Wireless Authentication

[MojoCat]

I am trying to get a basic blueprint of the following project:  Simular to air2data, I would like to allow wireless data in each of my store's networks.  The user would connect to the wireless network where he/she would be presented a webpage to login.  After a successful login, the user would have access to the network/internet.  I am guessing I would start out with a redirect until the user starts a session - perhaps stored under the mac address of the computer.  I think the router would point to the webserver as its default gateway, where the webserver would authenticate the user.  Anyone ever had a project like this?  I know my way around PHP quite well, but its just finding the structure of this project that is taking a while to figure out.  Any ideas would be greatly helpful!

 

Dan

[xtopolis]

This is really an "it depends" question:

 

Consider the following aspects...

 

Pre) Is that data that will be accessible potentially dangerous/vital to your company if leaked/hacked?

 

1)Is the wireless access only intended for your employees?

  Y)Start with building a secure network on the hardware side:

     --Encryption, limited available IP addresses/or static IPs only, non standard subnet for address pool (not using typical 192.168...addrs)

     --Filter by ip/ mac address

     --Alternative means of authentication

  N)Consider having 2 different routers, one to handle non employee access(customers, free wifi users), and another for employee only access(SEE Y).

 

2)Access to the network, shared folders/drives with windows/unix authentication to access, possibly even vpns?

 

-----

For authenticating a user, write a User class that checks to see if a session is set, and a hash is set for that user, and put it at the top of every page..  The way one of my simpler auth mechanisms works is:

 

At the top of every page I have

require 'config.php' --> holds vars(database names, passwords, etc,)

  (and inside config, it creates a database object for me to use)

require 'user.php'

 

$user = new User();

 

The user class checks to see if the user has a login hash set?, if not, it checks if there are $_POST vars set (meaning the user just tried to login), if not, it redirects and dies back to a login page.

 

On a successful login,(check database for 1 valid matching username/pass combo), then store username and hash of pw in session vars

My login hash is a hash of ($_SERVER['REMOTE_ADDR'].$_SESSION['un'].$_SESSION['pw'].$_SERVER['HTTP_USER_AGENT']);

 

Each time a page is loaded, the User class runs, and if it sees that hash  is set, it verifies it by checking is

$login_hash == hash of ($_SERVER['REMOTE_ADDR'].$_SESSION['un'].$_SESSION['pw'].$_SERVER['HTTP_USER_AGENT']);

 

If so, the session hasn't changed, it's a pretty good chance it's the same user.  allow the page to display.

[revraz]

You probably should get a commercial product for this like Aruba

 

http://www.arubanetworks.com/