From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Brendan Grieve" Subject: [Announcement]: Web Statistics Frontend for ulacc Date: Sun, 12 May 2002 09:12:50 +0800 Sender: netfilter-admin@lists.samba.org Message-ID: <001d01c1f952$22a57db0$641410ac@cat> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_001A_01C1F995.30BC88B0" Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.samba.org This is a multi-part message in MIME format. ------=_NextPart_000_001A_01C1F995.30BC88B0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable [To Moderator if Any]: My apologies on last emails. They had a typo in = the return address. Resent with correct address. Hi All, I've sat down and written up some Traffic Accounting Software for some = of my clients. This part of it is the Web Front End that they see. I thought = this would be of interest to some of you. If you prefer to see a working (sane chrooted) example, click through = to: http://www.worldguard.com.au/cgi-bin/ipacc Here is an except from my README file: - ipacc ----- -------------------------------------------------------------------------= -- 1. What is it? -------------------------------------------------------------------------= -- This piece of software has been designed to run with my Traffic Account Module written for ULOGd. Therefore I shall start off by giving a quote from its documentation: - As part of my UAS software suite (Users Aren't Stupid), I have a = Traffic Accounting module for use with Harald Welte's ulog netfilter target. (http://www.gnumonks.org/cgi-bin/cvsweb.cgi/ulog). I've been looking = for a decent 2.4 Kernel traffic accounting module for a while and gave up = and wrote my own. This module has one fairly interesting feature. Most networks that I administrate are generally quite dynamic. That is, all the = workstations on it are assigned their network details and IP Address via DHCP. As = some of my clients wished to have accounting down to the workstation = detail, I've made this particular module use a mixture of the IP and MAC. This means that if a workstation gets a new IP, it will still have traffic statistics applied correctly to it. If more than one IP has the same = MAC, as when they are behind a router, then accounting will still work, but will only give totals for all addresses. This means I'm trusting the = MAC rather than the IP, and I am using two tables, one to store MAC's and = one to store IP's, with a relationship of one MAC to many IP's. NOTE: Both = a MAC and IP_can_ be forged, but this is a topic for another discussion. ------8< Snip of Documentation on how it does this ---- 8< ----------- * It would be fairly simple to write a web front-end that parses the file and links MAC to machine names. ipacc is essentially the 'web front-end' that parses in the logfile and gives a user friendly report. There's not terribly much more to comment on it, apart from the fact that its taken hours of work and I'm very pleased to FINALLY finish it. -------------------------------------------------------------------------= -- 2. How do I Compile it? -------------------------------------------------------------------------= -- Hopefully this is fairly simple. I'll just give some step-by-step instructions: - 1. Uncompressed archive to some directory. 2. Copy examples/ipacc.conf to /etc, and modify it. 3. Ensure ipaccount.log exists. Touch it if not. Did I mention that you should also have already set up my ulogd_ACCOUNT module? 4. Create a new group 'ipacc' and add the user the webserver runs under to it. On my system I added the following entry to my /etc/group ipacc:x:22:httpd 5. Set relevant modes on the config file and logfile dir. On mine I = went: - chown root.root /etc/ipacc.conf && chmod u=3Drw,g=3Dr,o=3Dr /etc/ipacc.conf chown root.ipacc /var/log/ipacc && chmod u=3Drwx,g=3Drx,o=3D /var/log/ipacc chown root.root /var/log/ipacc/* && chmod 644 /var/log/ipacc/* 6. Compile it. Should be as simple as going 'make' in the directory. 7. Copy the binary 'ipacc' to your cgi-bin directory. On my system it was /usr/shared/httpd/cgi-bin, and make sure the webserver has perms to run it. ie: - install -o root -g ipacc -m 750 ipacc /usr/shared/httpd/cgi-bin 8. Copy the icons directory to your webserver icons directory, or set up your web server such that http://localhost/icons/ipacc/blah.jpg will read the picture. Make sure permissions are correctly set. Done! -------------------------------------------------------------------------= -- 3. ipacc.conf -------------------------------------------------------------------------= -- The config file is fairly simple (I hope). It is based around having = groups of options. For instance, if a company has 20 computers, and those 20 computers belong to 3 departments, it would make sense to create three groups, and stick the relevant computers into their relevant group. That way each department can pay for their internet usage. There is also one 'special' group called 'GLOBAL'. This simply holds a = few global variables for use in configuring the software. It can also hold 'default' values for some variables. A typical options file will look like: - group GLOBAL { # Comment - Global Options set here } group R&D { # Custom group called R&D host 00:43:21:59:22:0d "Hawk Eye" host 00:43:21:59:0d:16 "Eagle Eye" } group OTHER { # I like to put unknowns in their own group accept_unknown 1 } A list of all the current variables are as follows. A [G] means it can = be set in the GLOBAL group. A [C] means it can be set in a custom group. accept_unknown [C] Someone brings in their notebook from home and plugs in. They will register as an unknown MAC address. Who should account for this traffic? This option sets a group to 'accept' unknown MAC address traffic. Values can be 0 or 1 cost_per_meg [C][G] When enabling cost estimation, this option specifies how much each meg over and beyond 'initial_traffic' costs. Value is a float/real. cosT_per_month [C][G] When enabling cost estimation, this option specifies how much per month you have to pay minimum. Value is a float/real estimate_cost [G] Use this option to enable cost estimation. The software will try to work out how much you are paying for bandwith. It uses the highest of upload or download. Value can be 0 or 1 host [C] This gives a MAC address a name. Whenever the MAC address is seen in the logs, it will now be assigned to this group, and given a more friendly name. Value is of the form: MACADDRESS FRIENDLYNAME ipaccountlog [G] Where can the ipaccount log be found. Value is a string initial_traffic [C][G] When cost estimation is enabled, what initial traffic do you get before you have to start paying per megabyte. keepstats_days [G] NOT USED YET - This field will specify how long to keep statistics in the 'watermark' files. This way you can rotate and delete the larger uLOG file without losing history. keepstats_size [G] NOT USED YET - This field will specify the maxium size the 'watermark' file can be. This was you can rotate and delete the larger ULOG file without losing history. percent_total [G] When enabled, certain columns will appear on some reports showing the percentage bandwith used of the TOTAL bandwith for that month by a group(s)/computer. This way, if it says 'R&D' is using 35% of the bandwith, they can pay for 35% of the total cost. Use this rather than relying on Cost Estimation to be totally accurate. -------------------------------------------------------------------------= -- 4. What is 'Automatic' -------------------------------------------------------------------------= -- Before I forget I'll just explain Automatic (Found on the report). I've actually written an IP account report before for clients of mine. It was based on ipchains and used the 'counter' for a chain. It was a = huge big ugly hack but it worked, and I loathed every character of it. When I updated to my much nicer cleaner interface, I found that my new interface just didn't feel as inuitive. Sometimes I want to sort by Computer, and sometime by date. So I created an 'Automatic' sort that emulates my old interface's method of sorting. It uses the following = rules: - No Month or Group Selected - Show by Date - A month selected, but no Group/Computer - Show by Group (for that month) - No month selected, but a group/computer selected - Show by date (for that group/computer) - Both a month and group selected - Show by Group (A list of Computers in the group, for that Month) This was a nice clean hack :-) -------------------------------------------------------------------------= -- 5. TO DO -------------------------------------------------------------------------= -- Not much really. I would like to implement a 'watermark' file that = stores the 'parsed' ULOG file. This way the Ulog file can be safely deleted, = and a date/size can be set on how long to keep old history. -------------------------------------------------------------------------= -- 6. Contact/Download Details -------------------------------------------------------------------------= -- My name is Brendan Grieve. I hope someone finds some use for this = software or can modify to their needs. Official Download Location: http://www.worldguard.com.au/projects/ipacc My Email: brendan (@) worldguard.com.au Stay well. God Bless! ------=_NextPart_000_001A_01C1F995.30BC88B0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
[To Moderator if Any]: My apologies on = last emails.=20 They had a typo in the return address. Resent with correct = address.
 
Hi All,

I've sat down and written up some Traffic Accounting = Software for some of my
clients. This part of it is the Web Front End = that=20 they see. I thought this
would be
of interest to some of = you.

If=20 you prefer to see a working (sane chrooted) example, click through = to:
http://www.worldguard= .com.au/cgi-bin/ipacc

Here=20 is an except from my README file:=20 -

ipacc
-----

------------------------------------------= ---------------------------------
1.=20 What is=20 it?
------------------------------------------------------------------= ---------

This=20 piece of software has been designed to run with my Traffic = Account
Module=20 written for ULOGd. Therefore I shall start off by giving a quote
from = its=20 documentation: -

  As part of my UAS software suite (Users = Aren't=20 Stupid), I have a Traffic
  Accounting module for use with = Harald=20 Welte's ulog netfilter target.
  (http://www.gnumo= nks.org/cgi-bin/cvsweb.cgi/ulog).=20 I've been looking for
  a decent 2.4 Kernel traffic accounting = module=20 for a while and gave up and
  wrote my own.

  This = module=20 has one fairly interesting feature. Most networks that I
  = administrate=20 are generally quite dynamic. That is, all the workstations
  on = it are=20 assigned their network details and IP Address via DHCP. As = some
  of my=20 clients wished to have accounting down to the workstation = detail,
  I've=20 made this particular module use a mixture of the IP and MAC. = This
 =20 means that if a workstation gets a new IP, it will still have = traffic
 =20 statistics applied correctly to it. If more than one IP has the same=20 MAC,
  as when they are behind a router, then accounting will = still=20 work, but
  will only give totals for all addresses. This means = I'm=20 trusting the MAC
  rather than the IP, and I am using two = tables, one to=20 store MAC's and one
  to store IP's, with a relationship of one = MAC to=20 many IP's. NOTE: Both a
  MAC and IP_can_ be forged, but this is = a topic=20 for another discussion.

------8< Snip of Documentation on how = it does=20 this ---- 8< -----------

    * It would be = fairly=20 simple to write a web front-end that = parses
     =20 the file and links MAC to machine names.

ipacc is essentially the = 'web=20 front-end' that parses in the logfile and
gives a user friendly = report.=20 There's not terribly much more to comment
on it, apart from the fact = that its=20 taken hours of work and I'm very
pleased to FINALLY finish=20 it.


----------------------------------------------------------= -----------------
2.=20 How do I Compile=20 it?
------------------------------------------------------------------= ---------

Hopefully=20 this is fairly simple. I'll just give some step-by-step
instructions: = -

1. Uncompressed archive to some directory.

2. Copy=20 examples/ipacc.conf to /etc, and modify it.

3. Ensure = ipaccount.log=20 exists. Touch it if not. Did I mention that you
   should = also have=20 already set up my ulogd_ACCOUNT module?

4. Create a new group = 'ipacc' and=20 add the user the webserver runs under
   to it. On my = system I=20 added the following entry to my=20 /etc/group
       =20 ipacc:x:22:httpd

5. Set relevant modes on the config file and = logfile=20 dir. On mine I went: -
        = chown=20 root.root /etc/ipacc.conf && chmod=20 u=3Drw,g=3Dr,o=3Dr
/etc/ipacc.conf
     &n= bsp; =20 chown root.ipacc /var/log/ipacc && chmod=20 u=3Drwx,g=3Drx,o=3D
/var/log/ipacc
     &n= bsp; =20 chown root.root /var/log/ipacc/* && chmod 644 = /var/log/ipacc/*

6.=20 Compile it. Should be as simple as going 'make' in the = directory.

7. Copy=20 the binary 'ipacc' to your cgi-bin directory. On my system = it
  =20 was /usr/shared/httpd/cgi-bin, and make sure the webserver has=20 perms
   to run it. ie:=20 -
        install -o root -g ipacc = -m 750=20 ipacc /usr/shared/httpd/cgi-bin

8. Copy the icons directory to = your=20 webserver icons directory, or set up
your
   web server = such=20 that http://localhost/icons/ipa= cc/blah.jpg=20 will read
   the picture. Make sure permissions are = correctly=20 set.

Done!

------------------------------------------------= ---------------------------
3.=20 ipacc.conf
-----------------------------------------------------------= ----------------

The=20 config file is fairly simple (I hope). It is based around having = groups
of=20 options. For instance, if a company has 20 computers, and those = 20
computers=20 belong to 3 departments, it would make sense to create three
groups, = and=20 stick the relevant computers into their relevant group. That
way each = department can pay for their internet usage.

There is also one = 'special'=20 group called 'GLOBAL'. This simply holds a few
global variables for = use in=20 configuring the software. It can also hold
'default' values for some=20 variables.

A typical options file will look like:=20 -

    group GLOBAL=20 {
        # Comment - Global = Options set=20 here
    }

    group R&D=20 {
        # Custom group called=20 R&D
        host = 00:43:21:59:22:0d=20 "Hawk Eye"
        host = 00:43:21:59:0d:16=20 "Eagle Eye"
    }

    group = OTHER=20 {
        # I like to put unknowns = in=20 their own group
        = accept_unknown=20 1
    }

A list of all the current variables are = as=20 follows. A [G] means it can be
set in the GLOBAL group. A [C] means = it can be=20 set in a custom group.

accept_unknown [C]
Someone brings in = their=20 notebook from home and plugs in. They will
register as an unknown MAC = address. Who should account for this
traffic? This option sets a = group to=20 'accept' unknown MAC address
traffic.
Values can be 0 or=20 1

cost_per_meg [C][G]
When enabling cost estimation, this = option=20 specifies how much each
meg over and beyond 'initial_traffic' = costs.
Value=20 is a float/real.

cosT_per_month [C][G]
When enabling cost = estimation,=20 this option specifies how much per
month you have to pay = minimum.
Value is=20 a float/real

estimate_cost [G]
Use this option to enable cost=20 estimation. The software will try to
work out how much you are paying = for=20 bandwith. It uses the highest
of upload or download.
Value can be = 0 or=20 1

host [C]
This gives a MAC address a name. Whenever the MAC = address=20 is seen in
the logs, it will now be assigned to this group, and given = a=20 more
friendly name.
Value is of the form:    =20 MACADDRESS FRIENDLYNAME

ipaccountlog [G]
Where can the = ipaccount log=20 be found.
Value is a string

initial_traffic [C][G]
When = cost=20 estimation is enabled, what initial traffic do you get
before you = have to=20 start paying per megabyte.

keepstats_days [G]
NOT USED YET - = This=20 field will specify how long to keep statistics in
the 'watermark' = files. This=20 way you can rotate and delete the larger
uLOG file without losing=20 history.

keepstats_size [G]
NOT USED YET - This field will = specify the=20 maxium size the 'watermark'
file can be. This was you can rotate and = delete=20 the larger ULOG file
without losing history.

percent_total = [G]
When=20 enabled, certain columns will appear on some reports showing = the
percentage=20 bandwith used of the TOTAL bandwith for that month by
a = group(s)/computer.=20 This way, if it says 'R&D' is using 35% of the
bandwith, they can = pay for=20 35% of the total cost. Use this rather than
relying on Cost = Estimation to be=20 totally=20 accurate.


----------------------------------------------------= -----------------------
4.=20 What is=20 'Automatic'
----------------------------------------------------------= -----------------
Before=20 I forget I'll just explain Automatic (Found on the report).
I've = actually=20 written an IP account report before for clients of mine.
It was based = on=20 ipchains and used the 'counter' for a chain. It was a huge
big ugly = hack but=20 it worked, and I loathed every character of it.

When I updated to = my much=20 nicer cleaner interface, I found that my new
interface just didn't = feel as=20 inuitive. Sometimes I want to sort by
Computer, and sometime by date. = So I=20 created an 'Automatic' sort that
emulates my old interface's method = of=20 sorting. It uses the following rules:

 - No Month or Group=20 Selected
    - Show by Date
 - A month = selected, but=20 no Group/Computer
    - Show by Group (for that=20 month)
 - No month selected, but a group/computer=20 selected
    - Show by date (for that=20 group/computer)
 - Both a month and group = selected
   =20 - Show by Group (A list of Computers in the group, for that = Month)

This=20 was a nice clean hack=20 :-)

--------------------------------------------------------------= -------------
5.=20 TO=20 DO
-------------------------------------------------------------------= --------
Not=20 much really. I would like to implement a 'watermark' file that = stores
the=20 'parsed' ULOG file. This way the Ulog file can be safely deleted, = and
a=20 date/size can be set on how long to keep old=20 history.


-----------------------------------------------------= ----------------------
6.=20 Contact/Download=20 Details
--------------------------------------------------------------= -------------
My=20 name is Brendan Grieve. I hope someone finds some use for this = software
or=20 can modify to their needs.

Official Download Location: http://www.worldguar= d.com.au/projects/ipacc
My=20 Email:  brendan (@) worldguard.com.au

Stay well. God=20 Bless!


------=_NextPart_000_001A_01C1F995.30BC88B0--