Subsections

1.3 Configuration OPT_C3SURF

OPT_C3SURF

Default Setting: OPT_C3SURF='no'

Activate or deactivate the package.

C3SURF_LOG_PATH

Default Setting: C3SURF_LOG_PATH='/var/log/c3surf'

Defines the directory for C3SURF's log files. On router shutdown the log files should be saved to a persistent medium or the path can be set here, if you want to keep the files. The path must exist on the permanent medium.


Important: 'c3surf_mac.blacklist' resides in the persistent directory
C3SURF_PERSISTENT_PATH. An own blacklist has to be copied there. The scope of the protocol is defined below.


C3SURF_DOLOG_LOGIN

Default Setting: C3SURF_DOLOG_LOGIN='yes'

Logging of Login/Logout: c3surf_login.log (default: 'yes')

C3SURF_DOLOG_INVALID

Default Setting: C3SURF_DOLOG_INVALID='yes'

Logging of invalid logins: c3surf_invalid.log (default: 'yes'). If OPT_LOGINUSR is set to 'yes', invalid logins can not be logged.

C3SURF_DOLOG_PAGE

Default Setting: C3SURF_DOLOG_PAGE='no'

Logging of accesses to the html page: c3surf_page.log (default: 'no'). Each access to the login page will be logged. The page log grows fast and thus is only recommended for the ``curious''.

C3SURF_DOLOG_HTTPD

Default Setting: C3SURF_DOLOG_HTTPD='no'

Logging of all accesses to mini_httpd: c3surf_httpd.log (default: 'no').


Important: In addition start the log function of the Mini-httpd (use only for tests or debugging). When turned on, it is advisable to regularly check the log and delete it, it quickly gets quite large.

opt_cpmvrmlog: http://extern.fli4l.de/fli4l_opt-db3/search.pl?pid=427 may be used for regular saving. The mini_httpd has to be restarted afterwards for correct logging. The script /usr/local/bin/c3surf_kill_httpd.sh (Config example in appendix) exists for this purpose.

C3SURF_PERSISTENT_PATH

Adapt in any case, recommendation: '/var/lib/persistent/c3surf'

Defines the directory for files that should be preserved after a reboot or poweroff. Ideally, this points to a hard disk or CF card ('/var/lib/persistent/c3surf'). A directory in the RAM disk may be selected as well (eg in order to minimize access to the medium). In this case the directory should be copied to the disk from time to time (eg by opt_cpmvrmlog) because the data would be lost after a reboot, crash or power loss.


What is saved here:


MAC blacklists:

'c3surf_mac.blacklist', will be created when needed (see Admin Interface). Blocking of a MAC address is solved via an own file and not with the packet filter, because large amounts of entries may cause problemes there. Don't forget: blocked MAC addresses keep average users away from your net, which is enough for normal usecases, but not professionals. The MAC blacklist only prevents the login via C3SURF / loginusr, there are no direct blocks in the firewall.


User data:

<userloginname>.data (i.e. 'frank.data'), these files contain data on the user such as first and lastname, E-mail address, statistics and quotas. Persistant user data allows to avoid recreating user data files on every startup. This means: if for user ``frank'' a file 'frank.data' exist on system start the settings in the config file will be ignored.

Overwriting of user data may be forced by LOGINUSR_ACCOUNT_x_OVERWRITE='yes'. By LOGINUSR_DELETE_PERSISTENT_DATA='yes', all ``*.data'' files will be deleted on reboot.

C3SURF_WORKON_TMP

Default Setting: C3SURF_WORKON_TMP='no'

If C3SURF_PERSISTENT_PATH is set, you may specify 'yes' here. On system start persistent data will then be copied from the harddisk to the directory C3SURF_TMP_PATH and only be accessed there. Accesses to the harddisk by C3SURF only will occur if the admin writes data to persistent files.


Important: Persistant data is:

For FLASH memory specify 'no' here, because in normal use C3SURF will only read files. Write accesses are only caused by the admin.

C3SURF_QUOTA

Default Setting: C3SURF_QUOTA='no'

If the access should be limited, enter 'yes' here. Access is blocked for an IP address for C3SURF_BLOCKTIME minutes after reaching time limit or the maximum registration counter. Default value is 'yes'.


Important: Individual -TIME, -BLOCKTIME and -COUNTER for LOGIN_USR accounts are activated ('yes') or deactivated ('no') by this variable.

C3SURF_COUNTER

Default Setting: C3SURF_COUNTER='0'

Specifies the number of possible interruptions within the surftime.


Important: A multitude of interruptions for (Logout/Login) may be defined. If i.e. '1' is specified here the user may logout and login once within the surftime which corresponds to two registrations in this time. On the following registration the user gets the time difference left from C3SURF_TIME.

If in addition C3SURF_BLOCKTIME='0' is set the C3SURF_COUNTER will be reset at 0:00 o'clock the following day.

Notes to the long-term contingent (C3SURF_COUNTER='-2'):
Hence you may combine i.e. 10 hours of online time C3SURFTIME(C3SURF_TIME='600') with a blocking time of a week (C3SURF_BLOCKTIME='10080' : 60sec x 24h x 7days). This way the 10 hours may be used during one week. Those using all the time on the first day in one piece will have to wait for the rest of the week. After the blocking time 10 hours will be provided anew. Short: The user may use ten hours in one week, which he may spread in a meaningful manner over this timespan.

If the quota is not used within a week, no ``Quota-Block'' will occur. Then there is no waiting time. If the quota is used on the first day then the account is blocked for the remaining 6 days of the week. Applies also to LOGINUSR_ACCOUNT_x_COUNTER.

Recommendation: C3SURF_SAVE_QUOTA='yes', to retain the values also after a normal reboot. On a power failure the values will be lost.

If C3SURF_QUOTA='yes', after reaching the counter a block corresponding to C3SURF_BLOCKTIME is activated.

C3SURF_TIME

Default Setting: C3SURF_TIME='60'

Number of minutes that an activation is valid.

The value '0' means an unlimited login (also applies for LOGINUSR_ACCOUNT_x_TIME).

Special case:

C3SURF_BLOCKTIME

Default Setting: C3SURF_BLOCKTIME='240'

Number of minutes an IP gets blocked if surftime was exceeded or the Admin performs a block via the Web interface. By this a computer may be blocked from the net for this time and thus usage is restricted. C3SURF_QUOTA='yes' has to be set in order to perform the block.

Special cases:


Important: Unblocking is performed with an accuracy of one minute.

C3SURF_SAVE_QUOTA

Default Setting: C3SURF_SAVE_QUOTA='yes'

Saves Quota values on shutdown and restores them on systemstart of the router. The temporary files of the quota-management will be written to C3SURF_PERSISTENT_PATH on normal shutdown and will be restored to the temporary directory on system start again. All actual user data will be preserved this way. An accidental shutdown will not be recoverable this way.


Important: LOGINUSR_DELETE_PERSISTENT_DATA='no', should be set because otherwise this setting will delete all user accounts und their quota data.

C3SURF_CHECK_ARP

Default Setting: C3SURF_CHECK_ARP='yes'

Check in the countdown module whether an IP of a computer has vanished from the ARP table. Shut down computers may be recognized this way, but sometimes with a massive time delay.

C3SURF_CONTROL_HOST_OR_NET_N

C3SURF_CONTROL_HOST_OR_NET_N='0'

Value: integer numbers.
How much and which IP ranges or hosts should be controlled by c3Surf? This affects forwarding to another net (FORWARD Chain).

C3SURF_CONTROL_HOST_OR_NET_x

C3SURF_CONTROL_HOST_OR_NET_x='Netzwerk OR Host OR IP-Address'

Controls all clients.


Important: A complete net may be specified here for simplicity, e.g. WLAN. Then all wireless users need to use the login page. Also a reference to a host (@host) or an IP address may be specified. Who or what is entered here is redirected to the login page and the blocking rules defined below apply.

Example:

C3SURF_CONTROL_HOST_OR_NET_1='IP_NET_3'       # Specify the net IP/MASK
C3SURF_CONTROL_HOST_OR_NET_2='@T8200'         # or host @HOST
C3SURF_CONTROL_HOST_OR_NET_3='192.168.13.11'  # or IP address

The next example is basically the same as the one above (IP_NET_3) if in "base.txt" the IP address has been set accordingly.

C3SURF_CONTROL_HOST_OR_NET_1='192.168.0.1/24' # controls all clients

For a computer to be excluded, you may either include all IP addresses individually in C3SURF.txt (i.e. create a list of all 256 addresses and leave one out), or you can use the CIDR notation (as above). Then IP groups have to be used causing less writing (8 rows instead of 255).

This may look as follows:

C3SURF_CONTROL_HOST_OR_NET_N='8'                # Number of hosts or nets
C3SURF_CONTROL_HOST_OR_NET_1='192.168.0.0/31'   # 0-1
C3SURF_CONTROL_HOST_OR_NET_2='192.168.0.3'      # only 3 not 2
C3SURF_CONTROL_HOST_OR_NET_3='192.168.0.4/30'   # 4-7
C3SURF_CONTROL_HOST_OR_NET_4='192.168.0.8/29'   # 8-15
C3SURF_CONTROL_HOST_OR_NET_5='192.168.0.16/28'  # 16-31
C3SURF_CONTROL_HOST_OR_NET_6='192.168.0.32/27'  # 32-63
C3SURF_CONTROL_HOST_OR_NET_7='192.168.0.64/26'  # 64-127
C3SURF_CONTROL_HOST_OR_NET_8='192.168.0.128/25' # 128-255

The computer with the IP '192.168.0.2' is able to do everything allowed by fli4l's firewall without registration.

C3SURF_CONTROL_PORT_N

C3SURF_CONTROL_PORT_N='0'

Value: Integer numbers.
How much TCP ports of the routers should be controlled?

How much and which ports explicitely named should be controlled by c3Surf? IP ranges and hosts from above are affected.
C3SURF_CONTROL_HOST_OR_NET_N. c3Surf controls these ports and frees them after successful login so that all services existing on this ports of the router may be used (INPUT-Chain).

C3SURF_CONTROL_PORT_x

C3SURF_CONTROL_PORT_x='port_nr'

Port number and the access to the services of the router (fli4l) behind them are blocked until login. After successful registration, services can be used for the time provided.

Examples:

C3SURF_CONTROL_PORT_1='515' # i.e. lpdsrv (printer usable after login)
C3SURF_CONTROL_PORT_2='21'  # i.e. ftp - (note: ftp on the router!)

Other possible port adresses:
  21=ftp
  22=ssh
  5000=imonc
  5001=telmod
  8118=privoxy
  9050=tor
  3128=squid
  20000=mtgcapri
  80=http(Admin)
  515=lpdsrv

All depends on your own configuration. To all ports not mentioned here the rules from 'base.txt' apply. After registration, the rules of 'base.txt' are still valid. c3Surf is only a pre-chain to these rules until the login was performed successfully. So after registration all the rules are still obeyed. So you may, for example, deny access from WLAN to the wired network in 'base.txt'. This is also valid for users legitimated in WLAN by c3Surf.

C3SURF_BLOCK_PORT_N

C3SURF_BLOCK_PORT_N='0'

Value: Integer numbers.
How much TCP ports of the routers should be blocked?

Hints:
Permanent blocking of services for nets and hosts mentioned above
C3SURF_CONTROL_HOST_OR_NET_N. How much and which ports explicitely named should be blocked permanently by c3Surf? No access to the router's services behind those ports for hosts and/or computers of the blocked nets even not after login. This affects the INPUT-Chain. If you want to block certain services permanently, you should better do this with the parameters for the INPUT chain in 'base.txt'. Why:
Because these rules are not valid anymore if the parameter OPT_C3SURF='no' is set. If you deactivate C3SURF the rules defined here have to be transferred to the 'base.txt' if you want your blocks for the hosts or nets mentioned above to persist.

C3SURF_BLOCK_PORT_x

C3SURF_BLOCK_PORT_x='port_nr'

Examples:

C3SURF_BLOCK_PORT_1='5000'           # z.B. imonc
C3SURF_BLOCK_PORT_2='5001'           # z.B. telmond
C3SURF_BLOCK_PORT_3='20000'          # z.B. mtgcapri (OPT_MTGCAPRI)
C3SURF_BLOCK_PORT_4='22'             # z.B. ssh
C3SURF_BLOCK_PORT_5='8118'           # z.B. privoxy (PROXY)
C3SURF_BLOCK_PORT_6='9050'           # z.B. tor (PROXY)
C3SURF_BLOCK_PORT_7='80'             # z.B. httpd Admin interface (HTTPD)
C3SURF_BLOCK_PORT_8='7437'           # z.B. caiviar (OPT_CAIVIAR)

C3SURF_HTTPD_PORT

Default Setting: C3SURF_HTTPD_PORT='8080'

On which port and which IP address should the mini_httpd listen for login attempts? http queries from computers will be redirected to this address and port. Port 8080 is the default here.


The following should be considered when choosing the port number:

If by mistake a port already in use is defined here, fli4l tries again and again to start httpd. This fails because the port is already occupied by the Admin Interface or another service. This can only be seen on the console or in the logs. You notice it because C3SURF will not work and fli4l generates high CPU load and appears to be running slowly.

C3SURF_HTTPD_LISTENIP

Default Setting: C3SURF_HTTPD_LISTENIP='Host OR IPAddress'

Specifies the local IP to which the login interface will bind to, either IP address or @hostname. Http requests of clients will be redirected on demand (i.e., when they are not logged in). Hence, users come quickly to the login page.

Examples:

C3SURF_HTTPD_LISTENIP='@wifi-router'    # Hostname
C3SURF_HTTPD_LISTENIP='192.168.11.3'    # IP-address
C3SURF_HTTPD_LISTENIP='IP_NET_1_IPADDR' # IP-address-variable

The http service for C3SURF always binds to exactly one IP address.

1.3.1 Optional Parameters For OPT_C3SURF

C3SURF_CONTROL_SQUID

Default Setting: C3SURF_CONTROL_SQUID='no'

By adding the variable C3SURF_CONTROL_SQUID='yes' the control over squid will be forced. The C3SURF port redirection will be set to the beginning which also affects other packages (i.e. openvpn).

Recommendation is 'no', those using i.e. squid should check, if no other functions are affected inadvertently by it.

C3SURF_SLOPPY_MAC

Default Setting: C3SURF_SLOPPY_MAC='no'

C3SURF_CHECK_CURFEW

Default Setting: C3SURF_CHECK_CURFEW='yes'

Turn automatic logoff when reaching the curfew on ('yes') or off ('no').

C3SURF_PORTAL_DEFAULT_LANG

Default Setting: C3SURF_PORTAL_DEFAULT_LANG='de'

Possible values: a two-characters country code (i.e. 'de', 'fr', 'en').

Sets the default language for the login page. If omitted, 'de' is assumed.

Under ~/opt/files/srv/www/c3surf/lang/ a file named c3surf.<countrycode> should exist. At the moment 'de', 'fr', 'en' and 'it' are supported. If you want to create a file for another language you may send it to the fli4l team for inclusion.

C3SURF_PORTAL_LANGUAGES

Default Setting: C3SURF_PORTAL_DEFAULT_LANG='de fr en it'

Value range: a list of two characters each, separated by spaces.

Specifies the language files that should be transferred to the system for the login page. If there is no language file corresponding to the two character shortcut here, a warning will be issued that no file was found for it and therefore nothing was copied. The build process is not aborted.

© 2001-2015 The fli4l-Team - 25 October 2015