One RADIUS server for logins, usage records, and the day a server dies.
radiusward is the RADIUS server your access points, switches, VPN concentrators and broadband gateways talk to. It decides who may connect, keeps a record of every session, and keeps doing both when one of its servers fails.
With the credentials you already have.
Wi‑Fi and wired 802.1X, VPN, subscriber logins and captive portals — against your users file, SQL database, LDAP directory or Active Directory. No new user store to maintain.
- Certificates
- EAP‑TLS for managed laptops and phones; PEAP, TTLS and TEAP with a certificate inside; client certificates checked against your CA, with CRL and OCSP revocation.
- Passwords
- PAP, CHAP and MS‑CHAP over UDP; PEAP, TTLS, TEAP and EAP‑pwd for 802.1X. Passwords stored as cleartext, NT hashes, bcrypt, SHA‑crypt, yescrypt, PBKDF2 or salted SHA — and radiusward tells you which method each format allows.
- Active Directory
- PAP by LDAP bind, or MS‑CHAPv2 and PAP over Netlogon in pure Java — no Samba, no domain join on the server. Group membership, nested groups and per‑group policies.
- SIM cards
- EAP‑SIM, EAP‑AKA and EAP‑AKA′ for private LTE/5G networks that hold their own subscriber keys; pseudonyms and fast re‑authentication.
- Policy
- Reply attributes per user and group, a device limit per user that holds across all servers (Simultaneous‑Use), login hours, expiry, usage counters, IPv4 and IPv6 address pools, a second factor with TOTP, a small rules language for the final decision.
- Roaming and control
- Realms forwarded to other RADIUS servers with failover and discovery; Change‑of‑Authorization and Disconnect to the device through an HTTP API; RadSec and DTLS where the network is not trusted.
Confirmed only once it is safe.
A device's Start, Interim and Stop records are the usage you bill and the answer to "who had this address at 14:05". radiusward treats them accordingly.
- Stored on three servers first
- A record is confirmed to the device only after it is written to disk on two of the three cluster servers. A crash — even a power loss — of any one of them loses nothing that was confirmed.
- Counted once
- A device that retries, after a timeout or a failover, through either gateway, gets the same answer and the session is counted once. The rules are precise enough to be tested, and they are.
- Whole sessions
- Start and Stop land in the same replicated state wherever they arrived; a lost Stop is closed by an idle timeout at the session's last record; a device restart (Accounting‑On/Off) closes its sessions.
- Delivered to your database
- PostgreSQL — one row per session in the column layout billing tools expect, optionally the full event history — JSON‑lines files, or forwarded to another RADIUS server. Written after the confirmation, exactly once, and buffered by the log while the database is down.
- Stated, not implied
- What a confirmation guarantees, when radiusward stays silent, and where the guarantee ends are written down and tested: the accounting contract.
Built to be operated, not only installed.
Three cluster servers and two or more gateways. What that costs you, and what it gives you back.
- Failover in seconds
- A failed leader is replaced in about two seconds — within a device's retry window, so logins and records continue without anyone noticing.
- Metrics, dashboards, alerts
- Prometheus metrics on every process, five Grafana dashboards and alert rules that ship with the Helm chart: no leader, export lag, a disk filling up, the backup behind, a certificate about to expire.
- Recovery built in
- A server that lost its disk copies the state from the others and rejoins on its own. A continuous backup outside the cluster restores a cluster that lost two servers at once.
- Upgrades without downtime
- Servers restart one at a time while the cluster keeps its quorum; changes to how records are applied take effect only once every server runs the new version.
- When things go wrong
- Per‑request traces for a user or a device, an authentication log with the reason for every decision, configuration reload without a restart.
Start on a laptop. Deploy where your services are.
One container image for amd64 and arm64, public, non‑root, with an SBOM. Java 25 inside; nothing else to install.
Docker
A complete cluster with Docker Compose in one command — the quickstart.
Kubernetes
The Helm chart: members with their own volumes, gateways with their own addresses, the backup, dashboards and alerts. Tested nightly under failures.
Hosts with systemd ↗
Units for the members, the gateways and the backup, for machines without containers.
Amazon ECS ↗
Example CloudFormation and Terraform templates on Graviton — validated, not yet deployed by the project.
Choose the architecture, not the longest feature list.
Worth evaluating when
- losing session records on a crash is not acceptable — they feed billing, usage limits or compliance;
- you want to read what the server guarantees and check it before relying on it;
- your team can run and monitor a three-server service, or already runs Kubernetes.
Evaluate carefully when
- you need the simplest possible single-server installation;
- you depend on another RADIUS server's modules or configuration format — radiusward is not compatible with them;
- you need device certifications or a support contract today.
What it is not. Not a hosted service; not certified by any device vendor; not yet independently audited. Interoperability is tested against software clients and servers, not named hardware.
The trade-offs in detail →