Slashdot Mirror
IAS/RADIUS Implementation in a Coffee Shop?
noyler asks: "I've been asked to decide on the best way for metering a 'free' wireless network at a local coffee shop. Here's the scenario: currently, local college students come to the coffee shop, grab a cup of coffee, and then spread out like it's a study hall for 6 to 10 hours at a time and use the free internet. The coffee shop loves this, but it's getting really crowded for the other customers that just come in for some coffee and have nowhere to sit. The management wants to implement a system that, upon buying a drink, grants a time-limited connection for that customer of 3 or 4 hours. If the customer wants more access, another drink will need to be purchased. The store network is a simple cable modem with wireless access point attached right now. After implementation, customers should be prompted for a username/password (which can come from his or her receipt) and then have access to the 'net. One limitation is that the customers should not have to install any third-party software to use it--no window for software corruption liability that way. The customer base is mostly Windows with an ever-growing number of Mac users as well. What are some good ideas for doing this? I've considered RADIUS, or some kind of portal software, but don't see any clear answers. Any suggestions for software to use?? The coffee shop is very low budget, so cheap hardware and free software would be best!"
You could ask the patrons to make another purchase when the food or drink runs out/gets cold...
Print out a randomized WEP key on the receipt, and somehow automate it to be good for only 3 hours.
Before I part with'em: two pennies weigh ~4.996+/-0.014g, have a zinc core, and the face of Lincoln. You can keep 'em.
Looks to me like the management is a bunch of assholes. No other coffee shop does this, so why do you think customers will tolerate it?
Does the coffee shop have a problem with people buying one drink and staying there for more than 4 hours?!?!?!!? I doubt it. The extra complications and customer confusion aren't worth the one or two people who leech of the network.
A local coffee shop recently implemented a policy where wireless access is turned off from 11:30am to 1:30pm. They already get tons of business during lunch hours, so they don't need to attract any more.
And the men who hold high places must be the ones who start
To mold a new reality... closer to the heart
Hook up each computer to a bicycle-powered generator. After 3 or 4 hours, they'll need to buy another coffee just to keep them awake.
Easy peasy.
Why not just hire the Annoying Coffee Shop Guy from MTV's Boiling Point.
Beauty is in the eye of the beerholder.
Simply have the manager remind the students that the free networking is supported by thier continued purchasing. Simply changing the mindset is a whole lot better than trying to screw with a psudeo-login-tracking system. It also allows the managers to target just those that are a problem rather than inconviencing everyone.
This would certainly be a cheap solution:
http://www.hackinthebox.org/article.php?sid=15607
NoCatNet will do what you need it to.
NoCat
I suggest looking at the ZyXEL ZyAIR B-4000. It's an access point / receipt printer that is commonly used for selling access. The user gets a receipt, logs into a website, and is granted access for X period of time. You could make it so that when someone buys coffee, they get a receipt good for four hours. Or for $X they can get all day access... It's all up to you. Either way, it's trivial to use. The clerk just presses one of three preconfigured buttons on the receipt printer, the receipt with the access code is created, and everything else happens automagically.
Replace all your electrical outlets with blank faceplates. Once the battery's out, the user's got to go somewhere else. Should be about 3-4 hours or so....
perl -e 'foreach(values %SIG){$_="IGNORE";}while(){}'
Pretty simple really. The store management generates a set of userid / password cards good for the time period that they want (1 hour, 2 hours, etc).
When you buy a cup of coffee, you can get a free card. If the worker sees your laptop, he or she can give it to you automatically, or you can ask.
Then customers who connect wirelessly can use the the username / password combination to get online. When their time is up, they will be disconnected and will need to get a new username and password combination.
Tut Systems ExpressWay is one example of a product that does this. (DISCLAIMER: I have a business relationship with Tut Systems).
The world will not get better through technology. We must seek to be better people.
Easy Fix! or charge for the good seats by the outlets!
Set up few bar tables for laptop users, so they have to stand up while using the wireless access. Just state clearly that chairs are reserved only for customers with beverages.
This idea is so asinine and restrictive that I can almost guarantee that it will fail miserably as well as probably upset a great deal of the existing customer base. Case in point: I frequent a coffee shop here in Pittsburgh constantly. The Beehive offers free wireless access as well as has around 8-9 computers with all sorts of multiplayer games installed, as well as DVD drives (you can watch movies), and believe it or not, cable access. A number of the computers have tuner cards built in. The money they get from the PCs more than covers the costs of their relatively low upkeep, upgrades, and of course the DSL, which seems to be basic SDSL at maybe.....1.5mps? They are the only coffee shop in the area to offer free internet, and of course people come and congregate based on this fact. The most comparable coffee shop that offers internet would be the Quiet Storm, and it costs roughly $20/month to $10 for a few hours or something (maybe the day). Of course, Starbucks has T-Mobile hotspots that are completely locked down, but I won't get into THAT. Don't charge by the hour. By imposing a fixed cost for a fixed period of time (1 coffee = 3 hours or whatever) people will feel like they are being charged for internet usage. No coffee, no internet. If your crowd is a mostly college crowd, it is understandable that many of them are rather poor and cannot afford $10 in coffee a day. I'm sure that a sizable percentage of your customers comes by just to hang out and sees a coffee or two as the cost of admission. This is the appeal of coffee shops, right? The more friends people have with them, the more paying customers you have. If you have a problem with a large group that does not buy enough to use up your entire space, they need to be kindly, and politely I might add, informed about the simple economics of running a coffee shop. I'm sure the owner pays rent or a mortgage, taxes and obviously, employees. Also, you should look at supplementing the costs of the free net with some rental computers or something that people can use out of convenience, like a CD burner and a printer. Sometimes it is incredibly convenient to be working on a project and have such things available without having to go to kinkos, especially in a college environment. Just think about this differently at least. Anything so restrictive is sure to raise complaints and decrease the overall satisfaction of your customers. $100/month is totally worth it to spend, especially when your customers are buying freaking $2-3 coffees. If you implement a system like this, it is going to take time and money to deploy and test, depending on your setup, which I'm guessing isn't probably all that sophisticated. The problem is really the people that are just using the space. Those are customers you can certainly afford to lose and the best way is ultimately to politely ask them to leave if they are finished with their drinks so that paying customers can use their space. Every bar and coffee shop (the successful ones at least) I've been to will certainly follow some similar policy. I drive a taxi and I clearly wouldn't let someone ride around without giving me some cash. I expect any other sensible businessman to do the same.
zosxavius photography
Please don't comment on stories in which you have no interest.
I successfully implemented a RADIUS-based captive portal on m0n0wall recently. It's a very solid (and free) solution, made more robust by having a separate machine for RADIUS and isc-dhcpd. FreeRADIUS is quite easy to manage, we just used a flat-file for auth. You can also use an SQL server if you need it.
http://www.m0n0.ch/wall
I stuck it on a Dell SFF. Incredibly robust. No downtime in a week (the entire project duration) for over 500 users.
M0n0wall is very easy to use and manage, NoCat had me wiped out trying to configure it. The main stumbler was that active development is only progressing on NoCatSplash, which AFAIK still doesn't do authentication, and NoCat doesn't intuitively run on BSD, tied as it is to Linux' firewall.
And as a BSD user, I was more drawn to m0n0wall anyhow.
While it might be a bit expensive, BlueSocket is what is used at Virginia Tech for its wireless network. Students log in with their student ID and password and it records the MAC address. After 15 minutes of inactivity, the MAC address is dropped from the usage table and the use has to log back in again. I'm sure it could be modified to do other things, too.
These "Vantage Service Gateway" appliances that Zyxel sells are pretty neat, but not exactly cheap: vsg-1200 @ buy.com.
:)
They have some quirks, as we're still playing around w/the one we have.. Like they seem to break VPN for example. They do a weird rewrite of DNS that screws up people trying to check their email via outlook over a VPN... But if you don't need VPN from behind then, they seem to do the job.
Transparently controls access to the internet, no configuration on the user's machine is needed. It intercepts any web traffic and makes the user login, as you were mentioning. You can set up user accounts locally on the VSG, or use a RADIUS server. You can control access time and bandwidth limits based on users and billing profiles that you set up on the box. The web interface seems a little "clunky" to me... think it was written in a different country and translated based on the wording of some of the error messages
Place sig here.
I agree with others: A verbal reminder is the best. If it's a technological solution, us-types (Slashdotters, that is) will naturally try to get around it - we treat it as a challenge. The first thing that came to my mind was just picking up a discarded receipt from one of the 98% of customers who don't use wireless.
Nomadix is probably the leader in this space. Their products are good, fast, and relatively cheap considering the functionality and low maintenance requirements. For small sites there is the wireless gateway and for larger ones (up to 200 concurrent users) there is the HotSpot gateway. You can review the products and feature list here
Someone else mentioned ZoneCd from publicip, which we looked into, but my client decided that a support contract was more in-line with their operational model. However, if you're posting here, chances are you would be fine with ZoneCd. Either way, you can avoid the mess of RADIUS and MS.Couldn't you set up the access point so that it only allows access from a certain area of the coffee shop? Not sure how big this place is but if it is big enough to delegate only half or a fourth of the tables/seating to people wanting to use the internet this might work. You know, use foil or something to block the WIFI from going into the area of the shop you want to allow for people just there to drink some coffee so that people sitting there won't get a wireless signal at all. Then mark one area as the wireless internet access area.
Forgive me if blocking the WIFI signal is impossible... but I thought it was pretty easy to block the signal from spreading (like lining the inside of a cardboard box with foil leaving just one side open and putting the access point in there.
My Xbox Live Gamer Card
I live in Riga, Latvia. Paid public WiFi access is available in many places such as "Double Coffee", "Coffee Nation", "Statoil", "Lido" etc. etc. Wireless service is provided by Lattelekom. Coffee shop customers can buy prepaid cards with username and password for Lattelkom Radius server. Alternatively, login/pass can be obtained by SMS. Coffee and Internet access can be purchased together or separately. When there are no more free seats waitress will ask WiFi-only customers to leave.
t =6 705
http://www.lattelekom.lv/ltk/content/?lng=en&ca
The idea is that any establishment can use Lattelekom service to grant paid WiFi access to their customers.
Friends of mine used to run a coffee shop. You were given 10 minutes to sit at a table without a drink. Then someone would come collect your cup and ask "would you like another?" You were, of course, permitted to say no. You were then given another 10 minutes, and someone would again come to the table and ask "can I get you anything?" Again, you're permitted to say no. 10 more minutes and the waiter would return to the table and state "I'm sorry, if I can't get you anything I'm going to have to ask you to leave." And that got rid of the lurkers.
How we know is more important than what we know.
I agree that verbal warnings would be a bad solution. I've had exepriences at coffeeshops where the manager came out every hour to check the timestamp on everyone's receipts. If it was more than an hour old, you had to buy something or leave. Lets just say that this practice didn't bolster a sense of respect for the establisment.
I think some obvious, well placed signage reminding people that they should support the cafe appropriate to the time spent would be the best solution. That way, you don't have to battle with your customers, and it would promote an atmosphere of support for the business. Plus, you don't want to kick out someone who may be a good regular customer just because they've only a few bucks on them one day (as students sometimes do).
This too, will end.
**DISCLAIMER ON**
;-). When it prints the reciepts with the "code" it can also add it into another database to check against when they use the webpage.
I've seen this question in different forms before. I know there has to be something out there indexed on freshmeat that will handle it, but I have yet to see it done the way I would do it. And the idea is only in my head, I haven't yet the chance to play with an actual implementation so I may be mispeaking Linuxes capabilities or how specifically to go about this.
**DISCLAIMER OFF**
The way I would look at doing it would be a simple cheap linux box with a WiFi card and a LAN Card. You can turn the linux box into a WiFi gateway with a 192.168.x.x on one side and the "real" network on the other. Add in NAT.
Now as for the authentication/control/lock down that will be accomplished via firewall rules and a webpage. If they are "authenticated" then you add the appropriate firewall rules to allow them to get out. You have a script check every 5 minutes for expires and remove them out of the firewall rules when they expire. Those that are expired are presented with a webpage that will allow them to get out again. This can all be done with firewall rules. A rule to let them out, or a rule that directs all port 80 traffic to a special web server that presents them with one page only.
This web page can take whatever input you want (ala PHP or Perl) and add them in again. I liked the idea of the reciepts. You could even have the a Linux POS/WiFi router that handles it all
Would love the chance to put one together. If there are any coffee shops in the Boise Idaho drop me a line...
Happy Hacking!
"Don't fear death... fear not living..." -me
Do it for me.. I built a prepay wireless gateway that works on a simple system of assigning a unique number to authenticate a connection - extra work was required to properly meter only 'external' bandwidth, and some minor mods required to disconnect users when their paid-for time expired (though this feature is in chillispot now).
I ran this on an X-Box with a USB wireless adapter, and it would work quite happily on any IP based network setup.
I gots ta ding a ding dang my dang a long ling long
I've been to a few places that do this already. One doesn't actually block the (plentiful) plugs, but their official policy is battery only. Signs are posted saying so. It's OK to plug in to save and shutdown if your battery runs out. The other places simply have no plugs available.
Just remove all of the publicly accessible power outlets. That'll limit them to the charge they have on their laptop batteries. Of course, it's still something only an asshole would do.
It's good to use your head, but not as a battering ram.
This device comes with a printer and all you have to do is push a button to print authentication info for the users.
http://www.zyxel.com/product/model.php?indexcate=1 103876296&indexcate1=1085450343&indexFlagvalue=102 1876859