Check ID:
Provider: AWS
Service:
Severity: MEDIUM
Categories:
Resource type:
directoryservice_radius_server_security_protocolProvider: AWS
Service:
directoryserviceSeverity: MEDIUM
Categories:
identity-accessResource type:
OtherWhat this check verifies
AWS Directory Service RADIUS configuration uses the authentication protocol defined for MFA integration. The finding evaluates whether directories with RADIUS enabled are set toMS-CHAPv2 instead of weaker options like PAP, CHAP, or MS-CHAPv1.
Risk
UsingPAP, CHAP, or MS-CHAPv1 weakens RADIUS-based MFA.
PAP exposes cleartext credentials, while legacy CHAP variants permit offline cracking and replay, enabling unauthorized access to AD-integrated services and lateral movement, degrading confidentiality and integrity.
Recommendation
Standardize onMS-CHAPv2 for RADIUS authentication to MFA providers. Disable PAP, CHAP, and MS-CHAPv1 to prevent downgrades. Apply least privilege and defense in depth: use strong shared secrets, restrict network access to RADIUS endpoints, and monitor authentication logs for anomalies.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://docs.secureauth.com/0903/en/ms-chapv2-and-radius—sp-initiated—for-cisco-and-netscaler-configuration-guide.html
- https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_mfa.html
- https://www.freeradius.org/documentation/freeradius-server/4.0~alpha1/raddb/mods-available/mschap.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = directoryservice_radius_server_security_protocol. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks