Computing Service

Information about the Lapwing service

Please note that some of the links on this page will only work if you already have a network connection. If you have come to this page directly from the Lapwing login page and do not yet have a network connection set up, you will need either to use another system to look at the pages you need, or to contact the Computing Service Help Desk on (01223) 334681.

• What is Lapwing and who can use it?
• Where can I use Lapwing?
• What can I do using Lapwing?
• How to use Lapwing
• Security issues with use of Lapwing
• What is VPDN?
• Printing from Lapwing using PWF iPrint
• Who is using Lapwing?

What is Lapwing and who can use it?

Lapwing is the name of the Computing Service facility for wireless hotspot connections to the Cambridge University Data Network. To use the Lapwing service you need to be a current staff member or a student of the University and to provide your Raven password, as Lapwing will forward you to Raven for authentication. Instructions for obtaining a Raven password are at http://www.cam.ac.uk/cs/ docs/faq/n5.html; if you are unable to use this link please contact the Help Desk.

Having Javascript enabled in your browser is recommended when using Lapwing, as this helps to ensure the effective working of the authentication system. Information on how to do this for various browsers, and on how to suppress various security warnings that may appear during a Lapwing session, is given by the following: Microsoft Internet Explorer (Windows/Macintosh), Mozilla Firefox (Windows/Linux), KDE Konqueror (Linux); no special configuration appears to be needed for Safari (Macintosh).

Where can I use Lapwing?

Initially Lapwing was piloted within the Computing Service, in certain lecture theatres, and in the West Room of the University Library. The service is now out of the pilot phase and the number of hotspots is expanding. Some of these are available to all members of the University, and others only to members of the hosting institution.
Please see the table below for a list of institutions where Lapwing is available.

What can I do using Lapwing?

In many respects Lapwing provides a normal CUDN connection similar to a hard-wired connection. Any connection through Lapwing normally gives you access to Cambridge-restricted facilities such as restricted newsgroups and cam-only web pages, unless the institution that has set up the hotspot has imposed further restrictions. You can also access PWF printers using the iPrint facility.

However, for security reasons there are certain restrictions, described below, on what you can do using Lapwing directly. In most cases there are satisfactory secure alternatives available. See below for the VPDN service, which does not have the restrictions but requires extra configuration effort.

The Lapwing service operates with laptops and will be tested with other wireless-capable devices such as PDAs in due course.

Starting up a Lapwing connection

The information given here assumes that you have a wireless-capable machine (802.11a/b/g) that has already been configured for use with a wireless network. If you are using an operating system earlier than Windows XP or Mac OS X, have installed a non-standard wireless card, or have previously configured your machine with a static IP address, you may need to do some extra setting up; if you need advice on configuring your machine to use wireless, please see your local computer support staff.

1. Provided you are within range of a Lapwing hotspot, Lapwing should appear on the list of visible wireless networks when you start up your machine:
   • on a Mac you can see this list by pulling down the Airport menu (if this menu does not appear on the Menu bar, go to System Preferences, then Network, then Airport, and make sure that the box "Show Airport status in Menu bar" is checked).
   • On a wireless-capable Windows XP system, you should normally be able to see the list of visible networks by right-clicking on the wireless status icon near the right-hand end of the taskbar.

   Select Lapwing from the list; you should now have a wireless connection established.

2. To authenticate for your session you now need to start up a web browser such as Internet Explorer or Firefox, and request any http page not local to your machine (for instance http://www.cam.ac.uk/; note that the URL must start with http not https). Lapwing will intercept the web page request and display a page confirming that you have reached Lapwing.
3. If the page you request happens to have been cached locally on your system, it will be displayed directly and will not take you to Lapwing; in that case, click on some links to find something that actually needs network access. Note that attempting any other network activity, such as making an IMAP connection to read mail, or using ssh to login to a shared system, will not work until you have been through the authentication process.
4. Once you have reached the Lapwing page, click Login and you will be redirected to Raven where you will need to fill in your CRSid and your Raven password.

If this process is successful you will see a confirmation and an invitation to click on a link to take you to the page you initially requested, which will open in a new window, leaving the existing Lapwing window (the keep-alive window) open. You are now connected and can use all network facilities subject to the limitations described below.

The Lapwing keep-alive window

It is essential not to close the Lapwing keep-alive window during your session, as this will cause you to become disconnected from the network within a few minutes. The window can however safely be minimised. On some browsers, depending on their configuration, you will get periodic security alerts about moving from HTTPS to HTTP; you should respond to these (by selecting OK or Continue) as otherwise you may be disconnected from the network.

Closing a Lapwing connection

To end your Lapwing session, click the logout button on the Lapwing keep-alive window.

Security issues with use of Lapwing

Although the authentication process to Raven is encrypted, all subsequent traffic over your Lapwing connection is susceptible to snooping by anyone in the vicinity who has a wireless card and appropriate software. There are therefore some restrictions on what you may do over Lapwing. In most cases there are satisfactory alternatives; in any case all the restrictions can be circumvented if necessary by running a VPDN session (see below) over your Lapwing session.

• Lapwing permits all ordinary web browsing whether to insecure or secure sites (http and https). The latter includes Hermes Webmail.
• Standard Telnet (for logging in to remote systems) is not available; the secure alternative SSH should be used instead. SSH on Windows machines is most conveniently provided by an application called PuTTY (see http://www.cam.ac.uk/cs /docs/faq/e46.html). On a Unix system use the ssh command; on a Macintosh you can use free clients such as iTerm or JellyfiSSH, or the ssh command in a Terminal window.
• Standard ftp is not permitted: the secure alternatives are sftp and scp (e.g. using WinSCP on a Windows system, or Fetch on a Mac). You are most likely to be affected by this if you are trying to use anonymous ftp; however, most anonymous ftp sites now have alternative versions available via a web browser, using http for downloading.
• Insecure use of POP and IMAP (for reading mail) and SMTP (for sending mail) with Lapwing is not permitted. Hermes users are not allowed to use these insecure protocols in any case and should not have any problems. (See http://www.cam.ac.uk/cs/email/muasettings.html for correct mail program configuration for Hermes). If you use LDAP (other than with Webmail), it needs to be secure (LDAPS); see http://www.cam.ac.uk/cs/email/ldapsettings.html .
• Users of other mail servers may need to know that Lapwing does not in general (Hermes being an exception) permit "secure" connections using STARTTLS, as these start off in insecure mode and Lapwing cannot distinguish them from genuinely insecure connections. Secure connections using IMAPS/POPS and SMTPS (also described as IMAP over SSL, and so on) are permitted. To find out which protocol you are using, look at your mail program's configuration page. Hermes is an exception to the STARTTLS restriction because it enforces the use of encryption for all connections made from Lapwing clients. Similar arrangements may be possible for other known mail servers in Cambridge. If you need to connect to another mail server, then if your mail server has a Web interface you can use that; otherwise, you may be able to configure your mail client to use IMAPS/POPS and SMTPS if the mail server can handle this. Otherwise, the only way for you to access the mail server through Lapwing is to use the VPDN service.
• Full technical details may be found at Lapwing allowed ports, which is a list of TCP/UDP ports on which Lapwing traffic may be initiated.

What is VPDN?

The VPDN (Virtual Private Dial-up Network) service provides an encrypted, and therefore secure, connection to the CUDN, for use by Cambridge users wishing to use CUDN facilities via external or insecure connections. It can be used in conjunction with Lapwing to avoid the security restrictions listed above. To use the service you need to apply for a VPDN account; it requires the installation of a special VPDN client, and some configuration. Leaflets are available from the Computing Service (see pointers from http://www.cam.ac.uk/cs/docs/remote.html; see also http://www.cam.ac.uk/cs/netdiv/vpdn.html and http://www.cam.ac.uk/cs/netdiv/wireless/index.html).

Printing from Lapwing using PWF iPrint

It is possible to use the iPrint facility (http://iprint.pwf.cam.ac.uk/) from Lapwing. This enables a Lapwing user (on a Windows XP system) to print to any convenient PWF printer that they are normally entitled to use, subject to the usual charging arrangements for the printer concerned.

Who is using Lapwing?

Below is a table of the institutions already deploying Lapwing with a link to their lookup page and their location map:

© University Computing Service, University of Cambridge