RADIUS

This article is about an authentication, authorization, and accounting protocol. For Radius (disambiguation), see RADIUS (disambiguation).

Remote Authentication Dial In User Service (RADIUS) is an AAA (authentication, authorization and accounting) protocol for applications such as network access or IP mobility. It is intended to work in both local and roaming situations.

Some ISPs (commonly modem, DSL, or wireless 802.11 services) require you to enter a username and password in order to connect on to the Internet. Before access to the network is granted, this information is passed to a Network Access Server (NAS) device over the Point-to-Point Protocol (PPP), then to a RADIUS server over the RADIUS protocol. The RADIUS server checks that the information is correct using authentication schemes like PAP, CHAP or EAP. If accepted, the server will then authorize access to the ISP system and select an IP address, L2TP parameters, etc.

The RADIUS server will also be notified if and when the session starts and stops, so that the user can be billed accordingly; or the data can be used for statistical purposes.

Additionally RADIUS is widely used by VoIP service providers. It is used to pass login credentials of a SIP end point (like a broadband phone) to a SIP Registrar using digest authentication, and then to RADIUS server using RADIUS. Sometimes it is also used to collect call detail records (CDRs) later used, for instance, to bill customers for international long distance.

RADIUS was originally developed by Livingston Enterprises for their PortMaster series of Network Access Servers, but later (1997) published as RFC 2058 and RFC 2059 (current versions are RFC 2865 and RFC 2866). Now, several commercial and open-source RADIUS servers exist. Features can vary, but most can look up the users in text files, LDAP servers, various databases, etc. Accounting tickets can be written to text files, various databases, forwarded to external servers, etc. SNMP is often used for remote monitoring. RADIUS proxy servers are used for centralized administration and can rewrite RADIUS packets on the fly (for security reasons, or to convert between vendor dialects).

RADIUS is a common authentication protocol utilized by the 802.1X security standard (often used in wireless networks). Although RADIUS was not initially intended to be a wireless security authentication method, it improves the WEP encryption key standard, in conjunction with other security methods such as EAP-PEAP.

RADIUS is extensible; most vendors of RADIUS hardware and software implement their own dialects.

RADIUS uses UDP ports 1812 or 1645 for Authentication and 1813 or 1646 for Accounting. For example, Microsoft RADIUS servers default to the higher ports but Cisco devices default to the lower ports. Funk software's RADIUS servers also defaults to the lower ports. The official IETF port number assignment is the higher port numbers 1812 and 1813.

The DIAMETER protocol is the planned replacement for RADIUS. DIAMETER uses SCTP or TCP while RADIUS uses UDP as the transport layer.

Standards

The RADIUS protocol is currently defined in:

• RFC 2865 Remote Authentication Dial In User Service (RADIUS)
• RFC 2866 RADIUS Accounting

Other relevant RFCs are:

• RFC 2548 Microsoft Vendor-specific RADIUS Attributes
• RFC 2607 Proxy Chaining and Policy Implementation in Roaming
• RFC 2618 RADIUS Authentication Client MIB
• RFC 2619 RADIUS Authentication Server MIB
• RFC 2620 RADIUS Accounting Client MIB
• RFC 4670 RADIUS Accounting Client MIB for IPv6 (Obsoletes: RFC 2620)
• RFC 2621 RADIUS Accounting Server MIB
• RFC 4671 RADIUS Accounting Server MIB for IPv6 (Obsoletes: RFC 2621)
• RFC 2809 Implementation of L2TP Compulsory Tunneling via RADIUS
• RFC 2867 RADIUS Accounting Modifications for Tunnel Protocol Support
• RFC 2868 RADIUS Attributes for Tunnel Protocol Support
• RFC 2869 RADIUS Extensions
• RFC 2882 Network Access Servers Requirements: Extended RADIUS Practices
• RFC 3162 RADIUS and IPv6
• RFC 3575 IANA Considerations for RADIUS
• RFC 3576 Dynamic Authorization Extensions to RADIUS
• RFC 3579 RADIUS Support for EAP (Updates: RFC 2869)
• RFC 3580 IEEE 802.1X RADIUS Usage Guidelines
• RFC 4014 RADIUS Attributes Suboption for the DHCP Relay Agent Information Option
• RFC 4590 RADIUS Extension for Digest Authentication (new revision pending)

See also

• DIAMETER
• Kerberos
• TACACS
• TACACS+
• List of RADIUS Servers

External links

• An Analysis of the RADIUS Authentication Protocol
• List of RADIUS attributes
• Configure RADIUS for secure 802.1x wireless LANs
• Self-sign a RADIUS server for secure PEAP or EAP-TTLS authentication
• RadiusExpert public wiki on RADIUS protocol and compatible devices and software