{"id":115348,"date":"2024-09-05T16:10:01","date_gmt":"2024-09-05T20:10:01","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&p=115348"},"modified":"2024-09-17T10:23:05","modified_gmt":"2024-09-17T14:23:05","slug":"manage-insecure-radius-protocols","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/manage-insecure-radius-protocols","title":{"rendered":"Manage Insecure RADIUS Protocols"},"content":{"rendered":"\n

Blast-RADIUS is a vulnerability inherent in the RADIUS authentication protocols PAP<\/code> and MS-CHAP<\/code> that can compromise the security of your network. This vulnerability exploits unencrypted, non-TLS-based protocols such as PAP<\/code> and MS-CHAPv2<\/code> which are vulnerable to brute force and man-in-the-middle (MiTM) cyberattacks.<\/p>\n\n\n\n

<\/p><\/div>

Warning:<\/strong> \n

Unless you are configuring RADIUS MFA for VPN, JumpCloud discourages using using non-TLS-based RADIUS protocols and instead recommends using TLS-based authentication protocols (PEAPv0\/MS-CHAPv2<\/code>, EAP-TTLS\/PAP<\/code>, and EAP-TLS<\/code>).<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n

Identifying Insecure Protocols<\/h2>\n\n\n\n
    \n
  1. Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
  2. Go to INSIGHTS <\/strong>> Directory Insights<\/strong>. <\/li>\n\n\n\n
  3. In the Event Type<\/strong> filter, select radius_auth_attempt<\/strong>.<\/li>\n\n\n\n
  4. Search for PAP<\/code> vulnerabilities:\"\"\n
      \n
    1. In the Search <\/strong>bar, enter \u201cPAP<\/code>\u201d and run a report.<\/li>\n\n\n\n
    2. Click export<\/strong> and then export the report as a JSON <\/strong>file.<\/li>\n\n\n\n
    3. Inspect the JSON file and search for \u201cauth_type\u201d: \u201dPAP\u201d<\/code>.
      \"\"<\/li>\n<\/ol>\n<\/li>\n\n\n\n
    4. Search for MS-CHAP<\/code> vulnerabilities:\"\"\n
        \n
      1. In the Search <\/strong>bar, enter \u201cMS-CHAP<\/code>\u201d and run a report.<\/li>\n\n\n\n
      2. Click export<\/strong> and then export the report as a JSON <\/strong>file.<\/li>\n\n\n\n
      3. Inspect the JSON file and search for \u201cauth_type\u201d: \u201dMS-CHAP\u201d<\/code>.
        \"\"<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n\n\n\n

        <\/p><\/div>

        Note:<\/strong> \n

        When looking through the JSON file to find insecure protocol types, make sure you look for the auth_type<\/code>, and ignore the eap_type<\/code>.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n

          \n
        1. If you identify insecure protocols in your device fleet, please switch to the secure TLS-based RADIUS authentication protocols (PEAPv0\/MS-CHAPv2<\/code>, EAP-TTLS\/PAP<\/code>, and EAP-TLS<\/code>).<\/li>\n<\/ol>\n\n\n\n

          <\/p><\/div>

          Important:<\/strong> \n

          Any resulting non-TLS PAP<\/code> or MS-CHAP<\/code> authentication types are indicative of insecure protocols and should be switched to TLS-based RADIUS authentication protocols as soon as possible. <\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n

          Managing Insecure Protocols<\/h2>\n\n\n\n

          Block Insecure Protocols<\/h3>\n\n\n\n

          You can use the JumpCloud Admin Portal to restrict insecure RADIUS authentication protocols from being used on any future network configurations. <\/p>\n\n\n\n

          To block insecure RADIUS protocols: <\/p>\n\n\n\n

            \n
          1. Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
          2. Go to USER AUTHENTICATION <\/strong>> RADIUS<\/strong>.<\/li>\n\n\n\n
          3. Select the RADIUS network configuration you want to change. The RADIUS details tab displays.<\/li>\n\n\n\n
          4. Click the Authentication <\/strong>tab. <\/li>\n\n\n\n
          5. Select Require secure protocols<\/strong> to restrict the use of non-TLS-based network authentication protocols.<\/li>\n\n\n\n
          6. Click Save<\/strong>.
            \"\"<\/li>\n<\/ol>\n\n\n\n

            Mitigate Risk Using Insecure Protocols<\/h3>\n\n\n\n

            If your integration or equipment only supports insecure, non-TLS-based legacy protocols, use Directory Insights to try and mitigate your risk by monitoring RADIUS access and enforcing the following security measures for all users:<\/p>\n\n\n\n