RADIUS User Management

Overview

RADIUS is the most commonly used protocol for implementing AAA on remote dial-up users. RADIUS runs atop UDP, and its authentication and accounting port numbers are 1812 and 1813, respectively. RADIUS uses the client/server model for communication between the RADIUS client and server to provide AAA functions.

RADIUS transmits packets over UDP connections. A shared key, which is not transmitted over the network, is used for authentication between the RADIUS client and server. As such, user passwords transmitted between the RADIUS client and server are encrypted using the shared key to prevent passwords from being disclosed on an insecure network. The device allows you to configure a shared key for packet encryption to improve transmission security. For security purposes, it is recommended that the shared key contain at least 6 characters and at least two types of the following characters: uppercase letters, lowercase letters, digits, and special characters. You are advised to periodically change the shared key.

Impact on the System

None

Procedure

Enter the system view.
```
system-view
```
Create a RADIUS server template and enter its view.
```
radius-server template template-name
```
Configure a shared key for the RADIUS server.
```
radius-server shared-key cipher key-string
```

Checking the Security Hardening Result

After a shared key is configured for the RADIUS server on the device, it is displayed in ciphertext, and users cannot obtain its information.