network protocols handbook.pdf

104Protocols GuideSecurity and VPN - AAA ProtocolsProtocol NameRADIUS: Remote AuthenticationDial In User ServiceProtocol DescriptionRADIUS is a protocol for carrying authentication, authorization,and configuration information between a Network Access Serverwhich desires to authenticate its links and a shared AuthenticationServer. RADIUS uses UDP as the transport protocol.RADIUS also carries accounting information between a NetworkAccess Server and a shared Accounting Server.Key features of RADIUS are:Client/Server Model: A Network Access Server (NAS) operatesas a client of RADIUS. The client is responsible for passing userinformation to designated RADIUS servers, and then acting onthe response which is returned. RADIUS servers are responsiblefor receiving user connection requests, authenticating theuser, and then returning all configuration information necessaryfor the client to deliver service to the user. A RADIUS server canact as a proxy client to other RADIUS servers or other kinds ofauthentication servers.Network Security: Transactions between the client and RADIUSserver are authenticated through the use of a shared secret,which is never sent over the network. In addition, any userpasswords are sent encrypted between the client and RADIUSserver, to eliminate the possibility that someone snooping on aninsecure network could determine a user’s password.Flexible Authentication Mechanisms: The RADIUS server cansupport a variety of methods to authenticate a user. When it isprovided with the user name and original password given by theuser, it can support PPP PAP or CHAP, UNIX login, and otherauthentication mechanisms.Extensible Protocol: All transactions are comprised of variablelength Attribute-Length-Value 3-tuples. New attribute values canbe added without disturbing existing implementations of the protocol.Protocol Structure8 16 32 bitCode Identifier LengthAuthenticator (16 bytes)• Code - The message types are described as follows:1 Access-Request2 Access-Accept3 Access-Reject4 Accounting-Request5 Accounting-Response11 Access-Challenge12 Status-Server (experimental)13 Status-Client (experimental)255 Reserved• Identifier - The identifier matches requests and replies.• Length - The message length including the header.• Authenticator - A field used to authenticate the replyfrom the radius server and in the password hidingalgorithm.Related protocolsUDP, CHAP, RAPSponsor SourceRADIUS is defined by IETF (http://www.ietf.org) in RFC 2865and 2866.Referencehttp://www.javvin.com/protocol/rfc2865.pdfRemote Authentication Dial In User Service (RADIUS)http://www.javvin.com/protocol/rfc2866.pdfRADIUS Accounting