ROS RADIUS is insecure

[tikmakro]

Hi,

There have been many forum topics requesting RADIUS security improvements, going back 10+ years.

PAP for Winbox Radius Logins

Please make winbox logins with radius as a backend not CHAP-only. CHAP seems like a good idea at first, until you have to severely compromise password security on the radius server by storing all passwords in cleartext. Also, usage of two factor authentication is not possible with CHAP. So please enable use of PAP for that. SSH and telnet already do this, I’m not sure on why winbox doesn’t.

Authenticating Login Users via Radius with LDAP backend

Hi I try to integrate the Miktrotik Routers into our central Radius AAA System. We use Freeradius with a LDAP backend. The problem I’m facing is that when I try to log in on the web interface is that it send’s an authentication request with mschap and freeradius seams not to be able to handle that. Is there a way to change this so that it die simple plaintext authentication? Regards Matthias

When dose routeros radius authentication using PAP

When or How to make radius is using PAP instead of MSCHAPv2 in Routeros Radius Client? In https://wiki.mikrotik.com/wiki/Manual:RADIUS_Client Access-Request I didn’t find when routeros is using MSCHAPV2 and when I set ppp profile encrypt set to no. My server still get MSCHAPv2 Challenge responses. [04CDD6F7-4380-4A08-BDB9-BB61B2CDD9DC.png] We are using a owned accouting system and we are using a own-built radius server so that our employee can using l2tp vpn. In MSCHAPv2 password is stored a…

Mikrotik 2 Factor authentication

Hello, I wannt to authenticate winbox or ssh with second factor. The problem is with password, which mikrotik sends this mschapv2, so its hasched. Authenticator cannot recognize it and I get blank pass field. Is there any option to change mschapv2 to pap for example or whatever . What’s about dot1x, there is a few options eap methods. Can I authorize by this way ?

RouterOS currently uses MS-CHAPv2 for RADIUS login, including WebFig, SSH and API access. There is no setting allowing users to change to any other authentication method.

Microsoft advised way back in 2012 that MS-CHAPv2 is insecure: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2012/2743314

MS-CHAPv2 is not supported by many modern identity providers. It requires the RADIUS backend to store either the user’s cleartext password or the NT hash of it. The NT hash is password-equivalent, so storing it is much worse security. Modern IdP’s use one-way password encryption so exposure of password material doesn’t permit login.

With PAP, the RADIUS server receives the submitted password for that login attempt and can verify it against its normal password backend, without having to store NT hashes.

ROS should support more than a single RADIUS authentication protocol. Please add support for selecting the preferred one for RouterOS management login, especially PAP, because many RADIUS providers don’t support MS-CHAPv2.

Thanks.

[jaclaz]

You should send this feature request directly to Mikrotik, while from time to time the developers read the forum, there Is no guarantee they will ever see this thread.