AuthHound

RADIUS attribute 18 · type string

Reply-Message

Reply-Message (attribute 18) is free-text the RADIUS server sends back with an accept or reject — the message a user might see, and a place servers stash a reason for a denial.

Also searched as: RADIUS reject reason text. Defined in RFC 2865.

What it means

Reply-Message carries prose meant for a person: a login banner on accept, or a short reason on reject. Multiple Reply-Message attributes concatenate in order. Not every supplicant displays it, and its presence never changes the accept/reject decision — but when it is shown, it's frequently the only outward sign of why access was denied.

How it's used

Use it to surface a human-readable reason on reject where the NAS will display it. Don't rely on it for machine logic — parse the structured attributes instead.

Common gotchas

  • Many 802.1X supplicants discard Reply-Message entirely, so a helpful reject reason set here may never reach the user. The server-side log is the reliable place to read it.

Seeing this attribute in a reject or an accept that behaves wrong? Paste the full log into the analyzer — it runs in your browser, nothing is uploaded, and it ranks the likely causes for your specific output.

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return — early access:

No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.