radtest

radtest sends one Access-Request and prints the answer: Access-Accept with its attributes (a VLAN, a session limit), Access-Reject, or nothing. It must run on a device the server lists as a client, with that client's shared secret; otherwise the server stays silent, which looks just like a server that is down. radclient is the tool underneath: it reads any attributes from its input, so it can send what a real switch sends.

radtest command usage

radtest USER PASSWORD SERVER[:PORT] NAS-PORT SECRET
echo 'User-Name=USER,User-Password=PASSWORD' | radclient [-r TRIES] [-t SECONDS] SERVER auth SECRET

Options

NAS-PORT

radtest: which port of the switch the user is on (0 when it does not matter)

SECRET

the shared secret this client and the server agreed

-r 1 -t 2

radclient: one try, waiting 2 seconds

auth

radclient: send an Access-Request (acct for accounting)

radtest examples

radtest alice correct-horse 10.0.1.11 0 switch-secret

Asks the RADIUS server whether alice's password is right, and prints the attributes of the answer.

radtest alice correct-horse 127.0.0.1 0 testing123

The same question asked on the RADIUS server itself, as its localhost client: rules out the network and the secret.

echo 'User-Name=alice,User-Password=x' | radclient -r 1 -t 2 10.0.1.11 auth switch-secret

Sends one Access-Request and gives up after 2 seconds; exit code 1 when nothing usable came back.

Pitfalls

• No answer is not a reject: the server drops requests from unknown clients and with a wrong shared secret without a word. Its log says which.
• A FreeRADIUS server reads clients.conf and the users file at start: restart it after editing them.