Radius

A special tool helps computers join a network.

It asks for your name and secret code. This is how it checks who you are. Then, it decides what you can do.

The tool also keeps track of your work. It can record how much time you spend online. This helps people know how much to charge. It can even help you use networks in new places. This tool makes staying safe on the web easier.

RADIUS is a tool that helps manage network access.

It uses a set of steps called AAA. This stands for authentication, authorization, and accounting.

First, the tool checks who you are. This is authentication. You send a name and password to a server. The server checks if your info is correct. Then, it moves to authorization. This step decides what you can do on the network. You might be allowed to use Wi-Fi but not other services. The server sends an Access-Accept message to let you in. It might also send an Access-Reject to stop you.

Next, the tool handles accounting. This part keeps track of your session. It records when you start and stop using the network. It can also track how much data you use. This helps people bill users correctly.

RADIUS also helps with roaming. This lets you use your own login at different places. It uses realms to find the right home server. A realm is like an email address part. It tells the system where to send your request.

RADIUS is a special way for computers to talk to each other. It helps manage how people join a network. This system uses three main steps called AAA. These steps are authentication, authorization, and accounting.

Authentication checks if you are who you say you are. Authorization decides what you are allowed to do once you are inside. Finally, accounting keeps track of what you did. This helps companies manage their networks and bill users for what they use. It is a very important tool for keeping networks organized.

When you try to join a network, the process starts with a request. You send your name and password to a device called a Network Access Server, or NAS. The NAS then sends an Access-Request to a RADIUS server.

The server checks your details against a list. It might use a local file or an external source like Active Directory. The server then sends one of three answers back to the NAS. It might send an Access-Reject to deny you. It might send an Access-Challenge to ask for more info, like a PIN. Or, it sends an Access-Accept to let you in.

Once you are connected, the accounting step begins. The NAS sends an Accounting-Request to the server to show you have started.

The server records your name and your network address. Sometimes, the NAS sends updates called Interim Updates. These tell the server how much data you are using. When you leave, the NAS sends an Accounting-Stop message. This final note tells the server how long you stayed and how much data you moved. This data is great for monitoring the network and making sure billing is fair.

RADIUS was first made by a company called Livingston Enterprises in 1991. It was created to help with access server authentication. Later, it became an official standard for groups like the IETF.

Today, it is often used for 802.1X authentication. The system can run on computers using UNIX or Microsoft Windows. It uses different types of digital packets to move information. These packets carry details like your username and your IP address. It can work using two different ways to move data called TCP or UDP.

One cool thing about RADIUS is that it helps with roaming. This means you can use your own login at different places.

It uses something called a realm to make this work. A realm is a piece of text added to your name, like an email address. It uses an '@' sign to show where your home server is. The system can even use a chain of servers to pass your request along. This allows people to visit new networks and still use their own credentials. It makes connecting to new places much easier and faster.

Remote Authentication Dial-In User Service, or RADIUS, is a networking protocol used to manage network access. It provides a centralized way to handle three essential tasks known as AAA. These tasks are authentication, authorization, and accounting. Authentication verifies the identity of a user or a machine. Authorization determines what specific resources that user is allowed to access. Accounting tracks the usage and duration of the network session. By centralizing these functions, RADIUS allows administrators to manage many users from one single location.

The mechanism of RADIUS relies on a client/server model. The client is usually a Network Access Server, or NAS, which controls entry to the network. The server is typically a background process running on UNIX or Microsoft Windows. When a user attempts to connect, they provide credentials like a username and password. These credentials might arrive via a Point-to-Point Protocol (PPP) or an HTTPS web form. The NAS then creates an Access-Request packet. This packet contains the user's credentials and other details, such as their IP address or phone number. To protect the password, RADIUS uses a method based on the RSA Message Digest Algorithm MD5.

Once the RADIUS server receives the Access-Request, it performs the authentication step. It checks the provided information against a database. This could be a local flat file or an external source like LDAP, Kerberos, or Active Directory. After checking the identity, the server sends one of three responses back to the NAS. An Access-Reject unconditionally denies access, perhaps because the account is inactive. An Access-Challenge asks the user for more information, such as a PIN or a security token. Finally, an Access-Accept grants access.

After authentication, the server moves to the authorization stage. Even if a user is identified, they may not have permission for every service. For example, a user might be allowed on a wireless network but blocked from a VPN. The RADIUS server sends authorization attributes to the NAS to set the terms of the connection. These attributes can include a specific IP address to assign to the user. They can also define the maximum time a user can stay connected. Other attributes might include VLAN parameters or Quality of Service (QoS) settings.

The final stage is accounting, which is described in RFC 2866. This process begins when the NAS sends an Accounting-Start packet to the server. This packet contains a unique session identifier and the user's network address. While the user is online, the NAS may send Interim-Update packets. These updates provide information on current data usage and session duration. When the session ends, the NAS sends an Accounting-Stop packet. This includes the final amount of data transferred and the reason for the disconnect. This data is vital for billing users and monitoring network statistics.

RADIUS also enables a feature called roaming through the use of realms. A realm is a piece of text, often using postfix notation like "user@realm," that identifies a user's home server. This allows users to move between different Internet Service Providers (ISPs) using their own credentials. When a RADIUS server sees a realm, it can act as a proxy. It looks up the realm in a table and forwards the request to the correct home server. This can involve proxy chaining, where requests move through a series of servers. While this helps networks scale, it requires high levels of trust between the different administrative entities.

Understanding the technical structure of RADIUS packets is important for network security. RADIUS packets are transported over UDP or TCP. They contain specific fields like the Code, Identifier, and Length. The Authenticator field is 16 bytes long and is used to encrypt passwords and authenticate replies. Data is carried in Attribute Value Pairs, or AVPs. These AVPs include essential information like the User-Name and Service-Type. However, security is a major concern. Because the MD5 hash used in RADIUS is considered insecure, some partners use secure tunnels to protect credentials during roaming. The Blast-RADIUS attack can also break the protocol if it is run on unencrypted transport like UDP.