How To: Test RADIUS Using radclient on Linux/WSL

Version Affected: All

 

Overview

Testing RADIUS can be difficult, especially with MFA involved. Several utilities can test RADIUS, but not all of them handle MFA easily, and few are command-line driven. Using radclient on a Linux system (including a Windows Subsystem for Linux, or WSL, machine) makes this easier, and it can even be scripted for faster, repeatable testing.

Test RADIUS Using radclient

The examples and screenshots below were taken from a WSL build of Debian 11. This guide assumes WSL (or another Linux machine) is already set up -- see Microsoft's Install WSL guide if it isn't.

Once the Linux distribution is set up, use its package manager to install the freeradius-utils package (the package name may differ on other distributions). On Debian, search for the package name, then install it:

Typing radclient alone in a terminal shows its help. This guide focuses on the -x and -s options, and the auth command:

radclient testing relies on a few basic RADIUS attributes:

• User-Name -- the username being authenticated.
• User-Password -- the password sent during testing, in clear text.
• State -- since RADIUS uses connectionless UDP, this lets the server keep track of a login that's in progress across multiple requests.

Create a RADIUS client specifically for the Linux/WSL machine being used to test. With the client rule set to Password only, run:

echo "User-Name = <username>,User-Password = <password>" | radclient -x -s <RADIUS_SERVER:PORT> auth <shared_secret>

Received Access-Accept and Passed filter : 1 confirm the password-only authentication worked -- the RADIUS server's own logs should show the same successful flow.

Next, change the RADIUS client rule to Password | Second Factor and test MFA, starting with the exact same command:

echo "User-Name = <username>,User-Password = <password>" | radclient -x -s <RADIUS_SERVER:PORT> auth <shared_secret>

This time the response is an Access-Challenge, not an Access-Accept. Continue the request using the State value from that response, with User-Password set to whichever second factor option is being tested: a TOTP code, 1 for SMS/text, or 2 for phone. For example, to choose SMS/text:

echo "State = <state_from_previous_response>,User-Name = <username>,User-Password = 1" | radclient -x -s <RADIUS_SERVER:PORT> auth <shared_secret>

The response asks which phone number to send the code to, so run the same command again with the same State and password to select it:

echo "State = <state_from_previous_response>,User-Name = <username>,User-Password = 1" | radclient -x -s <RADIUS_SERVER:PORT> auth <shared_secret>

Once the OTP arrives by SMS/text, send the same command a final time with that code as the password:

echo "State = <state_from_previous_response>,User-Name = <username>,User-Password = <otp_code>" | radclient -x -s <RADIUS_SERVER:PORT> auth <shared_secret>

Access-Accept and Passed filter : 1 confirm successful authentication with the SMS-delivered OTP.

Special Considerations

This guide is aimed at Linux users testing a RADIUS server setup or configuration. For a Windows alternative, see How To: Test RADIUS Using NTRadPing. Additional attributes can be sent to the RADIUS server -- see FreeRADIUS's RFC attribute lists for the many other options available.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.