RADIUS

Remote Authentication Dial-In User Service (RADIUS) is a distributed information interaction protocol that uses a client/server model. The protocol can protect networks against unauthorized access and is often used in network environments that require both high security and remote user access.

The RADIUS authorization process is combined with the RADIUS authentication process, and user authorization information is piggybacked in authentication responses. RADIUS uses UDP port 1812 for authentication and UDP port 1813 for accounting.

RADIUS was originally designed for dial-in user access, and has been extended to support additional access methods, such as Ethernet and ADSL.

The RADIUS client runs on the NASs located throughout the network. It passes user information to RADIUS servers and acts on the responses to, for example, reject or accept user access requests.

The RADIUS server runs on the computer or workstation at the network center and maintains information related to user authentication and network service access.

The RADIUS server operates using the following process:

1. Receives authentication, authorization, and accounting requests from RADIUS clients.

2. Performs user authentication, authorization, or accounting.

3. Returns user access control information (for example, rejecting or accepting the user access request) to the clients.

The RADIUS server can also act as the client of another RADIUS server to provide authentication proxy services.

The RADIUS server maintains the following databases:

• Users—Stores user information, such as the usernames, passwords, applied protocols, and IP addresses.

• Clients—Stores information about RADIUS clients, such as shared keys and IP addresses.

• Dictionary—Stores RADIUS protocol attributes and their values.

The RADIUS client and server exchange information between them with the help of shared keys, which are preconfigured on the client and server. A RADIUS packet has a 16-byte field called Authenticator. This field includes a signature generated by using the MD5 algorithm, the shared key, and some other information. The receiver of the packet verifies the signature and accepts the packet only when the signature is correct. This mechanism ensures the security of information exchanged between the RADIUS client and server.

The shared keys are also used to encrypt user passwords that are included in RADIUS packets.

The RADIUS server supports multiple user authentication methods, such as PAP, CHAP, and EAP.

Figure 3 illustrates the interactions between a user host, the RADIUS client, and the RADIUS server.

RADIUS uses in the following workflow:

1. The host sends a connection request that includes the user's username and password to the RADIUS client.

2. The RADIUS client sends an authentication request (Access-Request) to the RADIUS server. The request includes the user's password, which has been processed by the MD5 algorithm and shared key.

3. The RADIUS server authenticates the username and password. If the authentication succeeds, the server sends back an Access-Accept packet that contains the user's authorization information. If the authentication fails, the server returns an Access-Reject packet.

4. The RADIUS client permits or denies the user according to the authentication result. If the result permits the user, the RADIUS client sends a start-accounting request (Accounting-Request) packet to the RADIUS server.

5. The RADIUS server returns an acknowledgment (Accounting-Response) packet and starts accounting.

6. The user accesses the network resources.

7. The host requests the RADIUS client to tear down the connection.

8. The RADIUS client sends a stop-accounting request (Accounting-Request) packet to the RADIUS server.

9. The RADIUS server returns an acknowledgment (Accounting-Response) and stops accounting for the user.

10. The RADIUS client notifies the user of the termination.

RADIUS uses UDP to transmit packets. The protocol also uses a series of mechanisms to ensure smooth packet exchange between the RADIUS server and the client. These mechanisms include the timer mechanism, the retransmission mechanism, and the backup server mechanism.

Descriptions of the fields are as follows:

• The Code field (1 byte long) indicates the type of the RADIUS packet. Table 1 gives the main values and their meanings.

  Table 1: Main values of the Code field

  Code	Packet type	Description
  1	Access-Request	From the client to the server. A packet of this type includes user information for the server to authenticate the user. It must contain the User-Name attribute and can optionally contain the attributes of NAS-IP-Address, User-Password, and NAS-Port.
  2	Access-Accept	From the server to the client. If all attribute values included in the Access-Request are acceptable, the authentication succeeds, and the server sends an Access-Accept response.
  3	Access-Reject	From the server to the client. If any attribute value included in the Access-Request is unacceptable, the authentication fails, and the server sends an Access-Reject response.
  4	Accounting-Request	From the client to the server. A packet of this type includes user information for the server to start or stop accounting for the user. The Acct-Status-Type attribute in the packet indicates whether to start or stop accounting.
  5	Accounting-Response	From the server to the client. The server sends a packet of this type to notify the client that it has received the Accounting-Request and has successfully recorded the accounting information.

• The Identifier field (1 byte long) is used to match response packets with request packets and to detect duplicate request packets. The request and response packets of the same exchange process for the same purpose (such as authentication or accounting) have the same identifier.

• The Length field (2 bytes long) indicates the length of the entire packet (in bytes), including the Code, Identifier, Length, Authenticator, and Attributes fields. Bytes beyond this length are considered padding and are ignored by the receiver. If the length of a received packet is less than this length, the packet is dropped.

• The Authenticator field (16 bytes long) is used to authenticate responses from the RADIUS server and to encrypt user passwords. There are two types of authenticators: request authenticator and response authenticator.

• The Attributes field (variable in length) includes authentication, authorization, and accounting information. This field can contain multiple attributes, each with the following subfields:

  • Type—Type of the attribute.

  • Length—Length of the attribute in bytes, including the Type, Length, and Value subfields.

  • Value—Value of the attribute. Its format and content depend on the Type subfield.

  Commonly used RADIUS attributes are defined in RFC 2865, RFC 2866, RFC 2867, and RFC 2868. For more information, see "Commonly used standard RADIUS attributes."

  Table 2: Commonly used RADIUS attributes

  No.	Attribute	No.	Attribute
  1	User-Name	45	Acct-Authentic
  2	User-Password	46	Acct-Session-Time
  3	CHAP-Password	47	Acct-Input-Packets
  4	NAS-IP-Address	48	Acct-Output-Packets
  5	NAS-Port	49	Acct-Terminate-Cause
  6	Service-Type	50	Acct-Multi-Session-Id
  7	Framed-Protocol	51	Acct-Link-Count
  8	Framed-IP-Address	52	Acct-Input-Gigawords
  9	Framed-IP-Netmask	53	Acct-Output-Gigawords
  10	Framed-Routing	54	(unassigned)
  11	Filter-ID	55	Event-Timestamp
  12	Framed-MTU	56-59	(unassigned)
  13	Framed-Compression	60	CHAP-Challenge
  14	Login-IP-Host	61	NAS-Port-Type
  15	Login-Service	62	Port-Limit
  16	Login-TCP-Port	63	Login-LAT-Port
  17	(unassigned)	64	Tunnel-Type
  18	Reply-Message	65	Tunnel-Medium-Type
  19	Callback-Number	66	Tunnel-Client-Endpoint
  20	Callback-ID	67	Tunnel-Server-Endpoint
  21	(unassigned)	68	Acct-Tunnel-Connection
  22	Framed-Route	69	Tunnel-Password
  23	Framed-IPX-Network	70	ARAP-Password
  24	State	71	ARAP-Features
  25	Class	72	ARAP-Zone-Access
  26	Vendor-Specific	73	ARAP-Security
  27	Session-Timeout	74	ARAP-Security-Data
  28	Idle-Timeout	75	Password-Retry
  29	Termination-Action	76	Prompt
  30	Called-Station-Id	77	Connect-Info
  31	Calling-Station-Id	78	Configuration-Token
  32	NAS-Identifier	79	EAP-Message
  33	Proxy-State	80	Message-Authenticator
  34	Login-LAT-Service	81	Tunnel-Private-Group-id
  35	Login-LAT-Node	82	Tunnel-Assignment-id
  36	Login-LAT-Group	83	Tunnel-Preference
  37	Framed-AppleTalk-Link	84	ARAP-Challenge-Response
  38	Framed-AppleTalk-Network	85	Acct-Interim-Interval
  39	Framed-AppleTalk-Zone	86	Acct-Tunnel-Packets-Lost
  40	Acct-Status-Type	87	NAS-Port-Id
  41	Acct-Delay-Time	88	Framed-Pool
  42	Acct-Input-Octets	89	(unassigned)
  43	Acct-Output-Octets	90	Tunnel-Client-Auth-id
  44	Acct-Session-Id	91	Tunnel-Server-Auth-id

The RADIUS protocol features excellent extensibility. The Vendor-Specific attribute (attribute 26) allows a vendor to define extended attributes. The extended attributes can implement functions that the standard RADIUS protocol does not provide.

A vendor can encapsulate multiple subattributes in the TLV format in attribute 26 to provide extended functions. As shown in Figure 5, a subattribute encapsulated in attribute 26 consists of the following parts:

• Vendor-ID—ID of the vendor. The most significant byte is 0. The other three bytes contains a code compliant to RFC 1700.

• Vendor-Type—Type of the subattribute.

• Vendor-Length—Length of the subattribute.

• Vendor-Data—Contents of the subattribute.

Hewlett Packard Enterprise supports the RADIUS subattributes with a vendor ID of 25506. For more information, see "Proprietary RADIUS subattributes (vendor ID 25506)."