Question:

I am planning to migrate from Azure MFA Server to NPS with Azure MFA Extension, and I want to know the best practices for securing RADIUS authentication. I have some on-prem services that use RADIUS with PAP protocol, which I have read mixed opinions about. Is PAP secure enough for my scenario, where the client and the web server use HTTPS, and the NAS and the RADIUS server use XOR and MD5 encryption? What are the advantages and disadvantages of using other protocols, such as CHAP, MS-CHAP, PEAP, or EAP? I would appreciate any guidance from RADIUS experts. Thank you.

Answer:

RADIUS (Remote Authentication Dial-In User Service) is a protocol that provides centralized authentication, authorization, and accounting (AAA) for users who connect and use a network service. RADIUS is commonly used to secure wireless networks, VPNs, and other remote access solutions.

If you are planning to migrate from Azure MFA Server to NPS with Azure MFA Extension, you might be wondering how to secure RADIUS authentication for your scenario. In this article, we will discuss the best practices for securing RADIUS authentication, the pros and cons of different RADIUS protocols, and some tips for troubleshooting common issues.

Best Practices for Securing RADIUS Authentication

To secure RADIUS authentication, you should follow these best practices:

• Use a strong RADIUS shared secret. The RADIUS shared secret is a key that is used to encrypt and decrypt the communication between the network access server (NAS) and the RADIUS server. The shared secret should be at least 16 characters long, contain a mix of upper and lower case letters, numbers, and symbols, and be changed periodically. You should also avoid using the same shared secret for multiple NASs or RADIUS servers.
• Use certificate-based authentication. Certificate-based authentication is a method of verifying the identity of a user or a device by using a digital certificate issued by a trusted authority. Certificate-based authentication is more secure than password-based authentication, as it prevents credential theft, replay attacks, and man-in-the-middle attacks. You can use certificate-based authentication with protocols such as PEAP or EAP-TLS, which are supported by NPS and Azure MFA Extension.
• Use network policies to enforce access control. Network policies are rules that define who can access what resources on the network, based on criteria such as user identity, group membership, device type, location, time, and so on. Network policies can also specify the authentication methods, encryption levels, and accounting settings for each connection. You can configure network policies on NPS and apply them to different RADIUS clients and servers.
• Use accounting to monitor and audit network activity. Accounting is the process of recording and reporting information about network usage, such as the identity of the user, the duration of the session, the amount of data transferred, the IP address assigned, and so on. Accounting can help you track network performance, troubleshoot issues, analyze trends, and generate billing reports. You can configure accounting on NPS and store the accounting records in a local file, a SQL database, or a remote RADIUS server.

Pros and Cons of Different RADIUS Protocols

RADIUS supports various authentication protocols, such as PAP, CHAP, MS-CHAP, PEAP, EAP, and so on. Each protocol has its own advantages and disadvantages, depending on the security requirements, compatibility, and performance of your scenario. Here is a brief comparison of some common RADIUS protocols:

• PAP (Password Authentication Protocol) is the simplest and oldest RADIUS protocol, which sends the username and password in plain text to the RADIUS server. PAP is not secure, as it exposes the credentials to anyone who can intercept the network traffic. PAP is also vulnerable to brute force and dictionary attacks. PAP should be avoided, unless there is no other option available.
• CHAP (Challenge-Handshake Authentication Protocol) is an improvement over PAP, which uses a challenge-response mechanism to verify the password without sending it in plain text. CHAP is more secure than PAP, as it prevents replay attacks and protects against passive eavesdropping. However, CHAP is still vulnerable to active attacks, such as man-in-the-middle and offline cracking attacks. CHAP is also incompatible with some devices and applications, such as smart cards and biometrics.
• MS-CHAP (Microsoft Challenge-Handshake Authentication Protocol) is a variant of CHAP, which is designed for Windows-based systems. MS-CHAP has two versions: MS-CHAPv1 and MS-CHAPv2. MS-CHAPv1 is similar to CHAP, but uses a weaker encryption algorithm and a fixed challenge length. MS-CHAPv1 is not secure, as it can be easily cracked by tools such as asleap. MS-CHAPv2 is an enhancement over MS-CHAPv1, which uses a stronger encryption algorithm and a variable challenge length. MS-CHAPv2 is more secure than MS-CHAPv1, but still vulnerable to dictionary attacks and rainbow table attacks. MS-CHAPv2 is also incompatible with some devices and applications, such as Linux and Mac OS X.
• PEAP (Protected Extensible Authentication Protocol) is an extension of EAP, which provides a secure tunnel for other authentication protocols, such as MS-CHAPv2, EAP-GTC, or EAP-TLS. PEAP is more secure than PAP, CHAP, and MS-CHAP, as it encrypts the entire authentication exchange and protects against man-in-the-middle and offline cracking attacks. PEAP also supports certificate-based authentication, which can eliminate the need for passwords. PEAP is widely compatible with various devices and applications, such as Windows, Linux, Mac OS X, Android, iOS, and so on.
• EAP (Extensible Authentication Protocol) is a framework that supports multiple authentication methods, such as EAP-TLS, EAP-TTLS, EAP-FAST, EAP-SIM, and so on. EAP is the most flexible and secure RADIUS protocol, as it can provide strong authentication, encryption, and mutual verification for both the user and the server. EAP also supports certificate-based authentication, which can eliminate the need for passwords. EAP is widely compatible with various devices and applications, such as Windows, Linux, Mac OS X, Android, iOS, and so on.

Tips for Troubleshooting Common Issues

If you encounter any issues with RADIUS authentication, you can use the following tips to troubleshoot them:

• Check the network connectivity and firewall settings. Make sure that the NAS, the RADIUS server, and the Azure MFA Extension server can communicate with each other over the required ports and protocols. For example, the default ports for RADIUS are UDP 1812 for authentication and UDP 1813 for accounting. You can use tools such as ping, traceroute, telnet, or netstat to test the network connectivity and firewall settings.
• Check the RADIUS shared secret. Make sure that the RADIUS shared secret is the same on the NAS, the RADIUS server, and the Azure MFA Extension server. The RADIUS shared secret is case-sensitive and must match exactly. You can use tools such as NTRadPing or RadTest to test the RADIUS shared secret.
• Check the RADIUS configuration and policies. Make sure that the RADIUS configuration and policies are correct and consistent on the NAS, the RADIUS server, and the Azure MFA Extension server. For example, make sure that the RADIUS client and server settings are correct, the network policies match the user and device attributes, the authentication methods are supported and enabled, the encryption levels are compatible, and the accounting settings are appropriate. You can use tools such as NPS or Azure MFA Extension logs, event viewer, or network monitor to check the RADIUS configuration and policies.
• Check the user credentials and certificates. Make sure that the user credentials and certificates are valid and up-to-date on the user device, the directory service, and the certificate authority. For example, make sure that the username and password are correct, the certificate is not expired or revoked, the certificate chain is trusted, and the certificate matches the user identity. You can use tools such as certmgr, certutil, or openssl to check the user credentials and certificates.

—

I

hope this article helps you with securing RADIUS authentication for NPS with Azure MFA Extension. If you have any questions or feedback, please let me know. Thank you for using Copilot. 😊