pfSense

In response to Blast-RADIUS (CVE-2024-3596), we need more secure options for User Authentication via RADIUS. Ideally, we'd have support for EAP protocol types rather than the insecure MS-CHAP and even more insecure PAP. Or at the least, support for using the Message-Authenticator attribute in the packet.

We already have support for EAP protocol types in FreeRADIUS and for authenticating IPSec, so I'm not sure why it's not part of the User authentication RADIUS client too.