RADIUSserver

RADIUSServer refers to software that implements the Remote Authentication Dial-In User Service (RADIUS) protocol to provide centralized authentication, authorization, and accounting (AAA) for network access. It is commonly deployed to manage credentials and access policies for users connecting through wireless networks, VPNs, dial-up, or other network devices.

RADIUS operates as an exchange of UDP messages between Network Access Servers (NAS) and the RADIUS server. Authentication requests (Access-Request) are sent from a NAS to the server, which replies with Access-Accept, Access-Reject, or Access-Challenge. Communications are protected by a shared secret between the NAS and the RADIUS server. Accounting messages (e.g., Start, Stop, Interim-Update) are sent to the server on a separate port.

Key features include centralized user authentication, policy-based authorization, and accounting for session usage. RADIUS servers may authenticate against internal user stores or external directories such as LDAP or Active Directory, and they can support various authentication methods, including passwords and Extensible Authentication Protocol (EAP) methods. They also support proxying or routing requests to other RADIUS servers and can enforce per-user or per-group policies using attribute-value pairs (AVPs).

Typical deployments include enterprise WLANs using 802.1X, VPN gateways, and other access devices that require centralized AAA services. Common implementations include FreeRADIUS (open source), Microsoft Network Policy Server (NPS) on Windows Server, and commercial options such as Radiator.

Security considerations include protecting shared secrets, enabling strong authentication methods (such as EAP-TLS or PEAP), and ensuring proper logging and auditing of accounting records for compliance and troubleshooting.