What I'm trying to do is have users connect to the WiFi (A single SSID) with their own PSK, depending on the PSK, they are dropped to a specific vlan. The username and password which is sent to the radius from the WLC is the users MAC address. In this particular building there are lots of SSID's with connected unique vlans. So what I'm asking is can we ignore the username and password that comes through, and just match the psk? Can you have something like Username is the CISCO-AVPair = PSK attribute or something? Basically I just want unknown users to be authenticated using the psk and put to a certain vlan based on the psk they enter only. ________________________________ From: Freeradius-Users <freeradius-users-bounces+danstrong_01=hotmail.co.uk@lists.freeradius.org> on behalf of Alan DeKok <aland@deployingradius.com> Sent: Thursday, April 11, 2019 6:35 AM To: FreeRadius users mailing list Subject: Re: Unknown username and password matching On Apr 10, 2019, at 11:07 PM, Dan Strong <danstrong_01@hotmail.co.uk> wrote:

I'm trying authenticate users on to different networks but without their usernames and passwords.

Basically they input a specific psk on wireless and this then hits the radius and sends them onto a vlan.

So I have this working using DEFAULT auth-type = accept.

It's matching a Cisco avpair psk and vlan attribute, they get dropped on to a specific vlan. This works.

That's good.

If I put the wrong psk in, I don't get on the network so this is good and expected. It's matching the Cisco avpair psk in radius.

That's also good.

Is there any way to have a 2nd DEFAULT and have it match a 2nd cisco avpair? So in essence it looks at the first and says no, moves to the 2nd set of attributes? Validates a different password and drops them on a different vlan.

I know I'm using default and it's matching anything, maybe there is another way? I don't want to match a sent username and password to confirm as this is sent as the devices Mac address which would be unknown to me.

Feel like this should work somehow but I'm missing something...

It's not clear what you want it to do. You're asking about a particular solution. Which means that the *problem* isn't clear. What do you want it to do? Talk about results, not about configuration files. If you're not doing username / password checks, how do you distinguish users in one VLAN from users in another VLAN? Alan DeKok. - List info/subscribe/unsubscribe? See https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=02%7C01%7C%7Cc528e93c76254fb864cf08d6be4800f6%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636905613789614694&sdata=vqIvLxTpW2APWEjD%2FuomXFSBtV%2BfpvtOk%2BObKeHfex0%3D&reserved=0

Thanks Matthew, I think I'm following. Do you have an example to help? I'mcurrently just getting to grips with Freeradius. I can see the below commented out. Your saying that below I can add my own attributes such as Cisco-AVPair and it will look for this rather than username or password? key = %{%{Stripped-User-Name}:-%{User-Name}} My question is, under the syntax of the users file. Would I still need users to be present with attributes attached to them, even if username is ignored? Thanks! ________________________________ From: Freeradius-Users <freeradius-users-bounces+danstrong_01=hotmail.co.uk@lists.freeradius.org> on behalf of Matthew Newton <mcn@freeradius.org> Sent: Thursday, April 11, 2019 11:07 AM To: FreeRadius users mailing list Subject: Re: Unknown username and password matching On Thu, 2019-04-11 at 10:11 +0000, Dan Strong wrote:

So what I'm asking is can we ignore the username and password that comes through, and just match the psk?

Can you have something like Username is the CISCO-AVPair = PSK attribute or something?

You can configure the files module to look up a different attribute rather than User-Name. See the "key" configuration option. I would look at extracting the PSK from the Cisco-AVPair with a regex and put it into another attribute, then use that as the key. Saves confusion if you get multiple Cisco-AVPair attributes. -- Matthew - List info/subscribe/unsubscribe? See https://apc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=02%7C01%7C%7C7b90c07a2209405092e308d6be6e092a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636905777137760482&sdata=069RPFuBCQ66GRyQPE9AbvgQB%2FkpL2AaLF%2BHGWzP1Ig%3D&reserved=0

Hi Alan

The "users" file is a simple key-value database. It doesn't know about users. It knows about keys. You configure the key as above, and then the key is used for lookups.

Ok thanks this makes sense now. I did read the file, but it was not immediately clear to me what it did or how it all works. Thanks

On Apr 11, 2019, at 8:40 PM, Dan Strong <danstrong_01@hotmail.co.uk> wrote:

I'm wondering if anyone could give me a config example on this? Feel like I'm going round in circles and not sure if what I'm asking is possible? Below is what I originally had:

DEFAULT Auth-Type = Accept Tunnel-Private-Group-ID = "100", Cisco-AVPair = "psk=testcisco1"

DEFAULT Auth-Type = Accept Tunnel-Private-Group-ID = "101", Cisco-AVPair = "psk=testcisco2"

I know the first entry will be matched, which is why its only dropping me on to vlan 100 with testcisco1 only validating.

The documentation describes how this works.

So below I've got the following:

In dictionary I set an attribute as a string called: Cisco-Wireless-PSK

Then I have key in the files set as:

key = %{Cisco-Wireless-PSK]" }

I have then written the below, BUT I've no idea which file or where this should be placed...

foreach (Cisco-AVPair) { if %{Foreach-Variable-0} =~ /^psk=testcisco[0-9](.+)$/) { update control { Cisco-Wireless-PSK := "%{1}" } } }

Again, the documentation describes how the server works. Also, if you run the server in debugging mode, you will see which files it loads, and what configuration sections are run. Go read sites-enabled/default. This is documented extensively. Also read the technical guide available here: https://networkradius.com/freeradius-documentation/ That goes through the server basics in great detail. You want the "foreach" loop to go into the "authorize" section, before the "files" module. This should all become clear by reading the above referenced documentation. Alan DeKok.