Project

General

Profile

Actions
Copy link

Feature #15952

open

Support Message-Authenticator in the PHP RADIUS client

Added by Matthew Ross 11 months ago. Updated about 11 hours ago.

Status:
Feedback
Priority:
Normal
Assignee:
Christian McDonald
Category:
Authentication
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
25.11
Release Notes:
Default

Description

In response to Blast-RADIUS (CVE-2024-3596), we need more secure options for User Authentication via RADIUS. Ideally, we'd have support for EAP protocol types rather than the insecure MS-CHAP and even more insecure PAP. Or at the least, support for using the Message-Authenticator attribute in the packet.

We already have support for EAP protocol types in FreeRADIUS and for authenticating IPSec, so I'm not sure why it's not part of the User authentication RADIUS client too.

Files

RADIUSPRTCL.png (47.8 KB) RADIUSPRTCL.png List of currently available protocols for RADIUS authentication client Matthew Ross, 12/24/2024 04:14 PM
Actions
Copy link
 #1

Updated by Jim Pingle 10 months ago

  • Status changed from New to Needs Patch
  • Priority changed from High to Normal

We are limited by what is supported in the underlying upstream PHP RADIUS libraries, which lack such support. If an alternative presents itself, we can look into changing.

If communication with the RADIUS server only happens over secure, trusted links (e.g. VPN or secure network segments), such vulnerabilities are irrelevant.

Actions
Copy link
 #2

Updated by Alex Kolesnik 2 months ago

Hi Jim. Looks like this radius client implementation supports the required attribute - https://codeberg.org/fkooman/php-radius

Actions
Copy link
 #3

Updated by Christian McDonald about 14 hours ago

  • Status changed from Needs Patch to In Progress
  • Assignee set to Christian McDonald
  • Target version set to CE-Next
  • Plus Target Version set to 25.11
Actions
Copy link
 #5

Updated by Marcos M about 11 hours ago

  • Subject changed from User Auth RADIUS Client Secure Protocols to Support Message-Authenticator in the PHP RADIUS client
  • Target version changed from CE-Next to 2.9.0
  • % Done changed from 0 to 100

Tested working; "Require Message Authenticator" can now be set to "Yes" in FreeRADIUS when using pfSense as a client.

Actions
Copy link

Also available in: Atom PDF