RADIUS - Secure RADIUS Servers with TLS/radsecproxy (CVE-2024-3596)
Problem Being Solved
In July 2024, a CVE was issued explaining that RADIUS configured with UDP and PAP is vulnerable to MD5 related attacks (see RADIUS Protocol Vulnerability Exposes Networks to MitM Attacks).
When network devices connect to a RADIUS server, a connection is made from a partner/customer network using UDP to port 1812 on a server running in the Evo network. This UDP connection is vulnerable to the reported CVE.
Solution Overview
For customers to eliminate the vulnerability, connections established over the public Internet must include TLS. This is achieved by:
- The Evo RADIUS server providing a TLS entry point
- The network device in the partner (or customer) network connecting to RADIUS using TLS
The diagram below illustrates network boundaries and the TLS connection being established over port 2083 to the Evo RADIUS server.
Some network devices may not support making the TLS connection. The use of a RadSec Proxy provides the ability to continue uses a UDP connection within a trusted network, but using a TLS connection across the public Internet.
To obtain RadSec Proxy, see radsecproxy .
RadSec Proxy Configuration
If needed, a RadSec Proxy may be deployed within your trusted network. Network devices which cannot establish a TLS connection directly are configured to send RADIUS requests to the RadSec Proxy (UDP port 1812). The RadSec Proxy can be configured using the snippet below to establish the TLS connection with an Evo RADIUS server which supports TLS.
ListenUDP *:1812
ListenUDP localhost
tls default {
CACertificatePath /etc/ssl/certs/
CertificateFile /etc/ssl/client_folder/<partner-certificate>.crt
CertificateKeyFile /etc/ssl/client_folder/<partner-certificate>.key
CacheExpiry 3600
}
server <evo-provided-radius-host>.evosecurity.com {
Host <evo-provided-radius-host>.evosecurity.com
Type tls
CertificateNameCheck on
MatchCertificateAttribute CN:/^<evo-provided-radius-host>\.evosecurity\.com$/
StatusServer on
Secret <radius-secret>
}
client 127.0.0.1 {
type udp
secret <trusted-network-secret>
}
realm * {
server <evo-provided-radius-host>.evosecurity.com
AccountingServer <evo-provided-radius-host>.evosecurity.com
}In the snippet above, the following placeholders must be replaced as described below.
partner-certificate - a partner-generated certificate for connections into the proxy
trusted-network-secret - the shared secret that a network device uses to connect to the proxy
radius-secret - the shared secret used by RadSec Proxy when connecting to the Evo RADIUS server
evo-provided-radius-host - the host of the Evo RADIUS serverTesting TLS Connection When RadSec Proxy is Used
To test the TLS connection from RadSec Proxy to the Evo RADIUS server, use the radtest client within the trusted network with the command below:
radtest <username> "<password>" <radsecproxy-host>:1812 10 <trusted-network-secret>username - the email address to authenticate with Evo
password - the password to authenticate with Evo
radsecproxy-host - the IP or hostname of the RadSec Proxy
trusted-network-secret - the secret configured for connections to the RadSec ProxyYou can set this up to help secure your Evo RADIUS instance from within your network. Please let our support team know if you have any questions about this configuration as it relates to Evo Security.