Skip to main content
Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
July 22, 2024
Solved

RADIUS attribute: Message-Authenticator

  • July 22, 2024
  • 1 reply
  • 57009 views

I'm working on migrating my home OpenSUSE machine I'm using for freeradius server to authenticate admin and VPN users on my FG40F(7.2.8) from Leap 15.3 to 15.5(on a new machine). Obviously 15.5's repo has a newer version of freeradius-server image.
Then when I simply copied "clients.conf" and "users" file to the new machine and pointed the RADIUS config at the 40F to the new machine, the RADIUS auth request was simply dropped without showing much reason in debug output other than "missing mandatory attribute".

After some research and investigation, I figured out I had to set "require_message_authenticator = no" in the client config for the 40F at the server, which was not required with the older version of freeradius, in order to let the server accept those requests from the 40F.

So I found a way around but now wondering why 40F wouldn't send the Message-Authenticator attribute with the request.
Even with 7.4.4, the admin guide says it doesn't send the attribute.
https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/952303/radius-avps-and-vsas
While Fortiswitch 7.2.8 admin guide says it DOES send the attribute, AVP Type=80.
https://docs.fortinet.com/document/fortiswitch/7.2.8/administration-guide/137894/appendix-b-supported-attributes-for-radius-coa-and-rsso

Does anyone know the reason why this part is different between FortiOS and FortiSwitchOS?

The comment in the client.conf file shows below:
#  Old-style clients do not send a Message-Authenticator
#  in an Access-Request.  RFC 5080 suggests that all clients
#  SHOULD include it in an Access-Request.  The configuration
#  item below allows the server to require it.  If a client
#  is required to include a Message-Authenticator and it does
#  not, then the packet will be silently discarded.

Thanks,


Toshi


Best answer by vbandha

Hi @Toshi_Esumi 

They have made it mandatory in FortiOS 7.4.5
https://docs.fortinet.com/document/fortigate/7.4.5/fortios-release-notes/5880/radius-vulnerability

 

Regards,

Varun

 

1 reply

pminarik
Staff
pminarik
Staff
July 22, 2024

FortiOS only sends it when performing EAP authentication (where it is mandatory).

 

I'd be curious to see how "consistent" FortiSwitch is with this, given that the attribute is mentioned only with MAB and EAP (802.1x). At the same time, I can't quite recall if there is a scenario where a FSW would want to do plain, non-EAP, non-MAB, PAP/CHAP/MSCHAPv2 authentication.

    Toshi_Esumi
    SuperUser
    Toshi_EsumiAuthor
    SuperUser
    July 22, 2024

    So you're saying basically the 7.4.4 admin guide's description is incorrect, and FGTs do send that attribute with a condition.

    The RFC 5080 states...

    Any Access-Request packet that performs authorization checks,    including Call Check, SHOULD contain a Message-Authenticator    attribute.

    So I wouldn't argue with them for the freeradius' expectation with the newer version (I almost asked this to them) and not only EAP but also non-EAP admin&VPN user auth requests should have this attribute.

    But further arguing this with FTNT and submit a new feature request would take my time and effort. So I'll settle with my current "workaround" for this issue.

    Thank you for your prompt response @pminarik. I expected for this post to sit there without any comments a while.

    Toshi

    pminarik
    Staff
    pminarik
    Staff
    July 23, 2024

    > Any Access-Request packet that performs authorization checks,

     

    My reading of that RFC5080 section is that it discusses, and applies to, situations where an Access-Request is attempting to do only authorization, i.e. completely or essentially (MAB) without a password (provide username/MAC -> get info).

     

    With that said, I am not an expert, so dissent is welcome.

      Terms & ConditionsAccessibility statement