coova-chilli" true "Cloning CoovaChilli project"
execute_command "cd /usr/src && rm -rf webui" true "Removing any previous sources of Kupiki Admin"
execute_command "cd /usr/src && git clone $KUPIKI_WEBUI_ARCHIVE webui" true "Cloning Kupiki Admin web UI project"
if [[ "$KUPIKI_SQL_COUNTERS" = "Y" ]]; then
execute_command "cd /usr/src && rm -f sqlcounter && wget $KUPIKI_SQL_COUNTERS_URL" true "Download Kupiki SQL Counters"
fi
if [[ "$HASERL_INSTALL" = "Y" ]]; then
execute_command "cd /usr/src && rm -f ${HASERL_ARCHIVE}.tar.gz && wget $HASERL_URL" true "Download Haserl"
fi
if [[ "$DALORADIUS_INSTALL" = "Y" ]]; then
execute_command "cd /usr/src/ && rm -rf daloradius && git clone $DALORADIUS_ARCHIVE daloradius" true "Cloning daloradius project"
fi
execute_command "cd /usr/src/ && rm -rf portal && git clone $HOTSPOTPORTAL_ARCHIVE portal" true "Cloning Pi Hotspot portal project"
execute_command "cd /usr/src/ && rm -rf kupiki-portal-backend && git clone $HOTSPOTPORTAL_BACKEND_ARCHIVE kupiki-portal-backend" true "Cloning Pi Hotspot portal backend project"
}
secure_system() {
display_message ":::"
display_message "::: Configure sysctl kernel parameters"
display_message ":::"
cat >> /etc/sysctl.d/kupiki.conf << EOT
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0
net.netfilter.nf_conntrack_tcp_timeout_established = 3600
net.ipv4.conf.all.log_martians = 0
net.netfilter.nf_conntrack_helper = 0
net.ipv4.ip_forward = 1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.all.autoconf = 0
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.default.autoconf = 0
EOT
}
package_check_install() {
dpkg-query -W -f='${Status}' "${1}" 2>/dev/null | grep -c "ok installed" || ${PKG_INSTALL} "${1}"
}
PIHOTSPOT_DEPS_START=( apt-transport-https localepurge git wget )
PIHOTSPOT_DEPS_WIFI=( apt-utils firmware-brcm80211 firmware-ralink firmware-realtek )
PIHOTSPOT_DEPS=( build-essential grep whiptail debconf-utils nfdump figlet git fail2ban hostapd php-mysql php-pear php-gd php-db php-fpm libgd-dev libpcrecpp0v5 libxpm4 nginx debhelper libssl-dev libcurl4-gnutls-dev mariadb-server freeradius freeradius-mysql gcc make pkg-config iptables haserl libjson-c-dev gengetopt devscripts libtool bash-completion autoconf automake libffi-dev python python-pip jq python-backports.ssl-match-hostname docker docker-compose)
install_dependent_packages() {
declare -a argArray1=("${!1}")
if command -v debconf-apt-progress &> /dev/null; then
$SUDO debconf-apt-progress -- ${PKG_INSTALL} "${argArray1[@]}"
else
for i in "${argArray1[@]}"; do
echo -n "::: Checking for $i..."
$SUDO package_check_install "${i}" &> /dev/null
check_returned_code $?
echo " installed!"
done
fi
}
valid_ip_address() {
local typeChk=$1
local ip=$2
local stat=1
if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
OIFS=$IFS
IFS='.'
ip=($ip)
IFS=$OIFS
if [ $typeChk = "IP" ]; then
[[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \
&& ${ip[2]} -le 255 && ${ip[3]} -le 255 && ${ip[3]} -ne 0 ]]
stat=$?
else
[[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \
&& ${ip[2]} -le 255 && ${ip[3]} -eq 0 ]]
stat=$?
fi
fi
return $stat
}
get_updater() {
display_message "Checking for updater"
if [ -e /etc/kupiki/kupiki_updater.sh ]; then
display_message "Updater already exists. It will auto update itself"
else
display_message "Creating /etc/kupiki"
mkdir -p /etc/kupiki && chmod 700 /etc/kupiki
check_returned_code $?
display_message "Updater not found. Downloading latest version of the updater"
if ! wget --quiet --output-document="/etc/kupiki/kupiki_updater.sh" $KUPIKI_UPDATER_ARCHIVE ; then
display_message "Error while trying to wget new version from ${KUPIKI_UPDATER_ARCHIVE}"
exit 1
fi
display_message "Changing access rights"
chmod 700 /etc/kupiki/kupiki_updater.sh
check_returned_code $?
fi
if [[ "$ADD_CRON_UPDATER" = "Y" ]]; then
execute_command "grep kupiki_updater /etc/crontab" false "Checking for existing cron job"
if [[ $COMMAND_RESULT -ne 0 ]]; then
echo "0 6 * * 0 root /etc/kupiki/kupiki_updater.sh" >> /etc/crontab
fi
fi
}
check_previous_execution() {
if [ -d /etc/kupiki ]; then
display_message "A previous installation has been done. It's not recommanded to execute more than once the script."
read -p "Are you sure (Y/N) ?" -n 1 -r
echo
if [[ $REPLY =~ ^[Nn]$ ]]; then
exit 1;
fi
else
display_message "No previous installation of Kupiki. We continue the installation of the hotspot."
fi
}
version_gt() { test "$(printf '%s\n' "$@" | sort -V | head -n 1)" != "$1"; }
check_root
check_previous_execution
get_updater
if valid_ip_address 'NETWORK' $HOTSPOT_NETWORK && valid_ip_address 'IP' $HOTSPOT_IP; then
display_message "Checking HOTSPOT_NETWORK and HOTSPOT_IP parameters : OK"
else
display_message ""
display_message "Incorrect HOTSPOT_NETWORK and HOTSPOT_IP parameters"
display_message "HOTSPOT_NETWORK must be a network format (ex: 192.168.1.0) and HOTSPOT_IP must be an ip format (ex: 192.168.1.10)"
exit 1;
fi
if [[ "$HOTSPOT_IP" != "$WAN_INTERFACE_IP" ]]; then
display_message "Checking that HOTSPOT_IP is not the same than the WAN_INTERFACE : OK"
else
display_message ""
display_message "HOTSPOT_IP is the same than the WAN_INTERFACE. They must be different."
exit 1;
fi
if [[ "$HOTSPOT_NETWORK" != "$WAN_INTERFACE_NETWORK_MASK" ]]; then
display_message "Checking that HOTSPOT_NETWORK is not the same than the WAN_INTERFACE network : OK"
else
display_message ""
display_message "HOTSPOT_NETWORK parameter is the same than the WAN_INTERFACE network. They must be different."
exit 1;
fi
DEBIAN_VERSION=`cat /etc/debian_version`
if version_gt $DEBIAN_MINIMAL_VERSION $DEBIAN_VERSION; then
display_message ""
display_message "This script is used to get installed on Raspbian Lite (9+)"
display_message ""
exit 1
fi
verifyFreeDiskSpace
secure_system
prepare_install
update_package_cache
notify_package_updates_available
install_dependent_packages PIHOTSPOT_DEPS_START[@]
if [[ "$BLUETOOTH_ENABLED" = "N" ]]; then
display_message "Disable integrated Bluetooth support (After next reboot)"
echo "
dtoverlay=pi3-disable-bt-overlay" >> /boot/config.txt
check_returned_code $?
fi
execute_command "dpkg --purge --force-all coova-chilli" true "Remove old configuration of Coova Chilli"
execute_command "dpkg --purge --force-all haserl" true "Remove old configuration of haserl"
execute_command "dpkg --purge --force-all hostapd" true "Remove old configuration of hostapd"
execute_command "/sbin/lsmod | grep tun" false "Checking for tun module"
if [[ $COMMAND_RESULT -ne 0 ]]; then
display_message "Insert tun module if existing (for Raspbian Jessie Lite)"
find /lib/modules/ -iname "tun.ko.gz" -exec /sbin/insmod {} \;
check_returned_code $?
display_message "Modprobe module (no check - useless if already loaded)"
/sbin/modprobe tun
execute_command "/sbin/lsmod | grep tun" false "Checking for tun module"
if [[ $COMMAND_RESULT -ne 0 ]]; then
display_message "Unable to get tun module up. Please solve before running the script again."
display_message "If your distribution has been upgraded you should try to reboot first."
exit 1
fi
fi
execute_command "/sbin/ifconfig -a | grep $LAN_INTERFACE" false "Checking if LAN interface already exists"
if [[ $COMMAND_RESULT -ne 0 ]]; then
display_message "LAN interface not found. Upgrading the system first"
execute_command "apt dist-upgrade -y --allow-remove-essential --allow-change-held-packages" true "Upgrading the distro. Be patient"
install_dependent_packages PIHOTSPOT_DEPS_WIFI[@]
display_message "Please reboot and run the script again"
exit 1
fi
execute_command "echo 'maria-db-$MARIADB_VERSION mysql-server/root_password password $MYSQL_PASSWORD' | debconf-set-selections" true "Adding MariaDb password"
execute_command "echo 'maria-db-$MARIADB_VERSION mysql-server/root_password_again password $MYSQL_PASSWORD' | debconf-set-selections" true "Adding MariaDb password (confirmation)"
display_message "Getting WAN IP of the Raspberry Pi (for daloradius access)"
MY_IP=`ifconfig $WAN_INTERFACE | grep "inet " | awk '{ print $2 }'`
display_message "Updating the system hostname to $HOTSPOT_NAME"
echo $HOTSPOT_NAME > /etc/hostname
check_returned_code $?
if [[ "$AVAHI_INSTALL" = "Y" ]]; then
display_message "Adding Avahi dependencies"
PIHOTSPOT_DEPS+=( avahi-daemon libavahi-client-dev )
execute_command "grep $HOTSPOT_NAME /etc/hosts" false "Updating /etc/hosts"
if [[ $COMMAND_RESULT -ne 0 ]]; then
sed -i "s/raspberrypi/$HOTSPOT_NAME/" /etc/hosts
check_returned_code $?
fi
fi
install_dependent_packages PIHOTSPOT_DEPS[@]
display_message "Correct configuration for Collectd daemon"
sed -i "s/^FQDNLookup true$/FQDNLookup false/g" /etc/collectd/collectd.conf
check_returned_code $?
# type docker 2> /dev/null
# if [ $? -ne 0 ]; then
# display_message "Install Docker"
# curl -fsSL get.docker.com -o get-docker.sh && sh get-docker.sh
# check_returned_code $?
# fi
id -u kupiki > /dev/null
if [ $? -ne 0 ]; then
display_message "Create dedicated user kupiki"
adduser --disabled-password --gecos "" kupiki
check_returned_code $?
fi
grep -q -E "^docker:" /etc/group
if [ $? -ne 0 ]; then
display_message "Create Docker user group"
groupadd -f docker
check_returned_code $?
fi
id kupiki | grep docker > /dev/null
if [ $? -ne 0 ]; then
display_message "Add user kupiki to docker group"
gpasswd -a kupiki docker
check_returned_code $?
fi
display_message "Install pika module"
pip install pika
check_returned_code $?
# type docker-compose 2> /dev/null
# if [ $? -ne 0 ]; then
# display_message "Install docker-compose"
# pip install docker-compose~=1.23.0
# check_returned_code $?
# fi
if [[ "$NETFLOW_ENABLED" = "Y" ]]; then
DEBIAN_FRONTEND=noninteractive apt-get install -y --allow-remove-essential --allow-change-held-packages fprobe nfdump
fi
notify_package_updates_available
download_all_sources
execute_command "service mariadb restart" true "Starting MySql service"
execute_command "grep $WAN_INTERFACE /etc/network/interfaces" false "Update interface configuration ($WAN_INTERFACE)"
if [[ $COMMAND_RESULT -ne 0 ]]; then
cat >> /etc/network/interfaces << EOT
auto $WAN_INTERFACE
allow-hotplug $WAN_INTERFACE
iface $WAN_INTERFACE inet dhcp
EOT
check_returned_code $?
fi
execute_command "grep $LAN_INTERFACE /etc/network/interfaces" false "Update interface configuration ($LAN_INTERFACE)"
if [[ $COMMAND_RESULT -ne 0 ]]; then
cat >> /etc/network/interfaces << EOT
auto $LAN_INTERFACE
allow-hotplug $LAN_INTERFACE
iface $LAN_INTERFACE inet static
address $HOTSPOT_IP
netmask 255.255.255.0
network $HOTSPOT_NETWORK
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
EOT
check_returned_code $?
fi
if [ -e /etc/wpa_supplicant/wpa_supplicant.conf ]; then
execute_command "grep '^country=' /etc/wpa_supplicant/wpa_supplicant.conf" false "Update wifi configuration to add country code"
if [[ $COMMAND_RESULT -ne 0 ]]; then
display_message "Adding country code to wpa_supplicant"
echo "country=$WIFI_COUNTRY_CODE" >> /etc/wpa_supplicant/wpa_supplicant.conf
check_returned_code $?
fi
fi
execute_command "ifup $WAN_INTERFACE" true "Activating the WAN interface"
execute_command "ifup $LAN_INTERFACE" true "Activating the LAN interface"
if [[ "$NETFLOW_ENABLED" = "Y" ]]; then
display_message "Stopping fprobe service"
service fprobe stop
check_returned_code $?
display_message "Stopping nfdump service"
service nfdump stop
check_returned_code $?
display_message "Updating fprobe configuration"
cat > /etc/default/fprobe << EOT
INTERFACE="tun0"
FLOW_COLLECTOR="127.0.0.1:2055"
OTHER_ARGS="-fip"
EOT
check_returned_code $?
display_message "Updating nfdump configuration"
cat > /etc/default/nfdump << EOT
nfcapd_start=yes
EOT
check_returned_code $?
display_message "Updating nfdump service configuration (init.d)"
sed -i 's/^DAEMON_ARGS.*/DAEMON_ARGS="-D -l $DATA_BASE_DIR -P $PIDFILE -z -S 7"/' /etc/init.d/nfdump
check_returned_code $?
display_message "Updating nfdump service configuration (systemd)"
sed -i 's/^ExecStart.*/ExecStart=\/usr\/bin\/nfcapd -D -l \/var\/cache\/nfdump -P \/var\/run\/nfcapd.pid -p 2055 -z -S 7 -e/' /lib/systemd/system/nfdump.service
check_returned_code $?
display_message "Set cleaning options for Netflow data"
/usr/bin/nfexpire -t $NETFLOW_LOGS_DAYS -e /var/cache/nfdump
check_returned_code $?
display_message "Adding logs cleaning every day at 1am (system time)"
execute_command "grep nfexpire /etc/crontab" false "Adding Netflow stats update in the crontab"
if [[ $COMMAND_RESULT -ne 0 ]]; then
echo "00 01 * * * root /usr/bin/nfexpire -r /var/cache/nfdump" >> /etc/crontab
check_returned_code $?
fi
fi
execute_command "service freeradius stop" true "Stopping freeradius service to update the configuration"
display_message "Creating freeradius database"
echo 'drop database if exists radius;' | mariadb -u root -p$MYSQL_PASSWORD
echo "GRANT USAGE ON *.* TO 'radius'@'localhost';" | mariadb -u root -p$MYSQL_PASSWORD
echo "DROP USER 'radius'@'localhost';" | mariadb -u root -p$MYSQL_PASSWORD
echo 'create database radius;' | mariadb -u root -p$MYSQL_PASSWORD
check_returned_code $?
display_message "Installing freeradius schema"
mariadb -u root -p$MYSQL_PASSWORD radius < /etc/freeradius/3.0/mods-config/sql/main/mysql/schema.sql
check_returned_code $?
display_message "Adding setup data"
mariadb -u root -p$MYSQL_PASSWORD radius < /etc/freeradius/3.0/mods-config/sql/main/mysql/setup.sql
check_returned_code $?
display_message "Updating freeradius configuration - Activate SQL support"
ln -sf /etc/freeradius/3.0/mods-available/sql /etc/freeradius/3.0/mods-enabled/sql
check_returned_code $?
chown -h freerad:freerad /etc/freeradius/3.0/mods-enabled/sql
check_returned_code $?
display_message "Configuration of the Freeradius SQL driver"
sed -i 's/"rlm_sql_null"$/"rlm_sql_mysql"/' /etc/freeradius/3.0/mods-enabled/sql
check_returned_code $?
display_message "Change dialect of the Freeradius SQL driver to mysql"
sed -i 's/"sqlite"$/"mysql"/' /etc/freeradius/3.0/mods-enabled/sql
check_returned_code $?
display_message "Configuration of the Freeradius SQL connection"
DIALECT_LINE=`awk 's=index($0,"dialect = ") { print NR }' /etc/freeradius/3.0/mods-enabled/sql`
((DIALECT_LINE+=1))
#by default the radius_db is set to radius
#sed -i "${DIALECT_LINE}iradius_db = \"radius\"" /etc/freeradius/3.0/mods-enabled/sql
sed -i "${DIALECT_LINE}ipassword = \"radpass\"" /etc/freeradius/3.0/mods-enabled/sql
sed -i "${DIALECT_LINE}ilogin = \"radius\"" /etc/freeradius/3.0/mods-enabled/sql
sed -i "${DIALECT_LINE}iport = 3306" /etc/freeradius/3.0/mods-enabled/sql
sed -i "${DIALECT_LINE}iserver = \"localhost\"" /etc/freeradius/3.0/mods-enabled/sql
check_returned_code $?
display_message "Updating freeradius configuration - Activate SQL counters"
ln -sf /etc/freeradius/3.0/mods-available/sqlcounter /etc/freeradius/3.0/mods-enabled/sqlcounter
check_returned_code $?
chown -h freerad:freerad /etc/freeradius/3.0/mods-enabled/sqlcounter
check_returned_code $?
display_message "Bug fix for SQL dialect once SQL Counters are activated"
sed -i 's/dialect = \${modules\.sql\.dialect}/dialect = mysql/g' /etc/freeradius/3.0/mods-available/sqlcounter
check_returned_code $?
display_message "Update of Freeradius secret key"
sed -i "s/testing123/$FREERADIUS_SECRETKEY/g" /etc/freeradius/3.0/clients.conf
check_returned_code $?
display_message "Updating inner-tunnel configuration (1)"
sed -i 's/^[ \t]*-sql/sql/g' /etc/freeradius/3.0/sites-available/inner-tunnel
check_returned_code $?
display_message "Updating inner-tunnel configuration (2)"
sed -i 's/^#[ \t]*sql$/sql/g' /etc/freeradius/3.0/sites-available/inner-tunnel
check_returned_code $?
display_message "Updating freeradius default configuration (1)"
sed -i 's/^[ \t]*-sql/sql/g' /etc/freeradius/3.0/sites-available/default
check_returned_code $?
display_message "Updating freeradius default configuration (2)"
sed -i 's/^#[ \t]*sql$/sql/g' /etc/freeradius/3.0/sites-available/default
check_returned_code $?
display_message "Activating COA support in Freeradius"
rm -f /etc/freeradius/3.0/sites-enabled/coa
echo '
listen {
type = coa
ipaddr = *
port = 1700
virtual_server = coa
}
server coa {
recv-coa {
suffix
ok
}
send-coa {
ok
}
}' > /etc/freeradius/3.0/sites-enabled/coa
check_returned_code $?
chown -R freerad:freerad /etc/freeradius/3.0/sites-enabled/coa
check_returned_code $?
if [[ "$KUPIKI_SQL_COUNTERS" = "Y" ]]; then
execute_command "cp -f /usr/src/sqlcounter /etc/freeradius/3.0/mods-enabled/sqlcounter" true "Adding CoovaChilli counters (limit bandwidth)"
execute_command "chown freerad:freerad /etc/freeradius/3.0/mods-enabled/sqlcounter" true "Updating file access rights"
allCounters=`cat /etc/freeradius/3.0/mods-enabled/sqlcounter | grep "sqlcounter" | cut -d' ' -f2`
positionLine=`grep -m 1 -nr -e "^#.*daily$" /etc/freeradius/3.0/sites-enabled/default | cut -d: -f1`
display_message "Activating counters"
for counterName in $allCounters
do
sed -n -i "p;${positionLine}a ${counterName}" /etc/freeradius/3.0/sites-enabled/default
done
check_returned_code $?
fi
execute_command "freeradius -C" true "Checking freeradius configuration"
display_message "Activating IP forwarding"
sed -i '/^#net\.ipv4\.ip_forward=1$/s/^#//g' /etc/sysctl.conf
check_returned_code $?
execute_command "/etc/init.d/networking restart" true "Restarting network service to take IP forwarding into account"
execute_command "cd /usr/src/coova-chilli && dpkg-buildpackage -us -uc" true "Building CoovaChilli package"
execute_command "cd /usr/src && dpkg --force-depends -i coova-chilli_*_*.deb" true "Installing CoovaChilli package"
display_message "Configuring CoovaChilli up action"
echo 'ipt -I POSTROUTING -t nat -o $HS_WANIF -j MASQUERADE' >> /etc/chilli/up.sh
check_returned_code $?
display_message "Block access from LAN to WAN except portal"
echo '
LOCAL_IP=`ifconfig $HS_WANIF | grep -Eo "inet (addr:)?([0-9]*\.){3}[0-9]*" | grep -Eo "([0-9]*\.){3}[0-9]*" | grep -v "127.0.0.1"`
LOCAL_LAN=`ip -o -f inet addr show | grep $HS_WANIF | awk '\''/scope global/ {print $4}'\''`
ipt -I FORWARD 1 -i $TUNTAP -d $LOCAL_LAN -j DROP
ipt -I INPUT 1 -i $TUNTAP -d $LOCAL_IP -j DROP
' >> /etc/chilli/up.sh
display_message "Activating CoovaChilli"
sed -i 's/START_CHILLI=0/START_CHILLI=1/g' /etc/default/chilli
check_returned_code $?
display_message "Creating CoovaChilli at /etc/chilli/config"
#execute_command "touch /etc/chilli/config" false "Creating CoovaChilli at /etc/chilli/config"
#if [[ $COMMAND_RESULT -ne 0 ]]; then
cat <<EOF > /etc/chilli/config
HS_LANIF=$LAN_INTERFACE
HS_WANIF=$WAN_INTERFACE
HS_NETWORK=$HOTSPOT_NETWORK
HS_NETMASK=255.255.255.0
HS_UAMLISTEN=$HOTSPOT_IP
HS_NASID="KUPIKI"
HS_RADIUS=localhost
HS_RADIUS2=localhost
HS_RADSECRET=$FREERADIUS_SECRETKEY
HS_UAMSECRET=
HS_UAMALLOW=$HOTSPOT_NETWORK/24
HS_UAMFORMAT=$HOTSPOT_PROTOCOL$HOTSPOT_IP:$HOTSPOT_PORT
HS_UAMHOMEPAGE=$HS_UAMFORMAT
HS_MODE=hotspot
HS_TYPE=chillispot
HS_LOC_NAME=$HOTSPOT_NAME
HS_LAN_ACCESS=off
HS_SSID=$HOTSPOT_NAME
HS_TCP_PORTS="5000 80"
HS_COAPORT=3799
HS_MACAUTH=off
HS_MACPASSWD=
HS_UAMDOMAINS=
EOF
#fi
check_returned_code $?
if [[ "$MAC_AUTHENTICATION_ENABLED" = "Y" ]]; then
display_message "Configure MAC address authentication (1/2)"
sed -i '/^[ \t]*HS_MACAUTH=/{h;s/=.*/=on/};${x;/^$/{s//HS_MACAUTH=on/;H};x}' /etc/chilli/config
check_returned_code $?
display_message "Configure MAC address authentication (2/2)"
sed -i '/^[ \t]*HS_MACPASSWD=/{h;s/=.*/=\"$MAC_AUTHENTICATION_PASSWORD\"/};${x;/^$/{s//HS_MACPASSWD=\"$MAC_AUTHENTICATION_PASSWORD\"/;H};x}' /etc/chilli/config
check_returned_code $?
fi
execute_command "update-rc.d chilli start 99 2 3 4 5 . stop 20 0 1 6 ." true "Activating CoovaChilli on boot"
if [[ "$HASERL_INSTALL" = "Y" ]]; then
execute_command "cd /usr/src && tar zxvf ${HASERL_ARCHIVE}.tar.gz" true "Uncompressing Haserl archive"
execute_command "cd /usr/src/$HASERL_ARCHIVE && ./configure && make && make install" true "Compiling and installing Haserl"
display_message "Updating chilli configuration"
sed -i '/haserl=/s/^haserl=.*$/haserl=\/usr\/local\/bin\/haserl/g' /etc/chilli/wwwsh
check_returned_code $?
fi
display_message "Creating configuration file for hostapd"
echo 'DAEMON_CONF="/etc/hostapd/hostapd.conf"' >> /etc/default/hostapd
check_returned_code $?
display_message "Configuring hostapd"
echo "interface=$LAN_INTERFACE
driver=$LAN_WIFI_DRIVER
ssid=$HOTSPOT_NAME
hw_mode=g
channel=6
auth_algs=1
beacon_int=100
dtim_period=2
max_num_sta=255
rts_threshold=2347
fragm_threshold=2346" > /etc/hostapd/hostapd.conf
check_returned_code $?
if [[ "$DALORADIUS_INSTALL" = "Y" ]]; then
execute_command "cp -Rf /usr/src/daloradius /usr/share/nginx/html/" true "Installing Daloradius in Nginx folder"
display_message "Loading daloradius configuration into MySql"
mariadb -u root -p$MYSQL_PASSWORD radius < /usr/share/nginx/html/daloradius/contrib/db/fr2-mysql-daloradius-and-freeradius.sql
check_returned_code $?
display_message "Drop freeradius tables created by Daloradius to reload the Freeradius 3.0 version"
echo 'drop table if exists radius.radacct, radius.radcheck, radius.radgroupcheck, radius.radgroupreply, radius.radreply, radius.radusergroup, radius.radpostauth, radius.nas ;' | mariadb -u root -p$MYSQL_PASSWORD
check_returned_code $?
display_message "Reload original Freeradius schema"
mariadb -u root -p$MYSQL_PASSWORD radius < /etc/freeradius/3.0/mods-config/sql/main/mysql/schema.sql
check_returned_code $?
display_message "Creating users privileges for localhost"
echo "GRANT ALL ON radius.* to 'radius'@'localhost';" > /tmp/grant.sql
check_returned_code $?
display_message "Granting users privileges"
mysql -u root -p$MYSQL_PASSWORD < /tmp/grant.sql
check_returned_code $?
display_message "Configuring daloradius DB user name"
sed -i "s/\$configValues\['CONFIG_DB_USER'\] = 'root';/\$configValues\['CONFIG_DB_USER'\] = 'radius';/g" /usr/share/nginx/html/daloradius/library/daloradius.conf.php
check_returned_code $?
display_message "Configuring daloradius DB user password"
sed -i "s/\$configValues\['CONFIG_DB_PASS'\] = '';/\$configValues\['CONFIG_DB_PASS'\] = 'radpass';/g" /usr/share/nginx/html/daloradius/library/daloradius.conf.php
check_returned_code $?
display_message "Configuring daloradius DB proxy configuration file"
sed -i "s/\$configValues\['CONFIG_FILE_RADIUS_PROXY'\] = '\/etc\/freeradius\/proxy.conf';/\$configValues\['CONFIG_FILE_RADIUS_PROXY'\] = '\/etc\/freeradius\/3.0\/proxy.conf';/g" /usr/share/nginx/html/daloradius/library/daloradius.conf.php
check_returned_code $?
display_message "Configuring daloradius DB proxy path"
sed -i "s/\$configValues\['CONFIG_PATH_DALO_VARIABLE_DATA'\] = '\/var\/www\/daloradius\/var';/\$configValues\['CONFIG_PATH_DALO_VARIABLE_DATA'\] = '\/usr\/share\/ngin\/html\/daloradius\/var';/g" /usr/share/nginx/html/daloradius/library/daloradius.conf.php
check_returned_code $?
display_message "Building NGINX configuration (default listen port : 80)"
echo '
server {
listen 80 default_server;
listen [::]:80 default_server;
root /usr/share/nginx/html/daloradius;
index index.html index.htm index.php;
server_name _;
location / {
try_files $uri $uri/ =404;
}
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
}
}' > /etc/nginx/sites-available/default
check_returned_code $?
fi
display_message "Building NGINX configuration for the portal (default listen port : $HOTSPOT_PORT)"
if [[ "$HOTSPOT_HTTPS" = "Y" ]]; then
display_message "Creating folder for Nginx certificates"
mkdir /etc/nginx/certs/
check_returned_code $?
display_message "Generating self-signed certificate"
openssl req -x509 -nodes -days $CERT_DAYS -newkey rsa:2048 -keyout /etc/nginx/certs/$HOTSPOT_NAME.key -out /etc/nginx/certs/$HOTSPOT_NAME.crt -subj '/CN=$HOTSPOT_NAME'
check_returned_code $?
echo "
server {
listen $HOTSPOT_IP:$HOTSPOT_PORT ssl default_server;
ssl_certificate /etc/nginx/certs/$HOTSPOT_NAME.crt;
ssl_certificate_key /etc/nginx/certs/$HOTSPOT_NAME.key;
root /usr/share/nginx/portal;
index index.html;
server_name _;
location / {
try_files \$uri \$uri/ =404;
}
location ~ \.php\$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
}
}" > /etc/nginx/sites-available/portal
display_message "Update Chilli configuration to allow HTTPS in iptables"
sed -e 's/^HS_TCP_PORTS.*/HS_TCP_PORTS="5000 80 443"/' /etc/chilli/config > /tmp/config && cp /tmp/config /etc/chilli/config
check_returned_code $?
else
echo "
server {
listen $HOTSPOT_IP:$HOTSPOT_PORT default_server;
root /usr/share/nginx/portal;