Hi everyone,
I’m trying to add duo to a RADIUS authentication process to a router client device.
My normal RADIUS implementation works fine, from my DUO auth proxy box (with it all turned off) I can ssh to the router using domain credentials, running a packet capture on the NPS I can see requests and responses and authentication succeeds.
When DUO enters the equation things get a bit more difficult. I have configured the authproxy.cfg as follows:
;CLIENTS:
; Radius #Lab
[radius_client]
host=192.168.254.59
secret=XXXXXXXXXXXXXXX
; port=
; SERVERS:
; Radius #Lab
[radius_server_auto]
ikey=XXXXXXXXXXXXXXXXXXXX
■■■■
api_host=■■■■
radius_ip_1=192.168.254.1
radius_secret_1=XXXXXXXXXXXXXXXX
failmode=safe
client=radius_client
port=1812
The connectivity tool reports the following errors:
[duoauthproxy.lib.log#info] There are no configuration problems related to connectivity.
[duoauthproxy.lib.log#error] We cannot confirm that the Auth Proxy was able to establish a RADIUS connection to 192.168.254.59:1812. In the case of an actual failure this may be due to a misconfigured secret or network issues. This may also happen if the upstream RADIUS Server does not support the Status-Server message
[duoauthproxy.lib.log#debug] Exception:
[duoauthproxy.lib.log#info] -----------------------------
[duoauthproxy.lib.log#info] Testing section ‘radius_server_auto’ with configuration:
[duoauthproxy.lib.log#info] {‘api_host’: ‘■■■■’,
‘client’: ‘radius_client’,
‘debug’: ‘True’,
‘failmode’: ‘safe’,
‘ikey’: ‘XXXXXXXXXXXXXXXXXXXX’,
‘port’: ‘1812’,
‘radius_ip_1’: ‘192.168.254.1’,
‘radius_secret_1’: ‘’,
‘skey’: '[40]’}
[duoauthproxy.lib.log#warn] The RADIUS Server has connectivity problems.
[duoauthproxy.lib.log#info] There are no configuration problems related to connectivity.
I have configured the router with the duoauthproxy server as the RADIUS server and see authentication packets being sent to the NPS by the duoauthproxy server, one Access-Request packet followed by 3 more duplicate requests but no responses.
These are the authentication method settings I’m using on the NPS:
Can anyone ■■■■ist? There are no firewalls involved in this setup as it’s in a lab. Both the Auth Proxy and NPS server have two network interfaces one internal to the VM network and one bridged interface out.
The packet capture is from the NPS box. While checking the RADIUS clients I’ve seen I didn’t have the DUO auth proxy box enabled. Nice catch.
This has got me a lot further, however when attempting to connect now with my DUO user I receive a prompt successfully on my mobile device, and hit “Approve” but receive the following error message in the console. (I have confirmed this account is unlocked and not disabled on the NPS/DC)
To ensure authentication succeeds we need to pass some vendor specific attributes (26th Vendor Specific Attribute needs to be configured as the username passed back to the router device) In our case the user is “NOC” - a default RADIUS response passes through the username “remote” as you can see from the error log below on the router there is a username of “remote” being passed back to the router and not the VSA as defined on the NPS of “NOC”
Feb 22 12:24:31.148 2019 ROUTERNAME.com sshd[615]: User remote is authenticated successfully but no logical login-id configured.
Feb 22 12:24:31.148 2019 ROUTERNAME.com sshd[613]: error: PAM: user account has expired for securitylab\vaderd from 192.168.254.56
Feb 22 12:24:31.148 2019 ROUTERNAME.com sshd: SSHD_LOGIN_FAILED: Login failed for user ‘securitylab\vaderd’ from host ‘192.168.254.56’
