Hi Mourik,
This is a larger problem than just PacketFence.
It affects FreeRADIUS in general when authenticating PEAP, or really anything
that uses ntlm for authentication (Squid and Apache come to mind in some
configurations).
The following thread is very enlightening on the subject:
http://freeradius.1045715.n5.nabble.com/NTLMv2-with-FreeRADIUS-td5726394.html
Short answer, you can’t do ntlmv2 with PEAP on FreeRADIUS.
That said, the eap tunnel is secure from the supplicant to the PacketFence
server.
Unless someone can intercept and decrypt the traffic from the PacketFence
server to your AD server a MitM should not be possible.
Ensuring that unauthorized users/devices cannot have access to that traffic is
part of the reason why people have a NAC in the first place.
Perfect security would probably require IPsec between PF and the AD server.
That comes with it’s own set of problems though.
So patch early and patch often (all samba packages as well as your Active
Directory), and then make sure no one can snoop on the traffic between the AD
and PacketFence.
It may be we are witnessing the end of the PEAP era.
EAP-TTLS-PAP and EAP-TLS are not vulnerable to that issue, but their support on
windows is relatively recent.
Regards,
--
Louis Munro
[email protected] :: www.inverse.ca
+1.514.447.4918 x125 :: +1 (866) 353-6153 x125
Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence
(www.packetfence.org)
> On Apr 14, 2016, at 10:28 , mj <[email protected]> wrote:
>
> Hi all,
>
> Reading the samba security advisory from two days ago, we were advised
> to add the smb.conf:
>
> server signing = mandatory
> ntlm auth = no
>
> When adding that, the packetfence radius no longer appears to work.
> (seems logical)
>
> But...is there a way to follow the samba security advisory, and at the
> same time have packetfence with 802.1x security (as advocated on this
> list) for your networked devices?
>
> Or are we forced to choose..?
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
