Radiator Server Documentation — v10.33.3
Radiator

Documentation v10.33.3

Radiator Documentation

Welcome to the Radiator documentation. Radiator is a high-performance AAA (Authentication, Authorization, and Accounting) server designed for mission-critical network infrastructure.

Getting Started

Articles

About Radiator software development security

How Radiator Software ensures software development security.

Architecture Overview

Overview of Radiator Server's architecture, request flow, and core components including async processing, protocol servers, policies, handlers, and execution pipelines.

Backend Load Balancing

Configuration guide for load balancing across multiple backend servers using Radiator Server's built-in algorithms, including connection pool management and high availability.

Basic Installation

How to download and install Radiator

Built-in Environment Variables

Environment variables that control Radiator Server behavior at startup and runtime

Comparison Operators

Reference guide for comparison operators used in policy and handler conditions and condition clauses.

Configuration Editor

Features and keyboard shortcuts for the Management UI configuration editor

Configuration Import and Export

How to export and import Radiator configuration packages using the Management UI

Containers

Operate Radiator container images

Data Types

Supported data types in Radiator configuration language

Duration Units

Human-readable duration units for timeout, interval, and delay values

Environment Variables

Use environment variables to parameterize Radiator configuration

Execution Context

Variables available during request processing

Execution Pipelines

Executing actions

Filters

Transform and modify values in expressions and format strings

Getting a Radiator License

How to obtain and install a Radiator license

Health check /live and /ready

Health check endpoints for monitoring server availability and readiness in containerized environments

High Availability and Load Balancing

Guide to deploying Radiator Server in high availability configurations with load balancing, failover strategies, and multi-node architectures

High availability identifiers

Instance and cluster identifiers for distinguishing nodes and enabling high availability configurations

HTTP Basic Authentication

Authenticate HTTP requests using HTTP Basic Auth

Introduction

Introduction to configuration

Linux systemd support

How Radiator Server integrates with systemd for service management and readiness notification.

Local AAA Backends

Guide on when and how to create standalone Radiator instances without external dependencies

Log storage and formatting

Describes different log storage and formatting options

Management API privilege levels

Explain the different privilege levels of the Management API and UI

Namespaces

Understanding namespace hierarchies in logging and counters

Password Hashing

Secure password storage using cryptographic hashing algorithms

Probabilistic Sampling

Use cases and patterns for probabilistic pipeline execution

Prometheus scraping

Exposing operational metrics and counters through authenticated HTTP endpoints for Prometheus monitoring

PROXY Protocol Support

How to configure PROXY protocol v2 support in Radiator Server to preserve original client IP addresses when using load balancers like HAProxy or AWS NLB.

Radiator server health and boot up logic

Server startup sequence, recovery mode behavior, and service enable/disable functionality

Radiator sizing

Hardware resource requirements and performance guidelines for deploying Radiator server at scale

Radiator software releases

Build and release types for Radiator server binaries

Rate Limiting

Strategies for implementing rate limiting and request throttling in Radiator Server using Lua scripts and cache-based counters

Rate Limiting Algorithms

Comparing counter-based and GCRA rate limiting strategies

Reverse Dynamic Authorization

AKA Reverse CoA - Send Change of Authorization messages to NAS devices over existing outbound connections.

Service Level Objective

How to configure service-level-objective blocks to enable automatic circuit breaking and degradation for backend servers.

TACACS+ Authentication, Authorization, and Accounting

How to configure TACACS+ in Radiator Server for device administration, including ASCII multistage flows with one-time password challenges.

Template Rendering CLI

Generate configuration files from templates using the command line

Tools radiator-client

Command-line RADIUS test utility for sending RADIUS packets

TOTP/HOTP Authentication

Time-based and HMAC-based One-Time Password authentication

What is Radiator?

Learn what Radiator is and how it provides AAA services for network infrastructure

YubiKey Authentication

Yubico OTP validation with Radiator - cloud and offline paths

YubiKey Context Variables

Context variables for Yubico OTP offline authentication

Configuration

The top-level configuration blocks. Open an item to view child blocks and statements.

@init

Run initialization pipelines when Radiator loads or reloads configuration.

aaa

AAA policies configuration

backends

Read and write data on external systems

caches

Cache configuration for in-memory data caching and performance optimization

captures

Packet capture configuration for monitoring network traffic

certificates

Certificate and private key configuration for TLS/SSL connections

clients

Client configuration for RADIUS authentication and authorization

dictionary

RADIUS dictionary configuration for defining custom attributes and values

include

Configuration file inclusion statement for modular configuration management

license

License configuration

logging

Logging configuration for application and AAA event logging

management

Management interface configuration for HTTP/HTTPS API access and web UI

scripts

Custom Lua scripts configuration for extending AAA processing logic

servers

Server configuration for RADIUS and other servers

statistics

Statistics and metrics history configuration for Radiator operators

ui

Management UI customisation configuration

Execution Pipeline Actions

Actions that can be used in the execution pipelines.

accept

Accept action for unconditionally accepting RADIUS requests

append

Append action for appending new values to attributes

assert

Assert that two expressions are equal during pipeline execution

backend

Backend action for forwarding RADIUS requests to external backends

challenge

Challenge action for sending challenge responses in multi-factor authentication

chap

CHAP action for CHAP authentication

conditions

Evaluate conditions and accept or reject the request

copy

Copy action for copying attributes in RADIUS pre-proxying and post-proxying handlers

count

Increment a counter for metrics and monitoring

debug

Debug logging action for outputting variable values and formatted strings to application logs

discard

Discard action for silently dropping RADIUS requests

EAP

Configure EAP method handling for TLS, TTLS, PEAP, and TEAP authentication flows.

error

Generate an error into the pipeline

filter

Filter action for filtering unwanted attributes in RADIUS pre-proxying and post-proxying handlers

hotp

HOTP action for HMAC-based One-Time Password authentication

http-basic-auth

HTTP Basic Authentication action for HTTP server handlers

if

Conditional execution

ignore

Ignore action for continuing pipeline execution without setting a result

invoke

Invoke a named pipeline

log

Log transactions with an AAA logger

map

map statement for conditional logic

message

Message action for adding additional information to RADIUS responses

modify

Variable modification block

mschap

MSCHAP action for MSCHAP authentication

mschapv2

MSCHAPv2 action for MSCHAPv2 authentication

must

Convert ignore action results to reject

pap

PAP action for plaintext password authentication

reason

Reason action for providing additional context to RADIUS responses

reject

Reject action for unconditionally denying RADIUS requests

reject_errors

Control whether pipeline errors result in request rejection

replace

Replace action for replacing existing attributes with new values

reply

Send RADIUS reply immediately without waiting for pipeline completion

rewrite

Rewrite action for modifying attribute values based on their current value

set

Set action for assigning values to context attributes

sleep

Pause pipeline execution for a specified duration with optional random addition

sometimes

Probabilistic pipeline execution

stop

Stop action for halting pipeline execution while preserving the current result

totp

TOTP action for Time-based One-Time Password authentication

trace

Enable or disable per-request AAA pipeline tracing

try

Catch pipeline errors

until

Run actions until given result occurs

yubikey

YubiKey OTP offline authentication action