02/10/2024
Fortigate version 7.2.10 และ 7.4.5
มีการป้องกัน ช่องโหว่ RADIUS vulnerability
โดย fortigate จะ Force the validation of message-authenticator
ดังนั้นหาก Fortigate มีการเชื่อมต่อกับ Radius แนะนำให้ Make sure ว่า Radius ส่ง message-authenticator มาด้วยนะครับ
=================
1. For Windows Server, Kindly update the Windows Server to the latest patch using Windows update, which will address the security vulnerability in the Remote Authentication Dial-In User Service (RADIUS) protocol and enable "Access-Request messages must contain the message-authenticator attribute checkbox" for verification of the Message-Authenticator attribute in all Access-Request packets on the client.
Go to NPS > Open Radius Clients.
Select Radius Client.
Go to Advance Settings.
In Additional Options >Click to select the Access-Request messages must contain the message-authenticator attribute checkbox.
2. For FortiAuthenticator, Kindly upgrade FortiAuthenticator to version 6.6.2, that will have an option to enable Message-Authenticator attribute.
Go to Authentication > RADIUS Service > Clients > Create a new RADIUS client/edit a existing client > there's a toggle option to turn on "Require client to send Message-Authenticator attribute"
3. For Cisco Duo, Kindly refer to the below to upgrade DUO once the fix is available:
https://duo.com/docs/authproxy-notes
