RADIUS User Management

Remote Authentication Dial In User Service (RADIUS) is the most commonly used protocol for implementing authentication, authorization, and accounting (AAA) on remote dial-up users. RADIUS is operating over UDP, and its authentication and accounting port numbers are 1812 and 1813, respectively. RADIUS clients communicate with the RADIUS server to implement AAA functions for various users.

Security Policy

RADIUS transmits packets over UDP connections. A shared key, which is not transmitted over a network, is used for authentication between clients and the RADIUS server. In addition, passwords transmitted between clients and the RADIUS server are encrypted using the shared key to prevent user passwords from being intercepted on an insecure network.

Attack Methods

There are few attacks on RADIUS.

  • An attacker changes the contents in packets in transit. There is no method to protect packet integrity.
  • An attacker can sniff RADIUS packets. The password attribute is only hidden in a RADIUS request packet.

Configuration and Maintenance Methods

Configure a shared key by running the radius-server { shared-key key-string | shared-key-cipher key-string-cipher } [ { authentication | accounting } { ipv4-address [ vpn-instance instance-name ] | ipv6-address } [ source {ip-address source-ip-address | interface-type interface-num } ] ] port-number [ weight weight ] command.

Configuration and Maintenance Suggestions

The key in ciphertext mode is recommended.

Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >