{"id":6811,"library":"pyrad","title":"PyRad RADIUS Library","description":"PyRad is a Python library for implementing RADIUS (Remote Authentication Dial-In User Service) clients and servers. It simplifies handling RADIUS packets, attributes, and dictionaries. The current version is 2.5.4, and the project maintains an active release cadence with minor updates and bug fixes.","status":"active","version":"2.5.4","language":"en","source_language":"en","source_url":"https://github.com/pyradius/pyrad","tags":["RADIUS","network","authentication","client","server","networking"],"install":[{"cmd":"pip install pyrad","lang":"bash","label":"Install stable version"}],"dependencies":[],"imports":[{"note":"Direct import from the submodule is the standard and recommended practice.","wrong":"import pyrad.client; pyrad.client.RadiusClient()","symbol":"RadiusClient","correct":"from pyrad.client import RadiusClient"},{"note":"Direct import from the submodule is the standard and recommended practice.","wrong":"import pyrad.server; pyrad.server.RadiusServer()","symbol":"RadiusServer","correct":"from pyrad.server import RadiusServer"},{"note":"Direct import from the submodule is the standard and recommended practice.","wrong":"import pyrad.dictionary; pyrad.dictionary.Dictionary()","symbol":"Dictionary","correct":"from pyrad.dictionary import Dictionary"},{"symbol":"AccessRequest","correct":"from pyrad.packet import AccessRequest"}],"quickstart":{"code":"import os\nfrom pyrad.client import RadiusClient\nfrom pyrad.packet import AccessRequest\nfrom pyrad.dictionary import Dictionary, getDictionaryPaths\n\n# Pyrad relies on RADIUS dictionaries for attribute definitions.\n# It attempts to find default dictionaries (e.g., in /usr/share/pyrad/dictionaries).\n# For robustness, specify a dictionary path or ensure defaults are installed.\n# In a real app, you might use Dictionary('/etc/raddb/dictionary') or a custom path.\ntry:\n    # Try to load dictionaries from common system paths\n    radius_dict = Dictionary(getDictionaryPaths())\nexcept FileNotFoundError:\n    print(\"Warning: Could not find system RADIUS dictionaries. Using a minimal inline dictionary for example.\")\n    # Fallback to a minimal dictionary for demonstration if no default found.\n    radius_dict = Dictionary({\"RADIUS\": [\n        {\"name\": \"User-Name\", \"type\": \"string\", \"code\": 1},\n        {\"name\": \"User-Password\", \"type\": \"string\", \"code\": 2},\n        {\"name\": \"NAS-IP-Address\", \"type\": \"ipv4addr\", \"code\": 4}\n    ]})\n\n# Configure RADIUS server details (use environment variables for security in real apps)\nRADIUS_SERVER = os.environ.get('RADIUS_SERVER', '127.0.0.1')\nRADIUS_PORT = int(os.environ.get('RADIUS_PORT', '1812'))\nRADIUS_SECRET = os.environ.get('RADIUS_SECRET', 'testing123')\n\ntry:\n    # Initialize the RADIUS client\n    client = RadiusClient(\n        server=RADIUS_SERVER, \n        authport=RADIUS_PORT, \n        secret=RADIUS_SECRET.encode(), \n        dict=radius_dict\n    )\n\n    # Create an Access-Request packet\n    request = client.CreateAuthPacket(code=AccessRequest)\n    request[\"User-Name\"] = \"testuser\"\n    request[\"User-Password\"] = \"testpassword\"\n    request[\"NAS-IP-Address\"] = \"192.168.1.100\"\n\n    print(f\"Sending Access-Request to {RADIUS_SERVER}:{RADIUS_PORT}...\")\n    \n    # Send the packet and wait for a reply\n    reply = client.SendPacket(request)\n\n    if reply:\n        print(f\"Received reply: {reply.code}\")\n        if reply.code == 2:  # Access-Accept\n            print(\"Authentication successful!\")\n        else:\n            print(\"Authentication failed.\")\n        print(\"Reply attributes:\")\n        for attr_name in reply.keys():\n            # Using .get() is safer for potentially multi-valued attributes\n            print(f\"  {attr_name}: {reply.get(attr_name)}\")\n    else:\n        print(\"No reply received from RADIUS server (timeout or network issue).\")\n\nexcept Exception as e:\n    print(f\"An error occurred during RADIUS communication: {e}\")","lang":"python","description":"This quickstart demonstrates how to create a basic RADIUS client using `pyrad` to send an `Access-Request` packet and process the server's reply. It includes robust dictionary loading and environment variable usage for sensitive information like server address and secret."},"warnings":[{"fix":"Ensure your environment uses Python 3.8 or newer. Update your code to be Python 3 compliant, especially around string and byte handling.","message":"Python 2.x support has been completely dropped. If you are migrating from an older `pyrad` version (prior to 2.5.0) that supported Python 2, your code will break.","severity":"breaking","affected_versions":"<2.5.0 to >=2.5.0"},{"fix":"Always explicitly provide a `Dictionary` instance when initializing `RadiusClient` or `RadiusServer`. For example, `Dictionary('/etc/raddb/dictionary')` or `Dictionary(pyrad.dictionary.getDictionaryPaths())` if you expect system-wide dictionaries to be present. Create custom dictionaries if needed.","message":"Pyrad relies on RADIUS dictionaries (`pyrad.dictionary.Dictionary`) to understand attribute types and names. If you don't explicitly provide a dictionary, it attempts to load from common system paths, which might not always exist or contain the specific attributes you need.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Be aware of which client/server implementation you are using. If you need asynchronous I/O, use `pyrad.client_async.RadiusClient` and `pyrad.server_async.RadiusServer` and structure your code with `async`/`await`. Do not mix synchronous and asynchronous APIs directly.","message":"Pyrad introduced asynchronous client and server implementations (`client_async`, `server_async`) in version 2.2 for Python 3.5+. These operate differently from their synchronous counterparts (`client`, `server`) and require `asyncio` patterns.","severity":"gotcha","affected_versions":">=2.2"},{"fix":"Prefer `packet.get('Attribute-Name', 'default')` over `packet['Attribute-Name']`. This prevents `KeyError` if the attribute is missing and handles multi-valued attributes more gracefully.","message":"When accessing attributes from a `Packet` object, using `packet.get(attribute_name, default_value)` is generally safer than direct dictionary-style access (`packet[attribute_name]`). This is especially true for attributes that might be multi-valued or not present.","severity":"gotcha","affected_versions":"All versions (improved `get()` behavior in 2.4)"},{"fix":"Ensure `request.CreateMessageAuthenticator()` is called after all other attributes are added to an outgoing packet. For incoming packets, verify the authenticator using `reply.verifyMessageAuthenticator()` if the server uses it.","message":"The Message-Authenticator (Attribute 80) provides integrity protection for RADIUS packets. If used incorrectly or omitted when required by the RADIUS server/client, packets may be rejected.","severity":"gotcha","affected_versions":"All versions (support added in 2.2)"}],"env_vars":null,"last_verified":"2026-04-15T00:00:00.000Z","next_check":"2026-07-14T00:00:00.000Z","problems":[]}