Feature #15952
closed
Support Message-Authenticator in the PHP RADIUS client
Added by Matthew Ross about 1 year ago.
Updated 25 days ago.
Plus Target Version:
26.03
Description
In response to Blast-RADIUS (CVE-2024-3596), we need more secure options for User Authentication via RADIUS. Ideally, we'd have support for EAP protocol types rather than the insecure MS-CHAP and even more insecure PAP. Or at the least, support for using the Message-Authenticator attribute in the packet.
We already have support for EAP protocol types in FreeRADIUS and for authenticating IPSec, so I'm not sure why it's not part of the User authentication RADIUS client too.
Files
- Status changed from New to Needs Patch
- Priority changed from High to Normal
We are limited by what is supported in the underlying upstream PHP RADIUS libraries, which lack such support. If an alternative presents itself, we can look into changing.
If communication with the RADIUS server only happens over secure, trusted links (e.g. VPN or secure network segments), such vulnerabilities are irrelevant.
- Status changed from Needs Patch to In Progress
- Assignee set to Christian McDonald
- Target version set to CE-Next
- Plus Target Version set to 25.11
- Status changed from In Progress to Feedback
- Subject changed from User Auth RADIUS Client Secure Protocols to Support Message-Authenticator in the PHP RADIUS client
- Target version changed from CE-Next to 2.9.0
- % Done changed from 0 to 100
Tested working; "Require Message Authenticator" can now be set to "Yes" in FreeRADIUS when using pfSense as a client.
Is there a chance that this could be extended to the L2TP RADIUS authentication section?
- Status changed from Feedback to Resolved
Not likely - best to try moving away from L2TP.
Does this mean pfSense always sends the Message-Authenticator attributes now, or am I getting it wrong ?
Authentication does not work against Microsoft NPS if I check the box "Access-Request must contain the Message-Authenticator attribute"
The event log says the request does not contain the attribute.
If I clear the box, everything works correctly.
- Plus Target Version changed from 25.11 to 26.03
My tests were from some Access Points and from Diagnostics > Authentication on pfSense 26.03. The Message-Authenticator attribute can be seen with a pcap. The change was picked to 25.11 but there must be something else missing there because I can't get it to work on 25.11.
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 
Updated by 