DEV Community

Nirajan Acharya
Nirajan Acharya

Posted on

RADIUS Architecture in a Node.js Server

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) for users who connect to a network. It is widely used in enterprise environments, ISPs, and VPNs to manage user access securely.

In this blog, we will explore how RADIUS architecture works and how to implement a RADIUS server using Node.js.

Image description

Understanding RADIUS Architecture

RADIUS follows a client-server model consisting of the following key components:

  1. RADIUS Client (NAS - Network Access Server): The device that users connect to, such as a router, VPN server, or Wi-Fi access point.
  2. RADIUS Server: A centralized server that processes authentication and authorization requests.
  3. Database (Optional): Stores user credentials and policies for access control.

Workflow of RADIUS Authentication

  1. The user attempts to log in by providing credentials (username and password) to the NAS.
  2. The NAS forwards the credentials to the RADIUS server for authentication.
  3. The RADIUS server checks the credentials against its user database.
  4. If authentication is successful, the server grants access; otherwise, access is denied.
  5. Accounting logs may be generated to track user activities and session durations.

Implementing a RADIUS Server in Node.js

To implement a RADIUS server in Node.js, we will use the node-radius package.

Step 1: Install Dependencies

First, install the required package:

npm install node-radius
Enter fullscreen mode Exit fullscreen mode

Step 2: Create a Basic RADIUS Server 

const dgram = require("dgram");
const radius = require("radius");

const SECRET = "mysecretkey"; // Shared secret key
const server = dgram.createSocket("udp4");

server.on("message", (msg, rinfo) => {
    const packet = radius.decode({ packet: msg, secret: SECRET });
    console.log("Received RADIUS request:", packet);

    if (packet.code === "Access-Request") {
        const username = packet.attributes["User-Name"];
        const password = packet.attributes["User-Password"];

        if (username === "admin" && password === "password123") {
            const response = radius.encode({
                code: "Access-Accept",
                secret: SECRET,
                identifier: packet.identifier,
                attributes: [["Reply-Message", "Access granted"]],
            });
            server.send(response, 0, response.length, rinfo.port, rinfo.address);
        } else {
            const response = radius.encode({
                code: "Access-Reject",
                secret: SECRET,
                identifier: packet.identifier,
                attributes: [["Reply-Message", "Access denied"]],
            });
            server.send(response, 0, response.length, rinfo.port, rinfo.address);
        }
    }
});

server.bind(1812);
console.log("RADIUS Server is running on port 1812");
Enter fullscreen mode Exit fullscreen mode

Step 3: Testing the RADIUS Server

To test the server, you can use a RADIUS client like radtest:

radtest admin password123 127.0.0.1 0 mysecretkey
Enter fullscreen mode Exit fullscreen mode

If authentication is successful, you will receive an Access-Accept response.

Enhancing the RADIUS Server

  1. Integrating with a Database: Store user credentials in a database (MySQL, PostgreSQL, MongoDB) instead of hardcoding.
  2. Logging and Accounting: Implement logging mechanisms to track authentication attempts and user sessions.
  3. Adding EAP Support: Extend the server to support EAP (Extensible Authentication Protocol) for Wi-Fi authentication.
  4. Secure Communication: Encrypt sensitive user data and use TLS for secure transmission.

Conclusion

RADIUS is a crucial authentication protocol widely used in network security. By leveraging Node.js and the node-radius package, we can build a lightweight yet powerful RADIUS server for user authentication and access control.

Would you like to integrate this with an existing authentication system? Let me know in the comments!

Top comments (0)