TechKnowSurge
CompTIA Security+ 1.2 ISC2 CISSP 5.6 NIST 800-53 AC-17 NIST CSF PR.AA-03
TechKnowSurge Catalog Videos RADIUS
VideoSecurityFree

RADIUS

RADIUS is a widely used AAA (authentication, authorization, and accounting) protocol that enables centralized user authentication across a range of network access scenarios. Originally developed for dial-up modem environments, it remains a standard component in VPN authentication, network device access, and 802.1X port-based access control.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

RADIUS, which stands for Remote Authentication Dial-In User Service, is a AAA protocol responsible for authentication, authorization, and accounting in network environments. Its roots lie in dial-up networking, where remote users would connect to a bank of modems over the public switched telephone network, and the receiving server needed a way to validate credentials against a centralized directory rather than a locally maintained database. RADIUS provided the communication layer between the access server and the backend authentication infrastructure, such as Active Directory or LDAP, eliminating the need to manage duplicate credential stores across multiple systems. Today, RADIUS extends well beyond its dial-up origins and is deployed in a broad range of access control scenarios. When users authenticate to network devices such as routers via SSH, or when remote workers connect through a VPN, RADIUS enables the access point or firewall to offload credential verification to a centralized directory service, ensuring that a single set of credentials works consistently across both local and remote access methods. It also plays a critical role in 802.1X port-based access control, where it serves as the protocol linking the authenticator — such as a switch or wireless access point — to the authentication server, encapsulating EAP messages and returning access decisions. This flexibility and longevity have kept RADIUS a relevant and widely implemented standard in modern network security architecture.

What you'll learn

What's covered

RADIUS Protocol

Aligned to

CompTIA Security+
1.2 Summarize fundamental security concepts.
ISC2 CISSP
5.6 Implement authentication systems
NIST 800-53
AC-17 Remote Access
NIST CSF
PR.AA-03 Users, services, and hardware are authenticated.

Key terms

Remote Authentication Dial-In User Service
RADIUS
RADIUS is a client-server networking protocol that provides centralized authentication, authorization, and accounting management for users connecting to network access points or VPN services.
Authentication
The process of verifying the identity of a user, device, or system.
Authorization
The process of determining what actions or resources an authenticated user is permitted to access.
Virtual Private Network
VPN
A technology that creates a secure, encrypted tunnel over a public network to protect data in transit.
Active Directory
AD
Microsoft's directory service used to manage users, computers, and resources in a network.
802.1X
An IEEE standard for port-based network access control that requires devices to authenticate before gaining access to a wired or wireless network, using a supplicant, authenticator, and authentication server (typically RADIUS). It is the foundation of enterprise Wi-Fi security and wired port security using EAP methods.

Topics

Radius Aaa Protocols Network Access Control 802 1x Vpn Networking

Transcript

What RADIUS Is

RADIUS is an AAA protocol that's been around for a long time, but it's still widely used today.

RADIUS stands for Remote Authentication Dial-In User Service. The key to this is dial-in. Dial-in is kind of interesting: when we're talking about dial-in, we're talking about old dial-in modems. This technology, this server, has been around for quite some time.

The Dial-Up Example

One of the companies I worked for had a lot of dial-in users. What did that look like? We had sites all around the local metropolitan area, and what they had access to at these sites at the time was dial-up. They had phone lines that they could connect into our servers.

So what would happen is they would have a modem — a modulator-demodulator — and their computer would be hooked up to this modem. Then, to make a connection into the main office, they would dial up a phone number over the plain old telephone system. So POTS, plain old telephone system. It would make a connection to one of many modems on the other side. We had this bank of modems on the other side, and so it'd make a connection into this modem, which would then be attached to a server, and then that server would either grant them access or not grant them access.

But what happens is that we didn't want to maintain a separate set of usernames and passwords on this server. We wanted it to be part of Active Directory, and so Active Directory was a whole other server, and they already had usernames and passwords, and that's what they were going to use to log into this network through these phone systems. So what needed to happen is there needed to be some communication between this authentication server that had this bank of modems and also these authentication servers on the back end. What we would do is we create a RADIUS connection between these two.

AAA and Other Uses

RADIUS is an AAA protocol: authentication, authorization and accounting. That's what these servers did, and we use it in a lot of different cases.

One of those cases is when we are logging in — maybe we want to SSH into a router. Rather than having a local database that you're authenticating to, instead you're using the back end servers. Maybe it's Active Directory, maybe it's some sort of LDAP servers, whatever directory services are on that back end. We need to make a connection to that. One of the ways — it's not the only way, but one of the ways — is to use these RADIUS servers. So RADIUS is a technology that was originally designed for this dial-up, but we use it in other cases as well.

Another example is if you are VPNing in. If you're VPNing from a laptop from some sort of remote location, then the firewall a lot of times is what you're going to VPN into. Well, that firewall needs a set of credentials. Rather than having a set of credentials for logging in on the local network and a different set of credentials for logging into the VPN, instead you make a connection between the LDAP servers, or Active Directory, or whatever directory services that you have, and the firewall. That connection needs to somehow be set up — we need protocols, or we need some way of setting up that connection, and one of those protocols that we can use is RADIUS. So this is another example of how we would use RADIUS.

RADIUS and 802.1X

Another example of this is with 802.1X, because we have a way to make a connection now between the supplicant and the authenticator, which is eel will carry those EAP connections, the authentication messages, back and forth. So now we have communication between the supplicant and the authenticator, but we don't have communication between the authenticator and the authentication server.

So RADIUS is what is used to encapsulate our e on this side of it. RADIUS is the protocol, and we have RADIUS services that are running on this other side that help establish this connection and then get the proper authentication, the yay or nay, on each one of these.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →