toughradius

command module

v9.2.0 Latest Latest Go to latest Published: Jul 15, 2026 License: MIT Imports: 15 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/talkincode/toughradius

Links

Open Source Insights

README ¶

Welcome to the TOUGHRADIUS project!

 _____   _____   _   _   _____   _   _   _____        ___   _____   _   _   _   _____
|_   _| /  _  \ | | | | /  ___| | | | | |  _  \      /   | |  _  \ | | | | | | /  ___/
  | |   | | | | | | | | | |     | |_| | | |_| |     / /| | | | | | | | | | | | | |___
  | |   | | | | | | | | | |  _  |  _  | |  _  /    / / | | | | | | | | | | | | \___  \
  | |   | |_| | | |_| | | |_| | | | | | | | \ \   / /  | | | |_| | | | | |_| |  ___| |
  |_|   \_____/ \_____/ \_____/ |_| |_| |_|  \_\ /_/   |_| |_____/ |_| \_____/ /_____/

TOUGHRADIUS

ToughRADIUS philosophy cover

A powerful, open-source RADIUS server designed for ISPs, enterprise networks, and carriers. Supports standard RADIUS protocols, a full EAP / 802.1X authentication suite (EAP-TLS, PEAPv0/EAP-MSCHAPv2, EAP-TTLS), RadSec (RADIUS over TLS), and a modern Web management interface.

✨ Core Features

RADIUS Protocol Support

🔐 Standard RADIUS - Full support for RFC 2865/2866 authentication and accounting protocols
🔒 RadSec - TLS encrypted RADIUS over TCP (RFC 6614)
🌐 Multi-Vendor Support - Compatible with major network devices like Cisco, Mikrotik, Huawei, etc.
⚡ High Performance - Built with Go, supporting high concurrency processing

EAP / 802.1X Authentication

A pluggable EAP handler registry covers both challenge and tunneled methods:

🪪 EAP-MD5 / EAP-MSCHAPv2 - Challenge-based password methods (RFC 3748)
🔐 EAP-TLS - Certificate-based mutual authentication with TLS handshake, fragmentation reassembly, and certificate-to-identity mapping (RFC 5216)
🪟 PEAPv0 / EAP-MSCHAPv2 - Server-certificate TLS tunnel carrying inner EAP-MSCHAPv2 with MPPE key derivation, for Windows / AD / legacy enterprise networks
🧩 EAP-TTLS - TLS tunnel carrying inner PAP / MS-CHAPv2, onboarding LDAP and legacy credential stores without a per-client certificate rollout (RFC 5281)

⚠️ Compatibility note: PEAP and EAP-MSCHAPv2 are compatibility-first methods. MS-CHAPv2-style exchanges carry an NTLMv1-like attack surface (see Microsoft guidance). Use them to serve legacy devices and AD users; prefer EAP-TLS for new deployments where you control the client certificate estate.

Management Features

📊 React Admin Interface - Modern Web management dashboard
👥 User Management - Complete user account and profile management
📈 Real-time Monitoring - Online session monitoring and accounting record queries
🔍 Log Auditing - Detailed authentication and accounting logs

Integration Capabilities

Multi-Database Support - PostgreSQL, SQLite
🔌 Flexible Extension - Supports custom authentication and accounting logic
📡 Multi-Vendor VSA - Huawei, Mikrotik, Cisco, H3C, etc.

🚀 Quick Start

Prerequisites

Go 1.25+ (for building from source)
PostgreSQL or SQLite
Node.js 18+ (for frontend development)

Installation

1. Build from Source

# Clone repository
git clone https://github.com/talkincode/toughradius.git
cd toughradius

# Build frontend
cd web
npm install
npm run build
cd ..

# Build backend
go build -o toughradius main.go

2. Use Pre-compiled Version

Download the latest version from the Releases page.

Configuration

Copy the configuration template:

cp toughradius.yml toughradius.prod.yml

Edit toughradius.prod.yml configuration file:

system:
  appid: ToughRADIUS
  location: Asia/Shanghai
  workdir: ./rundata

database:
  type: sqlite # or postgres
  name: toughradius.db
  # PostgreSQL configuration
  # host: localhost
  # port: 5432
  # user: toughradius
  # passwd: your_password

radiusd:
  enabled: true
  host: 0.0.0.0
  auth_port: 1812 # RADIUS authentication port
  acct_port: 1813 # RADIUS accounting port
  radsec_port: 2083 # RadSec port

web:
  host: 0.0.0.0
  port: 1816 # Web management interface port

EAP Configuration

ToughRADIUS registers the following EAP handlers out of the box:

Method	Kind	Notes
`eap-md5`	Challenge	Default; password challenge (RFC 3748)
`eap-mschapv2`	Challenge	MS-CHAPv2 password challenge
`eap-tls`	Tunneled (certificate)	Certificate-based mutual authentication (RFC 5216)
`eap-peap`	Tunneled	PEAPv0 with inner EAP-MSCHAPv2 (Windows / AD)
`eap-ttls`	Tunneled	Inner PAP / MS-CHAPv2 (RFC 5281)

Fine-tune authentication behavior via system configuration (sys_config):

radius.EapMethod: Preferred EAP method offered on EAP-Identity (default eap-md5).
radius.EapEnabledHandlers: Allow-list of enabled handlers, comma-separated, e.g. eap-md5,eap-mschapv2,eap-tls. Use * to enable all registered handlers.

This lets you disable unauthorized EAP methods without interrupting the service.

⚠️ MS-CHAPv2-based methods (eap-mschapv2, eap-peap, and TTLS inner MS-CHAPv2) are compatibility-oriented and carry an NTLMv1-like attack surface. Prefer eap-tls for new deployments where you control client certificates.

Running

# Initialize database
./toughradius -initdb -c toughradius.prod.yml

# Start service
./toughradius -c toughradius.prod.yml

Access Web Management Interface: http://localhost:1816

Default Admin Account:

Username: admin
Password: toughradius

Change the default admin password immediately after first login. For any deployment exposed beyond a local development host, also set web.secret / TOUGHRADIUS_WEB_SECRET to a long random value before starting the service; it signs management API JWTs. Production mode (system.debug=false or logger.mode=production) refuses to start when the built-in placeholder or an empty JWT secret is still configured.

📖 Documentation

📚 Bilingual Handbook (mdbook) - CN/EN documentation site (source in docs-site/) consolidating the overview, security policy, RFC reference, and more; built, link-checked, and deployed to GitHub Pages by CI
Roadmap - Milestones and the EAP suite delivery plan (EAP-TLS / PEAP / TTLS, with TLS 1.3, TEAP, EAP-PWD tracked)
Feature Checklist / English - Product scope baseline for aligning future development with feature IDs and avoiding uncontrolled direction changes
Overview / Concepts & Terminology - Current architecture, service model, and AAA concepts
Admin UI Manual - React Admin management interface, pages, roles, and workflows
Operations Guide - Production configuration, environment variables, SQLite/PostgreSQL storage, backup, and runtime operations
Documentation Map / 中文 - Canonical map for handbook chapters and repository documents

🏗️ Project Structure

toughradius/
├── cmd/             # Application entry points
├── internal/        # Private application code
│   ├── adminapi/   # Admin API (New version)
│   ├── radiusd/    # RADIUS service core
│   ├── domain/     # Data models
│   └── webserver/  # Web server
├── pkg/            # Public libraries
├── web/            # React Admin frontend
└── docs/           # Documentation

🔧 Development

Backend Development

# Run tests
go test ./...

# Run benchmark tests
go test -bench=. ./internal/radiusd/

# Start development mode
go run main.go -c toughradius.yml

Frontend Development

cd web
npm install
npm run dev       # Development server
npm run build     # Production build
npm run lint      # Code linting

🤝 Contribution

We welcome contributions in various forms, including but not limited to:

🐛 Submitting Bug reports and feature requests
📝 Improving documentation
💻 Submitting code patches and new features
🌍 Helping with translation

📜 License

This project is licensed under the MIT License.

Third-Party Resources

The RADIUS dictionary files in the share/ directory are derived from the FreeRADIUS project and are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).

💎 Sponsors

Thanks to JetBrains for supporting this project!

Documentation ¶

There is no documentation for this package.

Source Files ¶

View all Source files

main.go

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
benchmark command Package main provides a command-line tool for benchmarking RADIUS server performance.	Package main provides a command-line tool for benchmarking RADIUS server performance.
certgen command Package main provides a command-line tool for generating TLS/SSL certificates required by ToughRADIUS for RadSec (RADIUS over TLS) and other TLS scenarios.	Package main provides a command-line tool for generating TLS/SSL certificates required by ToughRADIUS for RadSec (RADIUS over TLS) and other TLS scenarios.
config-tool command Package main provides a command-line tool for validating and inspecting ToughRADIUS configuration schema files.	Package main provides a command-line tool for validating and inspecting ToughRADIUS configuration schema files.
demo-seed command
radtest command Package main implements radtest, a simple RADIUS protocol testing client.	Package main implements radtest, a simple RADIUS protocol testing client.
reset-password command
config Package config provides application configuration management for ToughRADIUS.	Package config provides application configuration management for ToughRADIUS.
internal
adminapi Package adminapi implements the ToughRADIUS management REST API served under /api/v1.	Package adminapi implements the ToughRADIUS management REST API served under /api/v1.
app Package app wires ToughRADIUS runtime dependencies and process lifecycle.	Package app wires ToughRADIUS runtime dependencies and process lifecycle.
benchmark Package benchmark provides components for RADIUS server performance testing and benchmarking.	Package benchmark provides components for RADIUS server performance testing and benchmarking.
domain Package domain defines ToughRADIUS persistence models and table registry.	Package domain defines ToughRADIUS persistence models and table registry.
ldapauth Package ldapauth verifies user credentials against an LDAP or Active Directory server with the LDAP Bind operation defined in RFC 4511 section 4.2.	Package ldapauth verifies user credentials against an LDAP or Active Directory server with the LDAP Bind operation defined in RFC 4511 section 4.2.
radiusd Package radiusd implements ToughRADIUS protocol-serving pipelines.	Package radiusd implements ToughRADIUS protocol-serving pipelines.
radiusd/cache Package cache provides lightweight, concurrency-safe in-memory caches used by RADIUS protocol hot paths.	Package cache provides lightweight, concurrency-safe in-memory caches used by RADIUS protocol hot paths.
radiusd/errors Package errors provides unified error types for RADIUS authentication and accounting.	Package errors provides unified error types for RADIUS authentication and accounting.
radiusd/plugins Package plugins wires ToughRADIUS plugin implementations into the runtime registries used by the authentication, accounting, and EAP pipelines.	Package plugins wires ToughRADIUS plugin implementations into the runtime registries used by the authentication, accounting, and EAP pipelines.
radiusd/plugins/accounting Package accounting defines pluggable accounting handlers and shared request context types.	Package accounting defines pluggable accounting handlers and shared request context types.
radiusd/plugins/accounting/handlers Package handlers implements accounting event handlers used by the plugin runner.	Package handlers implements accounting event handlers used by the plugin runner.
radiusd/plugins/auth Package auth defines authentication pipeline interfaces and shared context types.	Package auth defines authentication pipeline interfaces and shared context types.
radiusd/plugins/auth/checkers Package checkers implements post-credential authorization checks in the authentication pipeline.	Package checkers implements post-credential authorization checks in the authentication pipeline.
radiusd/plugins/auth/enhancers Package enhancers implements Access-Accept attribute enrichment for successful authentications.	Package enhancers implements Access-Accept attribute enrichment for successful authentications.
radiusd/plugins/auth/guards Package guards provides pipeline guards that shape authentication response behavior.	Package guards provides pipeline guards that shape authentication response behavior.
radiusd/plugins/auth/validators Package validators implements credential validation handlers for the RADIUS authentication pipeline.	Package validators implements credential validation handlers for the RADIUS authentication pipeline.
radiusd/plugins/eap Package eap provides the shared EAP authentication orchestration layer for ToughRADIUS.	Package eap provides the shared EAP authentication orchestration layer for ToughRADIUS.
radiusd/plugins/eap/handlers Package handlers implements concrete EAP method handlers used by the coordinator in package eap.	Package handlers implements concrete EAP method handlers used by the coordinator in package eap.
radiusd/plugins/eap/statemanager Package statemanager provides EAP state storage implementations.	Package statemanager provides EAP state storage implementations.
radiusd/plugins/eap/tlsengine Package tlsengine drives a server-side TLS handshake for EAP-TLS (RFC 5216) across multiple EAP/RADIUS round-trips.	Package tlsengine drives a server-side TLS handshake for EAP-TLS (RFC 5216) across multiple EAP/RADIUS round-trips.
radiusd/plugins/eap/tlsfragment Package tlsfragment implements EAP-TLS fragmentation and reassembly as defined in RFC 5216 §2.1.5 (EAP-TLS) and the general RADIUS fragmentation considerations in RFC 7499.	Package tlsfragment implements EAP-TLS fragmentation and reassembly as defined in RFC 5216 §2.1.5 (EAP-TLS) and the general RADIUS fragmentation considerations in RFC 7499.
radiusd/plugins/vendorparsers Package vendorparsers defines vendor-specific request/response extension points.	Package vendorparsers defines vendor-specific request/response extension points.
radiusd/plugins/vendorparsers/parsers Package parsers provides vendor parser implementations for the vendorparsers plugin.	Package parsers provides vendor parser implementations for the vendorparsers plugin.
radiusd/registry Package registry is the plugin pipeline registry for the RADIUS server.	Package registry is the plugin pipeline registry for the RADIUS server.
radiusd/repository Package repository defines storage interfaces used by the RADIUS pipeline.	Package repository defines storage interfaces used by the RADIUS pipeline.
radiusd/repository/gorm Package gorm provides GORM-backed implementations of repository interfaces.	Package gorm provides GORM-backed implementations of repository interfaces.
radiusd/vendors Package vendors is the registry of RADIUS vendor definitions.	Package vendors is the registry of RADIUS vendor definitions.
radiusd/vendors/alcatel Package alcatel provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 3041 (the "alcatel" vendor namespace).	Package alcatel provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 3041 (the "alcatel" vendor namespace).
radiusd/vendors/aruba Package aruba provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 14823 (the "aruba" vendor namespace).	Package aruba provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 14823 (the "aruba" vendor namespace).
radiusd/vendors/cisco Package cisco provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 9 (the "cisco" vendor namespace).	Package cisco provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 9 (the "cisco" vendor namespace).
radiusd/vendors/h3c Package h3c provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 25506 (the "h3c" vendor namespace).	Package h3c provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 25506 (the "h3c" vendor namespace).
radiusd/vendors/huawei Package huawei provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 2011 (the "huawei" vendor namespace).	Package huawei provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 2011 (the "huawei" vendor namespace).
radiusd/vendors/ikuai Package ikuai provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 10055 (the "ikuai" vendor namespace).	Package ikuai provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 10055 (the "ikuai" vendor namespace).
radiusd/vendors/juniper Package juniper provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 2636 (the "juniper" vendor namespace).	Package juniper provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 2636 (the "juniper" vendor namespace).
radiusd/vendors/microsoft Package microsoft provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 311 (the "microsoft" vendor namespace).	Package microsoft provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 311 (the "microsoft" vendor namespace).
radiusd/vendors/mikrotik Package mikrotik provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 14988 (the "mikrotik" vendor namespace).	Package mikrotik provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 14988 (the "mikrotik" vendor namespace).
radiusd/vendors/radback Package radback provides a hand-maintained minimal RADIUS dictionary of the Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 2352 (the "radback"/Redback vendor namespace).	Package radback provides a hand-maintained minimal RADIUS dictionary of the Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 2352 (the "radback"/Redback vendor namespace).
radiusd/vendors/zte Package zte provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 3902 (the "zte" vendor namespace).	Package zte provides the generated RADIUS dictionary of Vendor-Specific Attributes (RFC 2865 §5.26) registered under SMI Network Management Private Enterprise Code 3902 (the "zte" vendor namespace).
webserver Package webserver hosts the ToughRADIUS admin HTTP server and middleware.	Package webserver hosts the ToughRADIUS admin HTTP server and middleware.
pkg
certgen Package certgen provides utilities for generating X.509 certificates for RadSec (RADIUS over TLS).	Package certgen provides utilities for generating X.509 certificates for RadSec (RADIUS over TLS).
common Package common provides general-purpose utility functions for the ToughRADIUS server.	Package common provides general-purpose utility functions for the ToughRADIUS server.
excel Package excel exports tabular structs to XLSX files for admin-side data download workflows.	Package excel exports tabular structs to XLSX files for admin-side data download workflows.
metrics Package metrics provides simple in-memory metrics collection.	Package metrics provides simple in-memory metrics collection.
timeutil Package timeutil provides shared time layouts and formatting/parsing helpers used across API handlers, exports, and reporting paths.	Package timeutil provides shared time layouts and formatting/parsing helpers used across API handlers, exports, and reporting paths.
validator Package validator integrates go-playground/validator with Echo and normalizes validation errors into a consistent API payload shape.	Package validator integrates go-playground/validator with Echo and normalizes validation errors into a consistent API payload shape.
validutil Package validutil provides reusable string and format validation helpers used by admin API input checks and domain-level guardrails.	Package validutil provides reusable string and format validation helpers used by admin API input checks and domain-level guardrails.
web Package web provides HTTP-layer helpers shared by the admin web server.	Package web provides HTTP-layer helpers shared by the admin web server.
web Package web embeds and serves the frontend static assets.	Package web embeds and serves the frontend static assets.