Cis AWS Euc 2.18

Ensure Radius server is using the recommended security protocol (Automated)

Description

The authentication protocol between the Microsoft AD DCs and the RADIUS server supported are PAP, CHAP, MS-CHAPv1, and MS-CHAPv2.

Rationale

MS-CHAPv2 provides the strongest security of the options supported.

Impact

None

Audit Procedure

Using AWS Console - For AWS Managed AD based environments

Perform the steps to check multi-factor authentication using the radius server protocol is set to MS-CHAP v2.

1. Log in to the Directory Service console at https://console.aws.amazon.com/directoryservicev2
2. In the left pane select Directories.
3. Choose the directory ID link for your AWS Managed Microsoft AD directory.
4. On the Directory details page, select the Networking & security tab.
5. In the Multi-factor authentication section, confirm that the Protocol is set to MS-CHAPv2.

Using AWS Console - For directory connector / self-managed AD environments

1. Log in to the AWS Workspaces console at https://console.aws.amazon.com/workspaces
2. In the left pane select Directories.
3. Select the directory ID link for your AWS Managed Microsoft AD directory.
4. On the Directories page, scroll to the Multi-factor authentication section and select Edit.
5. In the Multi-factor authentication section confirm that, in the Protocol field MS-CHAPv2 is selected from the dropdown list.

If it is not set to MS-CHAPv2 refer to the remediation steps below.

Expected Result

The RADIUS server protocol is configured to use MS-CHAPv2 for multi-factor authentication.

Remediation

Using AWS Console - For AWS Managed AD based environments

Perform the steps below to set the protocol to MS-CHAPv2 for multi-factor authentication.

1. Log in to the Directory Service console at https://console.aws.amazon.com/directoryservicev2
2. In the left pane select Directories.
3. On the Directory details page, select the Networking & security tab.
4. In the Multi-factor authentication section, choose Actions, and then choose Edit.
5. On the Enable multi-factor authentication (MFA) page change the following value:
6. Protocol - MS-CHAPv2
7. Click Save.

Using AWS Console - For directory connector / self-managed AD environments

1. Log in to the AWS Workspaces console at https://console.aws.amazon.com/workspaces
2. In the left pane select Directories.
3. Select the directory ID link for your AWS Managed Microsoft AD directory.
4. On the Directories page, scroll to the Multi-factor authentication section and select Edit.
5. In the Multi-factor authentication section modify the protocol using the dropdown menu to be MS-CHAPv2 from the currently selected option.
6. Click Save once settings are as desired.

Default Value

By default, this is dependent on your RADIUS server.

References

1. https://aws.amazon.com/blogs/security/how-to-enable-multi-factor-authentication-for-amazon-workspaces-and-amazon-quicksight-by-using-microsoft-ad-and-on-premises-credentials/
2. https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_mfa.html

CIS Controls

Controls Version v8:

• 5.6 Centralize Account Management

Controls Version v7:

• 16.2 Configure Centralized Point of Authentication

Profile

Level 2