Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help
RADCLIENT(1)		       FreeRADIUS Daemon		  RADCLIENT(1)

NAME
       radclient - send	packets	to a RADIUS server, show reply

SYNOPSIS
       radclient  [-4]	[-6]  [-b] [-c count] [-d raddb_directory] [-D dictio-
       nary_directory] [-f file] [-F] [-h] [-i id]  [-n	 num_requests_per_sec-
       ond]  [-p  num_requests_in_parallel]  [-q]  [-r	num_retries]  [-s] [-S
       shared_secret_file]  [-t	 timeout]  [-v]	 [-x]  server  {acct|auth|sta-
       tus|coa|disconnect|auto}	secret

DESCRIPTION
       radclient  is  a	 radius	 client	 program. It can send arbitrary	radius
       packets to a radius server, then	shows the reply. It  can  be  used  to
       test  changes you made in the configuration of the radius server, or it
       can be used to monitor if a radius server is up.

       radclient reads radius attribute/value pairs from it standard input, or
       from a file specified on	the command line. It then  encodes  these  at-
       tribute/value  pairs using the dictionary, and sends them to the	remote
       server.

       The User-Password and CHAP-Password attributes  are  automatically  en-
       crypted before the packet is sent to the	server.

OPTIONS
       -4     Use IPv4 (default)

       -6     Use IPv6

       -b     Enforce  the  Blast RADIUS checks.  All replies to an Access-Re-
	      quest packet must	contain	a Message-Authenticator	as  the	 first
	      attribute.

	      For  compatibility with old servers, this	flag is	not set	by de-
	      fault.  However, radclient still checks  for  the	 Blast	RADIUS
	      signature, and discards packets which match the attack.

       -c count
	      Send each	packet count times.

       -d raddb_directory
	      The  directory  that contains the	user dictionary	file. Defaults
	      to /usr/local/share/examples/freeradius/raddb.

       -D dictionary_directory
	      The directory that contains the main dictionary  file.  Defaults
	      to /usr/share/freeradius.

       -f file[:file]
	      File  to	read  the  attribute/value  pairs from.	If this	is not
	      specified, they are read from stdin.  This option	can be	speci-
	      fied  multiple times, in which case packets are sent in order by
	      file, and	within each file, by first packet to last  packet.   A
	      blank  line  separates logical packets within a file.  If	a pair
	      of files separated by a colon is specified, the second file will
	      be used to filter	the responses to requests from the first.  The
	      number  of  requests and filters must be the same.  A summary of
	      filter results will be displayed if -s is	passed.

       -F     Print the	file name, packet number and reply code.

       -h     Print usage help information.

       -i id  Use id as	the RADIUS request Id.

       -n num_requests_per_second
	      Try to send num_requests_per_second, evenly spaced.  This	option
	      allows you to slow down the rate at which	 radclient  sends  re-
	      quests.	When  not  using -n, the default is to send packets as
	      quickly as possible, with	no inter-packet	delays.

	      Due to limitations in radclient, this option does	not accurately
	      send the requested number	of packets per second.

       -p num_requests_in_parallel
	      Send num_requests_in_parallel, without waiting  for  a  response
	      for  each	one.  By default, radclient sends the first request it
	      has read,	waits for the response,	and once the response  is  re-
	      ceived,  sends  the second request in its	list.  This option al-
	      lows you to send many requests at	simultaneously.	 Once  num_re-
	      quests_in_parallel  are sent, radclient waits for	all of the re-
	      sponses to arrive	(or for	the  requests  to  time	 out),	before
	      sending any more packets.

	      This option permits you to discover the maximum load accepted by
	      a	RADIUS server.

       -P proto
	      Use  proto  transport protocol ("tcp" or "udp").	Only available
	      if FreeRADIUS is compiled	with TCP transport support.

       -q     Go to quiet mode,	and do not print out anything.

       -r num_retries
	      Try to send each packet num_retries times, before	giving	up  on
	      it.  The default is 10.

       -s     Print out	some summaries of packets sent and received.

       -S shared_secret_file
	      Rather  than  reading  the  shared  secret from the command-line
	      (where it	can be seen by others on the local  system),  read  it
	      instead from shared_secret_file.

       -t timeout
	      Wait  timeout  seconds  before deciding that the NAS has not re-
	      sponded to a request, and	re-sending the	packet.	  The  default
	      timeout is 3.

       -v     Print out	version	information.

       -x     Print out	debugging information.

       server[:port]
	      The  hostname  or	 IP address of the remote server. Optionally a
	      UDP port can be specified. If no UDP port	is  specified,	it  is
	      looked  up  in  /etc/services.  The  service  name looked	for is
	      radacct for accounting packets, and radius  for  all  other  re-
	      quests.  If  a  service  is not found in /etc/services, 1813 and
	      1812 are used respectively.  For	coa  and  disconnect  packets,
	      port 3799	is used.

	      If  a  host  name	 is  specified,	 then  radclient will do a DNS
	      lookup, and use the A record to find the IP address of  the  RA-
	      DIUS  server.  If	there is no A record, then radclient will look
	      for an AAAA record.  If there is no AAAA record, an  error  will
	      be produced.

	      IPv6  addresses  may  be	specified  by surrounding it in	square
	      brackets.	 For example, [2002:c000:0201:0:0:0:0:0],  or  with  a
	      port, [2002:c000:0201:0:0:0:0:0]:18120.

	      The  RADIUS attributes read by radclient can contain the special
	      attribute	Packet-Dst-IP-Address.	If this	attribute exists, then
	      that IP address is where the packet  is  sent,  and  the	server
	      specified	on the command-line is ignored.

	      If  the RADIUS attribute list always contains the	Packet-Dst-IP-
	      Address attribute, then the server parameter can be given	as -.

	      The RADIUS attributes read by radclient can contain the  special
	      attribute	 Packet-Dst-Port.  If this attribute exists, then that
	      UDP port is where	the packet is sent, and	the :port specified on
	      the command-line is ignored.

       acct | auth | status | coa | disconnect | auto
	      Use auth to send an authentication packet	(Access-Request), acct
	      to send an accounting  packet  (Accounting-Request),  status  to
	      send  a  status packet (Status-Server), or coa to	send a CoA-Re-
	      quest, or	disconnect to send a disconnection request. Instead of
	      these values, you	can also use a decimal code here. For example,
	      code 12 is also Status-Server.

	      The RADIUS attributes read by radclient can contain the  special
	      attribute	Packet-Type.  If this attribute	exists,	then that type
	      of packet	is sent, and the type specified	on the command-line is
	      ignored.

	      If the RADIUS attribute list always contains the Packet-Type at-
	      tribute, then the	type parameter can be given as auto.

       secret The  shared  secret  for this client.  It	needs to be defined on
	      the radius server	side too, for the IP address you  are  sending
	      the radius packets from.

EXAMPLE
       A  sample session that queries the remote server	for Status-Server (not
       all servers support this, but FreeRADIUS	has configurable  support  for
       it).

	      $	echo "Message-Authenticator = 0x00" | radclient	192.0.2.42 status s3cr3t
	      Sending request to server	192.0.2.42, port 1812.
	      radrecv: Packet from host	192.0.2.42 code=2, id=140, length=54
		  Reply-Message	= "FreeRADIUS up 21 days, 02:05"

SEE ALSO
       radiusd(8),

AUTHORS
       Miquel  van Smoorenburg,	miquels@cistron.nl.  Alan DeKok	<aland@freera-
       dius.org>

				  21 May 2024			  RADCLIENT(1)

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=radclient&sektion=1&manpath=FreeBSD+Ports+14.3.quarterly>

home | help