ImRAD RADIUS

RADIUS Overview

RADIUS(Remote Authentication Dial-In User Service) is a networking protocol, operating on ports 1812 and 1813, that provides centralized Authentication, Authorization, and Accounting (AAA or Triple-A) management for users who connect and use a network service.

RADIUS is a client/server protocol that runs in the application layer. Network access servers, which control access to a network, usually contain a RADIUS client component that communicates with the RADIUS server. RADIUS is often the back-end of choice for 802.1X authentication.

WPA-Enterprise is also referred to as WPA-802.1X mode, and sometimes just WPA (as opposed to WPA-PSK), this is designed for enterprise networks and requires a RADIUS authentication server to have users can use a network service.

The imRAD can be used on WPA, WPA2, and WPA3 Enterprise environments and supports EAP-TTLS and EAP-PEAP. The EAP-TTLS is a default authentication method.

RADIUS authentication consists of supplicant(user device), NAS(Network Access Server), and the RADIUS server. The user or machine sends a request to a Network Access Server (NAS) to gain access to a particular network resource using access credentials. The NAS sends a RADIUS Access-Request message to the RADIUS server, requesting authorization to grant access via the RADIUS protocol. The RADIUS server checks that the information is correct.

RADIUS Authentication and Authorization Flow

The imRAD was developed based on the FreeRADIUS and provides the most of RADIUS services. Our system can authenticate a User-Name in a Local database, remote databases, or LDAP servers, and Proxy servers. The following is the supporting remote DBMS or LDAP.

• MariaDB
• MySql
• Oracle 11g ~ 19c
• Microsoft SQL Server 2014 ~ 2019
• Tibero 6
• PostgreSQL 12
• SYBASE
• OpenLDAP
• Microsoft Active Directory Domain service(AD DS)
• Microsoft Active Directory Lightweight directory service(AD LDS)

Pass-Through Authentication makes it possible to authenticate directly a user through a remote database(e.g, Customer employee database) without importing data from the remote database to the imRAD local database.
However, when you set the Pass-Through Authentication, network traffic to the remote database may be increased and it may slow down the database.
To resolve this, the user credentials that were authenticated from a remote database are saved into the local database for few days(You can set how many days the cached users are kept in the local database from the RADIUS general settings). And then, authentication requests will not be sent to the remote database but be completed in the local database. We called it "cached user".
To securely save the User-password into the local database, it is saved as hashed data using the strong hash algorithm(e.g, SHA256 with salt).

Supporting TLS(Transport Layer Security) version is between 1.0 and 1.3 and can be changed the minimum and the maximum version from the RADIUS general settings. You must make sure the TLS version because some client operating systems still use TLS 1.0.

RADIUS Proxying is that the server can proxy any request to other RADIUS servers and other RADIUS servers can authenticate the proxying request. A famous proxying is eduroam(education roaming) and a user can be authenticated at an eduroam server using the RADIUS Proxying.

The Pass-Through Authentication and the RADIUS Proxying can be restricted by a NAS Identifier and you can also set this policy.

Configuring RADIUS

Getting started

Basically, to authenticate a user's device basically that is in the 802.1x environment, Follow the below instruction.

1. Register the IP address of an imRAD and the shared secret at a NAS.
2. Register the IP address of a NAS and the same shared secret at the RADIUS > settings > NAS .

After doing the above, the imRAD RADIUS can process the requests from the NAS that was registered. If you want to test a device(e.g, smartphone, tablet, laptop computer, and so on), please refer to the RADIUS Authentication testing.

Users

It manages 802.1x Users.

Reject2ban

It is designed to reduce the load on the databases from random requests of a malicious client.

Multi-Factor Authentication

In user authentication, this function utilizes additional attributes such as MAC address and NAS-ID (SSID), beyond the default attributes (User-Name, User-Password), to authenticate.

Groups

It is the RADIUS User groups.

Attributes

It provides a manager can search the attributes used in RADIUS.

Log

• Accounting: It displays all Accounting.
• Post-Authentication: It displays all log after attempting authentication.
• Reject2ban: It displays the Reject2ban log.

Settings

All settings for the RADIUS can be configured on this menu. After configuring something, the radiusd service will automatically apply the changed values in few seconds without an administrator manually restart the radiusd service. If you want to radiusd service can forcibly apply the changed value, click the "Apply" button at the bottom of this menu.