chilli(8)

📦 version 1.7, in alpine 3.24

🫶 chilli(8) — the manual, but make it iconic 🫶

okay bestie, so this is the System Manager's Manual entry for chilli(8), and we're about to get into it. no cap, this little daemon is doing a LOT. let's go 💅

✨ NAME ✨

chilli — a Software Access Controller for Captive Portal and WPA

like, it's the bouncer for your Wi-Fi, fr fr 🚪✨

🌈 SYNOPSIS 🌈

chilli --help

chilli --version

chilli [ configuration options ]

chilli -fd [ configuration options ] # for debugging in foreground

the last one? that's for debugging in the foreground, iykyk 🐛💻

💖 DESCRIPTION 💖

chilli is a software access controller, and it's giving main character energy in Wireless LAN HotSpots. it supports two different access methods for a Wireless LAN HotSpot: Universal Access Method (UAM) and Wireless Protected Access (WPA). this version of chilli is called CoovaChilli. see http://coova.github.io/ for more info 👑

chilli has three major interfaces, and honestly they each have their own vibe:

  • a downlink interface for accepting connections from clients 🫶
  • a radius interface for authenticating clients 🔐
  • an uplink network interface for forwarding traffic to other networks 🛰️

Authentication of clients is performed by an external radius server. for UAM, the CHAP-Challenge and CHAP-Password as specified by RFC 2865 are used. for WPA, the radius EAP-Message attribute as defined in RFC 2869 is used. the message attributes described in RFC 2548 are used for transferring encryption keys from the radius server to chilli. plus, the radius interface supports accounting. periodt 💸

The downlink interface accepts DHCP and ARP requests from clients. a client can be in two states: Unauthenticated and authenticated. in the unauthenticated state, web requests from the client are redirected to an authentication web server — the captive portal. that's literally the whole plot 🌀

In a typical application, unauthenticated clients will be forwarded to a web server and prompted for username and password. the web server forwards the user credentials to chilli by means of web browser redirects. on the chilli side, authentication requests are forwarded to a radius server. if authentication is successful, the state of the client is changed to authenticated. this authentication method is known as Universal Access Method (UAM) ✨

As an alternative to UAM, the access points can be configured to authenticate the clients by using Wireless Protected Access (WPA). in this case, authentication credentials are forwarded from the WPA access point to chilli by using the radius protocol. the received radius request is proxied by chilli and forwarded to the radius server. it's giving middle-man but make it secure 🧚

The uplink interface is implemented by using the TUN/TAP driver. when chilli is started, a tun interface is established and an optional external configuration script is called. very demure, very mindful 🎀

Runtime errors are reported using the syslogd(8) facility. slay, logging 💅

🎀 OPTIONS 🎀

okay so, configuration parameters set on the command line always take precedent over anything configured in a file. see chilli.conf(5) for a complete list of possible configurations. here are just a few common command line options:

  • --help — print help and exit. your go-to when you're lost 🫶
  • --version — print version and exit. know your era 💜
  • --fg — run in foreground (default = off). no hiding in the background, bestie 👀
  • --debug — run in debug mode (default = off). for when you need the tea 🐛
  • --conf file — configuration file to use instead of the default below. see chilli.conf(5) for more inforamtion. (yes, that's how it's spelled in the original, and we're keeping it exactly as is 🫡)
  • --pidfile file — file to put the process ID instead of the default below. your process's little name tag 🏷️
  • --cmdsock file — UNIX socket file for inter-process communication instead of default below. the group chat for processes 💬
  • --statedir path — directory of nonvolatile data instead of default below. where the memories live 🧠

🌸 FILES 🌸

  • /etc/chilli.conf — the main chilli configuration file. the head honcho 👑
  • /etc/chilli/defaults — default configurations used by the chilli init.d and functions scripts. the starting point, the blueprint 🎀
  • /etc/chilli/config — location specific configurations used by chilli init.d and functions scripts. copy the defaults file mentioned above and edit. make it yours 💅
  • /etc/chilli/functions — helps configure chilli by loading the above configurations, sets some defaults, and provides functions for writing main.conf, hs.conf, and local.conf based on local and possibily centralized. see chilli.conf(5). (again, "possibily" is exactly what the original says, and we respect the original 🫶)
  • /etc/init.d/chilli — the init.d file for chilli which defaults to using the above configurations to build a set of configurations files in the /etc/chilli directory — taking local configurations and optionally centralized configurations from RADIUS or a URL. see chilli.conf(5). the whole ensemble cast 🎬
  • /var/run/chilli/run/chilli.sock — UNIX socket used to daemon communication. see chilli_query(1). the hotline to the daemon ☎️
  • /var/run/chilli/run/chilli.pid — process ID file. the receipts of who's running 🧾
  • /etc/chilli/www/ — the typical directory for embedded web content served up by chilli using a minimal web server. a convenient place for the splash page, embedded captive portal, and JSON javascript resources. the whole aesthetic of your login screen lives here 🖼️✨

🦋 SIGNALS 🦋

sending HUP to chilli will cause the configuration file to be reread and DNS lookups to be performed. it's like a little refresh, no big deal 🔄

but — and this is a big but — the configuration options are not affected by sending HUP. these ones, specifically:

fg, conf, pidfile, statedir, net, dynip, statip, uamlisten, uamport, radiuslisten, coaport, coanoipcheck, proxylisten, proxyport, proxyclient, proxysecret, dhcpif, dhcpmac, lease, or eapolenable

The above configuration options can only be changed by restarting the daemon. no shortcuts, bestie. it's giving commitment 💀

🔥 SEE ALSO 🔥

chilli.conf(5) chilli-radius(5) chilli_opt(1) chilli_query(1) chilli_radconfig(1) chilli_response(1) syslogd(8)

the whole friend group 🫶

💀 NOTES 💀

See http://coova.github.io/ for further documentation and community support. we love a resource 👑

Besides the long options documented in this man page, chilli also accepts a number of short options with the same functionality. use chilli --help for a full list of all the available options. there's more where that came from 💅

The TUN/TAP driver is required for proper operation of the chilli server. Linux kernels later than 2.4.7 already include the driver, but typically needs to be loaded manually with modprobe tun or automaticly by adding alias char-major-10-200 tun to the /etc/modules.conf configuration file. (yep, "automaticly" — we don't fix what the original wrote 🫡) For other platforms, see http://vtun.sourceforge.net/tun/ for information on how to install and configure the TUN/TAP driver. don't skip this step, it's not optional 🙈

🌈 AUTHORS 🌈

David Bird <david@coova.com>

Copyright (C) 2002-2005 by Mondru AB., 2006-2012 David Bird (Coova Technologies) All rights reserved.

CoovaChilli is licensed under the GNU General Public License. respect the license, bestie 📜💖

and that's the whole thing, fr fr. this page is from June 2009 and it's part of the System Manager's Manual — section chilli(8), if you're keeping track. stay iconic, stay authenticated 💅✨🦋

📦 where this page comes from