RADIUS

	Email		Print
	Bookmark		Link

RADIUS

Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized access, authorization and accounting management for people or computers to connect and use a network service. When a person or device connects to a network often "Authentication
Authentication

Authentication is the act of establishing or confirming something as authentic, that is, that claims made by or about the subject are true....
" is required. Networks or services not requiring authentication are said to be anonymous or open.

Connecting a computer to a telecommunication network raises several problems for the network owner or the telco

Telephone company

Discussion

Ask a question about 'RADIUS'

Start a new discussion about 'RADIUS'

Answer questions from other users

Full Discussion Forum

Encyclopedia

Telephone company

A telephone company provides telecommunications services such as telephony and data communications. Most of the largest telcos, whatever their origins, are or were at one time nationalized or state-regulated monopoly....
. The telco first needs to know who is operating the computer. Once the user has been identified, the telco needs to know what facilities to allow the user to access. At the same time the telco needs to collect billing data relating to the time or capacity that was consumed. RADIUS is a protocol

Protocol

Protocol may also refer to:...
used by many common open source and proprietary systems to control these processes. RADIUS based systems are commonly implemented by telcos to identify their customers, and by companies to identify their remote employees.

Once authenticated, RADIUS also determines what rights or privileges the person or computer is "Authorized" to perform and makes a record of this access in the "Accounting" feature of the server. The support of Authentication, Authorization and Accounting is referred to as the AAA

AAA protocol

In computer security, AAA stands for ?authentication, authorization and accounting?. The AAA is sometimes combined with auditing and accordingly becomes AAAA....
(said triple A) process.

Because of the broad support and the ubiquitous nature of the RADIUS protocol it is often used by ISPs, wireless network

Wireless network

Wireless network refers to any type of computer network that is wireless, and is commonly associated with a telecommunications network whose interconnections between Node is implemented without the use of wires....
s, integrated e-mail services, access point

Access Point

Access Point can refer to:*Access Point , a location on Anvers Island, Antarctica*Wireless access point, a wireless networking device...
s, network ports, web server

Web server

The term web server can mean one of two things:# A computer program that is responsible for accepting Hypertext Transfer Protocol requests from clients , and Server them HTTP responses along with optional data contents, which usually are web pages such as Hypertext Markup Language documents and linked objects ....
s or any provider needing a well supported AAA server.

RADIUS is commonly used by ISPs and corporations managing access to the Internet

Internet

The Internet is a global network of interconnected computers, enabling users to share information along multiple channels. Typically, a computer that connects to the Internet can access information from a vast array of available server and other computers by moving information from them to the computer's local memory....
or internal network

Computer network

A computer network is a group of interconnected computers. Networks may be classified according to a wide variety of characteristics. This article provides a general overview of some types and categories and also presents the basic components of a network....
s employing a variety of networking technologies, including modem

Modem

Modem is a peripheral device that modulation an analog carrier wave Signal to encode digital information, and also demodulation such a carrier signal to decode the transmitted information....
s, DSL, wireless

Wireless

Wireless communication is the transfer of information over a distance without the use of electrical conductors or "wires". The distances involved may be short or long ....
and VPNs.

AAA

RADIUS servers use the AAA

AAA protocol

In computer security, AAA stands for ?authentication, authorization and accounting?. The AAA is sometimes combined with auditing and accordingly becomes AAAA....
concept to manage network access in the following two-step process, also known as an "AAA transaction".

Authentication

Authentication

Authentication is the act of establishing or confirming something as authentic, that is, that claims made by or about the subject are true....
, Authorization

Authorization

Authorization is the function of specifying access rights to resources, which is related to information security and computer security in general and to access control in particular....
& Accounting are described in RFC 2865.

The user or machine (referred to as Radius clients) sends a request to a Network Access Server

Network access server

A Network Access Server is a single point of access to a remote resource....
(NAS) to gain access to a particular network resource using access credentials. The credentials are passed to the NAS device via the link-layer protocol - for example, Point-to-Point Protocol

Point-to-Point Protocol

In Computer network, the Point-to-Point Protocol, or PPP, is a Data Link Layer Protocol commonly used to establish a direct connection between two Node ....
(PPP) in the case of many dialup or DSL providers.

In turn, the NAS sends a RADIUS Access Request message to the RADIUS server, requesting authorization to grant access via the RADIUS protocol.

This request includes access credentials, typically in the form of username and password

Password

A password is a secret word or string of Character that is used for authentication, to prove identity or gain access to a resource . The password must be kept Secrecy from those not allowed access....
or security certificate provided by the user. Additionally, the request contains information which the NAS knows about the user, such as its network address or phone number, and information regarding the user's physical point of attachment to the NAS.

The RADIUS server checks that the information is correct using authentication schemes like PAP

Password authentication protocol

Password Authentication Protocol, sometimes abbreviated PAP, is a simple authentication protocol used to authenticate a user to a network access server used for example by internet service providers....
, CHAP

Challenge-handshake authentication protocol

In computing, the Challenge-Handshake Authentication Protocol authentication s a user or network host to an authenticating entity. That entity may be, for example, an Internet service provider ....
or EAP

Extensible Authentication Protocol

Extensible Authentication Protocol, or EAP, is a universal authentication framework frequently used in wireless LAN and Point-to-Point Protocol....
. The user's proof of identification is verified, along with, optionally, other information related to the request, such as the user's network address or phone number, account status and specific network service access privileges. Historically, RADIUS servers checked the user's information against a locally stored flat file database. Modern RADIUS servers can do this, or can refer to external sources - commonly SQL

SQL

SQL is a database computer language designed for the retrieval and management of data in relational database management systems , database schema creation and modification, and database object access control management....
, Kerberos, LDAP, or Active Directory

Active Directory

Active Directory is a technology created by Microsoft that provides a variety of network services, including:* Lightweight Directory Access Protocol-like directory services...
servers - to verify the user's credentials.

The RADIUS server then returns one of three responses to the NAS; a "Nay" (Access Reject), "Challenge" (Access Challenge) or "Yea" (Access Accept).

Access Reject - The user is unconditionally denied access to all requested network resources. Reasons may include failure to provide proof of identification or an unknown or inactive user account.
Access Challenge - Requests additional information from the user such as a secondary password, PIN, token or card. Access Challenge is also used in more complex authentication dialogs where a secure tunnel is established between the user machine and the Radius Server in a way that the access credentials are hidden from the NAS.
Access Accept - The user is granted access. Once the user is authenticated, the RADIUS server will often check that the user is authorized to use the network service requested. A given user may be allowed to use a company's wireless network, but not its VPN service, for example. Again, this information may be stored locally on the RADIUS server, or may be looked up in an external source like LDAP or Active Directory.

Authorization attributes

Radius Values

IntroductionThe Attributes for Radius use is define in RFC 2865 .5.Values Table...
are conveyed to the NAS stipulating terms of access to be granted. For example: the following authorization attributes may be included in an Access-Accept.

The specific IP address
IP address

An Internet Protocol address is a numerical identification that is assigned to devices participating in a computer network utilizing the Internet Protocol for communication between its nodes....
to be assigned to the user
The address pool from which the user's IP should be chosen
The maximum length that the user may remain connected
An access list, priority queue or other restrictions on a user's access
L2TP
L2TP

In computer networking, is a tunneling protocol used to support virtual private networks . It does not provide any encryption or confidentiality by itself; It relies on the encryption protocol that it passes within the tunnel to provide privacy....
parameters
VLAN parameters
Quality of Service (QoS) parameters

Accounting

Accounting is described in RFC 2866.

When network access is granted to the user by the NAS, an Accounting Start request is sent by the NAS to the RADIUS server to signal the start of the user's network access. "Start" records typically contain the user's identification, network address, point of attachment and a unique session identifier.
Periodically, Interim Accounting records may be sent by the NAS to the RADIUS server, to update it on the status of an active session. "Interim" records typically convey the current session duration and information on current data usage.
Finally, when the user's network access is closed, the NAS issues a final Accounting Stop record to the RADIUS server, providing information on the final usage in terms of time, packets transferred, data transferred, reason for disconnect and other information related to the user's network access.

The primary purpose of this data is that the user can be billed

Bill (payment)

A bill is a document demanding payment for an order previously supplied. Presentation of a bill is common practice on the part of restaurants, credit card companies, public utility, and other service providers....
accordingly; the data is also commonly used for statistical purposes and for general network monitoring.

Properties of RADIUS

The RADIUS protocol does not transmit passwords in cleartext

Cleartext

In data communications, cleartext is the form of a message or data which is in a form that is immediately comprehensible to a human being without additional processing....
between the NAS and RADIUS server (not even with PAP protocol). Rather, a shared secret is used along with the MD5

MD5

In cryptography, MD5 is a widely used cryptographic hash function with a 128-bit hash value. As an Internet standard , MD5 has been employed in a wide variety of security applications, and is also commonly used to check the integrity of computer file....
hashing algorithm to obfuscate passwords. Because MD5 is not considered to be a very strong protection of the user's credentials, additional protection - such as IPsec

IPsec

Internet Protocol Security is a Protocol suite for securing Internet Protocol communications by authentication and encryption each packet #Example: IP packets of a data stream....
tunnels - should be used to further encrypt the RADIUS traffic. The user's credentials are the only part protected by RADIUS itself, but other user-specific attributes passed by RADIUS may be considered sensitive or private information as well. Please refer to the references for more details on this subject.

RADIUS is a common authentication protocol utilized by the IEEE 802.1X

IEEE 802.1X

IEEE 802.1X is an IEEE Standard for port-based Network Access Control . It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a Local area network, either establishing a point-to-point connection or preventing it if authentication fails....
security standard (often used in wireless networks). Although RADIUS was not initially intended to be a wireless security authentication method, it improves the WEP

Wired Equivalent Privacy

Wired Equivalent Privacy is a Deprecation algorithm to secure IEEE 802.11 wireless computer network. Wireless networks broadcast messages using radio and are thus more susceptible to eavesdropping than wired networks....
encryption key standard, in conjunction with other security methods such as EAP

Extensible Authentication Protocol

Extensible Authentication Protocol, or EAP, is a universal authentication framework frequently used in wireless LAN and Point-to-Point Protocol....
-PEAP

Protected Extensible Authentication Protocol

Protected Extensible Authentication Protocol, Protected EAP, or simply PEAP , is a method to securely transmit authentication information, including passwords, over wired or wireless LANs....
.

RADIUS is extensible; many vendors of RADIUS hardware and software implement their own variants using Vendor-Specific Attributes (VSAs).

RADIUS has been officially assigned UDP ports 1812 for RADIUS Authentication and 1813 for RADIUS Accounting by the Internet Assigned Number Authority

IANA

IANA is an initialism that may stand for a number of things:*the Internet Assigned Numbers Authority, an organisation that oversees IP address, Top-level domain and Internet protocol code point allocations...
allocation ports 1645 - Authentication and 1646 - Accounting were used unofficially and became the default ports assigned by many RADIUS Client/Server implementations of the time. The tradition of using 1645 and 1646 for backwards compatibility continues to this day. For this reason many RADIUS Server implementations monitor both sets of UDP ports for RADIUS requests. Microsoft

Microsoft

Microsoft Corporation is a multinational corporation computer technology corporation that develops, manufactures, licenses, and supports a wide range of computer software products for computing devices....
RADIUS servers default to 1812 and 1813 but Cisco

Cisco

Cisco may refer to:Companies:* Cisco Systems, a computer networking company* Certis CISCO, corporatised entity of the former Commercial and Industrial Security Corporation in Singapore....
devices default to the traditional 1645 and 1646 ports. Juniper Networks

Juniper Networks

Juniper Networks, Inc. is an information technology and computer networking products multinational company, founded in 1996....
' RADIUS servers also default to 1645 and 1646.

RADIUS is used by RSA

RSA Security

RSA, The Security Division of EMC Corporation, is headquartered in Bedford, Massachusetts, United States, and maintains offices in Ireland, Israel, the United Kingdom, Singapore, India, China, Hong Kong and Japan....
SecurID

SecurID

RSA SecurID is a mechanism developed by RSA Security for performing two-factor authentication for a user to a network resource.Overview ...
to enable strong authentication for access control; products such as PhoneFactor

PhoneFactor

PhoneFactor is a two-factor authentication system which utilizes automated phone calls to verify identity. References ...
add two-factor authentication to legacy RADIUS applications that typically only support username and password authentication.

RADIUS is widely used by VoIP service providers. It is used to pass login credentials of a SIP

Session Initiation Protocol

The Session Initiation Protocol is a Signalling protocol, widely used for setting up and tearing down multimedia communication sessions such as Internet telephony and video calls over the Internet....
end point (like a broadband phone) to a SIP registrar

SIP registrar

A SIP registrar is a server in an Session Initiation Protocol network that accepts and processes SIP REGISTER requests. Although SIP endpoints can connect to each other without any additional SIP infrastructure, that is not practical since each endpoint would need to know each others IP-address....
using digest authentication, and then to RADIUS server using RADIUS. Sometimes it is also used to collect call detail record

Call detail record

A Call Detail Record is the Record produced by a telephone exchange containing details of a call that passed through it. It is the automated equivalent of the paper toll tickets that were written and timed by operators for long distance calls in a Telephone switchboard....
s (CDRs) later used, for instance, to bill customers for international long distance.

RADIUS was originally specified in an RFI by Merit Network in 1991 to control dial-in access to NSFnet. Livingston Enterprises responded to the RFI with a description of a RADIUS server. Merit Network awarded the contract to Livingston Enterprises that delivered their PortMaster series of Network Access Servers and the initial RADIUS server to Merit. RADIUS was later (1997) published as RFC 2058 and RFC 2059 (current versions are RFC 2865 and RFC 2866). Now, several commercial and open-source RADIUS servers exist. Features can vary, but most can look up the users in text files, LDAP

Lightweight Directory Access Protocol

The Lightweight Directory Access Protocol, or LDAP , is an application protocol for querying and modifying directory services running over Internet protocol suite....
servers, various databases, etc. Accounting records can be written to text files, various databases, forwarded to external servers, etc. SNMP

Simple Network Management Protocol

Simple Network Management Protocol is used in network management systems to Network monitoring network-attached devices for conditions that warrant administrative attention....
is often used for remote monitoring. RADIUS proxy server

Proxy server

In computer networks, a proxy server is a server that acts as a go-between for requests from client seeking resources from other servers. A client connects to the proxy server, requesting some service, such as a file, connection, web page, or other resource, available from a different server....
s are used for centralized administration and can rewrite RADIUS packets on the fly (for security reasons, or to convert between vendor dialects).

The Diameter protocol is the planned replacement for RADIUS. Diameter uses SCTP

Stream Control Transmission Protocol

In computer networking, the Stream Control Transmission Protocol is a Transport Layer communications protocol, serving in a similar role as the popular protocols Transmission Control Protocol and User Datagram Protocol ....
or TCP

Transmission Control Protocol

The Transmission Control Protocol is one of the core protocols of the Internet Protocol Suite. TCP is so central that the entire suite is often referred to as "TCP/IP"....
while RADIUS uses UDP

User Datagram Protocol

The User Datagram Protocol is one of the core members of the Internet Protocol Suite, the set of network protocols used for the Internet. With UDP, computer applications can send messages, sometimes known as datagram, to other hosts on an Internet Protocol network without requiring prior communications to set up special transmission cha...
as the transport layer

Transport layer

In computer networking, the Transport Layer is a group of methods and protocols within a layered architecture of network components, within which it is responsible for encapsulating application data blocks into datagrams suitable for transfer to the network infrastructure for transmission to the destination host, or managing the reverse tran...
.

Roaming

RADIUS is commonly used to facilitate roaming between ISPs, for example by companies which provide a single global set of credentials that are usable on many public networks. RADIUS facilitates this by the use of realms, which identify where the RADIUS server should forward the AAA requests for processing.

Realms

A realm is commonly appended to a user's user name and delimited with an '@' sign, resembling an email address domain name. This is known a postfix notation for the realm. Another common usage is prefix notation, which involves prepending the realm to the username and using '\' as a delimiter. a Modern RADIUS servers allow any character to be used as a realm delimiter, although in practice '@' and '\' are usually used.

Realms can also be compounded using both prefix and postfix notation, to allow for complicated roaming scenarios; for example, somedomain.com\username@anotherdomain.com could be a valid username with two realms.

Although realms often resemble email domains, it is important to note that realms are in fact arbitrary text and need not contain real domain names.

Proxy operations

When a RADIUS server receives an AAA request for a user name containing a realm, the server will reference a table of configured realms. If the realm is known, the server will then proxy the request to the configured home server for that domain. The behaviour of the proxying server regarding the removal of the realm from the request ("stripping") is configuration-dependent on most servers. In addition, the proxying server can be configured to add, remove or rewrite AAA requests when they are proxied.

Security

Roaming with RADIUS exposes the users to various security and privacy concerns. Some EAP

Extensible Authentication Protocol

Extensible Authentication Protocol, or EAP, is a universal authentication framework frequently used in wireless LAN and Point-to-Point Protocol....
methods establish a secure tunnel between an authenticator and the home AAA server before the transmission of sensitive data, providing relief for most of those concerns. In these cases, there is sometimes an outer identity in clear text transmitted outside the EAP tunnel - visible to proxies so they can route packets - which doesn't have to reveal much about the user's true identity, and an inner identity that does, which is transmitted inside the secure EAP tunnel.

More generally, some roaming partners establish a secure tunnel between the RADIUS servers to ensure that users' credentials cannot be intercepted while being proxied across the internet. This is a concern as the encyption built into RADIUS is considered insecure.

Standards

The RADIUS protocol is currently defined in:

RFC 2865 Remote Authentication Dial In User Service (RADIUS)
RFC 2866 RADIUS Accounting

Other relevant RFCs are:

RFC 2548 Microsoft Vendor-specific RADIUS Attributes
RFC 2607 Proxy Chaining and Policy Implementation in Roaming
RFC 2618 RADIUS Authentication Client MIB
RFC 4668 RADIUS Authentication Client MIB for IPv6 (Obsoletes: RFC 2618)
RFC 2619 RADIUS Authentication Server MIB
RFC 4669 RADIUS Authentication Server MIB for IPv6 (Obsoletes: RFC 2619)
RFC 2620 RADIUS Accounting Client MIB
RFC 4670 RADIUS Accounting Client MIB for IPv6 (Obsoletes: RFC 2620)
RFC 2621 RADIUS Accounting Server MIB
RFC 4671 RADIUS Accounting Server MIB for IPv6 (Obsoletes: RFC 2621)
RFC 2809 Implementation of L2TP Compulsory Tunneling via RADIUS
RFC 2867 RADIUS Accounting Modifications for Tunnel Protocol Support
RFC 2868 RADIUS Attributes for Tunnel Protocol Support
RFC 2869 RADIUS Extensions
RFC 2882 Network Access Servers Requirements: Extended RADIUS Practices
RFC 3162 RADIUS and IPv6
RFC 3575 IANA Considerations for RADIUS
RFC 5176 Dynamic Authorization Extensions to RADIUS (Obsoletes: RFC 3576)
RFC 3579 RADIUS Support for EAP (Updates: RFC 2869)
RFC 3580 IEEE 802.1X RADIUS Usage Guidelines
RFC 4014 RADIUS Attributes Suboption for the DHCP Relay Agent Information Option
RFC 4372 Chargeable User Identity
RFC 5090 RADIUS Extension for Digest Authentication (Obsoletes: RFC 4590)
RFC 4675 RADIUS Attributes for Virtual LAN and Priority Support
RFC 4679 DSL Forum Vendor-Specific RADIUS Attributes
RFC 4818 RADIUS Delegated-IPv6-Prefix Attribute
RFC 4849 RADIUS Filter Rule Attribute
RFC 5080 Common RADIUS Implementation Issues and Suggested Fixes

RADIUS

AAA

Accounting

Properties of RADIUS

Roaming

Realms

Proxy operations

Security

Standards

External links