Appendix

This section covers diverse issues not presented in the main chapters.

Bind DNS Configuration

-CONTRIBUTED TOOL-

Through the following scripts, it is possible to generate the "zone" files for bind (a.k.a. named), for a single domain.

See also the related  ISC DHCP Configuration scripts.

Configuration options

The configuration options are in the freenac database and can be configured by the windows GUI 

  • web_showdns (true/false) : show the dns-related fields in the web interface
  • dns_domain = general domain
  • dns_ns = comma separated list of name servers (no space).
    These servers must be resolvable.
  • dns_mx = comma separated list of mail servers (no space).
    This is an ordered list (primary server first)
  • dns_primary = primary name server where this host file will be used (used in SOA)
  • dns_mail = email address for the DNS administrator (used in SOA)
  • dns_outdir = directory where the zone files will be written (existing files will be overwritten without confirmation)
  • dns_forwardzone = name of the generated zone file (forward).
  • dns_subnet = subnet for which a reverse dns zone file will be generated

generate_dns.php

This script will generate the normal (forward) zone files from the systems table.
An 'A' record will be generated for each system and will point the 'hostname' field to the last known ip ('r_ip').

Aliases (CNAME records) will be generated from the (comma separated) 'dns_alias' field and will point to the 'A' record of the host.

generate_dns_reverse.php

This script will generate the reverse zone files from the sytems table.

For each subnet matching the '$dns_subnet' configuration option, reverse records (PTR) will be extracted from the systems table. The last known IP address wil point to the hostname.

The generated files will be named like '254.168.192.in-addr.arpa' for the 192.168.254.0 subnetwork. 

Changelog and update notes

This document explains the changes from v2.2 RC3 to v3, and the steps to upgrade to v3.

What is new in V3.0.2?

V3.0.2 is a small point release (SVN build 1233) gathering fixes to the stable branch since v3.0.0.

New Web GUI: See README.webnew which explains the new design, and CHANGES which lists progress.

Windows GUI: several small improvements.

Backend changes:

  • Many small fixes to dameons. A detailed list of changes is in doc/CHANGES.detailed
  • DB changes are documented in contrib/migration_3.0_to_3.0.2/db_changes.sql
    • Clean up column defaults
    • Add switch: scan3 and vlan_id columns
    • Add several new rows to the config table.
    • Improve comments in the config table
  • Layer 3 scanning of switches/routers is now controlled by the new 'scan3' field in the switches table, not the router list in the config table.
  • Fixes to sample policies

What is new in V3.0.0?

A substantial change in FreeNAC v3.0 is the introduction of an OO (objected oriented) policy interface, which provides greater flexibility and encapsulation of individual decisions regarding control of end-device access to the network.

The main programs have been rewritten using OO techniques, some others have been modified to work with our framework, and some others have been added to this new release. The aim of the OO change is to have a modularized system which would be easier to debug, troubleshoot, maintain and extend in the long run.
It's now a requirement to use PHP 5 (not PHP4) - we recommend using the latest PHP version.

Here is a summary of the changes in v3.0 (since v2.2):

  1. vmpsd_external has been completely rewritten. vmps_lastseen doesn't exist any more, it was written as the postconnect daemon.
  2. Added the lib directory, which holds several class files that provide the framework for FreeNAC v3.0. In case you want to dig into the innards of FreeNAC, this is the place to start.
  3. Creation of a policy file which allows the system administrator with light PHP skills to modify the decision process. Sample policy files are provided in /opt/nac/etc, see also the Policy chapters in the Technical Guide which describe writing, testing and trying the sample policies.
  4. Emergency off scripts have been added. In case you want to quickly disable FreeNAC in your network (e.g. at 02:00 in the morning, when there is a problem on the network that is difficult to localise), you only need to run these scripts. Likewise, after disabling it, you can re-enable it (e.g. the next morning, serenely) using another script. See also the techguide chapter .
  5. The Windows GUI has been improved and adapted to support the new features.
  6. All the PHP scripts have now the extension '.php'. This is to allow phpDocumentor to better parse the scripts and thus get extra documentation auto magically generated.
  7. SNMP functions have been added to funcs.inc.php. Thus we can perform some operations to the switches (like programming of VMPS parameters, learning ports' status, etc) from several scripts. One of those scripts is cron_restart_port.php, which besides restarting a port, it allows for programming of the switch ports from the Windows GUI. Another interesting script is ping_switch.php which tells if a switch port and the switch are up or down.
  8. New interfaces for the integration of McAfee EPO anti virus and Windows update services (WSUS) have been added.
  9. The Database schema has changed a little, new fields and tables have been added.
    We have added fields to store ports and switches' status and the last time that the switch/port was monitored. In the systems table, we now have an index to indicate the health of a connecting device. Some other fields have been added to express what user last used the device, the last name of that device, or even to send an email whenever that device get connected to the network. See also the DB migration script in contrib/migration_2.2_to_3.0.
  10. The notion of health has been introduced. This allows quarantining of end-devices which do not meet the policy.
    Initially there is one module that uses this new health feature, using the port scan module: let's say that you know that a trojan opens the port 666 and if there is a system which is connecting to your network and its port 666 is open, you can decide what to do with it (notify, quarantine, kill it, etc).
    The policy health checking using the Wsus/Epo modules in still in beta status, example policies will be published in the coming weeks.

Installation & Configuration

See the Installation and User Guides.

Upgrading from V2.2 RC3

If you have a previous FreeNAC installation and would like to update to 3.0, here is what you have to do:

Stop previous instances of vmps, last_seen and proctst (if you are using this latter)

/etc/init.d/vmps stop
/etc/init.d/vmps_lastseen stop 
/etc/init.d/proctst stop

Checkout the latest stable release

mkdir /opt/nac3.0
svn co https://opennac.svn.sourceforget.net/svnroot/opennac/branches/3.0/ /opt/nac3.0

Then, copy over the config files or adapt the config.inc.template according to your needs.

Apply the changes to the database

cd /opt/nac3.0/contrib/migration_2.2_to_3.0/
mysql opennac < db_changes.sql

Add the extension .php to all php scripts you have in your crontab

Copy over the startup scripts

mv /etc/init.d/vmps /etc/init.d/vmps.$$
mv /etc/init.d/vmps_lastseen /etc/init.d/vmps_lastseen.$$
cp /opt/nac3.0/contrib/startup_init.d/vmps /etc/init.d/
cp /opt/nac3.0/contrib/startup_init.d/postconnect /etc/init.d/

Copy over the proctst configuration file (if you are using it)

mv /etc/proctst.conf /etc/proctst.$$
cp /opt/nac/contrib/etc/proctst.conf /etc

Activate the new directory

mv /opt/nac /opt/nac.$$
ln -s /opt/nac3.0/ nac 

And finally start the daemons and watch syslog

/etc/init.d/vmps start
/etc/init.d/postconnect start
/etc/init.d/proctst start (only if you are using it) 

All modules are configured via settings in the 'config' table. This was already the case in v2.2 RC3. If upgrading from an even earlier release (v2.1 for example), please read the relevant migration notes on config.inc. The contents of config.inc has not changed between v2.2 RC3 and V3.

Problems

As usual, any questions/remarks/queries can be posted in the forums .

See also the troubleshooting section of the user Guide, search the website, and serach the forum.

Is there are errors or omissions in this document, please login to the website and post a comment below.

Regards,

The FreeNAC Team

Internet sites/directories where FreeNAC is listed

This is an appendix to keep track of where we made submissions, and possible issues.

ISC DHCP Configuration

-CONTRIBUTED TOOL-

The generate_dhcp.php script in the contrib section can be used to generate an configuration file for the ISC DHCP daemon.

See also the ISC Bind configuration script

It uses the following parameters in the configuration database (editable using the windows GUI) :

  • dhcp_configfile : the file that this script will write - if it already exists, it will be overwritten without confirmation
  • dhcp_defaults = the global defaults (currently : default-lease-time, max-lease-time, ddns-update-style, authoritative, use-host-decl-names

The rest of the configuration will be taken from the FreeNAC database

  • Subnet and options from dhcp_options (subnet 0 = general options)
  • Fixed ip addresses from systems (where dhcp_fix = 1, the assigned IP will be dhcp_ip)

The "web_showdhcp" configuration flag toggle the ability to edit the dhcp_fix and dhcp_ip field in the web interface.

RSS Feeds

If you configure the web interface of FreeNAC, you can also have a feed containing the last connections.

It is available as http://<hostname>/nac/rss.php and you can subscribe it using your favorite RSS reader.

SNMP tests performed on non Cisco switches

We have received some requests to support switches from fabricants other than Cisco, so we got our claws on some non-Cisco switches and performed some SNMP tests to see what could be done with them. The switches we tested on are an HP Procurve 2600 and a 3COM 3812 and here are the results of our experiments:

The file /opt/nac/snmp_defs.inc.php contains the OIDs we use to document switches in the system. The first tests performed were to see if we could retrieve switch's general information (description, name, location, contact, software, hardware) using the OIDs declared for this effect. With the OIDs we had we could successfully retrieve the same information, but in some cases we needed to perform some minor changes since the OIDs/functions we have are Cisco oriented and in some switches they don't apply 'as is'.

Also we found other new OIDs that could provide better results. For instance, in snmp_scan, to get the list of physical interfaces we check a certain OID that tells if an interface is physical or not, but in the 3COM switches that doesn't apply since all interfaces are marked as physical even though they are virtual. Also in snmp_scan, to get the SW and HW with the OIDs we have, we need to perform string comparisons. We found other OIDs that directly give the HW, SW and firmware versions without the need to perform string comparisons.

The restart_port script was successfully tested on all non-Cisco switches. Also, apparently we were able to assign a port to a determined vlan (port programming) but using other OIDs which are not listed in the snmp_defs.inc file. These new OIDs are still not committed to SVN, since they are still at an experimental stage.

Statistics collection (V3.0 beta)

The purpose of this module is to collect daily statistics and store them in a table.

TBD: we are in the design stage, this page is for getting feedback.

A table is to be created with three columns:

  • id: autoincremented index
  • Code: name of statics
  • Value: a number/count
  • datetime: timestamp

Entries to be generated each day:

  • no. of ports, switches used
  • no. of end-devices: for active, unmanaged, killed, unknown
  • no. of end-devices per health: unknwown, transition, quarantine, ok, infected

Things to discuss:

  • Do the above counters, also cumularive?
  • What about patch, AV status? OS versions? NUm open ports (from scan module)?

Tips on working with subversion (SVN)

Make contributions

We welcome ideas and code contributions /fixes. you can make these in several ways:

  1. Diffs to the forum or developer email list
  2. committing code a subdirectory with your name in the contribs directory of the sources
  3. changing and committing the core software.

The idea is to start with 1. and progress towards 3. For 2. and 3. you'll need a SourceForge account for subversion and to be on the developer emails list.

For two and 3, you should also create documentation of your module/contribution, for example as an appendix to the Technical guide . For that you'll need a website account, and request "content editor" rights.

The rest of this document gives some example on working with subversion.

Checking out, committing changes

Checkout a working copy:
svn co https://opennac.svn.sourceforge.net/svnroot/opennac/trunk
svn co https://opennac.svn.sourceforge.net/svnroot/opennac/branches/3.0

Check for changes:
svn update contrib bin etc doc
svn help update

Make changes:
svn add <filename|directory>
svn delete <filename|directory>
svn copy <filename|directory>
svn move <filename|directory>
svn help [ add | delete | copy | move ]

Examine your changes:
svn status doc bin etc contrib
svn status <filename|directory>
svn diff
svn diff > <patchfile>
svn revert <filename>
svn help [ blame | status | diff | revert ]
svn [ blame | praise ]

Commit your changes:
svn commit --username YOUR_SF_USER –m "your message" contrib
svn commit --username YOUR_SF_USER –m "your message" doc
svn commit --username YOUR_SF_USER –m "your message" bin
svn commit --username YOUR_SF_USER –m "your message" etc
svn help commit

Subversion client settings

For servers behind a proxy, edit ~/.subversion/servers and set
the proxy values:
[groups]
group1 = *svn.sourceforge.net
[group1]
http-proxy-host = proxy1.MYDOMAIN.COM
http-proxy-port = 80

Limit what files are checking into SVN, edit ~/.subversion/config
[miscellany]
global-ignores = *.o *.lo *.la #*# .*.rej *.rej .*~ *~ .#* .DS_Store *,v RCS config.inc
Specifically, we don't want RCS files, or the productive config.inc
(with passwords) checked in

Merging a branch back to trunk

cd /trunk
svn update

Find the revision where the branch was created
svn log --verbose --stop-on-copy https://opennac.svn.sourceforge.net/svnroot/opennac/branches/2.2
For this example, branch 2.2 was created in revision 548

svn merge -r 548:HEAD https://opennac.svn.sourceforge.net/svnroot/opennac/branches/2.2

svn commit -m "Back to trunk"

 

Ubuntu Package

Synopsis

This section covers the creation and usage of the freenac ubuntu package. The package is still in an early state and mainly tries to ease installation of all required packages. Configuration of freenac is not yet included.

The package creation is still carried out all by hand. None of the debian provided tools were used so far.

Install the package

First all the dependencies of the freenac package must be installed. Since the package is a simple deb and not embedded in a repository, dependency handling can not be done by apt. Hence the dependency list must be extracted from the deb and feeded to apt manually.

$ dpkg -f freenac_....deb depends | sed -e 's/,//g' | xargs sudo apt-get -qq install

Now the freenac package can be installed.

$ sudo dpkg -i freenac_....deb

Extract a Package

To obtain all data (files to be installed as well as control files) from a package without installing it, proceed as follows.

To extract the files which would be installed,

$ dpkg-deb -x freenac_....deb dir-to-extract/

To extract the control files,

$ dpkg-deb -e freenac_....deb dit-to-extract/

To obtain the proper layout from which the package can be recreated again do the following. It's assumed that you created an empty directory freenac where everything will be extracted to.

$ dpkg-deb -x freenac_....deb freenac/
$ dpkg-deb -e freenac_....deb freenac/DEBIAN

Create a Package

To create the freenac package, proceed as follows.

  • Start with an empty directory, e.g. freenac/
  • Create two subdirectories, DEBIAN/ and opt/
  • Check out the freenac version to package from subversion
$ svn co https://opennac.svn.sourceforge.net/svnroot/opennac/... freenac/opt/nac2.2/
  • Create the necessary files in freenac/DEBIAN (see next section)

  • Create the package

$ dpkg-deb -b freenac/ ./

The Files in DEBIAN/

The following files should be inside the DEBIAN directory.

  • changelog
    Contains a high level changelog for this package
  • control
    Specifies the package name, version, architecture, dependencies and a short description about this package.
  • copyright
    License issues
  • rules

For an example of what these files should contain, have a look at the contrib/package_files directory.

Vendor comparison

To do: lets compare products fairly... this probably need to be combined into MAC-based and 802.1x based products, and concentrate only on the key competitors, and differentiate between open source and commercial?

 

OpenVMPS limitations

OpenVMPS works on a file basis, has no database, GUI, and is very intolant of errors on the configuration. FreeNAC is in fact an effort to make OpenVMPS enterprise-ready..

Problems With Cisco “VMPS” and “MAC Port” Authentication.

If you use the VMPS server on old catalysts already for limiting LAN access, what are the limitations?

  • Lack of management features
  • Monitoring
  • Alerting
  • Ease of use
  • GUI
  • User & device DB integration
  • Lack of support from Cisco

Cisco NAC

TBD

Microsoft NAP

TBD

Juniper

TBD

What does FreeNAC *not* do?

  • Layer 3 access control (for example offerning an automated web page with logon, but allowing layer 2 access with an IP address via DHCP..)
  • VPN or firewall access control
  • Remediation / quarantine vlans (planned)
  • MAC authentication on non-cisco switches

 

Vlan attribution: 'switch exceptions' feature

Introduction

The VLAN exception option (based on the vlanswitch table) is a feature allowing location dependant VLANs i.e. when VLAN naming is not consistent across switches, or not all VLANs are available on all switches.

Example: lets say there is an OfficeLAN and PrinterLAN in the main vlan table, but on switch 'sw101', there is only one LAN called 'LAN1'. This feature allows us to map the OfficeLAN and PrinterLAN on switch sw101, to the LAN1.

See also the Windows GUI user guide .

How does it work?

Well lets start by examining the SQL table:

mysql> describe vlanswitch;
+-----------+--------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+-----------+--------------+------+-----+---------+-------+
| vid | int(11) | NO | MUL | | |
| swid | int(11) | NO | MUL | | |
| vlan_id | int(11) | NO | | | |
| vlan_name | varchar(100) | NO | | | |
  • The swid field is a lookup/index into the switch table, and tells us to which switch the vlan exception is relevant.
  • The vid field is a lookup/index into the vlan table, and is the vlan that was attributed so far, i.e. usually the valn stored in the systems table for the end-device being authenticated.
  • The vlan_name is a text field containing the name of the VLAN to be assigned to end-devices that connect to this switch. So it is a valid vlan name on the switch swid.
  • vlan_id is the vlan number corresponding to lan_name, but it is not used. It is only for documentation purposes.

Going back to the example, lets say there is an OfficeLAN and PrinterLAN in the main vlan table, but on switch 'sw101', there is only one LAN called 'LAN1'. So both vlans need to be mapped to that.

First, create two entries in the VLAN exception table, using the Windows GUI:

sw101 OfficeLAN LAN1  
sw101 PrinterLAN LAN1

In the table there would be entries like the following, assuming that swid=10 indexes to sw101, vid=100 indexes to OfficeLAN, and vid=101 to PrinterLAN:

swid=10, vid=100, vlan_name=LAN1
swid=10, vid=101, vlan_name=LAN1

If Ports.vlanBySwitchLocation() is called in the policy, and lan_by_switch_location is enabled in the config table, we then query vlanswitch table to find the appropriate vlan_name.

  • We know the switch IP address, so lookup its index (swid)
  • For the end-device connecting, look up its assigned vlan index (vid)
  • now query vlanswitch to see if there is a row with swid and vid as above, if yes return vlan_name (the text name of the vlan to be sent back to the switch).

Issues

If there are many swicthes and vlans, then the number of rows in the vlanswitch table with le large and difficult to manage.

If there are several small/remote office with only one vlan (for example) and several main building with (say) 30 vlans, then an exception needs to be created for each vlan on each switch, which is alot. One solution for those simple 'one vlan' switches is the new proposed feature 'Vlan attribution by Switch, not by end-device '.

Comments/ideas are welcome.

Vlan attribution: for single-vlan switches, not by end-device

Background

FreeNAC attributes Vlans depending on a vlan value stored for that device.

There is also the "Vlan exception " feature, which allows the vlan attributed to be changed depending on the switch location. (See also the method Ports->getPortDefaultVlan() ). However if there are many "exceptions", i.e. many switches which do not have all Vlans, or vlan with different names, it can be difficult to manage.

Aim

There are sites who just need to attribute two vlans, allowed or denied. In this case, it is overkill to have a vlan per end-device, it would be simpler to just attribute a vlan per switch.

Lets say there is a Vlan "Internal" on all switches, but with different numbers. There is also a vlan "Guest".

  • The idea is to allow all known end-device (state=active) automaticallyonto "Internal", and unknowns onto "Guest".
  • So set the global default vlan to be "Guest".
  • In the policy file, write a policy that says:
    a) if device=active set vlan=getSwitchVlan
    b) if device=unknown set vlan=Gllobal default

Implementation

Thats the concept. For the implementation a vlan_id field has been added to the V3.0 DB schema. The Windows GUI (build 164) can modify that column.  A method getSwitchVlan has been added to the sample policies in V3.0.1.

[sb, 22nd Dec'07]

 

VMPS Tests Conducted

1. Two hosts (Mac address/Vlan pairs) were configured as being allowed in the VMPS database. When either of the allowed hosts were plugged into the switch, a VMPS request was generated and the server replies allowing the connection. No log messages are generated by the Switch.

2. Unplugging a PC causes no VMPS activity.

3. If a PC is connected with a MAC address that is not allowed, the switch logs an error and refuses access to the network:
DVLAN-1-DENYHOST:Host 00-03-ba-27-54-9b denied on port 2/1
Optionally, the server can tell the switch to shutdown the port, in which case it must be manually enabled again (this “secure” mode is perhaps useful for switches in physically exposed places).

4. If the primary VMPS does not reply, the switch retries with the secondary.

5. The switch tries to contact a server 3 times by default, before stopping. This value can be programmed on the switch (to a maximum of 10), on CatOS:
set vmps server retry XX, on IOS vmps retry XX

6. Reconfirmation:

The switch reconfirms (by default every 60 minutes, Cat OS: set vmps server reconfirminterval XX, IOS in ‘con t’ mode: vmps reconfirm XX) if the port is authorised.

If a host was previously enabled and the VMPS server was updated to disable this host, then this will be noticed by the switch on the next reconfirmation interval. On reconfirmation it blocks the ports and logs an appropriate message: "DVLAN-1-DENYHOST:Host 00-03-ba-27-54-9b denied on port 2/1"

If the primary and secondary are not available, the switch logs an error, but does not disconnect the PC/port (this is important to prevent cascaded network failures): "DVLAN-2-MACNOTRECONFIRMED:Mac [00-03-ba-27-54-9b] is not reconfirmed"

If the switch cannot contact a VMPS server, show vmps (IOS: sho vmps stat) displays No Host but does not log a message. The time of the last reconfirmation and the IP address of the server accessed.
VMPS Action: No Host
VMPS Last Accessed: 192.168.245.19
Last Reconfirmation: Fri Sep 10 2004, 08:30:02

Reconfirmation can be manually activated on the switch (Cat OS): reconfirm vmps (IOS: vmps reconfirm on IOS). During the confirmation show vmps shows a status or “In Progress” and then “Success” with the timestamp of the last reconfirmation updated.

To clear vmps statistics (IOS): clear vmps status

7. If two PCs define their MAC address to the same value then the switch authenticates on each packet, thus some packets are allowed from each PC. This would cause disruption to both PCs. It is not noted as an error by the switch, but can be detected by analysing the logs for frequent authentication of a specific MAC address within a short period of time.

8. If two PCs are connected to a hub (or unmanaged switch), which is connected to one (vmps) Switch port, then:
• If both PCs are authorised on the same VLAN they can both communicate.
• If only one is authorised, the traffic from the second is blocked. The authorised PC continues to work fine.
• If both are authorised, but in different VLANs, the switch changes the port constantly between the two VLAN, causing havoc, some packets pass from each machine. No errors are logged by the switch or VMPS server, since the authentications are successful. To detect this scenario, a monitoring would have to detect a VMPS “authentication storm” from one port and notify the network administrator.

9. If a PC is disabled in the VMPS database, and VMPS is restarted, there is no immediate effect. The PC continues to have access until the cable is added/removed or, the next VMPS reconfirmation (every 60 minutes).

10. If a PC’s MAC is added to the VMPS database, and VMPS is restarted, there is no immediate effect. The PC continues to be forced to the defaultvlan until the cable is added/removed or, the next VMPS reconfirmation (every 60 minutes).

Other findings

Several “VMWARE” virtual machines were running on the network, each looking like a real PC, with its own address. This usage is not really a risk; it allows tests to be conducted on virtual machines, but does confuse network management.

Some laptops have a docking station, which has a MAC different address from the built in Laptop MAC address.

Several users were used Wireless rather than Fixed Lan.

User acceptance was high (all problems were solved quickly).

A change/authorisation/expiry process needs to be developed/written and adhered to. What happens when a user leaves and a new user come, taking over an already authorised PC?

There is no noticeable delay when using the network.

If a user is refused access, and then added to the VMPS DB to allow access, he must either wait one hour, or re-authenticate. To ere-authenticate, there are several options
• disable and re-enable the network connection in the connections control panel (this is the quickest method)
• unplug/plug in his network cable, it takes some time for windows to realize it is on another network
• click on the network icon -> support -> "repair": it first tries to release its old address, but can't as the DHCP server is not here anymore, this may take 5 minutes

WSUS Integration

WSUS - Integration

Abstract

The Windwos Server Update Services

FreeNAC programming conventions

Program file headers:

/**
* filename.php
*
* Long description for file:
* Some words about the functionality the file provides, it's dependencies and so on
*
* PHP version 5
*
* LICENSE: This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as published
* by the Free Software Foundation.
*
* @package FreeNAC
* @author XX (FreeNAC Core Team)
* @copyright 2007 FreeNAC
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License Version 2
* @version SVN: $Id$
* @link http://freenac.net
*
*/

Other coding conventions:

  • use two spaces when indenting
  • comment your code
  • always use version control, preferable SVN
  • style: do not mix styles in the same source file, follow the style of the original author
  • use PHP documentor tags in headers and comments

Pending issues: Virtual machine

The latest release of the VM (3.02) has Ubuntu 8.04 (Hardy Heron) as its base OS.

The FreeRadius package provided for this version of Ubuntu is still broken when using perl, so this VM has FreeRadius and perl compiled from the sources, this way it is possible to use the rad2vmps module to provide for 802.1x authentication in conjuntion with FreeNAC.

Other issues to have in mind:

  • flap_detect is running every 4 minutes. Maybe set it to run every 20 minutes?

Have you found any more issues? Please report them in the forums or post a comment to this page.

Pending issues: Web GUI

Introduction

This page is used as a sort of bug tracking
system for known issues, next fixes, what is done etc. to the new WebGUI to be released with v3.0.2 (9.May'08: to be released in the next week). The new version is a complete re-write, see README.webnew for a description and CHANGES for progess.

If you want to have something moved up to priority, or submit a new entry, please use the Support forum, or better, post comments below.

Issues: priority

  • Log out does not do an apache logout (move to Zend framework for authentication & session mgt?)
  • Ports down/up: Show interface status: Can we show disabled or error disbled, Not connected? (different SNMP OID)
  • GuiList1:
    sort/search fields not being remembered?
  • Need an Advanced search page (search through all fields with drop downlists, or accross multiple fields)
  • More Cross-site scripting /security analysis

Issues: others

  1. Edit device: show last change user/date
  2. GuiList1 grid: add up/down arrow/icon for sorting
  3. logtail exclude pattern in config table
  4. option to scan a switch after adding it
  5. Enable an snmp-scan of all switches
  6. When deleting, do a cascaded delete
  7. EditDevice_more.inc.php move to mysqli, review
  8. Only one AD server can be configured for Domain WebGUI logon?
  9. Add & update device: no validation checking i.e. for a properly formed MAC address (there is security validation/cleaning though).
  10. CSS:
    • Are we using consistent class names everywhere?
    • increase font size in the logtail screens
    • make a nice header, do we still need the links?
  11. exceptions.inc: review integrate with /lib/exceptions.inc
  12. webfuncs.inc: remove unneeded stuff
  13. throw (more) exceptions where possible
  14. logtail:
    // TBD: catch error if file cannot be read, or non existant.
    // TBD: test if ad_auth=false
    throw exception
  15. Allow Administrators to edit config tables
  16. phpinfo:
    non standard header/footer, how we will we handle updates?
  17. footer: What else to add?
  18. index.php: File does not exist: /opt/nac/web/favicon.ico
  19. Sql auth (login/logout.php, GuiUserManager)
  20. Drupal auth
  21. ADGROUP auth
    we need to define the groups who'll be using each of these interfaces. In MySQL, you modify the table guirights to define the rights associated to each group. To declare a group, you use its full DN. For example:
    update guirights set ad_group='CN=FreeNAC_write,DC=domain,DC=com' where code=99;
    update guirights set ad_group='CN=FreeNAC_read,DC=domain,DC=com' where code=1;
  22. Multiple languages
  23. Switch to a PHP framework such as Zend, Symfony or php-cake?
  24. Demo WebGUI: graphs not working (HO)
  25. Dot in Edit end device
  26. config $auth mode from the config table, not from web1.config.inc

 

Done (issues fixed, for references purposes)

- Aside from these notes, see the svn (subversion) changelog in the v3 branch, CHANGES in the web directory and README.webnew.

  1. View Guilog and serverlog tables
  2. Show vlan and other config tables.
  3. Add graph GUI's: make the OO oriented
  4. GuiEditDevice
    • On update/delete, insert into guilog
    • Add more under 'Admin information'
  5. Left align fields?
  6. If there is no 'action', hide that column
  7. Test that all functions in the old GUI also working in the new one

Add MAC Vendor column to unknowns.php


I can only delete a record (using the "delete" option to the left) if I
first "edit" a record. It can be any record in any query. If the first
thing I try to do is delete a record I get "Invalid Argument".

"/etc/logrotate.d/syslog-ng" not setting permissions correctly
ls -al /var/log/messages
-rw-r----- 1 root adm 24550093 2008-02-26 06:53 /var/log/messages
(ADapt the syslog-ng config file, or set a cron entry after log rotation: 'chgrp freenac /var/log/messages /var/log/debug').

See also the forum thread http://freenac.net/phpBB2/viewtopic.php?p=1348

Fix used id=2 Edit device: restart port option

Port comment containing "<>" are stipped and not visible in the WebGUI

Security: escaping of output.

Add helpdesk role. 

Pending issues: Windows interface

Introduction

This page is used as a sort of bug tracking system for known issues, next fixes, what is done etc. to the Windows FreeNAC GUI. It tracks changes since V3.0. Bugzilla is not used because its consider slow and clunky. We may use a trac later, but for now...

If you want to have something moved up to priority, or submit a new entry, please use the Support forum, or the comments below.

Issues: priority

  • None

Issues: others

  1. Lookups: don't allow location 1 (default) to be changed
  2. Overview: Right click *several* rows to set status or vlan.
  3. if you add a new vlan to the windows gui, you need to close the gui and restart it in order for the vlan to show up under the "edit devices" section
    http://freenac.net/phpBB2/viewtopic.php?t=258
  4. New Wsus tab: list systems & expand to list of patches. Right click to edit end device.
  5. Edit:
    • user lookups: need to post for details to appear.
    • User drop down list only shows Username
    • vlan colour by lookup, not just INO
  6. Admin: Add snmp scan-now button?
  7. Config: tick boxes to enable modules
  8. Vlans: Allow colour to be changed in GUI?
  9. Edit cabletype table
  10. Users: Add search or lookup. Sync with user for this device from the edit tab
  11. Ports:
    • Ports page sometime slow to load
    • copy/move popup from ports to switches, ports -> pop patch
    • right click to get patch details, or add office & users
    • right click to delete several selected ports?
    • you can change switch name & port name (even though these are normally documented automatically), which allows for a manipulation error. We need to be able to change these fields to insert new ports though.
  12. Switches
    • The 'shutdown' field in the sub-port list is not displaying correctly. (An analysis of the configuration of the grid element has not explained why).
  13. Reporting:
    • OS versions, end-device security.
    • autosize columns, they are too big.
    • New statistics window?
    • Create reporting directory with some standard layouts?
  14. Patchcable: show etage01
  15. Performance:
    • Unknowns don't appear fast enough in the GUI?
    • Load the 'Computer users in office' query on startup, only once, and save in memory?
    • What else can be done to improve speed?
  16. Delphi: clean-up & publish sources? We need several, proprietary libraries anyway (MyDac, cxgrid), so will GPL'ing it help much?
  17. The ChangeDate field in the systems table is a string instead of a datetime field.

 

Done

See the CHANGELOG file in the repository directory where vmps.exe and vmps.xml are stored, e.g.

http://opennac.svn.sourceforge.net/viewvc/opennac/branches/3.0/WindowsGUI/CHANGELOG.txt?view=markup

__

TNC notes

To do: start off by providing links to the currect relevant FreeNAC docs, and to the Uni Hannover papers, current diagrams and brainstorm ideas we documented...

TCG:
https://www.trustedcomputinggroup.org/groups/network/

Hannover:

http://www.inform.fh-hannover.de/de/forschung/forschungsprojekte/tnc/

 

Microsft links: (where are the API definitions etc.??

http://www.microsoft.com/presspass/press/2007/may07/05-21NAPTNCPR.mspx

https://www.trustedcomputinggroup.org/news/Industry_Data/TNC_NAP_white_p...

Diverse notes & Frequently asked questions

Notes

This section contains diverse notes & links. Its a good place to paste summaries of Forum discussions for example.

Wake on LAN (WoL)

Some users have used WoL, (see http://freenac.net/phpBB2/viewtopic.php?t=78& ) but a request to Cisco explained the following.

WoL and Dynamic VLANs are not compatible because when the PC is shut down, the NIC will be powered down for a split second. This causes the switch to detect the link-down event and to un-assign the port. When the NIC comes back online, the port does not belong to any VLAN and since no frames are received by the port, it would never initiate VMPS queries or forward broadcast/multicast to the device connected to it.

You can verify this on the logs of the switch, you connect a computer to one port of the switch, shut down the computer and you will see a log on the switch that show that the port went down and then back up, make sure you to enable the link-status log on the interface for the switch to show when it goes up/down, the command to enable it is ?logging event link-status? and it is apply on the interface configuration.

Unmanaged systems on dynamic ports?

Through the use of snmp_scan.php we can document the systems which are on a switch and how the port has been configured (static, dynamic, trunk). If a device is on a static port, snmp_scan will document it as an unmanaged system. This system is supposed to always use the same port and therefore the same vlan.

But what happens when we move an unmanaged system to a dynamic port?

When such a case arises, the device is not connected to the network. In the FreeNAC server we don't see any requests coming when we plug the unmanaged device into the dynamic port. On the switch we see that the port goes down and up, but it doesn't generate a VMPS request. So far we can say that "Nothing happens" which is odd, but it is what we've gotten. More tests need to be carried out.

These tests were carried out using a Cisco Catalyst 2940 switch and a Linux machine.

Store user information in VTP domain?

Another experimental feature which we are not going to implement is the following:

When we have FreeRadius using the rad2vmps script, we wanted to know if it was possible to somehow pass user information contained in a RADIUS request to the FreeNAC database, using the field "VTP domain" which is part of any VMPS request.

In tests performed, we were able to get the username from the VTP domain, but we wanted to gather more information, such as:

  • Username
  • Domain
  • Radius port
  • Authentication mechanism
  • Commentary

Since the VTP domain only has space to hold 33 characters, this solution is neither practical, nor elegant, nor adequate.