FreeRADIUS - Authenticates about a third of the people on the internet, and has had the same project leader since 1999.

FreeRADIUS was founded in June 1999 by Miquel van Smoorenburg and Alan DeKok, with the first public alpha in August - which is why sources give both months. It was a fork of the Cistron RADIUS server, which van Smoorenburg had written himself and which had been widely adopted for a specific reason: the original RADIUS server had stopped being maintained.

The protocol has a precise origin. In 1991 Merit Network, a non-profit internet provider, needed to manage dial-in access across points of presence run by different organisations. It did not want to distribute usernames and passwords to every remote access server, so it wanted those servers to ask a central one and receive back a yes or a no. Livingston Enterprises built that, and called it Remote Authentication Dial-In User Service.

Livingston is worth a paragraph of its own. Founded in 1986 by Ronald Willens and his son Steven in Pleasanton, California, financed by its founders and then by its own operating profits rather than venture capital, it made the PortMaster access server - which by the mid-1990s held something like two-thirds of the ISP market and served over two thousand providers. It had ninety employees. Lucent acquired it in 1997, and the RADIUS server it had given away stopped being maintained.

That is the gap Cistron filled, and then FreeRADIUS forked Cistron. So the software authenticating a large fraction of the internet today descends, by two forks, from a program written to solve one non-profit's dial-up problem in 1991.

The numbers are the part people do not believe. A survey in November 2006 with over five hundred respondents put daily usage at around a hundred million people - roughly a third of global internet access at the time. More than fifty thousand sites run it, from installations with ten users to ones with over ten million. It underpins eduroam, the roaming authentication network used across universities worldwide. If you have ever connected to campus wireless anywhere in Europe, this is what said yes.

It supports more authentication types than any other open-source RADIUS server, and was for a long time the only open-source one implementing EAP at all - which matters because EAP is what 802.1X wireless authentication runs on. Version 2.0.0 in 2008 added virtual servers, IPv6 and a policy language; 3.0.0 in 2013 added RadSec, carrying RADIUS over TLS, which fixed a protocol whose original transport security was a shared secret and MD5.

And here is why it belongs beside three other entries on this timeline. Tenable closed its open-source scanner in 2005 to fund the company, and was forked. Rapid7 bought an open-source project and kept it open as a commercial differentiator. Elastic closed one, was forked, and reopened it three years later. FreeRADIUS did none of that. It stayed open, and became the thing everyone else builds against. Commercial support exists through a company built around it, which is a different arrangement from selling the software or restricting it.

Alan DeKok has led the project since 1999 - twenty-six years, with a core team that accumulated slowly: Alexander Clouter in 2009, Arran Cudbard-Bell in 2012, Matthew Newton in 2016. On a timeline mostly composed of acquisitions, rebrands and strategic exits, a piece of infrastructure quietly maintained by the same person for a quarter of a century is the genuinely unusual entry.

Founding stories

1999

The FreeRADIUS project

distributed, no headquarters · Founders:

A rewrite rather than a continuation. The stated purpose was a modular design that would let other people contribute without understanding the whole server - which is a decision about the shape of a community expressed as a decision about the shape of a codebase.

The timeline

Version 0.1
Nearly two years after the first alpha. Infrastructure software of this kind is slow to call itself finished, and the first stable release did not arrive until 2004.
Still shipping
Version 3.2.8 in August, twenty-six years after the project began, from the same project leader.

Flagship products and solutions

The serverWritten in C, under version 2 of the GPL, and the reference implementation in practice if not in name - the thing other RADIUS implementations are tested against.
The module setEvery authentication method is a module and every database connector is a module. Adding a new one usually requires no change to the server core at all, which is why it supports more authentication types than anything else in its category.
Vendor dictionariesVendor-specific attributes for more than a hundred manufacturers - Cisco, Juniper, Microsoft, HP, Lucent and the rest. That library is unglamorous, enormous and the reason the server works with equipment nobody involved has ever seen.
The client librariesA BSD-licensed client library, an Apache module and a PAM module, so applications can speak RADIUS without implementing it.

Key innovations

Modularity as a recruitment strategySplitting every authentication method and every storage backend into its own module means a contributor can add support for one thing while understanding only that thing. The design decision is technical; the reason for it was social, and it is why a project with a small core team supports more mechanisms than commercial products with large ones.
One codebase from ten users to ten millionThe same server handles a small office and a national carrier by changing defaults rather than by being a different product. Very little software spans four orders of magnitude of load without forking into editions, and the ones that do tend to end up as infrastructure.
The maintainer who writes the standardThe project leader has co-authored several of the RFCs defining the protocols the server implements. That closes an unusual loop - the person maintaining the most-deployed implementation is also among those specifying what it should do - and it is the arrangement that keeps a thirty-year-old protocol usable.
The same shape as ApacheA widely-used reference implementation stopped being maintained, a stopgap filled the gap, and a modular rewrite became the default for the next quarter century. This timeline records the same sequence at Apache, from the same years, in a different protocol. Abandonment by the original author is a more common origin for durable infrastructure than invention is.

Main markets

Internet providers, universities, enterprises and carriers - anywhere a network has to decide whether to let something on. It sits underneath wireless authentication, VPN access, broadband subscriber management and the roaming federations that let a visitor authenticate against their home institution from another continent.

Its competitors are the commercial policy servers sold by network equipment vendors, which typically integrate more closely with one manufacturer's hardware. The trade is the usual one, and this timeline records it under several other names: depth of integration against independence from any single supplier.

Analyst standing

There is no vendor position to assess. The measure that matters is deployment, and by the project's own survey the figure is around a hundred million daily users - a number worth attributing rather than asserting, since it comes from the project and dates from 2006.
The durable observation is about maintenance rather than innovation. Most software on this timeline changed hands, changed direction or stopped. This one has been maintained continuously by the same person since 1999, and the internet's authentication layer rests on that arrangement more than most people using it realise.

The FreeRADIUS project ↗

From the company

Sources