Created – October 30, 2002
Last updated – April 21, 2003
The primary goal of this
How-To is to install and configure Red Hat Linux 8.0 with an Orinoco wireless
NIC and the Kismet wireless sniffer. Now these
instructions also include drivers for Prism (SMC, Linksys, D-Link, etc.),
Cisco, and/or Amtel 802.11a wireless NICs. These instructions were primarily created for an IBM T30 with Windows 2000
Professional on half the hard drive. I
will use the other half of the hard drive for my Red Hat Linux
installation. Although, these instructions
were created for my particular situation, they should apply to many other
configurations.
Note - This process also works with Red Hat 9.0. The process to install the wireless tools is the same, but the file names (because of versions) is slightly different. I'm going to create a new document in the next couple of weeks to this exact process.
Note - For a period of time it was necessary to recompile the kernel when using Red Hat 8.0 + Orinoco-11b drivers. I believe changes were made to the Orinoco drivers that make this task unnecessary (I first noticed this in early March 2003). If you follow the following instructions you should no longer need to recompile the Kernel. If you would like learn how to build a simple kernel or want to use an older version of the Red Hat 8.0 kernel or Orinoco drivers, see my old Red Hat Linux 8.0 + Orinoco + Kismet HOWTO document.
Install Red Hat 8.0
Download Required Files
Update to the most recent packages
Install Orinoco drivers
Install HostAP drivers for Prism based cards (Optional)
Install ar5k drivers for Atheros 802.11a cards (Optional)
Install Ethereal
Install GPSDrive (Optional)
Install ImageMagick (Optional)
Install Kismet
Configure Kismet
Running Kismet
Other security tools
Install libpcap
To-Do
Questions/Comments/Concerns
Credits
Red Hat Linux has become the
most popular alternative the Windows operating systems. From the beginning of Red Hat, the company
has been working to package an operating system that is simple to install, easy
to use, and contains a variety of practical features.
There are several options to
obtain the media necessary to install Red Hat Linux. Some of the more popular options include:
If you install from CD, it is
recommended that you verify the integrity of the discs the first time you use
them. You will be prompted for this at
the beginning of the installation. The
first and most important step of this install is to install Red Hat Linux. If you need help to install the operating
system, visit http://www.Red
Hat.com/docs/manuals/linux/RHL-8.0-Manual/install-guide/.
Additionally, if you need to download a copy of Red Hat 8.0, visit the following site to find a mirror: http://www.redhat.com/download/mirror.html.
Here
are the options I choose during the installation of Red Hat Linux:
·
Select Language
(English) * Default
·
Keyboard Configuration
(US English) * Default
·
Mouse Configuration (3
Button Mouse (PS/2) * Default
·
Installation Type
(Custom)
·
Disk Partitioning Setup
(Automatically partition)
·
Automatic Partitioning
(Remove all Linux Partitions on this system)
·
Disk Setup (nothing)
·
Boot Loader
Configuration (Default)
·
Network Configuration
(Set hostname manually “wireless1”)
·
Firewall configuration
(Default)
·
Additional Language
Support (Default)
·
Time Zone Selection
(America/Chicago)
·
Account Configuration
(enter password for root account and create user account)
·
Authentication
Configuration (Default)
·
Package Group Selection
(Add the following)
o SQL Database Server - Add "mysql-server" (Click on Details)
o
Development Tools
o
Kernel Development
o
X Software Development
o
Gnome Software
Development
o Select System Tools, but remove "ethereal"
Total
install size: 1,921M
·
About to Install
(forward)
Installation
(25 minutes later for a CD install, 4 hours for a net install)
·
Boot Diskette Creation
(create one if you wish)
·
Graphical Interface (X)
Configuration (Select what you have – I have the ATI Radeon Mobility 7500)
·
Monitor Configuration
(Unprobed Monitor)
·
Customize Graphics
Configuration (Default)
·
Exit
(Automatically
Shutdown and restart into Red Hat Linux)
·
Welcome (forward)
·
Date and Time (I selected
Enable Network Time Protocol - forward)
·
Sound (forward)
· Update Agent (forward) register and install updates
·
Additional CDs (select
what you want)
·
Finish Setup (Forward)
Register with the Red Hat Network
Login using root and your password
Run
up2date to update the system with the latest and most stable packages.
Note – I understand it is
not recommended that you run a NIX system as root, and I agree if it were a
multi-user system that this would be discouraged.
Several files will be
required to complete the installation process.
Download the following files into the specified directories:
Login
with your username and password.
Start
a terminal window.
Red
Hat Icon -> System Tools -> Terminal
Note – Because it’s Linux,
and you should get use to the command line, you might add a link to the
terminal window to the panel window (Microsoft calls it the Task Bar). Right click on the panel window -> Add to
Panel -> Launcher from menu -> System Tools -> Terminal.
There are several different
drivers that work with Orinoco wireless NICs. The best and most popular
drivers are written by David Gibson, but do not include support to put the card
into monitor mode. The Orinoco drivers
by must be modified with a patch from Shmoo to enable this functionality. To find
out more information about the Orinoco drivers visit
http://ozlabs.org/people/dgibson/dldwd/. Additionally, for information about the
Shmoo patch for Orinoco cards, visit http://airsnort.shmoo.com/orinocoinfo.html.
Install
the Orinoco drivers
# cd or # cd /root/
# tar -zxf orinoco-0.13b.tar.gz
# patch -p0 <
orinoco-0.13b-patched.diff
patching file
orinoco-0.13b/hermes.c
patching file
orinoco-0.13b/hermes.h
patching file
orinoco-0.13b/orinoco.c
patching file
orinoco-0.13b/orinoco.h
# cd orinoco-0.13b
# make
# make install
To
test that the Orinoco drivers have installed correctly, you should see the
following lines after running the “dmesg“ command.
# dmesg
hermes.c: 4 Dec 2002 David
Gibson <[email protected]>
orinoco.c 0.13b (David
Gibson <[email protected]> and others)
orinoco_cs.c 0.13b (David Gibson <[email protected]> and others)
eth1: Station identity
001f:0001:0008:000a
eth1: Looks like a Lucent/Agere firmware version 8.72
eth1: Ad-hoc demo mode
supported
eth1: IEEE standard IBSS
ad-hoc mode supported
eth1: WEP supported,
104-bit key
eth1: MAC address
00:02:DE:AD:BE:EF
eth1: Station name
"HERMES I"
eth1: ready
eth1: index 0x01: Vcc 5.0, irq 3, io 0x0100-0x013f
eth1: New link status: Connected (0001)
Additionally,
to test that the Shmoo patch installed correctly, you should see “monitor”
listed as one of the available features.
# iwpriv eth1
eth1 Available private
ioctl :
force_reset (8BE0)
: set 0 & get 0
card_reset reset (8BE1) : set
0 & get 0
set_port3 reset (8BE2)
: set 1 int & get 0
get_port3 (8BE3)
: set 0 & get 1 int
set_preamble (8BE4)
: set 1 int & get 0
get_preamble (8BE5)
: set 0 & get 1 int
set_ibssport (8BE6)
: set 1 int & get 0
get_ibssport (8BE7)
: set 0 & get 1 int
monitor (8BE8)
: set 2 int & get 0
Note – I have notices that the Orinoco drivers do not want to release from the interface and you must manually shut down the interface. If you remove a wireless NIC, type in "# ifconfig eth1 down" before you reinsert or restart any PCMCIA NIC.
There are three main Linux drivers for Prism based cards with different features (Orinoco drivers, Linux-wlan drivers, and HostAP drivers). For my How-To document, I choose the HostAP driver because of the feature to turn the wireless NIC into an Access Point. For more information about the HostAP drivers go to http://hostap.epitest.fi/.
Copy the proper Red Hat Kernel config file for your system into the Kernel source folder. The source file will be different for different systems. Because my computer is a Pentium 4, I will use the kernel-2.4.18-i686.config file.
# cp /usr/src/linux-2.4/configs/kernel-2.4.18-i686.config /usr/src/linux-2.4/.config
Expand the HostAP file
# cd or cd /root
# tar –xzf hostap-2002-10-12.tar.gz
# cd hostap-2002-10-12
Compile and install the drivers
# make
# make install_pccard
To
test that the HostAP drivers have installed correctly, you should see the
following lines after running the “dmesg“ command.
# dmesg
hostap_crypt: registered algorithm 'NULL'
hostap_cs: hostap_cs.c 0.0.0 2002-10-12 (SSH Communications Security
Corp, Jouni Malinen)
hostap_cs: (c) Jouni Malinen <[email protected]>
hostap_cs: setting Vcc=33 (constant)
hostap_cs: CS_EVENT_CARD_INSERTION
prism2_config()
hostap_cs: setting Vcc=50 (from config)
Checking CFTABLE_ENTRY 0x01 (default 0x01)
IO window settings: cfg->io.nwin=1 dflt.io.nwin=1
io->flags = 0x0046, io.base=0x0000, len=64
hostap_cs: index 0x01: Vcc 5.0, irq 3, io 0x0100-0x013f
divert: allocating divert_blk for wlan0
hostap_cs: Registered netdevice wlan0
prism2_hw_init()
prism2_hw_config: initialized in 9396 iterations
wlan0: NIC: id=0x8002 v1.0.0
wlan0: PRI: id=0x15 v0.3.0
wlan0: STA: id=0x1f v0.8.3
wlan0: defaulting to host-based encryption as a workaround for firmware
bug in Host AP mode WEP
wlan0: LinkStatus=2 (Disconnected)
The ar5k drivers are the first open source Linux drivers written for 802.11a cards. Currently the drivers only enable the receive components of the wireless NIC, but just enough features necessary to monitor 802.11a networks.
Expand the vt_ar5k file
# cd or cd /root
# tar –xzf vt_ar5k_20030130.tar.gz
# cd vt_ar5k
Compile ar5k drivers
# make
Install the ar5k drivers into the proper locations. I had problems with "make install" so I'm installing them manually.
# cp vt_ar5k.o /lib/modules/2.4.18-27.8.0/net/vt_ar5k.o
# cp etc/pcmcia/vt_ar5k.conf /etc/pcmcia/vt_ar5k.conf
Edit the "/etc/modules.conf" file
Add the following line to select the channels that are available. This will be slightly different if you live outside the US.
options vt_ar5k reg_domain=fcc
Restart the pcmcia service
# service pcmcia restart
To
test that the ar5k drivers have installed correctly, you should see the
following lines after running the “dmesg“ command.
# dmesg
vt_ar5k: found [mem_start:0xd1ddc000, mem_end:0xd1dec000, len: 65536, irq:11]
vt_ar5k: setting up initial configuration register
divert: allocating divert_blk for wlan0
vt_ar5k (wlan0): starting card in standard mode
vt_ar5k (wlan0): MAC revision 0x0007
vt_ar5k (wlan0): PHY revision 0x0003
vt_ar5k (wlan0): A2 revision 0x0001
vt_ar5k (wlan0): hardware address 00:DE:AD:BE:EF:02
vt_ar5k (wlan0): status 0x00000100
vt_ar5k (wlan0): card initialized successfully
cs: IO port probe 0x0c00-0x0cff: clean.
cs: IO port probe 0x0100-0x04ff: excluding 0x3b8-0x3df 0x4d0-0x4d7
cs: IO port probe 0x0a00-0x0aff: clean.
Libpcap provides a network library that helps programmers create code that is easy to wire and portable to other operating systems. This package is now optional to get Kismet working, but recommended if you want to use Ethereal or tcpdump.
Expand
the libpcap file.
# cd or cd /root
# tar –xzf
libpcap-current.tar.gz
The
following line will depend on the date you downloaded the file.
# cd
libpcap-2002.10.19
# ./configure
# make
# make install
Ethereal is a network
protocol analyzer that allows for the capture, viewing, and analysis of
information of each packet that is transmitted over a network. When Kismet runs, it collects packets and
saves them to a file that is compatible with Ethereal. The Kismet dump files can be opened and
further analyzed in Ethereal. For more
information about the use and installation of Ethereal, visit http://www.ethereal.com/docs/user-guide/.
The
installation of Ethereal is as follows:
# cd /usr/src
# tar –xzf
ethereal-0.9.11.tar.gz
# cd ethereal-0.9.11
# ./configure
# make
# make install
GpsDrive is a navigation system that works in conjunction with a NMEA compatible GPS device to determine your exact position by collecting coordinate information. The installation of this program is optional and only necessary if you would like the ability to collect location information while using Kismet. The location data collected from a GPS combined with signal strength can be used to create maps of radio coverage. The coverage maps are created using the "gpsmaps" program included with Kismet. Additionally, recent versions of GPSDrive (greater the 1.30) can log access points detected with Kismet into a backend MySQL database.
Begin the installation of GpsDrive by uncompressing the files:
# cd / or cd /root
# tar –xzf gpsdrive-1.32.tar.gz
# cd gpsdrive-1.32
Configure, compile, and install the GpsDrive program:
# ./configure
# make
# make install
Now start the the mysqld service.
# service mysqld start
(you could also add mysqld to start automatically when Linux boots - Red Hat -> Server Settings -> Services, select mysqld, and click save)
Now run a script to create a MySQL database that will hold the access points that you detect.
# mysql < create.sql
To verify that GpsDrive works,
# gpsdrive &
Select “setup”
Select the serial port you will be using on your computer (I’m using “/dev/ttyS0”)
Note – If you’ve configured GpsDrive and are receiving “Input/output error”, you might verify that the serial port is enabled in BIOS. You can verify you are receiving data from the GPS with the following command:
# cat /dev/ttyS0
Install ImageMagick (Optional)
ImageMagick is a graphics package that contains tools and libraries necessary if you would like to use the program “gpsmap” included with Kismet. Gpsmap combines coordinate information collected from a GPS, with signal strength information to produce maps of wireless coverage areas.
Install ImageMagick from source
# cd or # cd /root
# tar –xzf ImageMagick-5.5.6.tar.gz
# cd ImageMagick-5.5.6
# ./configure
# make
# make install
Kismet has become one of the
standard tools necessary to perform wireless security assessments or just good
old war driving. The included features
challenge that of most commercial products, and are only limited to the weekly
(many times daily) update the author provides.
To
compile kismet, complete the following steps.
# cd or cd /root
# tar –xzf kismet-devel.tar.gz
# cd kismet-devel
# ./configure
# make dep
# make
# make install
If you have problems
installing Kismet or need help with other configuration options. http://www.kismetwireless.net/usage.shtml
Kismet must be configured to
specify various options including the type of wireless network card you will be
using.
Edit
the “/usr/local/etc/kismet.conf“
file.
Red Hat -> Accessories
-> Text Editor
Open ->
/usr/local/etc/kismet.conf
Or
use a command line editor such as pico or vi
#pico
/usr/local/etc/kismet.conf
Change
the following values in kismet.conf.
suiduser=<username you
created>
Verify
that eth1 is your wireless interface (I have a wired NIC eth0 and the Orinoco
as eth1).
source=orinoco,eth1,Kismet
logtemplate=%h/kismet-logs/%n-%d-%i.%l
Save
the “kismet.conf”
configuration file and exit.
Make
the kismet-logs directory that we stated in the kismet configuration file.
# cd /home/<username
you created>
# mkdir kismet-logs
Note – If you have been
doing everything as root, be sure to change the permissions on the kismet-logs
directory to belong to the user and not to root.
# chown
your_user_name:your_user_name kismet-logs
First you must place the
wireless card into monitor mode. This
can be done with the kismet_monitor command.
By adding the “–H” parameter, the program automatically rotates through
the different channels (radio frequencies) available to 802.11b.
To
begin kismet, type the following commands.
# kismet_monitor -H
# kismet
If
you want to use GpsDrive and Kismet, type the following commands.
# service mysqld start (you could also add it to start automatically when linux boots - Red Hat -> Server Settings -> Services, select mysqld, and click save)
# gpsdrive
select "start gpsd"
exit gpsdrive
# kismet_monitor -H
# kismet
new terminal window
# gpsdrive
Select the "use SQL" option
Select the "Show WP" option
Kismet has a good amount of
built in help documents. Once you begin
the Kismet program, press “h” to open a help window. Most screens will have a help window that explains each area, and
keys that can be pressed for various actions.
Another good source of help can be found in both the Kismet forum and
the Netstumbler forum.
Airsnort
– http://airsnort.shmoo.com
Wellenreiter
– http://www.remote-exploit.org/
Tcpdump
– http://www.tcpdump.org
Nmap
– http://www.insecure.org
AirJack
– http://802.11ninja.net
· Get the T30 sound card to work in Kismet (I got this to work with the ALSA drivers)
Change Log
1/13/2003 - Added Database Server, Added Change Log
1/15/2003 - Added GPSDrive Instructions
1/21/2003 - Added ImageMagick Instructions
2/7/2003 - A couple of corrections (Thanks S. Seglie)
3/13/2003 - Don't know what exactly what change, but I found it's no longer necessary to recompile the Red Hat kernel. I believe that one of the Red Hat Kernel updates must have made a change to how it supports modules. If you need to recompile the kernel, you might try the old version of my HOWTO instructions.
3/18/2003 - Renamed the document to Red Hat 8.0 Kismet HOWTO because now I've added support for other wireless NIC drivers. Updated the versions of Ethereal and ImageMagick.
3/27/2003 - Removed some old language about the pcmcia-cs drivers
3/31/2003 - Fixed two small mistakes (Thanks Robert)
4/21/2003 - Mentioned that the process works with Red Hat 9.0
Questions/Concerns/Comments
Feel free to contact me at [email protected].
btrimble, J. Repucci (corrections), S. Seglie, Robert
Copyright
2002 Tipsybottle.com. All Rights
Reserved