plugins icon indicating copy to clipboard operation
plugins copied to clipboard

net/freeradius - Error: It looks like the client has been updated to protect from the BlastRADIUS attack.

Open ignitedPotato opened this issue 1 year ago • 0 comments

Important notices Before you add a new report, we ask you kindly to acknowledge the following:

  • [x] I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
  • [x] I have searched the existing issues, open and closed, and I'm convinced that mine is new.
  • [x] The title contains the plugin to which this issue belongs

Describe the bug FreeRadius logs the following error for every login request, even though the login itself still works:

2024-09-24T13:50:24	 	 	Auth: (0) Login OK: [xxx] (from client xxx port 0 cli xx-xx-xx-xx-xx-xx)	
2024-09-24T13:50:24	 	 	Error: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!	
2024-09-24T13:50:24	 	 	Error: Please set "require_message_authenticator = true" for client xxx
2024-09-24T13:50:24	 	 	Error: It looks like the client has been updated to protect from the BlastRADIUS attack.	
2024-09-24T13:50:24	 	 	Error: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!	
2024-09-24T13:50:24	 	 	Error: Setting "require_message_authenticator = true" for client xxx	
2024-09-24T13:50:24	 	 	Error: BlastRADIUS check: Received packet with Message-Authenticator.	
2024-09-24T13:50:24	 	 	Error: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

I'm using a Unifi AP as a client which already fixed the BlastRADIUS issue. Would it be possible to add require_message_authenticator as a field for clients?

Environment OPNsense 24.7.4_1 (amd64).

ignitedPotato avatar Sep 24 '24 11:09 ignitedPotato