required message-authenticator for requests and access-challenge in privacyidea radius handling

[mierswa]

Hello,

nowadays radius authentication has a vulnerability https://www.heise.de/en/news/Blast-RADIUS-Security-vulnerability-in-the-RADIUS-network-protocol-published-9797220.html

is there a chance to implement the message-authenticator ?
I think it must be implemented in this file:
https://github.com/privacyidea/FreeRADIUS/blob/master/privacyidea_radius.pm

The code has to handle message-authenticator like described in rfc 3579 https://datatracker.ietf.org/doc/html/rfc3579#section-3.2

cut out from rfc:

This attribute MAY be used to authenticate and integrity-protect
Access-Requests in order to prevent spoofing. It MAY be used in
any Access-Request. It MUST be used in any Access-Request,
Access-Accept, Access-Reject or Access-Challenge that includes an
EAP-Message attribute.

thanks for help.

[plettich]

This will probably be fixed with #67
However it is interesting that we have to set the Message-Authenticator attribute in the plug-in instead of configuring it in the server.

[basvandervlies]

You also have to require it on the server. If it is not sent the server will drop the package, eg:

#                                                                                                                                                                                                         
client cartesius {                                                                                                                                                                                        
    ipaddr = 10.0.0.1/24                                                                                                                                                                                                                                                                                                                                        
    require_message_authenticator = yes                                                                                                                                                                   
    nas_type = other                                                                                                                                                                                      
} 

This is for the client check if it does not receive a packet with this information it will drop the connection, eg:

auth required pam_radius_auth.so skip_passwd retry=1 require_message_authenticator

[plettich]

Closed with #67