Compare commits

..

11 Commits
2023 ... master

Author SHA1 Message Date
Petko Bordjukov c489e4b0af Delete no longer needed Dockerfile 2024-09-19 21:47:55 +03:00
Petko Bordjukov f460163e31 Update for 2024 2024-09-19 01:38:27 +03:00
Petko Bordjukov ef328fec34 Correct radius accounting settings 2023-10-29 18:23:20 +02:00
Petko Bordjukov 2499feba6a update syslog target 2023-10-29 16:05:21 +02:00
Petko Bordjukov 9327d6804c Update secure the BSSIDs of the secure SSIDs 2023-10-29 13:31:03 +02:00
Petko Bordjukov 575dede9f6 Update usteer config 2023-10-29 13:16:36 +02:00
Petko Bordjukov fcaad99372 Add Radius auth and secure SSIDs 2023-10-29 13:04:30 +02:00
Petko Bordjukov 7d60b8f7b9 provisioning root passwords and host ssh keys 2023-10-29 12:44:21 +02:00
Petko Bordjukov 44faf38625 cmk plugin 2023-10-28 19:47:44 +03:00
Petko Bordjukov f1d22db38e Add monitoring 2023-10-28 19:44:09 +03:00
Petko Bordjukov 9f92732214
Prepare configuration for 2023 (#1) 2023-10-23 18:34:28 +03:00
27 changed files with 1727 additions and 123 deletions

2
.gitignore vendored
View File

@ -1,2 +1,4 @@
/tmp/ /tmp/
/bin/ /bin/
specific_config/**/dropbear_*_host_key
generic_config/**/etc/shadow

View File

@ -1,17 +0,0 @@
FROM debian:testing-slim
ARG IB_URL=https://downloads.openwrt.org/releases/23.05.0/targets/ath79/generic/openwrt-imagebuilder-23.05.0-ath79-generic.Linux-x86_64.tar.xz
#ARG IB_URL=https://downloads.openwrt.org/snapshots/targets/ath79/generic/openwrt-imagebuilder-ath79-generic.Linux-x86_64.tar.xz
RUN apt-get update && apt-get -q -y -o Dpkg::Use-Pty=0 install build-essential \
libncurses-dev libncurses-dev zlib1g-dev gawk git gettext \
libssl-dev xsltproc rsync wget unzip python3 python3-distutils file && \
apt-get clean autoclean && \
apt-get autoremove --yes && \
rm -rf /var/lib/{apt,dpkg,cache,log}/
WORKDIR /ib
RUN wget -q -c ${IB_URL} -O - | tar -xJv --strip-components=1
CMD bash

View File

@ -1,37 +1,45 @@
#!/bin/bash #!/bin/bash
VERSION="23.05.0" VERSION="23.05.4"
podman build \ mkdir -p "tmp/dl"
--build-arg=IB_URL="https://downloads.openwrt.org/releases/${VERSION}/targets/ath79/generic/openwrt-imagebuilder-${VERSION}-ath79-generic.Linux-x86_64.tar.xz" \ mkdir -p "bin"
-t "openfest-openwrt-ath79:${VERSION}" .
for config_file in specific_config/ath79/dlink_dap-2695-a1/*.conf podman run \
--rm \
-ti \
-v "$(pwd)/bin:/out" \
-v "$(pwd)/tmp/dl:/builder/dl" \
-u root \
"ghcr.io/openwrt/imagebuilder:ath79-generic-$VERSION" \
bash -c 'chown -R buildbot:buildbot /out /builder/dl'
for ap_dir in specific_config/ath79/dlink_dap-2695-a1/*
do do
customization_name="$(basename -s.conf ${config_file})" customization_name="$(basename ${ap_dir})"
tmpdir="tmp/${customization_name}" tmpdir="tmp/${customization_name}"
mkdir -p "${tmpdir}" mkdir -p "${tmpdir}"
mkdir -p "tmp/dl"
mkdir -p "bin" cp -rvp generic_config/ath79/dlink_dap-2695-a1/* "${tmpdir}/"
cp -rp generic_config/ath79/dlink_dap-2695-a1/* "${tmpdir}/" cp -rvp "${ap_dir}"/* "${tmpdir}/"
mkdir -p "${tmpdir}/etc/uci-defaults"
cp "${config_file}" "${tmpdir}/etc/uci-defaults/99-$(basename ${config_file})"
podman run \ podman run \
--rm \ --rm \
-ti \ -ti \
-v "$(pwd)/bin:/out:z" \ -v "$(pwd)/bin:/out:z" \
-v "$(pwd)/${tmpdir}:/files:z" \ -v "$(pwd)/${tmpdir}:/files:z" \
-v "$(pwd)/tmp/dl:/ib/dl:z" \ -v "$(pwd)/tmp/dl:/builder/dl:z" \
"openfest-openwrt-ath79:${VERSION}" \ "ghcr.io/openwrt/imagebuilder:ath79-generic-${VERSION}" \
bash -c "\
chown -R buildbot:buildbot /out /builder/dl &&
make image PROFILE=dlink_dap-2695-a1 \ make image PROFILE=dlink_dap-2695-a1 \
PACKAGES='kmod-ath10k -kmod-ath10k-ct -ath10k-firmware-qca988x-ct ath10k-firmware-qca988x -wpad-basic-mbedtls wpad-wolfssl usteer tcpdump-mini mtr iperf3 ethtool bwm-ng luci ebtables ip-bridge socat' \ PACKAGES='kmod-ath10k -kmod-ath10k-ct -ath10k-firmware-qca988x-ct ath10k-firmware-qca988x -wpad-basic-mbedtls wpad-wolfssl usteer tcpdump-mini mtr iperf3 ethtool bwm-ng luci ebtables ip-bridge socat' \
DISABLED_SERVICES='dnsmasq odhcpd firewall' \ DISABLED_SERVICES='dnsmasq odhcpd firewall' \
BIN_DIR=/out \ BIN_DIR=/out \
FILES=/files \ FILES=/files \
EXTRA_IMAGE_NAME="${customization_name}"\ EXTRA_IMAGE_NAME=\"${customization_name}\"\
V=sc V=sc"
done done
rm -rf "tmp" rm -rf "tmp"

View File

@ -0,0 +1,4 @@
config socat 'check_mk_agent'
option enable '1'
option SocatOptions '-U TCP-LISTEN:6556,fork,reuseaddr EXEC:/usr/bin/check_mk_agent'
option user 'root'

View File

@ -5,7 +5,7 @@ config system
option urandom_seed '0' option urandom_seed '0'
option compat_version '1.0' option compat_version '1.0'
option zonename 'UTC' option zonename 'UTC'
option log_ip '10.20.0.1' option log_ip '10.20.0.253'
option log_proto 'udp' option log_proto 'udp'
option conloglevel '8' option conloglevel '8'
option cronloglevel '5' option cronloglevel '5'

View File

@ -149,4 +149,5 @@ config usteer
#list event_log_types '' #list event_log_types ''
# List of SSIDs to enable steering on # List of SSIDs to enable steering on
list ssid_list 'OpenFest2023' list ssid_list 'OpenFest'
list ssid_list 'OpenFest Secure'

View File

@ -28,12 +28,11 @@ config wifi-iface 'wifinet0'
option device 'radio0' option device 'radio0'
option mode 'ap' option mode 'ap'
option network 'wifi' option network 'wifi'
option macaddr '02:0f:20:23:00:00' option macaddr '02:0f:20:24:00:00'
# Security # Security
option ssid 'OpenFest2023' option ssid 'OpenFest'
option encryption 'sae-mixed' option encryption 'none'
option key 'OpenFest2023'
option ieee80211w '2' # Protected management frames option ieee80211w '2' # Protected management frames
option ocv '1' # Operating channel validation option ocv '1' # Operating channel validation
option isolate '1' # Client isolation option isolate '1' # Client isolation
@ -66,12 +65,97 @@ config wifi-iface 'wifinet1'
option device 'radio1' option device 'radio1'
option mode 'ap' option mode 'ap'
option network 'wifi' option network 'wifi'
option macaddr '02:0f:20:23:00:01' option macaddr '02:0f:20:24:00:01'
# Security # Security
option ssid 'OpenFest2023' option ssid 'OpenFest'
option encryption 'sae-mixed' option encryption 'none'
option key 'OpenFest2023' option ieee80211w '2' # Protected management frames
option ocv '1' # Operating channel validation
option isolate '1' # Client isolation
option airtime_bss_weight '1' # Airtime fairness BSS weight
# Fast roaming
option ieee80211r '1'
option ft_over_ds '0' # Use Fast Transition over the air
option auth_cache '1'
option rsn_preauth '1'
option ft_psk_generate_local '1'
# Radio measurement, client steering
option ieee80211k '1'
option rrm_neighbor_report '1'
option rrm_beacon_report '1'
option stationary_ap '1'
option bss_transition '1'
option mbo '1'
option time_advertisement '2'
option time_zone 'GMT0'
# STA Power management
option wnm_sleep_mode '0'
option wnm_sleep_mode_no_keys '1'
option uapsd '0' # Work-around for bugs in power management
config wifi-iface 'wifinet2'
option device 'radio0'
option mode 'ap'
option network 'wifi'
option macaddr '02:0f:20:24:00:02'
# Security
option ssid 'OpenFest Secure'
option encryption 'wpa3-mixed'
option auth_server '10.20.0.2'
option auth_port '1812'
option auth_secret 'radius_secret'
option acct_server '10.20.0.2'
option acct_port '1813'
option acct_secret 'radius_secret'
option ieee80211w '2' # Protected management frames
option ocv '1' # Operating channel validation
option isolate '1' # Client isolation
option airtime_bss_weight '1' # Airtime fairness BSS weight
# Fast roaming
option ieee80211r '1'
option ft_over_ds '0' # Use Fast Transition over the air
option auth_cache '1'
option rsn_preauth '1'
option ft_psk_generate_local '1'
# Radio measurement, client steering
option ieee80211k '1'
option rrm_neighbor_report '1'
option rrm_beacon_report '1'
option stationary_ap '1'
option bss_transition '1'
option mbo '1'
option time_advertisement '2'
option time_zone 'GMT0'
# STA Power management
option wnm_sleep_mode '0'
option wnm_sleep_mode_no_keys '1'
option uapsd '0' # Work-around for bugs in power management
config wifi-iface 'wifinet3'
option device 'radio1'
option mode 'ap'
option network 'wifi'
option macaddr '02:0f:20:24:00:03'
# Security
option ssid 'OpenFest Secure'
option encryption 'wpa3-mixed'
option auth_server '10.20.0.2'
option auth_port '1812'
option auth_secret 'radius_secret'
option acct_server '10.20.0.2'
option acct_port '1813'
option acct_secret 'radius_secret'
option ieee80211w '2' # Protected management frames option ieee80211w '2' # Protected management frames
option ocv '1' # Operating channel validation option ocv '1' # Operating channel validation
option isolate '1' # Client isolation option isolate '1' # Client isolation

File diff suppressed because it is too large Load Diff

View File

@ -0,0 +1,39 @@
#!/bin/sh
CACHE_FILE=/tmp/cmk_wifi_interfaces.cache
echo "<<<wifi_interfaces:sep(59)>>>" # 59 = ascii semi-colon (;)
interfaces=$(ls /sys/class/net | grep -iE 'phy.+')
# Create empty file if it does not exist
# First plugin run may produce garbage data or not run at all, which is OK
# Cache file format: $interface,$time,$busy
touch $CACHE_FILE
cached_output="$(cat "$CACHE_FILE")"
echo -n "" > "$CACHE_FILE"
for interface in $interfaces
do
ch_time_old="$(echo "$cached_output" | awk -v interface="$interface" -F';' '$1 ~ interface { print $2 }')"
ch_time_busy_old="$(echo "$cached_output" | awk -v interface="$interface" -F';' '$1 ~ interface { print $3 }')"
output="$(ethtool -S "$interface")"
ch_time="$(echo "$output" | awk -F ': ' '/ch_time:/{ print $2 }')"
ch_time_busy="$(echo "$output" | awk -F ': ' '/ch_time_busy:/{ print $2 }')"
echo "$interface;$ch_time;$ch_time_busy" >> "$CACHE_FILE"
# The noise is represented as an unsigned byte, we need a signed one. Thus, we subtract 2**7.
noise="$(expr $(echo "$output" | awk -F ': ' '/noise:/{ print $2 }') - 256)"
phy="$(echo "$interface" | awk -F '-' '//{print $1 }')"
client_count="$(ls /sys/kernel/debug/ieee80211/$phy/netdev:$interface/stations/ | wc -l)"
# We calculate the deltas to use for alarms locally; fields are u64
delta_ch_time=$(expr $(expr $ch_time - $ch_time_old) % 18446744073709551616)
delta_ch_time_busy=$(expr $(expr $ch_time_busy - $ch_time_busy_old) % 18446744073709551616)
echo "$interface;$ch_time;$ch_time_busy;$noise;$delta_ch_time;$delta_ch_time_busy;$client_count"
done

View File

@ -1,9 +0,0 @@
uci batch << EOI
set system.@system[0].hostname='ap-fl'
set network.mgmt.ipaddr='10.20.0.50'
set wireless.radio0.channel='52'
set wireless.radio1.channel='4'
set wireless.wifinet0.macaddr='02:0f:20:23:50:00'
set wireless.wifinet1.macaddr='02:0f:20:23:50:01'
EOI
uci commit

View File

@ -0,0 +1,13 @@
uci batch << EOI
set system.@system[0].hostname='ap-fl'
set network.mgmt.ipaddr='10.20.0.50'
set wireless.radio0.channel='52'
set wireless.radio1.channel='4'
set wireless.wifinet0.macaddr='02:0f:20:24:50:00'
set wireless.wifinet1.macaddr='02:0f:20:24:50:01'
set wireless.wifinet2.macaddr='02:0f:20:24:50:02'
set wireless.wifinet2.nasid='ap-fl-5g'
set wireless.wifinet3.macaddr='02:0f:20:24:50:03'
set wireless.wifinet3.nasid='ap-fl-2g'
EOI
uci commit

View File

@ -1,9 +0,0 @@
uci batch << EOI
set system.@system[0].hostname='ap-fr'
set network.mgmt.ipaddr='10.20.0.51'
set wireless.radio0.channel='100'
set wireless.radio1.channel='7'
set wireless.wifinet0.macaddr='02:0f:20:23:51:00'
set wireless.wifinet1.macaddr='02:0f:20:23:51:01'
EOI
uci commit

View File

@ -0,0 +1,13 @@
uci batch << EOI
set system.@system[0].hostname='ap-fr'
set network.mgmt.ipaddr='10.20.0.51'
set wireless.radio0.channel='100'
set wireless.radio1.channel='7'
set wireless.wifinet0.macaddr='02:0f:20:24:51:00'
set wireless.wifinet1.macaddr='02:0f:20:24:51:01'
set wireless.wifinet2.macaddr='02:0f:20:24:51:02'
set wireless.wifinet2.nasid='ap-fr-5g'
set wireless.wifinet3.macaddr='02:0f:20:24:51:03'
set wireless.wifinet3.nasid='ap-fr-2g'
EOI
uci commit

View File

@ -1,9 +0,0 @@
uci batch << EOI
set system.@system[0].hostname='ap-team'
set network.mgmt.ipaddr='10.20.0.56'
set wireless.radio0.channel='52'
set wireless.radio1.channel='4'
set wireless.wifinet0.macaddr='02:0f:20:23:56:00'
set wireless.wifinet1.macaddr='02:0f:20:23:56:01'
EOI
uci commit

View File

@ -0,0 +1,13 @@
uci batch << EOI
set system.@system[0].hostname='ap-team'
set network.mgmt.ipaddr='10.20.0.56'
set wireless.radio0.channel='52'
set wireless.radio1.channel='4'
set wireless.wifinet0.macaddr='02:0f:20:24:56:00'
set wireless.wifinet1.macaddr='02:0f:20:24:56:01'
set wireless.wifinet2.macaddr='02:0f:20:24:56:02'
set wireless.wifinet2.nasid='ap-team-5g'
set wireless.wifinet3.macaddr='02:0f:20:24:56:03'
set wireless.wifinet3.nasid='ap-team-2g'
EOI
uci commit

View File

@ -1,9 +0,0 @@
uci batch << EOI
set system.@system[0].hostname='ap-voc-a1'
set network.mgmt.ipaddr='10.20.0.52'
set wireless.radio0.channel='36'
set wireless.radio1.channel='1'
set wireless.wifinet0.macaddr='02:0f:20:23:52:00'
set wireless.wifinet1.macaddr='02:0f:20:23:52:01'
EOI
uci commit

View File

@ -0,0 +1,13 @@
uci batch << EOI
set system.@system[0].hostname='ap-voc-a1'
set network.mgmt.ipaddr='10.20.0.52'
set wireless.radio0.channel='36'
set wireless.radio1.channel='1'
set wireless.wifinet0.macaddr='02:0f:20:24:52:00'
set wireless.wifinet1.macaddr='02:0f:20:24:52:01'
set wireless.wifinet2.macaddr='02:0f:20:24:52:02'
set wireless.wifinet2.nasid='ap-voc-a1-5g'
set wireless.wifinet3.macaddr='02:0f:20:24:52:03'
set wireless.wifinet3.nasid='ap-voc-a1-2g'
EOI
uci commit

View File

@ -1,9 +0,0 @@
uci batch << EOI
set system.@system[0].hostname='ap-voc-a2'
set network.mgmt.ipaddr='10.20.0.53'
set wireless.radio0.channel='132'
set wireless.radio1.channel='13'
set wireless.wifinet0.macaddr='02:0f:20:23:53:00'
set wireless.wifinet1.macaddr='02:0f:20:23:53:01'
EOI
uci commit

View File

@ -0,0 +1,13 @@
uci batch << EOI
set system.@system[0].hostname='ap-voc-a2'
set network.mgmt.ipaddr='10.20.0.53'
set wireless.radio0.channel='132'
set wireless.radio1.channel='13'
set wireless.wifinet0.macaddr='02:0f:20:24:53:00'
set wireless.wifinet1.macaddr='02:0f:20:24:53:01'
set wireless.wifinet2.macaddr='02:0f:20:24:53:02'
set wireless.wifinet2.nasid='ap-voc-a2-5g'
set wireless.wifinet3.macaddr='02:0f:20:24:53:03'
set wireless.wifinet3.nasid='ap-voc-a2-2g'
EOI
uci commit

View File

@ -1,9 +0,0 @@
uci batch << EOI
set system.@system[0].hostname='ap-voc-b'
set network.mgmt.ipaddr='10.20.0.54'
set wireless.radio0.channel='100'
set wireless.radio1.channel='7'
set wireless.wifinet0.macaddr='02:0f:20:23:54:00'
set wireless.wifinet1.macaddr='02:0f:20:23:54:01'
EOI
uci commit

View File

@ -0,0 +1,13 @@
uci batch << EOI
set system.@system[0].hostname='ap-voc-b'
set network.mgmt.ipaddr='10.20.0.54'
set wireless.radio0.channel='100'
set wireless.radio1.channel='7'
set wireless.wifinet0.macaddr='02:0f:20:24:54:00'
set wireless.wifinet1.macaddr='02:0f:20:24:54:01'
set wireless.wifinet2.macaddr='02:0f:20:24:54:02'
set wireless.wifinet2.nasid='ap-voc-b-5g'
set wireless.wifinet3.macaddr='02:0f:20:24:54:03'
set wireless.wifinet3.nasid='ap-voc-b-2g'
EOI
uci commit

View File

@ -1,9 +0,0 @@
uci batch << EOI
set system.@system[0].hostname='ap-ws-c'
set network.mgmt.ipaddr='10.20.0.55'
set wireless.radio0.channel='116'
set wireless.radio1.channel='10'
set wireless.wifinet0.macaddr='02:0f:20:23:55:00'
set wireless.wifinet1.macaddr='02:0f:20:23:55:01'
EOI
uci commit

View File

@ -0,0 +1,13 @@
uci batch << EOI
set system.@system[0].hostname='ap-ws-c'
set network.mgmt.ipaddr='10.20.0.55'
set wireless.radio0.channel='116'
set wireless.radio1.channel='10'
set wireless.wifinet0.macaddr='02:0f:20:24:55:00'
set wireless.wifinet1.macaddr='02:0f:20:24:55:01'
set wireless.wifinet2.macaddr='02:0f:20:24:55:02'
set wireless.wifinet2.nasid='ap-ws-c-5g'
set wireless.wifinet3.macaddr='02:0f:20:24:55:03'
set wireless.wifinet3.nasid='ap-ws-c-2g'
EOI
uci commit

View File

@ -1,9 +0,0 @@
uci batch << EOI
set system.@system[0].hostname='ap-ws-l'
set network.mgmt.ipaddr='10.20.0.57'
set wireless.radio0.channel='36'
set wireless.radio1.channel='1'
set wireless.wifinet0.macaddr='02:0f:20:23:57:00'
set wireless.wifinet1.macaddr='02:0f:20:23:57:01'
EOI
uci commit

View File

@ -0,0 +1,13 @@
uci batch << EOI
set system.@system[0].hostname='ap-ws-l'
set network.mgmt.ipaddr='10.20.0.57'
set wireless.radio0.channel='36'
set wireless.radio1.channel='1'
set wireless.wifinet0.macaddr='02:0f:20:24:57:00'
set wireless.wifinet1.macaddr='02:0f:20:24:57:01'
set wireless.wifinet2.macaddr='02:0f:20:24:57:02'
set wireless.wifinet2.nasid='ap-ws-l-5g'
set wireless.wifinet3.macaddr='02:0f:20:24:57:03'
set wireless.wifinet3.nasid='ap-ws-l-2g'
EOI
uci commit

View File

@ -1,9 +0,0 @@
uci batch << EOI
set system.@system[0].hostname='ap-ws-r'
set network.mgmt.ipaddr='10.20.0.58'
set wireless.radio0.channel='116'
set wireless.radio1.channel='10'
set wireless.wifinet0.macaddr='02:0f:20:23:58:00'
set wireless.wifinet1.macaddr='02:0f:20:23:58:01'
EOI
uci commit

View File

@ -0,0 +1,13 @@
uci batch << EOI
set system.@system[0].hostname='ap-ws-r'
set network.mgmt.ipaddr='10.20.0.58'
set wireless.radio0.channel='116'
set wireless.radio1.channel='10'
set wireless.wifinet0.macaddr='02:0f:20:24:58:00'
set wireless.wifinet1.macaddr='02:0f:20:24:58:01'
set wireless.wifinet2.macaddr='02:0f:20:24:58:02'
set wireless.wifinet2.nasid='ap-ws-r-5g'
set wireless.wifinet3.macaddr='02:0f:20:24:58:03'
set wireless.wifinet3.nasid='ap-ws-r-2g'
EOI
uci commit