RADIUS and VPN
A second factor for everything that speaks RADIUS.
VPN, firewalls, Wi-Fi controllers, network devices and Linux logins: the same Secret Squares and the same authenticator apps, without another product.
How a sign-in runs
The code comes from "Show grid" on the user’s PC or Mac, or from an authenticator app.
What it can do
A Windows service
It listens on UDP 1812 and answers any client that speaks RADIUS: VPN, firewalls, Wi-Fi controllers, network devices.
Three ways to ask
Two-step challenge (password, then code), password and code in one field, or code only.
Password check
Against Active Directory (LDAP) or against the user’s Twin Verify password.
Per-client groups and attributes
Different rules per client, and reply attributes such as VLAN, firewall groups and vendor attributes.
Blast-RADIUS protection
Protects against the Blast-RADIUS attack (CVE-2024-3596).
Codes from the user’s own device
"Show grid" in the tray or Mac menu bar, or an authenticator app, with the authenticator PIN as an option instead of the password. No hardware token.
Linux
SSH, sudo and su through pam_radius, with a setup script. Linux servers can also use the native client, which needs no RADIUS server and works offline.
Good to know
So that your planning is right from the start:
- The Twin Verify service must be reachable: RADIUS sign-in does not work offline.
- It is its own RADIUS service, not an extension for the Microsoft Network Policy Server.
Ready for a sign-in people do not work around?
Tell us about your organisation and we will show you how Twin Verify fits. Write to us or call us.