RADIUS

Remote Authentication Dial-In User Service (RADIUS) is a distributed information interaction protocol that uses a client/server model. It can protect networks against unauthorized access and is often used in network environments that require both high security and remote user access.

RADIUS uses UDP port 1812 for authentication and UDP port 1813 for accounting.

RADIUS was originally designed for dial-in user access. With the addition of new access methods, RADIUS has been extended to support additional access methods, including Ethernet and ADSL. RADIUS provides access authentication, authorization, and accounting services. The accounting function collects and records network resource usage information.

Client/server model

The RADIUS client runs on every NAS on the network to pass user information to the RADIUS server and determines to reject or accept each access request based on the server response.

The RADIUS server runs on the computer or workstation at the network center and maintains information related to user authentication and network access. It receives connection requests, authenticates users, and returns access control information (for example, rejecting or accepting the user access request) to the client.

The RADIUS server typically maintains the following databases: Users, Clients, and Dictionary. See Figure 2.

Figure 2: RADIUS server databases

Security and authentication mechanisms

The RADIUS client and the RADIUS server use a shared key to authenticate RADIUS packets and encrypt user passwords exchanged between them. For security, this key must be manually configured on the client and the server.

RADIUS servers support multiple authentication protocols, including PAP and CHAP. A RADIUS server can also act as the client of another AAA server to provide authentication proxy services.

Basic RADIUS message exchange process

Figure 3 illustrates the interactions between the host, the RADIUS client, and the RADIUS server.

Figure 3: Basic RADIUS message exchange process

RADIUS operates in the following manner:

  • The host initiates a connection request that carries the user's username and password to the RADIUS client.

  • Having received the username and password, the RADIUS client sends an authentication request (Access-Request) to the RADIUS server, with the user password encrypted by using the MD5 algorithm and the shared key.

  • The RADIUS server authenticates the username and password. If the authentication succeeds, the server returns an Access-Accept message containing the user's authorization information. If the authentication fails, the server returns an Access-Reject message.

  • The RADIUS client permits or denies the user according to the returned authentication result. If it permits the user, it sends a start-accounting request (Accounting-Request) to the RADIUS server.

  • The RADIUS server returns an acknowledgement (Accounting-Response) and starts accounting.

  • The user accesses the network resources.

  • The host requests the RADIUS client to tear down the connection and the RADIUS client sends a stop-accounting request (Accounting-Request) to the RADIUS server.

  • The RADIUS server returns an acknowledgement (Accounting-Response) and stops accounting for the user.

  • RADIUS packet format

    RADIUS uses UDP to transmit messages. To ensure smooth message exchange between the RADIUS server and the client, RADIUS uses timer management, retransmission, and a backup server mechanism. Figure 4 shows the RADIUS packet format.

    Figure 4: RADIUS packet format

    Descriptions of the fields are as follows:

    Table 1: Main values of the Code field

    Code

    Packet type

    Description

    1

    Access-Request

    From the client to the server. A packet of this type carries user information for the server to authenticate the user. It must contain the User-Name attribute and can optionally contain the attributes of NAS-IP-Address, User-Password, and NAS-Port.

    2

    Access-Accept

    From the server to the client. If all attribute values carried in the Access-Request are acceptable, the authentication succeeds, and the server sends an Access-Accept response.

    3

    Access-Reject

    From the server to the client. If any attribute value carried in the Access-Request is unacceptable, the authentication fails, and the server sends an Access-Reject response.

    4

    Accounting-Request

    From the client to the server. A packet of this type carries user information for the server to start or stop accounting for the user. The Acct-Status-Type attribute in the packet indicates whether to start or stop accounting.

    5

    Accounting-Response

    From the server to the client. The server sends a packet of this type to notify the client that it has received the Accounting-Request and has successfully recorded the accounting information.

    Table 2: Commonly used RADIUS attributes

    No.

    Attribute

    No.

    Attribute

    1

    User-Name

    45

    Acct-Authentic

    2

    User-Password

    46

    Acct-Session-Time

    3

    CHAP-Password

    47

    Acct-Input-Packets

    4

    NAS-IP-Address

    48

    Acct-Output-Packets

    5

    NAS-Port

    49

    Acct-Terminate-Cause

    6

    Service-Type

    50

    Acct-Multi-Session-Id

    7

    Framed-Protocol

    51

    Acct-Link-Count

    8

    Framed-IP-Address

    52

    Acct-Input-Gigawords

    9

    Framed-IP-Netmask

    53

    Acct-Output-Gigawords

    10

    Framed-Routing

    54

    (unassigned)

    11

    Filter-ID

    55

    Event-Timestamp

    12

    Framed-MTU

    56-59

    (unassigned)

    13

    Framed-Compression

    60

    CHAP-Challenge

    14

    Login-IP-Host

    61

    NAS-Port-Type

    15

    Login-Service

    62

    Port-Limit

    16

    Login-TCP-Port

    63

    Login-LAT-Port

    17

    (unassigned)

    64

    Tunnel-Type

    18

    Reply-Message

    65

    Tunnel-Medium-Type

    19

    Callback-Number

    66

    Tunnel-Client-Endpoint

    20

    Callback-ID

    67

    Tunnel-Server-Endpoint

    21

    (unassigned)

    68

    Acct-Tunnel-Connection

    22

    Framed-Route

    69

    Tunnel-Password

    23

    Framed-IPX-Network

    70

    ARAP-Password

    24

    State

    71

    ARAP-Features

    25

    Class

    72

    ARAP-Zone-Access

    26

    Vendor-Specific

    73

    ARAP-Security

    27

    Session-Timeout

    74

    ARAP-Security-Data

    28

    Idle-Timeout

    75

    Password-Retry

    29

    Termination-Action

    76

    Prompt

    30

    Called-Station-Id

    77

    Connect-Info

    31

    Calling-Station-Id

    78

    Configuration-Token

    32

    NAS-Identifier

    79

    EAP-Message

    33

    Proxy-State

    80

    Message-Authenticator

    34

    Login-LAT-Service

    81

    Tunnel-Private-Group-id

    35

    Login-LAT-Node

    82

    Tunnel-Assignment-id

    36

    Login-LAT-Group

    83

    Tunnel-Preference

    37

    Framed-AppleTalk-Link

    84

    ARAP-Challenge-Response

    38

    Framed-AppleTalk-Network

    85

    Acct-Interim-Interval

    39

    Framed-AppleTalk-Zone

    86

    Acct-Tunnel-Packets-Lost

    40

    Acct-Status-Type

    87

    NAS-Port-Id

    41

    Acct-Delay-Time

    88

    Framed-Pool

    42

    Acct-Input-Octets

    89

    (unassigned)

    43

    Acct-Output-Octets

    90

    Tunnel-Client-Auth-id

    44

    Acct-Session-Id

    91

    Tunnel-Server-Auth-id

    Extended RADIUS attributes

    Attribute 26 (Vender-Specific), an attribute defined in RFC 2865, allows a vendor to define extended attributes to implement functions that the standard RADIUS protocol does not provide.

    A vendor can encapsulate multiple sub-attributes as TLVs in attribute 26 to provide extended functions. As shown in Figure 5, a sub-attribute encapsulated in attribute 26 consists of the following parts:

    Figure 5: Format of attribute 26