Wi-Fi PSK-like auth for Ethernet (without RADIUS)

Installing and Using OpenWrt Network and Wireless Configuration
1

Per my understanding, Ethernet authentication is basically implementation of IEEE 802.1X, which necessarily requires authentication by a RADIUS server.

Is there any other authentication methods that would basically be a PSK instead of a whole credential auth? I simply want some APs on the LAN authenticate to access a specific VLAN. I'm not administrating user access, so credentials and RADIUS are definitely not what I'm looking for.

2

Afaik in theory: hostapd can do this for Ethernet too but please don't ask me how to emulate or simplify the auth part...

See this as a general reference: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/configuring_and_managing_networking/setting-up-an-802-1x-network-authentication-service-for-lan-clients-by-using-hostapd-with-freeradius-backend

If you achieve any progress please ping me!

3

Mmh, this is interesting but I don't want to do this for a couple of reasons:

  • Don't want to manually edit hostapd.conf outside of UCI/LuCi parameters.
  • I'm not familiar with RADIUS myself, how the hell do I simplify the auth... At that point might as well go full FreeRADIUS with more complete docs.

And speaking of RADIUS. doesn't dumb switches have a hard time dealing with EAPOL packets or something?

Anyhow, I do want to "deploy" auth to my LAN properly, and not have to chase any problems that may arise. Therefore, I respectfully veto your suggestion.

4

I did not wanted to say that's the way to go because of the radius dependency but only to illustrate the hostapd part.
I'm also curious if it is somehow possible to configure hostapd without radius to do dynamic vlan assignments on Ethernet ports.

5

The disjunct capabilities exist in the respective upstream projects, but I'm not aware of any kind of glue in OpenWrt (or really elsewhere) tying this together and making it 'easy' (most traditional OpenWrt devices aren't fast enough to do this, OpenWrt on switches is relatively young in comparison and there've been/ are way more pressing topics so far). This will require investigation and some development on your side, exceeding merely setting uci configs. It is an interesting topic, and I'm interested in your results, but I fear it's not a well trodden path.

6

This should be relevant:

You can't use this for a specific VLAN unless you break it out to a dedicated port. 802.1x authorize access to ports.

Don't try to avoid RADIUS. No need to make this more complicated than necessary by inventing non-standard ways to do stuff

7

To summarize:

  • RADIUS is the only way to get any auth, no standard PSK method.
  • 802.1X cannot let you auth to a specific VLAN.
  • Dumb switches cannot support EAPOL anyway.

That's three different reasons why I can't do precisely what I wanted. Unless the whole protocol is updated to address my suggested use-case, it ain't happening.

My disappointment is immeasurable, and my day night is runined.