|
|
| Line 1: |
Line 1: |
| <div style="float:right;">__TOC__</div>
| |
| [[Team:NOC]] has tried to build and support the fastest network for you: a network comparable to a medium sized ISP, built up in just a couple of days. It might not be perfect all the time. We will be providing blanket wireless coverage and wired network access to both venues and camping tents.
| |
|
| |
|
| === Key points ===
| |
|
| |
| * To use the camp WiFi on most modern devices, connect to the '''emfcamp''' network with a username of '''emf''' and a password of '''emf'''.
| |
| * If you're using a modern Android phone (Android 10 or above), the '''emfcamp-insecure22''' network is easier to configure, and it will be encrypted (despite the name).
| |
| * Don't set up your own wireless access point. This is a serious problem in such a dense event and [[Network/Rogue Access Points|here's why]].
| |
|
| |
| == Wireless ==
| |
|
| |
| <dl>
| |
| <dt>Network Name (SSID)</dt>
| |
| <dd>emfcamp</dd>
| |
| <dt>Username</dt>
| |
| <dd>emf</dd>
| |
| <dt>Password</dt>
| |
| <dd>emf</dd>
| |
| </dl>
| |
|
| |
| The whole field has been covered with many wireless access points to ensure the best possible coverage and to allow you to roam seamlessly without interruption. Please note that your device will be reachable by anyone on the internet, please take suitable precautions such as turning on a firewall, and making sure your software is up to date.
| |
|
| |
| You should not bring your own wireless access point, its unlikely to provide better service than the camp ones, and it makes the network worse for everyone else. Any rogue access points will be hunted down and disconnected from the network - see [[Network/Rogue_Access_Points]] if you want to know why. If you have a project that needs to provide its own AP for some reason please contact the NOC and we will find an alternative solution.
| |
|
| |
| Here is the complete list of wireless networks (SSIDs) available:
| |
|
| |
| {| class="wikitable"
| |
| ! emfcamp
| |
| | This is 2.4GHz + 5GHz and should you should use this one in preference, if you can see it. This is the most secure, WPA2-Enterprise. However, it's a pain to configure on Android devices.
| |
| |-
| |
| ! style="white-space: nowrap" | emfcamp-insecure22
| |
| | '''Warning: insecure on some devices''' This is both 5GHz and 2.4GHz, and can be used for older devices that don't support WPA2-Enterprise. If your device supports [https://en.wikipedia.org/wiki/Opportunistic_Wireless_Encryption Opportunistic Wireless Encryption], such as Android 10 or above, this is encrypted, although not quite as secure as the '''emfcamp''' SSID. Otherwise, it's unencrypted, and people will likely intercept your traffic. Inbound connections from the rest of the campsite are possible, inbound connections from the Internet are blocked.
| |
| |-
| |
| ! spacenet
| |
| | This is 2.4GHz + 5GHz and WPA2-Enterprise, you can connect with a valid account if your hackerspace offers.
| |
| |-
| |
| ! eduroam
| |
| | This is 2.4GHz + 5GHz and WPA2-Enterprise, you can connect with a valid account if your university/college/school is offering eduroam. More information can be found at [https://www.eduroam.org/ eduroam.org].
| |
| |}
| |
|
| |
| When connecting to any of the WPA2-Enterprise password, which require a username and password, you can use the following (case-sensitive):
| |
|
| |
| {| class="wikitable"
| |
| ! Username
| |
| ! Password
| |
| ! Result
| |
| |-
| |
| | emf
| |
| | emf
| |
| | Filtered connection with public IP address. Inbound connections from the rest of the campsite are possible, inbound connections from the Internet are blocked.
| |
| |-
| |
| | allowany
| |
| | allowany
| |
| | Unfiltered connection with public IP address
| |
| |-
| |
| | outboundonly
| |
| | outboundonly
| |
| | Filtered connection with public IP address. Inbound connections from the Internet or camp-site are not possible.
| |
| |}
| |
|
| |
| Use of the 5GHz SSIDs is recommended if your device supports them. 802.11b is disabled as it slows everyone else down.
| |
|
| |
| Even if you are using an encrypted network, you should still [[#Encryption|encrypt any sensitive traffic]] sent over the air end-to-end to prevent snooping. Although some SSIDs offer encryption, it is only over-the-air.
| |
|
| |
| We have airtime fairness configured on our wireless controllers, so if you wish to use a lot of bandwidth (e.g. stream videos or download large files), please use a [[#Wired|wired connection]].
| |
|
| |
|
| |
| ==== Client Settings ====
| |
| Also see [[Network/802.1X client settings]] for a list of OS-specific client settings.
| |
|
| |
| SSID: emfcamp
| |
|
| |
| EAP-TTLS:
| |
|
| |
| Phase 1: EAP-TTLS
| |
| Phase 2: PAP
| |
|
| |
| PEAP:
| |
|
| |
| Phase 1: PEAP
| |
| Phase 2: MSCHAPv2 or EAP-MSCHAPv2 or PAP
| |
|
| |
| CN = radius.emf.camp
| |
| CA = ISRG Root X1
| |
|
| |
| SHA256 Fingerprint = B8:3B:F9:39:C4:F2:BF:D0:87:D7:93:5C:A0:DD:18:F3:31:7B:DD:B1:EC:88:3B:22:E0:B2:39:CB:7C:F8:FD:43
| |
|
| |
| Make sure '''you check the certificate''' in order to know you are connecting to the correct network (you should check on both the CN and the CA). Check [[Network/RADIUS_certificate|here]] for the complete certificate.
| |
|
| |
| [[File:Ubuntu network settings.png|thumb|Ubuntu network settings]]
| |
| On Ubuntu/Debian based distros the certificate file can be found in /etc/ssl/certs/ISRG_Root_X1.pem
| |
|
| |
| '''Android'''
| |
|
| |
| This app will help you get set up: https://play.google.com/store/apps/details?id=nl.eventinfra.wifisetup. Or follow [[Network/802.1X_client_settings#Manually|these instructions]] to do it manually.
| |
|
| |
| == Wired Ethernet ==
| |
|
| |
| All camping areas are within 60m of a datenklo (or data toilet), where you can connect to the network. If you intend to do so please bring 60-70m of CAT5 cable as we are unable to provide any.
| |
|
| |
| Lay your own cable neatly from your tent back to the nearest Datenklo, and leave 6m of slack coiled on the floor in front of it. And please lay it so that it can be clearly seen that it needs to be plugged in - or you risk having your cable overlooked. At regular intervals a member of the NOC team will connect it up and enable the port.
| |
|
| |
| If you wish to be removed from a Datenklo again on Sunday or Monday, leave your entire cable coiled outside the DK and we will disconnect it. If you need to leave before then, contact the [[Team:InfoDesk|helpdesk]] directly.
| |
|
| |
| All of our edge ports are at least 100 Mbps or 1 Gbps, auto-negotiate, auto-MDX. We are unlikely to have PoE ports for general use.
| |
|
| |
| <!-- Note that most of our ports will not support 10 Mbps - if you need it for old equipment or embedded things, please bring your own switch to convert. !-->
| |
|
| |
| == Static IPs ==
| |
|
| |
| If you need a static IP on the wired network, contact the NOC.
| |
|
| |
| == IPv6 ==
| |
|
| |
| Naturally, IPv6 is available throughout the network and should "just work" for you. [[Team:NOC]] does not recommend disabling IPv6 if you have problems, instead try to understand the problem you are experiencing and get educated in the new world order. Contact the [[Team:InfoDesk|NOC helpdesk]] if you need help.
| |
|
| |
| == Services ==
| |
|
| |
| * DNS: 78.158.87.11 and 78.158.87.12
| |
| * NTP: 78.158.87.11 and 78.158.87.12 (ntp1.emf.camp and ntp2.emf.camp)
| |
| * Nearest Debian mirror: http://debian.mirror.uk.sargasso.net
| |
|
| |
|
| |
| == Security ==
| |
|
| |
| === Encryption ===
| |
|
| |
| Please treat the network as wide open and full of attackers. Although [[Team:NOC]] themselves will not monitor the network, always assume that Alice flirting with Bob will be spied upon by The Third Party.
| |
|
| |
| Any sensitive information including passwords must therefore be encrypted. Please make sure you don't use any software or web applications that send sensitive data or passwords in the clear.
| |
|
| |
| The following mechanisms should be safe:
| |
| * Anything that goes through a VPN
| |
| * Any website that uses HTTPS
| |
| * Any application that uses SSL
| |
| ** In the case of email, you need to have SSL enabled for both receiving mail (POP, IMAP) and sending it (SMTP)
| |
| * ssh and scp
| |
| * Where possible, use One-time passwords. Real tokens work best, many of those should be compatible with open source radius servers. [http://perlmonks.org/?node=967433 Here] is a simple Perl radius server implementation for [http://tools.ietf.org/html/rfc6238 RFC6238] tokens that works with ssh and other stuff on linux.
| |
|
| |
| The following are almost always unsafe:
| |
|
| |
| * FTP with login/password (are almost always sent in the clear)
| |
| * Telnet with login/password
| |
| * Email if you don't use SSL
| |
| * Webmail that doesn't use HTTPS
| |
| ** Someone could trigger a password reminder and then intercept your email
| |
| * Websites that use HTTP (not HTTPS) where you need to fill in a password in the page itself
| |
|
| |
| Possibly unsafe, make sure that you understand what you're doing:
| |
|
| |
| * Websites where you need to fill in a password and your ''browser'' (not the website!) tells you it's going to be sent securely
| |
| * Websites that require an account but remember you're logged in
| |
| ** The password ''may'' be protected but not the content or cookies that automatically log you in
| |
| * Any time your browser or other application brings up ''anything'' to do with a certificate
| |
| * Anything not protected with SSL: someone could be faking DNS answers to impersonate certain sites
| |
|
| |
| Remember: if you're being stupid someone may feel the need to teach you a security lesson in a not so subtle way! (No, that doesn't mean it's ok to hack people just to see if their security is in order.)
| |
|
| |
| === Firewall ===
| |
|
| |
| On the wired network there is no network firewall and on the WiFi network there is limited firewalling in place. We operate an unfiltered network that is wide open to the Internet. There is no NAT, and everybody has a public IP address. This is our definition of "network neutrality" - a network that doesn't do anything whatsoever to your IP connection.
| |
|
| |
| If you are used to feeling secure just because you've been sitting behind a NAT router, think again. You are now wide open to the whole Internet. Ensure your personal firewall is enabled and set to "Public Network" and that you have applied all security updates to your OS and applications.
| |
|
| |
| By default the WiFi network allows inbound connections from the rest of the campsite, but inbound connections from the Internet are blocked. If you want to ensure no inbound connections are possible towards your WiFi device, use the "outboundonly"-login.
| |
|
| |
| In case you want to enable inbound connections towards your WiFi-device, use the "allowany"-login.
| |
|
| |
| == FAQ ==
| |
|
| |
| === Can I bring a server? ===
| |
|
| |
| Sure. You can host a server anywhere on the network, and the long DHCP lease time will effectively give you a static IP address.
| |
|
| |
| If you would like to house your server in our data centre (NOC-DC), please contact us before the event by e-mail to noc@. 1 Gbps copper ports are standard; if you require a 10 Gbps port, you'll need to supply a DAC or SFPs (our end Arista-coded) with fibre.
| |
|
| |
| === Is there a server I can use to host data on site? ===
| |
|
| |
| Due to lack of demand at the last event, this will not be provided this time.
| |
|
| |
| === Can I use the 2.4GHz band for non-wifi projects? ===
| |
|
| |
| The following channels are available for adhoc/mesh/other wireless stuff:
| |
|
| |
| * 2.4GHz: Channel 1
| |
| * 5GHz: Channel 136, 140
| |
|
| |
| We cannot force you to use these channels, but we are trying to build a functional wireless network for the other attendees too. So please, don't do any experiments on other channels.
| |
|
| |
| === Can I bring an access point? ===
| |
|
| |
| No, this is strictly prohibited! We need all available channels to provide good quality coverage for the rest of the attendees. Please do not be selfish here as you will degrade performance for everyone else, and we WILL track you down.
| |
|
| |
| If you think you can ignore this rule because one little access point can't hurt anyone, think again. This page has the calculations on just how huge a problem it is for an event of our size: [[Network/Rogue Access Points]].
| |
|
| |
| If you are operating a village (using an EMF-supplied tent) that has poor coverage, we may be able to arrange to put an extra access point in it during the event to improve coverage. Stop by the NOC and ask.
| |
|
| |
| === Can I bring a switch? ===
| |
|
| |
| Yes, but for stability purposes all edge ports are limited to 10 MAC addresses at a time. If you want to connect a switch with more stations, you need to stop by the NOC and ask us to raise the port-security on your port. If you do this, you need to convince us that you know what you're doing and promise not to do anything that may harm the network - in particular, you must not connect the switch to our network by more than 1 cable (not even to a different DK). Make sure that you disable STP and other protocols on your switch which try to be intelligent.
| |
|
| |
| === My port goes up and down every couple of minutes ===
| |
|
| |
| You have probably tripped port security. Most likely scenario is that you have connected more than 10 stations without consulting us (see answer to previous question). To reduce support calls, the port will automatically be re-enabled after a few minutes. But if you haven't fixed the problem, it will immediately be shut down again.
| |
|
| |
| == Supporters ==
| |
|
| |
| We'd like to extend our immense gratitude to the following people and organisations who have been instrumental in making the EMF network and uplink happen through their donations and sponsorship:
| |
|
| |
| * [https://ethernet.business.sky.com Sky For Business]
| |
| * [http://www.sargasso.co.uk/from/emfcamp Sargasso Networks]
| |
| * [https://eventinfra.org EventInfra]
| |
| * [https://www.lonap.net LONAP]
| |
| * [https://www.comtec.com Comtec Enterprises]
| |
| * [https://www.mythic-beasts.com/ Mythic Beasts]
| |
| * [https://www.i3d.net/ i3D.net]
| |
