Remote Authentication Dial-In User Service (RADIUS) is a protocol that facilitates communication between network devices, remote access servers, and a central database, allowing users and devices to be authenticated to access networks. RADIUS was initially created to verify the identities of users who access corporate networks remotely through modem pools and serial line connections.
Remote network users using RADIUS have to connect to their networks through a network access server (NAS). The NAS queries the RADIUS server, which is a central authentication server with the details of the clients who connect to the NAS, to get the details of the respective client and complete the verification.
Devices such as routers, switches, wireless access points, and VPNs are the major gateways through which crucial data of organizations are communicated. These devices need to authenticate users and devices attempting to access the network. RADIUS authenticates their credentials, ensuring that only authorized users and devices can access the critical components of an organization's network infrastructure.
What sets RADIUS apart from other protocols is that it offers capabilities beyond authentication. RADIUS provides extensive logging and accounting features that track user activities in the network. These logs are useful for monitoring network usage, detecting suspicious behavior, and conducting forensic analysis in the event of a security incident.
RADIUS can also be integrated into MFA solutions, thereby authorizing not only network access but also access to other resources like apps and machines.
RADIUS can authenticate users using two different methods of authorization. They are:
PAP is predominantly used when RADIUS is employed as an additional factor in MFA solutions. The focus of these solutions is to authorize users to access other resources, and PAP is much easier to integrate with them.
RADIUS authentication uses a centralized architecture to deliver consistent and secure authentication across all network devices and services.
Before implementing RADIUS authentication, certain prerequisites must be met to ensure a smooth and successful setup. Here are the essential requirements:
Here's how the entire process of verifying remote users and network devices using RADIUS authentication works:
ManageEngine ADSelfService Plus offers adaptive MFA with 20 different authenticators, including RADIUS authentication. You can use MFA to protect endpoints, such as on-premises and cloud application logins, computers, VPNs, OWA, and self-service password management tasks. With ADSelfService Plus, you can customize the MFA authentication process for various user accounts based on their OU and group memberships, allowing you to secure your privileged accounts and activities against cyberthreats.
Remote Authentication Dial-In User Service (RADIUS) is a protocol that facilitates communication between network devices, remote access servers, and a central server, allowing for users and devices to be authenticated for network access. It was initially developed to authenticate a large base of users who connected remotely to corporate networks via dial-up connections.
One similarity between RADIUS and LDAP is that they use a centralized server to store and authenticate the credentials and data they receive. However, LDAP is primarily used to query for details on directory objects, like users, groups, and devices, and verify them, while RADIUS authorizes access to networks, which includes the networks in which LDAP queries are made. RADIUS can use LDAP to query for user credentials and device certificates that request access to the network.
RADIUS authenticates the credentials of users and various network resources, such as routers, switches, wireless access points, and VPNs, that try to connect to a network. It ensures that only authorized users and devices can access the critical components of an organization's network infrastructure.
The RADIUS authentication requires three major components to function:
Other requirements include deciding the authentication protocol (PAP or CHAP), purchasing the RADIUS server software, and configuring your firewall to open ports for the RADIUS protocol to communicate with the network's devices.
When you sign in to your non-Microsoft accounts, you will be prompted for a TOTP to be entered on the login screen. You can find this TOTP in the Microsoft Authenticator app, which can be accessed after completing the device verification.
When you sign in to your Microsoft account, you will be prompted to approve the sign-in notification on the Microsoft Authenticator app, where you will use the device verification method that you registered with.
While RADIUS can request an additional TOTP when using the PAP method and authenticate with a certificate using CHAP method, additional authentication methods are not supported. However, RADIUS can be used as an additional verification method in MFA solutions to authorize credentials and devices secured by the MFA solutions.
Yes, RADIUS servers can be hosted in the cloud. After hosting the server on the network or in the cloud platform, RADIUS can be used as a verification method to log in to the network or cloud platform.
