IAS/RADIUS Implementation in a Coffee Shop?

noyler asks: "I've been asked to decide on the best way for metering a 'free' wireless network at a local coffee shop. Here's the scenario: currently, local college students come to the coffee shop, grab a cup of coffee, and then spread out like it's a study hall for 6 to 10 hours at a time and use the free internet. The coffee shop loves this, but it's getting really crowded for the other customers that just come in for some coffee and have nowhere to sit. The management wants to implement a system that, upon buying a drink, grants a time-limited connection for that customer of 3 or 4 hours. If the customer wants more access, another drink will need to be purchased. The store network is a simple cable modem with wireless access point attached right now. After implementation, customers should be prompted for a username/password (which can come from his or her receipt) and then have access to the 'net. One limitation is that the customers should not have to install any third-party software to use it--no window for software corruption liability that way. The customer base is mostly Windows with an ever-growing number of Mac users as well. What are some good ideas for doing this? I've considered RADIUS, or some kind of portal software, but don't see any clear answers. Any suggestions for software to use?? The coffee shop is very low budget, so cheap hardware and free software would be best!"

Comments

How to Build a Simple Wireless Authenticated Gatew

[jsimon12]

This would certainly be a cheap solution:
http://www.hackinthebox.org/article.php?sid=15607

I'm pretty sure

[SLot]

NoCatNet will do what you need it to.

NoCat

ZyXEL ZyAIR B-4000

[nuxx]

I suggest looking at the ZyXEL ZyAIR B-4000. It's an access point / receipt printer that is commonly used for selling access. The user gets a receipt, logs into a website, and is granted access for X period of time. You could make it so that when someone buys coffee, they get a receipt good for four hours. Or for $X they can get all day access... It's all up to you. Either way, it's trivial to use. The clerk just presses one of three preconfigured buttons on the receipt printer, the receipt with the access code is created, and everything else happens automagically.

Public IP / Zone CD

[therubberduckie]

By far the greatest setup for this is http://www.publicip.net/. It will actually allow users to login and you can set how long each user is allowed to use the wifi. The developer is very active in the forums and personally answers almost all questions. Here is a list of the features. Check it out, I have used it in the past and been nothing but impressed!

• Customize ZoneCD login pages
• Choose to use a branded template
• Create multiple zones from same login
• Zones can be Public, Shared or Private
• Separate permissions for your Zone logins.
• Configure web registration
• User authentication and management
• Homepage redirection
• Daily time limits per user
• Daily download limits
• Zone open and close times
• Block by mac address
• Configure user permissions(Classes)
• Customize firewall rules for each Class
• Content Filtering (block porn, downloads, etc.)
• Daily Log Mailer program
• Block traffic to *wired* network
• Branded "Terms of Use" template or use your own
• Usage statistics
• Multilingual login pages
• End-User reporting

m0n0wall or NoCat

[derinax]

I successfully implemented a RADIUS-based captive portal on m0n0wall recently. It's a very solid (and free) solution, made more robust by having a separate machine for RADIUS and isc-dhcpd. FreeRADIUS is quite easy to manage, we just used a flat-file for auth. You can also use an SQL server if you need it.

http://www.m0n0.ch/wall

I stuck it on a Dell SFF. Incredibly robust. No downtime in a week (the entire project duration) for over 500 users.

M0n0wall is very easy to use and manage, NoCat had me wiped out trying to configure it. The main stumbler was that active development is only progressing on NoCatSplash, which AFAIK still doesn't do authentication, and NoCat doesn't intuitively run on BSD, tied as it is to Linux' firewall.

And as a BSD user, I was more drawn to m0n0wall anyhow.

Coffee shops

[QuantumG]

Friends of mine used to run a coffee shop. You were given 10 minutes to sit at a table without a drink. Then someone would come collect your cup and ask "would you like another?" You were, of course, permitted to say no. You were then given another 10 minutes, and someone would again come to the table and ask "can I get you anything?" Again, you're permitted to say no. 10 more minutes and the waiter would return to the table and state "I'm sorry, if I can't get you anything I'm going to have to ask you to leave." And that got rid of the lurkers.