Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for computers to connect and use a network service.

My question is can we use RADIUS to authenticate/authorize hosts/servers/nodes which are connecting to the network service (like HTTP) instead of users?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

Yes, basic client software and server software can be RADIUS clients and can authenticate themselves against RADIUS.

For example, FreeRADIUS server offers the Apache RADIUS authentication module that allows any Apache web-server to become a RADIUS client for authentication and accounting requests.

You can integrate RADIUS client functionality by using RADIUSclient framework which is a library for writing RADIUS Clients that includes radlogin, a flexible RADIUS aware login replacement, a command line program to send RADIUS accounting records, an utility allowing to send RADIUS AAA requests from command line or from shell scripts and a utility to query the status of a (Merit) RADIUS server. All these programs are based on a library which lets you develop a RADIUS-aware application in less than 50 lines of C code. It is highly portable and runs on Linux, many BSD variants and Solaris.

share|improve this answer
add comment

This is totally dependent on your implementation details. Generally, "yes". For instance, Spring Security, a web application security infrastructure, provides a RADIUS plugin to do Auth/Auth for web applications.

If you are taking system-2-system or machine-2-machine, then again, basically "yes" again. But you will need to come up with a way (certificate, key, etc) to securely store and provide the credentials as you flow from system-2-system and out to the RADIUS server, that prevents clear text or other compromise-able storage.

share|improve this answer
add comment

I don't think you can use radius for host authentication. it's for dial up users. You might use tacacs.

share|improve this answer
    
TACACS says > TACACS+ and RADIUS have generally replaced TACACS and XTACACS in more recently built or updated networks. –  Deepesh M Feb 8 '13 at 3:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.