newlinux wrote

I did send an email request about this to support.

Just wondering if others here had any information.

Hi guys!

I've waited long enough for TP-Link to release a newer version of EAP Controller for Linux, so I grabbed the new V2.6.1 just released for Windows and ported it to Linux for myself. I make this version available in the hope you will enjoy and probably help to test it further, so we can move on with new APs such as EAP225-Outdoor, which requires Controller v2.6.x.

I did wait for v2.6.1 because this version is supposed to fix multiple security bugs already being openly discussed such as CVE-2018-10164, CVE-2018-10165, CVE-2018-10166, CVE-2018-10167 and CVE-2018-10168.

But be warned: Although my setup of EAP Controller introduces privilege separation to fix a nasty root exploit in versions 2.4.x to v2.6.x I discovered and reported to TP-Link already last year, it still might be vulnerable, although my version will not allow to remotely change files outside the EAPController directory tree as do other versions. So, please read the following advice:

- If you are familiar with Linux firewalls and know what you do, you can run EAP Controller on public servers, but you have to block all EAPC ports not needed from the outside (read this twice!).

- If you want to be on the safe side without any special firewall setup, use EAP Controller only in private LANs, not on public servers.

Standard disclaimer: This software is no official release, it's a "fan-made movie". ;) By using it, you agree that there is no warranty, no support, not even a promise that the software fits for any purpose except academic research, LOL. Use on your own risk, but for your own fun! Fasten seat bells when running it.

Since the forum doesn't allow uploads anymore and I can't attach files to this post, here is how to download the EAP Controller v2.6.1 for Linux by anon FTP:

Update #2: The community version of Omada Controller 2.7.0 for Linux is here. It is supposed that TP-Link fixed all the known bugs mentioned above, while tpeap as usual adds Privilege Separation for enhanced security.

Update #1: For the new, improved tpeap v1.1, see the post #26 on page 3.

FTP to: ftp.rent-a-guru.de
Username: anonymous
Password: your mail address
Change directory: cd /private
Set bin mode: binary
Get TAR archive: get eapc-2.6.1.tar.gz
Exit from FTP: quit

Note that you will not be able to see a listing of the FTP directory /private nor see any files therein, but you can download the file eapc-2.6.1.tar.gz.

SHA256 sum for the file:

8761cd203ba2af53fb5dcf4dc74cc6899db1b3031d2c722ad067957dfa477289 *eapc-2.6.1.tar.gz

Read this recipe first to the end before changing anything in your setup, especially read the paragraph about saving your old config.

Let's go:

To install EAP Controller v2.6.1 I recommend to save your current version first. Rename /opt/tplink/EAPController to /opt/tplink/EAPController-x.y.z, where x, y and z are replaced by the version number of your current software.

IMPORTANT: In order to get right ownership of files you need to create a role account for the EAP Controller user first. I suggest you either create a role account as described below before unpacking the TAR archive in its final installation /opt/tplink/. This way, you don't have to fiddle with right ownership of the files.

To create a role account, execute following command as root:

adduser --system --disabled-login --group --no-create-home \
        --home /opt/tplink/EAPController --gecos "EAPC privilege separation" \
        --shell /bin/bash eapc

Next, unpack the TAR archive downloaded by FTP as user root directly in /opt/tplink/ or in any other directory of your choice. It will create two subdirectories, one is EAPController-2.6.1, the other is tpeap, my improved start/stop script for the Controller.

You don't need to use /opt/tplink for the installation, but you need to create a symlink /opt/tplink/EAPController pointing to the actual installation directory such as /whatever/directory/EAPController-2.6.1.

The tpeap script is already installed in the EAP Controller v2.6.1, so you don't need to copy it over, but since there is a nice README and a man page, I did include the complete tpeap package separately. You can install the man page in your online manual - see the man page for the man command to find out the directory name for local man pages.

As explained above, now create a symlink /opt/tplink/EAPController pointing to /opt/tplink/EAPController-2.6.1. This way, you can easily switch back to your old software if you wish to do so by simply changing the symlink.

Next, create a symlink /etc/init.d/tpeap pointing to /opt/tplink/EAPController/bin/tpeap. Run the command update-rc.d tpeap if you want to have EAP Controller started automatically at reboot of your server. For usage of update-rc.d RTFM. Note that I here use the name EAPController, not the actual installation directory. This simplifies future updates significantly and tpeap can even be used to start your old EAP Controller version, if you correct its files ownership as outlined in the README!

If you want, you can install another symlink /usr/bin/tpeap pointing to the start/stop script /opt/tplink/EAPController/bin/tpeap, so you can easily start and stop EAPController by just typing this new command instead of the full path name of the script.

See the README if you are unsure how to create those symlinks.

One more step: If you want to save your old config, copy the content of the data subdirectory over to EAPController-2.6.1. Make sure to not change ownership of files, since eapc needs write permissions to those files! I tested this with a config from v2.5.3, but if you are upgrading from earlier EAP Controller versions, it might fail. In the latter case you might want to make a backup of the settings through the web UI and install it later the same way in v2.6.1. I didn't test this, because I type much faster in the command line than you can even grab your mouse. :)

Note that tpeap will background itself to start/stop the EAP Controller, so don't panic if the controller does not start immediately after tpeap exits. If you want to run tpeap in the foreground as the old tpeap script did, run the new script with option -w. For more options/arguments of tpeap again RTFM.

Note that v2.6.1 needs more time to start up than previous versions needed. If your system is a slow one and tpeap exits too fast, you might to want increase the value of the WAIT_TIME variable in the script.

After start of EAPController connect to it using a web browser as usual.

Sunshine!

PS: If you want to read more about the privilege separation, see the README included in the tpeap distribution or search for my old posts in this forum (search keys: "privilege separation", "eapc", "pharosctl" for the same for Pharos Controller).

And while we're at it:

Find here Pharos Control v2.0.4 for Linux with privilege separation fixing security bugs such as visible admin passwords in the database:

FTP to: ftp.rent-a-guru.de
Username: anonymous
Password: your mail address
Change directory: cd /private
Set bin mode: binary
Get TAR archive: get PharosControl-2.0.4.tar.gz
Exit from FTP: quit

SHA256 sum for the file:

8aabd1eff80b5a9c9a58fb0befb0ae71f7beaaa9706a665c6cee9108ed995802 *PharosControl-2.0.4.tar.gz

Same story, same game: you need to create a role account for the Pharos Control server:

adduser --system --disabled-login --group \
        --no-create-home \
        --home /opt/pharoscontrol \
        --gecos "Pharos Control Privilege Separation" \
        --shell /bin/bash pharos

Then extract the TAR archive into /opt/tplink, create a symlink PharosControl therein pointing to PharosControl-2.0.4.

Install PharosControl/bin/pharosctl into /etc/init.d and - if you wish - into /usr/bin (again with symlinks) and there you are. A README is included, also a man page for pharosctl.

Note that you need an external Java Runtime Environment to run Pharos Control, for example the latest Oracle JRE (the EAP JRE is not recommended for Pharos Control).

This one was harder to port to Linux, I needed to use the Java class for starting up the server on headless systems from the old version. Also, it still needs testing, but looks fine so far. Update: saving firmware files in the Pharos repository for batch updates doesn't work yet.

More sunshine! ;)