RFC 2138 (rfc2138) - Page 3 of 65
Remote Authentication Dial In User Service (RADIUS)
Alternative Format: Original Text Document
RFC 2138 RADIUS April 1997
6. Examples .............................................. 59
6.1 User Telnet to Specified Host ................... 60
6.2 Framed User Authenticating with CHAP ............ 60
6.3 User with Challenge-Response card ............... 61
Security Considerations ...................................... 63
References ................................................... 64
Acknowledgements ............................................. 64
Chair's Address .............................................. 65
Author's Addresses ........................................... 65
1. Introduction
Managing dispersed serial line and modem pools for large numbers of
users can create the need for significant administrative support.
Since modem pools are by definition a link to the outside world, they
require careful attention to security, authorization and accounting.
This can be best achieved by managing a single "database" of users,
which allows for authentication (verifying user name and password) as
well as configuration information detailing the type of service to
deliver to the user (for example, SLIP, PPP, telnet, rlogin).
Key features of RADIUS are:
Client/Server Model
A Network Access Server (NAS) operates as a client of RADIUS. The
client is responsible for passing user information to designated
RADIUS servers, and then acting on the response which is returned.
RADIUS servers are responsible for receiving user connection
requests, authenticating the user, and then returning all
configuration information necessary for the client to deliver
service to the user.
A RADIUS server can act as a proxy client to other RADIUS servers
or other kinds of authentication servers.
Network Security
Transactions between the client and RADIUS server are
authenticated through the use of a shared secret, which is never
sent over the network. In addition, any user passwords are sent
encrypted between the client and RADIUS server, to eliminate the
possibility that someone snooping on an unsecure network could
determine a user's password.
Rigney, et. al. Standards Track