Radius server in a DMZ, how to authenticate AD users ?
Pascal
we have a wifi project and we would like to authenticate Active
Directory users.
Is there a way to add the Radius server in a DMZ without being member
of the AD domain and authenticate the wifi users ?
Do you know basic secure infrastructure for such a situation ?
Thank you
--
Pascal
jwgoe...@gmail.com
these two articles help:
Windows Server 2003 Technical Library > Planning for IAS as a RADIUS
Server
IAS as a RADIUS server security considerations
http://technet2.microsoft.com/windowsserver/en/library/bfa1451a-6f53-4792-98a0-00d10977fd2c1033.mspx?mfr=true
Securing IAS: IAS and firewalls
http://technet2.microsoft.com/windowsserver/en/library/bfa1451a-6f53-4792-98a0-00d10977fd2c1033.mspx?mfr=true
Regards,
J Wolfgang Goerlich
S. Pidgorny <MVP>
requirement - the firewall considerations part of TechNet concerns a
firewall between RADIUS clients (wireless APs and controllers) and IAS.
There's no need to host IAS on DMZ.
--
Svyatoslav Pidgorny, MS MVP - Security, MCSE
-= F1 is the key =-
* http://sl.mvps.org * http://msmvps.com/blogs/sp *
<jwgoe...@gmail.com> wrote in message
news:1181685904....@z28g2000prd.googlegroups.com...
Pascal
Thank you for your answers.
But is it really secure to join the radius to the domain ?
--
Pascal
jwgoe...@gmail.com
> There's no need to host IAS on DMZ.
That depends upon ones risk tolerance and the cost of the DMZ, doesn't
it? If I were deploying an IAS server and had a spare interface on my
firewall, I would definitely put it in a DMZ.
J Wolfgang Goerlich
S. Pidgorny <MVP>
"Pascal" <pasc...@nospam.hotmail.com> wrote in message
news:mn.6ae27d767...@nospam.hotmail.com...
> Thank you for your answers.
>
> But is it really secure to join the radius to the domain ?
Basically you have to. The risk is that somebody will attempt to
authenticate against the domain.
S. Pidgorny <MVP>
<jwgoe...@gmail.com> wrote in message
news:1181734482.6...@g37g2000prf.googlegroups.com...
Overengineering, in my opinion. Do basic threat modeling: identify a
scenario when a firewall between IAS and the rest of the domain will prevent
successful attack. I struggle figuring out such scenario.
Leythos
says...
> G'day:
>
> <jwgoe...@gmail.com> wrote in message
> news:1181734482.6...@g37g2000prf.googlegroups.com...
> > Svyatoslav Pidgorny wrote:
> >> There's no need to host IAS on DMZ.
> >
> > That depends upon ones risk tolerance and the cost of the DMZ, doesn't
> > it? If I were deploying an IAS server and had a spare interface on my
> > firewall, I would definitely put it in a DMZ.
> >
>
> Overengineering, in my opinion. Do basic threat modeling: identify a
> scenario when a firewall between IAS and the rest of the domain will prevent
> successful attack. I struggle figuring out such scenario.
The idea of putting an authentication box, attached to the domain for
authentication, in the DMZ to expose LAN resources is just plain wrong
and the model needs to be rethought.
--
Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam9...@rrohio.com (remove 999 for proper email address)
jwgoe...@gmail.com
I find it difficult to believe that putting an IAS in a DMZ or
perimeter network is an altogether outrageous idea. Note that the
Technet article says that in "the most common configuration, the
firewall is connected to the Internet and the IAS server is another
intranet resource that is connected to the perimeter network." In
addition, the Windows 2003 Security exam also describes this IAS/
Radius configuration.
The point of a putting a firewall between the client and the IAS
server is that one suspects the IAS server might be compromised. A
possible scenario includes an attacker compromising the IAS server and
then using it as a beachhead to compromise further systems. If cost is
not a significant issue, I would argue placing a second firewall
between the IAS server and the production network makes sense. This
gives an administrator greater control over the IAS environment.
Regards,
J Wolfgang Goerlich
Leythos
jwgoe...@gmail.com says...
If a server in the DMZ has the ability to authenticate with the LAN
network services then there is little point in having a DMZ. If you open
any common ports between DMZ and LAN, and the DMZ node is a member of
the LAN domain/authentication, then you've just eliminated the security
of the DMZ.
