Questions about login

[sinancetinkaya]

This is a question ticket, not a bug report.

credentials provides a simple username/password authentication (usernames and passwords defined in configuration)

1. In "credential" mode, do clients have to re-login after the router is rebooted?

2. How to restrict only one device per account?

3. Is custom hooks/triggers supported? Like executing a shell script before/after when a client logs in?

Thank you!

[f00b4r0]

This is a question ticket, not a bug report.

OK, so I moved this to the (now available) Discussions section :)

credentials provides a simple username/password authentication (usernames and passwords defined in configuration)

1. In "credential" mode, do clients have to re-login after the router is rebooted?

Yes, this is the case for all authentication modes. When the router is rebooted, by definition all state is lost and so the system starts as new.

2. How to restrict only one device per account?

Assuming you're asking about "credentials" mode, currently this is not supported: the "credentials" authentication system is very basic and would typically only be used by very simple setups.

Such restriction would however be possible to implement when using a RADIUS backend (the RADIUS server would simply deny login when a session is already established for a given user).

3. Is custom hooks/triggers supported? Like executing a shell script before/after when a client logs in?

This is not (yet) supported. What kind of use case do you have in mind?

[sinancetinkaya]

This is not (yet) supported. What kind of use case do you have in mind?

Let's say only one device can use per account. I was planning to update the mac address in dhcp-> static leases list so it'd be easier to see who the client is.

I have done one device per account and updating static leases in OpenNDS. But enforcing clients to relogin after rebooting router is impractical, so I gave up on captive portal.

name_email_login() {
  password="$emailaddress"
  
  if [ "$username" = "" ] && [ "$password" = "" ]; then
    logger -t opennds "username or password cannot be blank"
    login_form
    footer
    exit
  fi
  
  
  # read user password from /etc/config/opennds
  stored_password=$(uci get opennds.@users[0]."$username")
  
  if [ "$password" != "$stored_password" ]; then
    logger -t opennds "incorrect password"
    login_form
    footer
    exit
  fi

  dhcp_host_name=""
  dhcp_host_mac=""
  dhcp_host_index=""
  
  index=0
  while uci get dhcp.@host[$index] &> /dev/null ; do

    dhcp_host_name="$(uci get dhcp.@host[$index].name)"
    
    if [ "$dhcp_host_name" = "$username" ]; then
      dhcp_host_mac=$(uci get dhcp.@host[$index].mac)
      dhcp_host_index=$index
      logger -t opennds "dhcp host matched: index=$dhcp_host_index name=$dhcp_host_name"
      break
    fi

    index=$((index+1));
  done
  
  if [ "$dhcp_host_index" = "" ]; then
    logger -t opennds "dhcp host not found, adding: dhcp_host_name=$username dhcp_host_mac=$clientmac"
    uci add dhcp host
    uci set dhcp.@host[-1].name="$username"
    uci set dhcp.@host[-1].mac="$clientmac"
    uci commit
  else
    if [ "$dhcp_host_mac" != "$clientmac" ]; then
      logger -t opennds "dhcp_host_name=$username has new mac=$clientmac, revoking previous mac=$dhcp_host_mac"
      ndsctl deauth "$dhcp_host_mac" 
      uci set dhcp.@host[$index].mac="$clientmac"
      uci commit
    
    fi
  fi
   
thankyou_page
footer

}

[f00b4r0]

I think one way to implement something like this would be to have a "ubus" authentication backend. uspot would simply call over ubus a configurable ubus service, passing the credentials that were provided on the login form, and the ubus service would simply return a true/false state to allow/deny login.

This would give maximum flexibility to implement complex login rules that could leverage anything from a SQL db to local router state (implementation would be completely unrestricted as long as the ubus input/output interface is provided to interface with uspot) and this would enable you to do what you want (provided that you write the authentication service), with minimal changes to uspot code.

But in my humble opinion, for what you're trying to do RADIUS is pretty much the de-facto standard and would make all of this quite easier :)

(As a side note, consider that updating uci configuration for every client login will not scale well: it will create I/O contention, and might also wear the storage media if it is e.g. flash).

[sinancetinkaya]

You're right, I have a microsd card attached as extroot, so wearing is not an issue for me.
In my case, a (online?) radius server has a drawback because when the router doesn't have internet access, clients won't be able to connect to wifi?

[sinancetinkaya]

My case might sound weird to you 🙂
I'm not providing paid internet to public.
This is just a small family/friends network.
Whenever I change wifi password, their friends steal the wifi password via qr code.

I decided to give captive portal a try, but that relogin requirement after router restart is a dead end for me.

[f00b4r0]

I don't think a captive portal is the right tool to solve this problem unfortunately :)

[sinancetinkaya]

Damn :( Is there a way to get rid of these leeches? I am open to suggestions.

…

On Wed, 3 Jan 2024, 15:49 Thibaut, ***@***.***> wrote: I don't think a captive portal is the right tool to solve this problem unfortunately :) — Reply to this email directly, view it on GitHub <#3 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAUNHR5QNGQ4TB4VYGQBQQLYMVHU5AVCNFSM6AAAAABBLKGPXSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DAMBSGQ4TM> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[f00b4r0]

well teach your family not to share their wifi password maybe? :)
alternatively you could setup a MAC filter on the access point, assuming your authorized devices have fixed MAC (so e.g. disabling private MAC would be required to connect to your SSID). But this is rather off topic, you're probably better off asking in the OpenWrt forums.