2
RADIUS
RADIUS is a distributed information interaction protocol that uses a client/server model. It can protect
networks against unauthorized access and is often used in network environments where both high
security and remote user access are required.
RADIUS uses UDP as the transport protocol. It uses UDP port 1812 for authentication and UDP port
1813 for accounting.
RADIUS was originally designed for dial-in user access. With the addition of new access methods,
RADIUS has been extended to support additional access methods, for example, Ethernet and ADSL.
RADIUS provides access authentication and authorization services, and its accounting function collects
and records network resource usage information.
Client/server model
The RADIUS client runs on the NASes located throughout the network. It passes user information to
designated RADIUS servers and acts on the responses (for example, it rejects or accepts user access
requests).
The RADIUS server runs on the computer or workstation at the network center and maintains information
related to user authentication and network service access. It listens to connection requests, authenticates
users, and returns user access control information to the clients (for example, by rejecting or accepting
the user access request).
In general, the RADIUS server maintains the following databases: Users, Clients, and Dictionary, as
shown in
.
Figure 2
RADIUS server components
•
Users
—Stores user information such as the usernames, passwords, applied protocols, and IP
addresses.
•
Clients
—Stores information about RADIUS clients, such as shared keys and IP addresses.
•
Dictionary
—Stores RADIUS protocol attributes and their values.
Security and authentication mechanisms
Information exchanged between a RADIUS client and the RADIUS server is authenticated with a shared
key, which is never transmitted over the network. This enhances information exchange security. In
addition, to prevent user passwords from being intercepted on insecure networks, RADIUS encrypts
passwords before transmitting them.
A RADIUS server supports multiple user authentication methods, such as PAP and CHAP of PPP.
Moreover, a RADIUS server can act as the client of another AAA server to provide authentication proxy
services.
