Personal Website of Yakov Shafranovich

WPA on Fedora Core 3 with Microsoft’s MN-520 WiFi Card

I had the the Microsoft MN-520 Wireless PCMCIA Card for some time but have never yet used a router with WPA support. With the move and a new wireless setup, I decided to use WPA-PSK for better security over plain WEP. Much to my suprise Linux did not support WPA out of the box (unlike Windows XP SP2) but after some fiddling, I got it to work. I am going to summarize the steps that I took in this post in hopes that it would be helpful for someone else.

NOTE: I am running Redhat Fedora Core 3 and am providing instructions for that OS only.

To start off, the default wireless driver used for this card (orinoco_cs) does not support WPA. In order to use WPA with this card, you will need to install a different driver plus a special software piece called a “supplicant” which takes care of the authentication (I happen to use “wpa_supplicant”). Here are the steps you should follows.

1. Download the latest stable hostap-driver, wpa_supplicant and hostap-utils source from http://hostap.epitest.fi/.
2. Extract the hostap-driver and hostap-utils source into two directories, switch to root (su) and run make in each directory (if you are running kernel v2.6.12, you will need to fiddle with the source of the kernel until hostap compiles properly).

NOTE: Before running make on hostap-driver, you will need to enable the NVRAM download. Look for a file called “hostap_config.h” in “/driver/modules” directory of the extracted source. In it, find the line “#define PRISM2_NON_VOLATILE_DOWNLOAD” and make sure it is NOT commented out.

3. Run the “make install” command in the hostap-driver directory to install the driver.
4. Find the “/etc/pcmcia/config” file. In it you will find the entry for the Microsoft MN-520 card. You need to comment out the entry with “#”.
5. Restart the pcmcia services by running “/etc/init.d/pcmcia restart” in order to reload the configuration file.
6. In the system log you should see something along the lines of the following when you insert the PCMCIA card (you can use “tail /var/log/messages -f” to monitor it):

Jul 31 17:16:46 localhost kernel: hostap_cs: 0.3.7 - 2005-02-12 (Jouni Malinen)
Jul 31 17:16:47 localhost kernel: hostap_cs: Registered netdevice wifi0
Jul 31 17:16:47 localhost kernel: hostap_cs: index 0×01: Vcc 5.0, irq 3, io 0×0100-0×013f
Jul 31 17:16:47 localhost kernel: wifi0: NIC: id=0×800c v1.0.0
Jul 31 17:16:47 localhost kernel: wifi0: PRI: id=0×15 v1.1.0
Jul 31 17:16:47 localhost kernel: wifi0: STA: id=0×1f v1.4.97. Now at this point, the driver should be functional. HOWEVER, the second piece of the puzzle - the wpa_supplicant WILL NOT work until the firmware on the actual card is upgraded. Before doing that, go into the hostap-utils directory, and run the following command: “./hostap_diag wlan0″. You should see something along the lines of:

NICID: id=0×800c v1.0.0 (PRISM II (2.5) PCMCIA (SST parallel flash))
PRIID: id=0×0015 v1.1.0
STAID: id=0×001f v1.4.9 (station firmware)

The three version numbers in the syslog and provided by hostap_diag are the version numbers of the firmware. In order for wpa_supplicant to work, they need to be upgraded to v1.70 (the latest is 1.84). Jun Sun has a webpage devoted to the discussion on the gory details.

NOTE: Flashing firmware on your card may render is unusable and is not covered by warranty. Additionally, depending on the country you are in and the manufacturor of the card, this may even be illegal. I take no responsibility for anything that may happen to you or your card. Remember: you are on your own here
8. Download the latest Prism firmware from Pavel Roski’s site. In that file you will find several directories. In the primary directory look for a file called “pk*something”, in the secondary look for a file called “sf*something”. These are the right firmware revisions for the MN-520 card. Make sure that the “sf” file is numbered at least above 01070.
9. Put the two files into the hostap-util directory and run “./prism2_srec pk**** sk*****”. You NEED to include both files. If everything is fine, the program will end off with an “OK” message. This just a check to make sure the files are compatible.
10. If you are to update the card, run “./prism2_srec -v -f pk**** sk*****” to actually update the card. Following that, plug it out and plug it back in, and you should have the following in your syslog indicating the higher version numbers:

kernel: wifi0: NIC: id=0×800c v1.0.0
kernel: wifi0: PRI: id=0×15 v1.1.1
kernel: wifi0: STA: id=0×1f v1.8.4

11. After this is done, you can actually replace the hostap drivers with RPMs from atRPMs since the firmware update ability will no longer be needed.
12. After this is all finished, install wpa_supplicant (either via a precompiled RPMs or straight compiled). After installation, change the “/etc/wpa_suplicant.conf” file with your network data and run it as follows:

/usr/sbin/wpa_supplicant -c/etc/wpa_supplicant.conf -iwlan0 -d

If everything is fine, the WPA support should go up and work.

Feel free to leave comments on this post.

Posted in Linux | No Comments »

Thunderbird RPM

Since the official Fedora distribution is lagging, Thomas Chung provides excellent instructions on building your own RPM. For the lazy ones among you, I put up my binary RPM here.

Following up on an earlier problem of sharing Thunderbird data between Windows and Linux, David Tenser has an article on his website explaining how to do it. The key is to install the Windows version FIRST. I will post whenever I get around to doing it.

Posted in Projects, Linux | No Comments »

Recovering a Corrupted RPM Database

One of the more fun things to do for Linux sysadmins is dealing with corrupted RPM databases. RPM or “Redhat Package Manager” was invented by Redhat to allow for easier management of installed programs and dependicies on Linux systems.

In my specific case, one of our servers running Fedora Core 2 somehow got its RPM database corrupted. The recommended remedy is running “rpm -vv –rebuilddb” to rebuild the RPM database from the sources. In our case it was so bad, that everything was corrupted. Luckily, Redhat systems run a cron job daily to record the list of all RPM packages in the system and place that in the “/var/log/rpmpckgs” file. So the solution was as follows:

1. Backup the /var/lib/rpm directory (tar -cf somefile /var/lib/rpm/).
2. Erase the RPM files (rm /var/lib/rpm/* -f).
3. Re-init the RPM database (rpm -vv –initdb).
4. Use a script written by Michael Fratoni to parse the package list and rebuild the DB.

The two problems that I had is figuring out that the “/var/lib/rpm” directory needed to be emptied AND that we didn’t have any RPM files on disk (which the script required). Some more patching of the script to download the files first via “wget” helped. The result - an hour of command line work and one recovered RPM database.

Posted in Programming, Linux | Comments Off

Internet Connection Sharing on Linux

Recently I have been asked about how to setup a service similar to Internet Connection Sharing (ICS) in Windows. For those really interested Microsoft’s ICS implementation consists of an internal DHCP server hardwired to the 192.168.0.0/24 range with the master computer set to 192.168.0.1. There is also a small DNS server running on the master computer caching the data from the network’s DNS servers and some sort of forwarding process that actually shuffles the data back and forth. Since standard protocols are used, any type of OS can use such configuration including Linux and Mac OS. But, the question of the day is how to setup a similar thing on Linux.

We need three components for this to function: a DHCP server, a DNS server and the traffic forwarding component. Luckily Linux includes all three with every possible customization option needed. The DHCP and DNS servers, called “dhcpd” and “bind” respectively, are both made by ISC and are available for download there or at your favorite repository. If you are using Fedora Core, then you should also download “caching-nameserver” packages to make your local DNS server cache the DNS for the network. Of course, it goes without saying that YOU NEED a network interface of some kind to connect the computers together in your internal network.

1. LAN SETUP.

The first step is to make sure that your internal network functions. You should setup your Ethernet wired or wireless card and set its IP address to something like “192.168.0.1″ via “ifconfig” utility as follows:

/sbin/ifconfig eth1 192.168.0.1 netmask 255.255.255.0

Run “/sbin/ifconfig” to check if the changes are applied. If you are using a Redhat Linux or Fedora Core system, you can set these settings via the “Network” utility in “System Settings” folder of your start menu (assign IP address).

2. DHCP Server.

Once the LAN is setup and DHCP is installed, you need to create a configuration file and place it in “/etc/dhcpd.conf”. Here is a sample configuration:

default-lease-time 3600;
max-lease-time 7200;
authoritative;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.0.255;
option routers 192.168.0.1;
option domain-name-servers 192.168.0.1;
ddns-update-style ad-hoc;
subnet 192.168.0.0 netmask 255.255.255.0 {
range 192.168.0.10 192.168.0.50;

This will set your DHCP server. Now you have to start it as follows (on Redhat/Fedora):

/etc/init.d/dhcpd start

Or manually:

/sbin/dhcpd

Check the system log and at this point you should try pinging different computers on your local LAN to see if the LAN setup works. If it does, the next step is the DNS server.

2. DNS / BIND.

If you installed BIND and “caching-nameserver” package on Fedora, all you need to do is start the server:

/etc/init.d/named start

Check the system log to make everything is fine. To check whether DNS works locally, use the “nslookup” command and run “server 127.0.0.1″ and try to do a lookup (with an Internet connection). Then try to do the same on any other LAN computer via nslookup/

3. Sharing the connection.

The actual sharing component in Linux is done via the firewall (iptables or ipchains depending on the Kernel version). For the 2.6 kernels, the iptables command is used. You need add the following to “/etc/sysconfig/network” file on Fedora:

FORWARD_IPV4=true

and run a set of commands:

/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

where “eth0″ is your Internet connection. For a simpler solution, just download the Firestarter GUI Firewall which has NAT support.

Once everything is up and running, try to see if Internet is up on client computers via a web browser. Make sure to check the system log for problems. Once you have everything down pat, you can set the DNS and DHCP servers to run automatically either via the “Services” utility in Fedora (to run on startup) or by editing the “ifup/ifdown” scripts in the “/etc/syconfig/network-scripts” directory (to start when the connection goes up).

Posted in Programming, Linux | Comments Off

Viewing Treo’s SD card under Linux

Today I ran into an interesting problem with my Treo 600 and Redhat’s Fedora Core 2 Linux. I was trying to transfer something over to the external SD card in the Treo. A few days ago I got the external SD card reader to work after some fidgeting, but today I happen to be trying out a trial version of a program called Card Export II. What this program does is that is presents the inserted SD card as a USB drive to the OS, just like a flash drive allowing regular OS tools to read and write to it. At the same time, it also avoids the speed problems that regular Palm Desktop process has for SD cards on Windows. The question is how to get to work this under Linux. It is also convient that I do not have to take out the SD card from the Treo.
Read the rest of this entry »

Posted in Projects, Programming, Linux | 2 Comments »