Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for computers to connect and use a network service.
My question is can we use RADIUS to authenticate/authorize hosts/servers/nodes which are connecting to the network service (like HTTP) instead of users?
Yes, basic client software and server software can be RADIUS clients and can authenticate themselves against RADIUS.
For example, FreeRADIUS server offers the Apache RADIUS authentication module that allows any Apache web-server to become a RADIUS client for authentication and accounting requests.
You can integrate RADIUS client functionality by using RADIUSclient framework which is a library for writing RADIUS Clients that includes radlogin, a flexible RADIUS aware login replacement, a command line program to send RADIUS accounting records, an utility allowing to send RADIUS AAA requests from command line or from shell scripts and a utility to query the status of a (Merit) RADIUS server. All these programs are based on a library which lets you develop a RADIUS-aware application in less than 50 lines of C code. It is highly portable and runs on Linux, many BSD variants and Solaris.
This is totally dependent on your implementation details. Generally, "yes". For instance, Spring Security, a web application security infrastructure, provides a RADIUS plugin to do Auth/Auth for web applications.
If you are taking system-2-system or machine-2-machine, then again, basically "yes" again. But you will need to come up with a way (certificate, key, etc) to securely store and provide the credentials as you flow from system-2-system and out to the RADIUS server, that prevents clear text or other compromise-able storage.
I don't think you can use radius for host authentication. it's for dial up users. You might use tacacs.
