- Freeradius-Users - lists.freeradius.org

Blast RADIUS resources to protect your network
by Alan DeKok 11 Jul '24

11 Jul '24

As news of the Blast RADIUS vulnerability spreads, we wanted to let you know about resources that we’ve put together for you. The big takeaway is this: ********. You MUST UPGRADE your systems as soon as possible. ********* The upgrade process needs to be done carefully but we have many resources to help you. We have FREE RESOURCES available here: https://edit.inkbridgenetworks.com/blastradius ——————————— The following products have an EARLY BIRD DISCOUNT until the END OF WEDNESDAY (tomorrow, July 10) this week. - Step-by-step upgrade guide and worksheet: https://inkbridgenetworks.myshopify.com/products/blastradius-upgrade-docume… The BlastRADIUS Upgrade Guide and Excel worksheet explains exactly how to protect your network from the vulnerability. Together, these documents reduce the risk of “do it yourself” solutions, which can result in accidental network outages. The documents give a set of detailed steps to take, including what configuration changes to make, where those changes should be made, and how to verify that the changes have been applied correctly. - Upgrade guide, Worksheet and a Verification Tool https://inkbridgenetworks.myshopify.com/products/blastradius-documentation-… The BlastRADIUS Verification Tool enables administrators to verify that systems have been upgraded and configured correctly. It looks at packet captures, and can send RADIUS packets directly to a RADIUS server. The result is a report indicating whether or not the systems are still vulnerable. - Upgrade guide, Worksheet, Verification Tool and 3 months of support. https://inkbridgenetworks.myshopify.com/products/blastradius-documentation-… While we have full confidence in the documentation and tool, some customers may be looking for additional support. We will provide the above tool and documentation, along with three (3) months of technical support. Our engineers will answer questions you have about any aspects of the BlastRADIUS vulnerability, or the above documentation and verification tool. ————————— The following products have an EARLY BIRD discount until the END OF TUESDAY (July 16th) BlastRADIUS Verification Tool + Guide and Worksheet, and 6 Months of Enhanced Support: https://inkbridgenetworks.myshopify.com/products/blastradius-documentation-… For customers who are looking for more personal interaction, we will provide the above documentation, verification tools, and six (6) months of technical support. We will also provide two (2) video conferencing sessions of up to three (3) hours in length with our engineers. BlastRADIUS Carrier Package: https://inkbridgenetworks.myshopify.com/products/blastradius-telco-review-p… Telcos and carriers have unique requirements, greater sensitivity, and large customer-driven urgency. In this package, we will provide documentation, verification tools, and twelve (12) months of technical support. We will also provide four (4) video conferencing sessions of up to three (3) hours in length with our engineers. The sessions with our engineers can also be used to advocate on your behalf with technology vendors. The fixes needed for the BlastRADIUS issue are new, networks are complex, and there may be corner cases that the vendors have been unable to test. If you have issues with vendor behaviour as a result of BlastRADIUS, we can join a call with you and the vendor to clarify any issues. We will also work with the vendors to test and verify any fixes, including updating the RADIUS standards to address issues which we may find. ————————————— Blast RADIUS in the media: https://financialpost.com/pmn/business-wire-news-releases-pmn/blastradius-v… https://thehackernews.com/2024/07/radius-protocol-vulnerability-exposes.html https://www.thinkbroadband.com/news/10143-new-blast-radius-protocol-vulnera…

2 3

Question after updating (Blast RADIUS)
by Burn Zero 11 Jul '24

11 Jul '24

Hi, I updated the packages and the configuration today (require_message_authenticator = auto limit_proxy_state = auto). Please note that we have hundreds of clients and I don't know if they are updated or not. I informed them to check with their vendors. But as recommended, I upgraded the FreeRADIUS servers first. After that I went through the logs and I see below: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > BlastRADIUS check: Received packet without Message-Authenticator. > Setting "require_message_authenticator = false" for client <client name> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Thu Jul 11 14:06:23 2024 : Error: UPGRADE THE CLIENT AS YOUR NETWORK IS VULNERABLE TO THE BLASTRADIUS ATTACK. Thu Jul 11 14:06:23 2024 : Error: Once the client is upgraded, set "require_message_authenticator = true" for <client name> > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Thu Jul 11 14:06:23 2024 : Error: Setting "limit_proxy_state = true" for client <client name> Thu Jul 11 14:06:23 2024 : Error: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Thu Jul 11 14:06:23 2024 : Error: The packet does not contain Message-Authenticator, which is a security issue. Thu Jul 11 14:06:23 2024 : Error: UPGRADE THE CLIENT AS YOUR NETWORK MAY BE VULNERABLE TO THE BLASTRADIUS ATTACK. Does that error mean, 1. The setting is set to false for that particular client and enabled for all other clients? 2. It is said that the change does not persist across server restarts. So what if the server restarts and the same client connects? Will it be set to false for that client again? 3. Even if we have the both (require_message_authenticator = auto and limit_proxy_state = auto) set in the radiusd.conf, the clients which are not upgraded will still be able to connect? I went through the documentation in radiusd.conf.rpmnew but I am still confused. Sorry. Thank you.

2 1

problem with ippool module
by Rubenb 10 Jul '24

10 Jul '24

Im using freeradius 3.2.4 , I have a problem that I couldn't set up ippool module. When I do a symbolic link with mods-enabled and mods-available of ippool module , I set up ippool module with two pools. Then when I go to start the service freeradius with systemd , it couldnt start , syslog says: /"rlm_ippool: Failed to open file /etc/freeradius/db-users.ippool: Read-only file system" "/etc/freeradius/mods-enabled/ippool[67]: Instantiation failed for module "users_employee""/ this is my config of ippool module: /ippool users_employee { filename = ${db_dir}/db-users.ippool range_start = 192.168.248.1 range_stop = 192.168.248.254 netmask = 255.255.254.0 cache_size = 800 ip_index = ${db_dir}/db-users.ipindex override = no maximum_timeout = 0 } ippool it { filename = ${db_dir}/db-it.ippool range_start = 192.168.249.1 range_stop = 192.168.249.254 netmask = 255.255.254.0 cache_size = 800 ip_index = ${db_dir}/db-it.ipindex override = no maximum_timeout = 0 }/ The config example in the file ipool module says that I can put the same config that the file ipool module in the radiusd.conf base config file , but its the same because radiusd.conf have an include of mods-enabled so the config that I have in ipool module is supposed that its going to be charged by the service. If I do "freeradius -X" , the service start in debugg mode with 0 problems , and I can see that freeradius in debugg mode charged the module ippool. I want to use ippool and not sqlipool , I have this: opnsense (openvpn server instance) + freeradius (ldap + ippool) + openldap. I have openvpn server instance in opnsense working and openldap with freeradius ldap module working. Now I need to implement ippool module to create two pools for two groups of LDAP. I need to know if I am missing something important with ippool module , thanks in advantage. --

2 4

Blast RADIUS webinar in 1 hour
by Alan DeKok 09 Jul '24

09 Jul '24

If you missed our webinar at 9am EDT this morning you can still register to attend our session at 14:00 ETD. Sign up here: https://alandekok.com/webinar/ If you register back can’t attend, you’ll automatically get a recording link after the session. Recordings will be made available on our website, but it will take us a couple of days to get it up. ----------- See our Blast RADIUS Resource Hub for technical papers, tools, and FAQ: https://www.inkbridgenetworks.com/blastradius

1 0

RADIUS design flaw announced today
by Alan DeKok 09 Jul '24

09 Jul '24

The FreeRADIUS notification is at https://www.freeradius.org/security/ It's time to upgrade every switch, router, VPN concentrator, firewall, access point controller, RADIUS server. World-wide. This is a design flaw in the RADIUS protocol. It affects all vendors of all RADIUS products. I've been working on this for 5 months, and have written the definitive guide that all vendors are using to fix their equipment. We also have vendor-neutral test tools and upgrade documentation. This is not just a "patch Tuesday". The new security features are controlled by compatibility flags. Upgrading is a multi-step process on both client and server. Full details at https://www.inkbridgenetworks.com/blastradius/faq In short, I was complaining about this issue in 1998. I tried to fix it in RFC5080, in 2007. FreeRADIUS has had fixes in since 3.0.0, in 2007. Since most vendors didn't follow the recommendations of RFC 5080, we're now in a panic mode "OMG, upgrade everything". I'm doing a free webinar later today at https://alandekok.com/webinar/ Alan DeKok.

1 0

Freeradius and dtls
by Redfearn, Jean G RTX 09 Jul '24

09 Jul '24

Does Freeradius support dtls (tls over UDP)? If so, how do I configure it? Jean

3 5

CRITICAL VULNERABILITY: BlastRADIUS
by Alan DeKok 08 Jul '24

08 Jul '24

If you’re on this mailing list, you need to know about BlastRADIUS. BlastRADIUS is a thirty year-old design flaw in the RADIUS protocol. Exploiting the vulnerability allows an attacker to authenticate anyone to your local network: • Any Multi-Factor Authentication (MFA) can be bypassed • Unknown users can be given network access • Unknown users can be granted administrative login to key networking equipment • Known users can have their traffic redirected to a "honeypot" BlastRADIUS has a CVSS score of 9.0, which is extremely high. This vulnerability affects ALL RADIUS clients and ALL RADIUS servers. It is an issue in the underlying protocol, not any specific implementation. All RADIUS servers are affected and MUST BE UPGRADED as soon as possible. In some cases, it is possible to upgrade clients in a less time critical manner. See our resource hub for more information. https://www.inkbridgenetworks.com/blastradius *** RESOURCES *** freeRADIUS resource page: https://www.freeradius.org/security/ InkBridge Networks BlastRADIUS resource page: https://www.inkbridgenetworks.com/blastradius Official BlastRADIUS site: https://blastRADIUS.fail <https://blastradius.fail/> FREE Webinar TODAY 9am ET with: - Alan DeKok, founder of freeRADIUS and InkBridge Networks CEO - Nadia Heninger, lead cryptographer who discovered the vulnerability Register now: https://alandekok.com/webinar2/ FREE Webinar TODAY 2:00pm ET with Alan DeKok Register now: https://alandekok.com/webinar/ Webinar recordings will be made available if you aren’t able to attend.

1 0

2 IMPORTANT Announcements from Network RADIUS
by Alan DeKok 08 Jul '24

08 Jul '24

**** MAJOR UPDATES BEING ANNOUNCED TOMORROW **** Stay tuned for an important announcement tomorrow regarding some CRITICAL changes you need to know about. We have been working to improve RADIUS security for decades, and we're announcing the results tomorrow. Rest assured that we have been working hard behind the scenes with the community so that everyone is aware of the changes. We’ll be hosting two webinars on Tuesday, July 9th (tomorrow) to explain what is changing.. Both sessions will have similar content, giving background and context for the changes, and information about how you can increase RADIUS security. The first session will have a special guest cryptographer to give some additional background. For both sessions, the intended audience is implementers, system administrators, and people generally familiar with RADIUS. Recordings will be made available if you aren’t able to attend. In short, keep tomorrow open. Be prepared. REGISTER FOR Tuesday, July 9th 9:00am ET. https://alandekok.com/webinar2/ <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…> Alan DeKok, founder of freeRADIUS and CEO of InkBridge Networks (formerly Network RADIUS) and a special cryptographer guest REGISTER FOR Tuesday July 9th, 2:00pm ET. https://alandekok.com/webinar/ <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…> Alan DeKok founder of freeRADIUS and CEO of InkBridge Networks (formerly Network RADIUS) You may also want to check out our RFC for the IETF on deprecating insecure practices in RADIUS: https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…> *** Network RADIUS has rebranded as InkBridge Networks *** Over the last sixteen years, Network RADIUS has evolved from a freeRADIUS centred consultancy, to one that provides products and services for a wide variety of network protocols. It was time for our brand to reflect our new position as the global leader in foundational network expertise. We are still in the process of migrating our old Network RADIUS site to our new digs at InkBridgeNetworks.com <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…>. You’ll notice some of our pages still link to Network RADIUS site but that won’t be for long. If you have any questions about this, feel free to respond to this email. Visit our new website at https://InkBridgeNetworks.com <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…> Read our press release at: https://alandekok.com/network-radius-becomes-inkbridge-networks-goes-after-… <https://1ae5b3aa-37c8-421a-8a7b-e33cac27e221.mlbtlr.com/p2/G0eViqYKQmazQ_n5…>

1 0

Don't use CHAP or MS-CHAP!
by Alan DeKok 06 Jul '24

06 Jul '24

From https://cybernews.com/security/rockyou2024-largest-password-compilation-lea… ... researchers discovered what appears to be the largest password compilation with a staggering 9,948,575,739 unique plaintext passwords. The only reason that passwords leak is that organizations store clear-text passwords in a database. That approach has been a terrible idea for decades, and this latest leak proves it. With CHAP, passwords *have* to be stored in clear-text in the DB, where attackers can steal them. With PAP, passwords can be stored in "crypted" form. When an attacker steals the DB, the passwords are protected. I've written more in an article on our web site. https://networkradius.com/articles/2022/04/01/pap-vs-chap.html As for MS-CHAP, it can be broken by an attacker with a laptop, in milliseconds. It should be considered to be no more secure than sending clear-text passwords over the wire, without even the protection that RADIUS offers for PAP. Alan DeKok.

1 0

Generating IPs link
by Daniel Garza 03 Jul '24

03 Jul '24

Hello, I was following through the documentation at https://freeradius.org/documentation/freeradius-server/4.0.0/howto/modules/…, and came to the "Generating IPs" section, but it seems the link isn't functioning. Should I be referencing a different link for this documentation? Thanks in advance -- Daniel Garza Network Engineer Netgate IT

2 1