# What is Remote Authentication Dial-In User Service (RADIUS)? Remote Authentication Dial-In User Service (RADIUS) is a network protocol used to centrally manage user authentication, authorisation and connection logging in IP-based networks. In simple terms, it helps networks verify who is allowed to log in and what level of access they should receive. ### Key Takeaways The key points at a glance: - RADIUS is a network protocol that centrally checks who is allowed to log in to a network and what access rights they have. - It is mainly used in corporate Wi-Fi networks, for VPN access, by internet service providers and in cloud environments. - Logins follow a request-response process between the Network Access Server and the RADIUS server. - The AAA principle combines authentication, authorisation and accounting in a single system. - Extensions such as EAP-TLS and RadSec (RADIUS/TLS) add strong authentication and encrypted transport. - Its advantages include central access management; its drawbacks include dependence on the RADIUS server. ## What is RADIUS? When someone connects to a corporate Wi-Fi network, a VPN or an internal company network, the system first needs to verify who they are and what they are allowed to access. This is where Remote Authentication Dial-In User Service (or RADIUS for short) comes in. RADIUS was originally developed in the 1990s to manage dial-up modem connections centrally. Today, it is an established authentication standard for networks, especially for: - **Corporate Wi-Fi networks** where each user logs in with their own credentials - **VPN access**, when employees connect to internal systems from outside the company network - **Office network ports**, which are only activated after a successful login - **Internet service providers**, which use RADIUS to manage customer access and billing - **Cloud and data centre environments**, where large numbers of user accounts need to be managed centrally A RADIUS server can be set up on different [operating systems, including Linux](https://www.ionos.com/en-ie/digitalguide/server/configuration/radius-server/) and Windows. It can also run on Unix systems or in containerised environments. Many network devices and firewalls also have built-in RADIUS support or can be configured to use an external RADIUS server. ## How does RADIUS work? RADIUS works through a clear **request-response process**. When a user tries to log in, the system sends the login details to a central RADIUS server. The server checks the information and decides whether access should be granted and which permissions the user should receive. From a technical perspective, RADIUS follows a client-server model, with both sides communicating via the User Datagram Protocol (UDP). Modern extensions such as RadSec can also use TLS-secured TCP connections. Here, the RADIUS server acts as the central decision point for authentication and access control. RADIUS allows access to be managed centrally rather than configured separately on each device. The process works as follows: 1. A user tries to **connect to a network**. 2. The Network Access Server (such as a Wi-Fi controller or VPN gateway) sends an **authentication request** to the RADIUS server. 3. The RADIUS server **checks the login credentials**, often against a central directory. 4. The server sends a **response** back: `Access-Accept`, `Access-Reject` or `Access-Challenge`. If the login is successful, the server also sends authorisation details, such as which network segments (VLAN) the user can access and which restrictions apply. ## What are the three core pillars of RADIUS? RADIUS is based on the AAA principle: authentication, authorisation and accounting. These three pillars determine who can log in, what they are allowed to do and how their connections are recorded. ### Authentication Authentication answers the question: ‘Who are you?’ At this stage, the system checks whether a person or device is allowed to log in. The RADIUS server verifies the login credentials itself or checks them against a connected backend system. Typical authentication methods include: - Username and password - Certificate-based methods, such as EAP-TLS - Token-based or multi-factor authentication Note Remote Authentication Dial-In User Service (RADIUS) supports multiple authentication methods, but it does not determine which method is used. Instead, the method is defined by the existing network and authentication infrastructure. ### Authorisation Authorisation answers the question: ‘What are you allowed to do?’ After a user has been successfully authenticated, the RADIUS server determines which permissions they should receive. It sends this information back to the network device as attributes, such as: - Access to specific VLANs - Permission to use only certain parts of the network - Bandwidth limits This allows access to be managed in detail based on the user’s role, user group or device. ### Accounting Accounting answers the question: ‘What happened?’ RADIUS can record session data, which is often used for billing, security audits or troubleshooting. This can include: - Start time, end time and session duration - Amount of data transferred - Assigned IP address Accounting is especially important for internet service providers, large corporate networks and any environment where access needs to be documented and traceable. Note Despite its age, RADIUS is still widely used in modern networks. Companies need to control who can access which systems and from where, whether users are in the office, working from home or on the go. RADIUS gives them a central way to manage access, especially when combined with modern security measures. ## How has RADIUS evolved over time? RADIUS was developed in the 1990s for dial-up connections. Since then, enterprise Wi-Fi, VPN access, IEEE 802.1X and cloud infrastructures have changed what networks need from authentication systems. As a result, the original protocol has been expanded to support **stronger authentication methods, better encryption and greater scalability**. These expansions allow RADIUS to support modern security requirements, including multi-factor authentication, network segmentation and zero-trust access control. ### Extended authentication methods One major step in the evolution of RADIUS was the integration of the **Extensible Authentication Protocol (EAP)**. EAP allows RADIUS to support modern login methods, including certificate-based ones such as EAP-TLS. With EAP-TLS, devices and servers authenticate each other using digital certificates. This is much more secure than password-only authentication because passwords do not need to be transmitted or stored. It also makes attacks such as phishing and automated password guessing much harder. In practice, tunnel-based EAP methods are also used alongside certificate-based methods:
Method How it works Authentication Security level Typical use
EAP-TLS Uses digital certificates for mutual authentication Client and server authenticate with certificates Very high Recommended standard for corporate networks and enterprise Wi-Fi
PEAP Creates a TLS tunnel, then uses password-based login inside it Server authenticates with a certificate, client with a password Medium to high Widely used in corporate Wi-Fi networks
EAP-TTLS Creates a TLS tunnel that can support different authentication methods Server authenticates with a certificate, client usually with a password Medium to high Flexible environments that use different login methods
### Data transmission and security enhancements RADIUS has also been expanded to make data transmission more secure. The original protocol uses UDP and only encrypts certain password-related information. The password itself is disguised using an MD5-based mechanism, but the rest of the communication remains unencrypted. RADIUS/TLS, defined in RFC 6614 and often referred to as RadSec, addresses this limitation. With RadSec, all communication between the network device and the RADIUS server is sent over an encrypted [TLS](https://www.ionos.com/en-ie/digitalguide/server/security/tls-transport-layer-security/) connection. This helps protect the data against unauthorised interception and tampering, so it meets modern security requirements. RadSec is used mainly in larger corporate networks, by internet service providers and in highly interconnected organisations with strict security requirements. ### Other RADIUS enhancements As well as new authentication methods and more secure data transmission, RADIUS has also been expanded over time to make it more flexible for modern corporate networks. Some of the main enhancements include: - **Additional attributes (attribute-value pairs):** RADIUS uses attributes (i.e. information elements) within each request. Over time, many new attributes have been added, allowing the server to process much more information than before. - **Support for VLAN assignments:** After a successful login, RADIUS can automatically assign users to specific network segments, known as VLANs. Guests might receive internet access only, while employees can access internal systems. This separation improves security and simplifies administration. - **Dynamic access controls:** Access rights can be assigned based on specific conditions during login. For example, the RADIUS server can consider which network or device someone is connecting from, the time of day or which user group they belong to. This makes it possible to apply different security levels depending on the situation. - **Integration of multi-factor authentication:** Modern RADIUS servers can be combined with additional security factors, such as one-time codes, authenticator apps or hardware tokens. This provides stronger protection, especially for VPN and remote access. ## What are the advantages and disadvantages of RADIUS?
Advantages Disadvantages
Access rights can be managed centrally instead of separately on each device Setup can be time-consuming, especially in large networks
Authentication, authorisation and accounting are handled in one system The network depends on the RADIUS server, so a server failure can disrupt logins
RADIUS scales well in networks with large numbers of users Running a dedicated RADIUS server can be overkill for small networks
Access can be controlled based on roles, user groups or devices RADIUS without modern extensions does not fully encrypt all communication
RADIUS can work with certificates, multi-factor authentication and VLAN assignment Troubleshooting can be difficult, especially with certificate problems or configuration errors
RADIUS is well established and supported by a wide range of network devices
Session logging helps with audits, billing and troubleshooting
This is a markdown version of: [https://www.ionos.com/en-ie/digitalguide/server/know-how/remote-authentication-dial-in-user-service/](https://www.ionos.com/en-ie/digitalguide/server/know-how/remote-authentication-dial-in-user-service/) for AI/LLM consumption.