The Mikrotik Hotspot / captive portal is a great feature, however its limited by the ability to expire a user based on the login time/date. The existing options available to expire a user are uptime (cumulative time online) or bytes sent/received. Something better suited to our office environment is to give a user access for a period of time, say one day or one week. For a small office deployment it seems excessive to deploy and support a RADIUS server for this task, Mikrotik User Manager also doesn’t seem to contain this feature either. To get around this limitation I have devised a couple of scripts which can be used to achieve this function.

The scripts work by setting a comment on the user when they log in for the first time, the comment contains the date the user is logging in. Another script is then scheduled to run daily to find all the users where the date has reached greater than the specified period and disable the accounts.

Form simplicity I’m just going to apply this to the default user profile under /ip hotspot user profile

The script to add the date comment:

{
 :local date [ /system clock get date ]
 :if ( [ /ip hotspot user get $user comment ] = "" ) do={
  [ /ip hotspot user set $user comment=$date ]
 }
}

And the script to expire users, this converts the current date to an integer by summing the day, months and year together and comparing it against the same addition on the comment we placed on each user above. If the user is to be disabled, we also disconnect them if they are active. You can change the offset variable to how many days you would like to expire the user after.

{
 :local offset 7
 :global today

 {
  :local date [ /system clock get date ]
  :local montharray ( "jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec" )
  :local monthdays ( 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 )
  :local days [ :pick $date 4 6 ]
  :local monthtxt [ :pick $date 0 3 ]
  :local year [ :pick $date 7 11 ]
  :local months ([ :find $montharray $monthtxt]  )
  :for nodays from=0 to=$months do={
   :set days ( $days + [ :pick $monthdays $nodays ] )
  }
  :set days ($days + $year * 365)
  :set today $days
 }

 :foreach i in [ /ip hotspot user find where disabled=no ] do={
  :if ([ :find [ /ip hotspot user get $i comment ] ] = 0 ) do={
   :local date [ /ip hotspot user get $i comment ]
   :local montharray ( "jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec" )
   :local monthdays ( 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 )
   :local days [ :pick $date 4 6 ]
   :local monthtxt [ :pick $date 0 3 ]
   :local year [ :pick $date 7 11 ]
   :local months ( [ :find $montharray $monthtxt ] )
   :for nodays from=0 to=$months do={
    :set days ( $days + [ :pick $monthdays $nodays ] )
   }
   :set days ($days + $year * 365)
   :if ( ($days + $offset) < $today ) do={
    :local name [/ip hotspot user get $i name]
    :log info "HOTSPOT EXPIRE SCRIPT: Disabling Hotspot user $name first logged in $date"
    [ /ip hotspot user disable $i ]
    [ /ip hotspot active remove [find where user=$user] ]
   }
  }
 }
}

Lastly we need to add this to the system scheduler to run each day. I run it at 5mins past midnight.

/system scheduler add name=expire-hotspot-users on-event="/system script run expire-hotspot-users" \
policy=read,write start-time=00:05:00 interval=1d

Here’s the entire export:

/ip hotspot user profile
set [ find default=yes ] idle-timeout=none keepalive-timeout=2m on-login=":local date [ /system clock get date ]\r\
    \n:if ( [ /ip hotspot user get \$user comment ] = \"\" ) do={\r\
    \n [ /ip hotspot user set \$user comment=\$date ]\r\
    \n}" rate-limit=1024000/2048000 shared-users=unlimited
/system scheduler
add interval=1d name=expire-hotspot-users on-event="/system script run expire-hotspot-users" policy=read,write start-date=\
    may/30/2012 start-time=00:05:00
/system script
add name=expire-hotspot-users policy=read,write, source="{\r\
    \n :local offset 7\r\
    \n :global today\r\
    \n \r\
    \n {\r\
    \n  :local date [ /system clock get date ]\r\
    \n  :local montharray ( \"jan\",\"feb\",\"mar\",\"apr\",\"may\",\"jun\",\"jul\",\"aug\",\"sep\",\"oct\",\"nov\",\
    \"dec\" )\r\
    \n  :local monthdays ( 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 )\r\
    \n  :local days [ :pick \$date 4 6 ]\r\
    \n  :local monthtxt [ :pick \$date 0 3 ]\r\
    \n  :local year [ :pick \$date 7 11 ]\r\
    \n  :local months ([ :find \$montharray \$monthtxt]  )\r\
    \n  :for nodays from=0 to=\$months do={\r\
    \n   :set days ( \$days + [ :pick \$monthdays \$nodays ] )\r\
    \n  }\r\
    \n  :set days (\$days + \$year * 365) \r\
    \n  :set today \$days\r\
    \n }\r\
    \n \r\
    \n :foreach i in [ /ip hotspot user find where disabled=no ] do={\r\
    \n  :if ([ :find [ /ip hotspot user get \$i comment ] ] = 0 ) do={\r\
    \n   :local date [ /ip hotspot user get \$i comment ]\r\
    \n   :local montharray ( \"jan\",\"feb\",\"mar\",\"apr\",\"may\",\"jun\",\"jul\",\"aug\",\"sep\",\"oct\",\"nov\"\
    ,\"dec\" )\r\
    \n   :local monthdays ( 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 )\r\
    \n   :local days [ :pick \$date 4 6 ]\r\
    \n   :local monthtxt [ :pick \$date 0 3 ]\r\
    \n   :local year [ :pick \$date 7 11 ]\r\
    \n   :local months ( [ :find \$montharray \$monthtxt ] )\r\
    \n   :for nodays from=0 to=\$months do={\r\
    \n    :set days ( \$days + [ :pick \$monthdays \$nodays ] )\r\
    \n   }\r\
    \n   :set days (\$days + \$year * 365)\r\
    \n   :if ( (\$days + \$offset) < \$today ) do={ \r\
    \n    :local name [/ip hotspot user get \$i name]\r\
    \n    :log info \"HOTSPOT EXPIRE SCRIPT: Disabling Hotspot user \$name first logged in \$date\"\r\
    \n    [ /ip hotspot user disable \$i ]\r\
    \n    [ /ip hotspot active remove [find where user=\$user] ]\r\
    \n   }\r\
    \n  }\r\
    \n }\r\
    \n}"

I wanted to have RANCID automatically alert our infrastructure team of any changes to network device configurations, as well as maintaining a history of configuration revisions. By default RANCID is designed to perform a daily or periodic poll of networks devices to collect configurations, however with a few small tweaks it is possible to get a snapshot every time the devices configuration changes.

There are a couple of ways to achieve this, either triggering RANCID via SNMP traps, or from the devices syslog. I elected to use the syslog method as this gives the added benefit of collecting logs from our network devices as well.

One of the challenges I came across while configuring this, was that when using a web gui to make changes on some devices (for example an netscreen), the device configuration is saved after every single change. This meant a high amount of RANCID spam if several things were being altered at once. The solution below gets around this by writing to a file for each device that has been updated and only grabbing the configuration after no further changes have occurred for a specified period (five minutes).

I won’t cover installing RANCID or Syslog-ng here as there is plenty of other resources floating about on how to do this. On Ubuntu its as simple as apt-get install rancid syslog-ng.

First of all we need to edit /etc/syslog-ng/syslog-ng.conf to create a filter for our syslogs and then specify what to do with them. Here is what I added.

The first line listens for incoming UDP syslog messages.

source s_net { udp (); };

Next we create a destination rule of what to do when we receive logs we are interested in. Note the perl script (/usr/bin/mark_for_rancid.pl) here is what we will run when we get some interesting syslog traffic.

destination d_rancid { program("perl /usr/bin/mark_for_rancid.pl" template("$HOST\n") ); };

Here is some filters that I have defined to catch syslog traffic that I’m interested in, for IOS a “Configured from” message, for Junos – a commit and for a netscreen the “System configuration saved” message.

filter f_cisco_configured{ match ("SYS-5-CONFIG_I: Configured"); };
filter f_juniper_commit{ match ("UI_COMMIT:"); };
filter f_netscreen_saved{ match ("System configuration saved"); };

The last part of the syslog-ng configuration is to put these together into a rule. There are three rules below, one for each of the filters.

log {
 source(s_net);
 filter(f_cisco_configured);
 destination(d_rancid);
};

log {
 source(s_net);
 filter(f_juniper_commit);
 destination(d_rancid);
};

log {
 source(s_net);
 filter(f_netscreen_saved);
 destination(d_rancid);
};

The next step is to create the first of two perl scripts we will use.  /usr/bin/mark_for_rancid.pl is the script that runs when syslog-ng sees our defined interesting log messages above. This creates a file for each host in a directory and updates the timestamp on that file each time it is triggered.

#!/usr/bin/perl
use warnings;

my $host=<>;
my $collectdir = "/usr/local/rancid/var/collect";

chomp($host);
$host=lc($host);

if ($host) {system("su - rancid -c \"touch $collectdir/$host\"");};
1;

You can change the collectdir to some meaningful location, best to give your rancid user ownership of this directory as its that user who will be running the cron job to remove these files.

The next scrip is designed to be run from cron, I run it every minute to get changes as quickly as possible, but you may wish to decrease its frequency if you like. I’ve stored this as /usr/bin/rancid_collect.pl and it looks like this:

#!/usr/bin/perl
use warnings;
use File::stat;

use constant DEBUG => (0); #set to 1 to enable log text
my $age = 60*5;
my $collectdir = "/usr/local/rancid/var/collect";
@files = <$collectdir/*>;

print (scalar @files . " routers to consider collecting\n") if DEBUG;
foreach $file (@files) {
 @fileparts = split('/', $file);
  if ((time - stat($file)->mtime) > $age) {
   print "Running collection for $fileparts[6]\n" if DEBUG;
   system("/usr/bin/rancid-run -r $fileparts[6]");
   unlink($file);
   print "Collection completed\n" if DEBUG;
} else {
   print "$fileparts[6] is younger than $age seconds\n" if DEBUG;
}
}
1;

Essentially this lists all files in our collect dir and if the timestamp is older than the specified age (5 minutes) executes rancid-run to grab the devices config. It then removes the file.

The last step is to add this script to your rancid users crontab, something like this:

* * * * * /usr/bin/rancid_collect.pl 2>&1 > /dev/null

It’s worth mentioning that your forward and reverse DNS needs to be setup properly as the file that is created is the hostname of each device received via syslog, RANCID should be configured to use this name for the host.

Just a couple of quick notes to streamline your install of the Perl SDK for vSpehere 5.

It will speed up your install to grab a few prerequisites via aptitude first:

apt-get install libarchive-zip-perl libcrypt-ssleay-perl libclass-methodmaker-perl libdata-dump-perl libsoap-lite-perl perl-doc libssl-dev libuuid-perl liburi-perl libxml-libxml-perl ia32-libs

We also need to set the http_proxy and ftp_proxy vars for some reason, the installer will fail if they are not set, so to work around this we can just configure blank variables:

export http_proxy=
export ftp_proxy=

Now untar the package and run the installer:

tar -zxvf VMware-vSphere-Perl-SDK-5.0.0-422456.x86_64.gz
cd vmware-vsphere-cli-distrib
./vmware-install.pl

Accept the licence, and complete the install process.