RADIUS: Implementing Two-Factor Authentication Across Your Network

The Protectimus RADIUS 2FA solution can be used to enable two-factor authentication for any software or equipment that supports RADIUS authentication protocol.

The Protectimus RADIUS Server connector works as a RADIUS server. It transfers authentication requests from the RADIUS device to the Protectimus multi-factor authentication (MFA) server and returns the answer permitting or denying access.

Add two-factor authentication (2FA / MFA) to protect your VPN, Wi-Fi, and any other software or device that supports RADIUS. To do that, integrate with Protectimus Cloud MFA Service or On-Premise Platform via RADIUS authentication protocol.

The list of software and devices that can be integrated with Protectimus via RADIUS authentication protocol includes but is not limited to:

• Ubuntu;
• Cisco AnyConnect;
• Cisco Switches;
• Citrix ADC (NetScaler ADC), Citrix Gateway (NetScaler Gateway), Citrix Virtual Desktops (XenDesktop), Citrix Virtual Apps (XenApp);
• VMware Horizon View (VDI), VMware Horizon Cloud DaaS (VDI), VMware vCenter Server;
• OpenVPN;
• Array AG SSL VPN
• Aruba ClearPass
• Barracuda SSL VPN
• Forcepoint VPN
• Juniper VPN
• Pulse Connect Secure SSL VPN
• F5 BIG-IP APM VPN;
• Palo Alto Networks VPN;
• FortiGate VPN;
• Check Point Remote Access VPN;
• Windows VPN;
• MikroTik VPN;
• SonicWALL TZ, NSA, Aventail series;
• WatchGuard Mobile VPN
• Wi-Fi hotspots;
• macOS;
• Huawei SSL VPN;
• UserGate VPN, etc.

The Protectimus RADIUS 2FA software is easy to set up. But if you have any questions, our team is always ready to help you with deploying RADIUS two-factor authentication (2FA) even in the most complex infrastructure. Get in touch with our support team.

To integrate Protectimus 2FA solution with your RADIUS supporting device or software you need to set up and configure Protectimus RADIUS Server, and then configure the authentication policies on the device or application you want to add Protectimus 2FA to:

1. You allow the transmission of an authentication request over the RADIUS protocol to Protectimus RADIUS Server;
2. The Protectimus RADIUS Server component receives and processes the authentication request;
3. Then Protectimus RADIUS Server contacts the Protectimus authentication server to verify the one-time password entered by the user.

1. Install Protectimus RADIUS Server to enable RADIUS 2FA

1.1. How to Install Protectimus RADIUS Server Using a Docker Image

1. To start installing the Protectimus RADIUS Server, first of all, download and install docker and docker-compose:

• Docker: https://docs.docker.com/engine/install/
• Docker-compose: https://docs.docker.com/compose/install/

2. Then clone the git repository: https://github.com/protectimus/platform-linux.git

3. Go to the platform-linux/radius directory and run:

docker-compose up -d

4. You can monitor the process of Protectimus RADIUS Server deployment using the command:

docker-compose logs -f

5. After the deployment process is complete, the Protectimus RADIUS Server will be available at: https://localhost:8443

1.2. How to Install Protectimus RADIUS Server on Windows

1. Download the installer at the Platform page.
2. Run the installer as administrator.
3. Check the Radius checkbox.
   
   

   ATTENTION!
   If you plan to use the Protectimus On-Premise Platform, keep the Platform checkbox checked.
   If you plan to use the Protectimus SAAS Service, uncheck the Platform checkbox.

If you plan to use the Protectimus On-Premise Platform	If you use plan to use the Protectimus SAAS Service

4. Java (JDK 7 and above) must be installed on the machine, if not, it will be installed automatically, click Install.

5. When Java is installed, click Next.

6. Choose the folder to install the Protectimus components and click Install.

7. When the installation is complete, you’ll see this message.

2. Get Registered and Configure Basic Settings

1. Register with the Protectimus Cloud Service and activate API or install the Protectimus On-Premise Platform.
2. Add Resource.
3. Add Users.
4. Add Tokens or activate Users’ Self Service Portal.
5. Assign Tokens to Users.
6. Assign Tokens with Users to the Resource.

3. Configure Protectimus RADIUS Server

The Protectimus RADIUS Server settings can be configured by specifying them in the radius.yml file, which must be located in the same directory as the executable.

Available properties that you should add to the radius.yml file include:

3.1. Authentication Process Settings

auth:
	providers:
    	- LDAP
    	- PROTECTIMUS_OTP
	re-enter-otp: true
	principal-normalization: true
	bypass-otp:
    	ldap-filter: (memberOf=cn=bypass-otp,ou=groups,dc=test,dc=com)
    	usernames:
          	- john
          	- luci
	inline-mode:
    	enabled: false
       	separator: ''
       	attributes:
         	NAS-Identifier:
           	- home-nas
           	- work-nas

providers:

re-enter-otp:

principal-normalization:

bypass-otp:

inline-mode:

3.2. RADIUS Settings

radius:
  secret: secret
  clients:
	- name: vpn-client
  	secret: secret
  	ips:
    	- 10.0.0.0/24
  auth-port: 1812
  listen-address: 0.0.0.0
  dictionaries:
	- file:<some_path>/<some_name>.dat
  attributes:
	copy-state: true
	defaults:
  	Service-Type: NAS-Prompt-User
	for-users:
  	john:
    	Service-Type: Login-User
	ldap:
  	memberOf:
    	'[cn=admins,ou=groups,dc=test,dc=com]':
      	Service-Type: Administrative
  	uid:
    	john_wick:
      	Class: Pro
	conditional:
  	'[ldapUser.attributes["uid"] == "john"]':
    	Service-Type:
      	- Login-User
  	'[request.getAttributeValue("User-Name") == "john"]':
    	Class:
      	- RDP_HeadOffice_GP
  ip-attributes:
	- NAS-IP-Address
	- NAS-IPv6-Address

secret:

clients:

auth-port:

listen-address:

dictionaries:

attributes:

copy-state:

defaults:

for-users:

ldap:

conditional:

ip-attributes:

3.3. PROTECTIMUS API Settings (setting up connection to the PROTECTIMUS service )

protectimus-api:
	login:
	api-key:
	url: https://api.protectimus.com/
	resource-id:

login:

api-key:

url:

resource-id:

3.4. LDAP Settings

ldap:
  base: dc=test,dc=com
  urls:
	- ldap://127.0.0.1:389
  username: admin@test.com
  password: secret
  principal-attribute: userPrincipalName
  custom-filter: (memberof=cn=managers,ou=groups,dc=test,dc=com)

base:

urls:

principal-attribute:

custom-filter:

3.5. RADIUS_PROXY Authentication Provider Configuration

proxy:
  secret: secret
  auth-port: 1812
  remote-address: 192.168.1.1

secret:

auth-port:

remote-address:

3.6. AD Authentication Provider Configuration

ad:
  urls:
	- ldap://127.0.0.1:389
  domain: test.com

3.7. An Example of radius.yml file

radius:
  secret: secret
  clients:
	- name: vpn-client
  	secret: secret
  	ips:
    	- 10.0.0.0/24
  auth-port: 1812
  listen-address: 0.0.0.0
  dictionaries:
	- file:/.dat
  attributes:
	copy-state: true
	defaults:
  	Service-Type: NAS-Prompt-User
	for-users:
  	john:
    	Service-Type: Login-User
	ldap:
  	memberOf:
    	'[cn=admins,ou=groups,dc=test,dc=com]':
      	Service-Type: Administrative
  	uid:
    	john_wick:
      	Class: Pro
	conditional:
  	'[ldapUser.attributes["uid"] == "john"]':
    	Service-Type:
      	- Login-User
  	'[request.getAttributeValue("User-Name") == "john"]':
    	Class:
      	- RDP_HeadOffice_GP
  ip-attributes:
	- NAS-IP-Address
	- NAS-IPv6-Address

auth:
  providers:
	- LDAP
	- AD
	- PROTECTIMUS_PASSWORD
	- PROTECTIMUS_OTP
	- RADIUS_PROXY
  bypass-otp:
	ldap-filter: (memberOf=cn=bypass-otp,ou=groups,dc=test,dc=com)
	usernames:
  	- john
  	- luci
	ips:
  	- 10.0.0.0/24
  	- 1::/64
  re-enter-otp: true
  principal-normalization: true
  inline-mode:
	enabled: false
	separator: ''

ldap:
  base: dc=test,dc=com
  urls:
	- ldap://127.0.0.1:389
  username:
  password:
  principal-attribute: userPrincipalName
  custom-filter: (memberof=cn=managers,ou=groups,dc=test,dc=com)

ad:
  urls:
	- ldap://127.0.0.1:389
  domain: test.com

protectimus-api:
  login: test@protectimus.com
  api-key: secret
  url: https://api.protectimus.com/
  resource-id: 1

proxy:
  secret: secret
  auth-port: 1812
  remote-address: 192.168.1.1

3.8. Dictionary example

VENDOR  	12356   fortinet

VENDORATTR  12356   Fortinet-Group-Name     	1   string
VENDORATTR  12356   Fortinet-Access-Profile 	6   string

Now you need to configure your device or application to communicate with Protectimus RADIUS Server service over RADIUS protocol.

If you have other questions, contact our customer support service.