topic Re: Check Point Radius Access to SmartConsole with no local user in SASE and Remote Access

Check Point Radius Access to SmartConsole with no local user

Keld_Norman — Thu, 15 Nov 2018 11:07:14 GMT

Hi CheckMates,

I am looking in to Radius authentication of an AD user to allow login to SmartDashboard

Is it possible to give an AD user access to SmartDashboard using Radius without having to add it first in the -> manage & settings -> Permissions & administrators -> administrators ?

My wish is to have a group in Active Directory that I can add an AD user to and then he/she can login to the SmartDashboard.

If that is not possible and i HAVE TO use a local user - then I want to associate one checkpoint local user - it could be a user called radius_admin - to all users that try to login to the smart dashboard. If the user is approved in AD/Radius then the login is allowed - can this be done ?

Best regards

Keld Norman

Re: Check Point Radius Access to SmartConsole with no local user

Nüüül — Thu, 15 Nov 2018 17:30:35 GMT

Hi,

Two years ago I tried similar thing on 77.20 and ended up with creating the users and authorize them with the built in groups. Password came from RADIUS

regarding this:

Security Management R80.20 Administration Guide

it did not change. neither for TACACS or SecureID

Re: Check Point Radius Access to SmartConsole with no local user

Keld_Norman — Fri, 16 Nov 2018 08:11:34 GMT

Thanks Daniel Meier

Was it for administrators to access the SmartDashboard you made that setup ? or for VPN or other services for users ?

By the way, a note about radius for SSH and WebGui access:

I found that the setup in the webgui only supports PAP by default (also known as rfc1334) where credentials are transmitted from the Radius Client in plain text or rather .. it XORs the password with an MD5 hash based on the shared secret and transmit that to the radius server.

(So I did not configure that to avoid creating a security risk and failing compliance checks.)

Re: Check Point Radius Access to SmartConsole with no local user

Nüüül — Fri, 16 Nov 2018 16:58:33 GMT

Hi,

I did it for authenticating Administrators. Ended up with SafeNet Token Authentication

For VPN I either ended up with LDAP only, or using a Cisco ASA, as it is more flexible

Cheers

Daniel

Re: Check Point Radius Access to SmartConsole with no local user

Darren_Fine — Tue, 19 May 2020 08:27:53 GMT

Hi guys,

Was researching using radius for Smartconsole logins and the security risk thereof.

Like you guys mentioned the PAP protocol seems to allow for the md5 hash to be cracked somewhat easily which would reveal the password so its a good idea to use a dynamic one time password.

So if that is the case - is it better to only auth with the one time password ?

(I was originally going to use a <userstore password>+<1 time token> combination .. but if this can be viewed then surely its safer to just use the <1 time token> cause it wont be valid anymore)

I hope the above makes sense 🙂

Regards

PS ..<the above Smartconsole issue doesnt seem to be a problem with vpns since the 1st factor is via the user store and the second auth via radius can be just the 1 time token password - and this wont matter if it is decrypted since it wont be valid again>

Re: Check Point Radius Access to SmartConsole with no local user

Alon_Alapi — Tue, 19 May 2020 14:41:49 GMT

Hi,

I have a customer RFE that will probably meet you requirements,

Please contact me offline (alonal@checkpoint.com) and we will take it from there.

Thanks,

Alon

Re: Check Point Radius Access to SmartConsole with no local user

Michal_Gans — Wed, 24 Aug 2022 14:14:41 GMT

Hello,

is there any progress with RFE? Customer asked me for something similar.

Thanks

Re: Check Point Radius Access to SmartConsole with no local user

Alon_Alapi — Thu, 25 Aug 2022 06:10:38 GMT

Hi,

I suggest to continue this discussion via email (alonal@checkpoint.com)

Thanks,

Alon

Re: Check Point Radius Access to SmartConsole with no local user

spaceForceOne — Tue, 30 Aug 2022 02:23:59 GMT

Did you manage to get this working? (without creating individual administrator accounts on Check Point)