# What is Remote Authentication Dial-In User Service (RADIUS)?

> Remote Authentication Dial-In User Service (RADIUS) is a protocol for carrying authentication, authorization, configuration, and accounting information between a network access device and a central RADIUS server.

- Canonical URL: https://yellowcube.eu/glossary/remote-authentication-dial-in-user-service/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Despite its dial-in name, it is widely used for wired and wireless access, virtual private networks, and other services that need centralized decisions about network admission.

A RADIUS client — often a switch, wireless controller, access point, or VPN gateway — sends an Access-Request containing identity and connection attributes. The server responds with Access-Accept, Access-Reject, or Access-Challenge and may return attributes that the client uses to configure the session. Separate accounting messages can record starts, stops, usage, and interim updates. Proxies can route requests between administrative domains.

### Key points

- **Enforcement roles:** The RADIUS server evaluates policy or consults an identity source; the network access device enforces the returned decision and session attributes.
- **Attribute design:** Control which user, device, location, realm, and session data are sent, trusted, logged, proxied, or used in policy, and normalize vendor-specific attributes deliberately.
- **Transport security:** Classic RADIUS over UDP relies on shared secrets and MD5-based protections that do not encrypt the whole packet. RADIUS over TLS protects transport; the newer RADIUS/1.1 profile removes MD5 use but remains experimental.
- **Important limitation:** An Access-Accept is an instruction to the access device, not proof that it enforced policy correctly. RADIUS does not encrypt the admitted user’s traffic, and weak endpoint authentication, shared-secret handling, proxy trust, or accounting gaps can undermine the design.

### Related terms

[Authentication, authorization, and accounting (AAA)](<https://yellowcube.eu/glossary/authentication-authorization-and-accounting/>) · [IEEE 802.1X authentication](<https://yellowcube.eu/glossary/ieee-802-1x-authentication/>) · [Network access control (NAC)](<https://yellowcube.eu/glossary/network-access-control/>) · [Virtual private network (VPN)](<https://yellowcube.eu/glossary/virtual-private-network/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>)

### Sources

[RFC 2865: RADIUS](https://datatracker.ietf.org/doc/html/rfc2865) · [RFC 2866: RADIUS Accounting](https://datatracker.ietf.org/doc/html/rfc2866) · [RFC 6614: RADIUS over TLS](https://datatracker.ietf.org/doc/html/rfc6614) · [RFC 9765: Experimental RADIUS/1.1](https://datatracker.ietf.org/doc/html/rfc9765)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.