Accenture MDR Quick Start Guide for FreeRadius

This quick start guide will help Accenture MDR customers configure FreeRadius to send logs to the Log collection Platform (LCP).

The document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring FreeRadius
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at Accenture Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

FreeRadius

LCP

514 (UDP) or

601 (TCP)

Default port

Configuring FreeRadius

Login to the machine where the FreeRadius is hosted.
Modify the file in below location

etc/freeradius/radius.conf

The "log" section of the radius.conf file is where the primary logging configuration for the FreeRADIUS server is located.

logdir = syslog
Log_destination = syslog
log{
    destination = syslog
    syslog_facility = daemon
    stripped_names = no
    auth = yes
    auth_badpass = no
    auth_goodpass = no
}

NOTE : The steps mentioned till now will ensure the logs goes to syslog directory within machine where freeradius is hosted. In order to send syslog to remote server, consult your system admin for configuration to send the syslog to remote server.

Below is one set of example for configuring syslog to remote server for linux machine :

3. Edit the file in below location

/etc/syslog.conf

# .=notice will log only authentication messages (L_AUTH)
# <facility_name>.=notice @LCP-IP
# .=err will log only module errors for radius
#<facility_name>.=err @LCP IP
# .* will log all messages in the same log file
# <facility_name>.* @LCP IP

4. Restart the syslog daemon

LCP Configuration Parameters

Table 1-2: The FreeRadius event collector (Syslog - 3958) sensor properties to be configured by MDR are shown in the table.

Property	Default Value	Description
Protocol	UDP	The default protocol for syslog. The collector can also accept logs in TCP.
IP Address	Custom value	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture Security MDR onboarding team.
Signatures	: Auth: : Info: : Warning: : ERROR: : Error:	MDR recommended signatures processed by the FreeRadius event collector.
Port Number	514	The default port number for syslog. For TCP, the default port is 601.