RADIUS: Central sign-in for Wi-Fi and VPN

In short: A protocol with which devices such as Wi-Fi access points, switches or VPN servers have users checked by a central server.

In more detail: RADIUS (Remote Authentication Dial-In User Service) separates the access point from the user directory: on every login attempt the access point asks the RADIUS server whether the user may come in and what they may do. That gives one account per person instead of one shared Wi-Fi password.

In Depth

The three roles (AAA)

RADIUS covers authentication (who are you?), authorization (what may you do?) and accounting (what did you do and for how long?). Involved are the supplicant (the user’s device), the authenticator (access point, switch or VPN gateway) and the RADIUS server, which is usually connected to a directory such as LDAP or Active Directory.

WPA2/WPA3-Enterprise and 802.1X

On a corporate Wi-Fi every user signs in with their own user name and password or a certificate. The procedure behind it is IEEE 802.1X with EAP (Extensible Authentication Protocol). The access point only passes the EAP messages through and lets the client into the network only when the RADIUS server agrees. Well-known EAP types are PEAP, EAP-TLS (with certificates on both sides) and EAP-TTLS.

Advantages

When someone leaves the company they are blocked in one place, and the Wi-Fi password does not have to be changed. Rules per user or group can be defined, for example assignment to a particular VLAN. Access is logged and traceable. Free servers such as FreeRADIUS are widespread.

Security notes

The RADIUS protocol itself only weakly obscures the password attribute. Between authenticator and server a strong shared secret and a protected network or RadSec (RADIUS over TLS) should therefore be used. With PEAP, clients must verify the server certificate, otherwise users can be fooled by a fake access point.

See also: Authentication, Single sign-on, Certificate