Cellular Network Infrastructure » cni-legacy » OpenBSC

[[PageOutline]]

= Information on the WRTU54G UMA TA =

== Getting shell / console access ==

The easiest part is to flash a modified firmware image that removes the root password from the /etc/passwd file in the squashfs.

You can then access the serial console and log in as root without password.

== Changing the SEGW / GANC address ==

On the shell of the device, change to the /nv directory and edit the two lines in rc.conf for UMA_SGW and UMA_UNC to:

{{{

UMA_SGW="my.segw.host.name"

UMA_UNC="my.unc.host.name"

}}}

Then, use the {{{rawaccess -a rc.conf}}} command to store the changes to flash and reboot the system.

== Enabling more logging ==

In /nv/rc.conf:

{{{

LOG_ENABLE="1"

UMALOG_ENABLE="on"

UMA_LOG_SIZE="1"

}}}

Then, use the {{{rawaccess -a rc.conf}}} command to store the changes to flash and reboot the system.

== Adding a new CA Certificate ==

While modifying the firmware, add your new CA root certificate in DER format to /ramdisk_copy/etc/kineto/ and then add the filename

and path into a new line in /ramdisk_copy/etc/kineto/init_ike.cfg, like this:

{{{

ike ca /etc/kineto/my_new_ca.der

}}}

Furthermore, edit /etc/rc.d/init.d/umaset and /etc/rc.d/init.d/RJ11_recovery to each include a line like this:

{{{

echo "ike ca /etc/kineto/my_new_ca.der" >> $IKE_CONF

}}}

== Enabling telnet ==

Using the toolchain included in the Linksys WRTU54G GPL release, you can cross-compile utelnetd for a compatible uclibc:

{{{

./utelnetd-0.1.11 $ make CC=mipsel-linux-gcc

mipsel-linux-gcc -I. -pipe -DSHELLPATH=\"/bin/login\" -Wall -fomit-frame-pointer   -c -o utelnetd.o utelnetd.c

mipsel-linux-gcc  -I. -pipe -DSHELLPATH=\"/bin/login\" -Wall -fomit-frame-pointer utelnetd.o  -o utelnetd

strip  --remove-section=.comment --remove-section=.note utelnetd

./utelnetd-0.1.11 $

}}}

You can then include this utelnetd binary into the squashfs image to /usr/sbin/utelnted.

Furthermore, you have to edit /etc/rc.d/rc.proprietary and change the line

{{{

[ "`uname -ar | grep diag`" ] && /usr/sbin/utelnetd&

}}}

into

{{{

usr/sbin/utelnetd&

}}}

to unconditionally start the telnet daemon at every boot.  Alternatively, you can set

{{{

hostname="diag"

}}}

in /nv/rc.conf.

= Setting up a SEGW =

The SEGW needs to

 * allocate a virtual IP to the remote end from a local pool

 * use EAP-SIM to authenticate the peer, using tuples (IMSI/RAND/SRES/Kc)

 * authenticate itself using a certificate that has been signed by the CA certificate installed on the WRT54U

 * provide at least one DNS server via IKEv2 attributes to the peer

== make sure your private key is not PKCS8 ==

The default CA.pl script of opensl generates private keys in PKCS#8 format, which is not supported

by charon of OpenSWAN.  you have to convert the PKCS#8 into raw RSA files like this:

{{{

openssl pkcs8 -nocrypt < my_privatekey.pem > my_privatekey_raw.pem

}}}