Section 6.1. radpwtst

6.1. radpwtst

radpwtst is a testing tool that sends requests to a RADIUS server, such as Radiator, and waits for a reply. Use it to send Access-Request, Accounting-Request (Stop and Start), and Status-Server requests. radpwtst checks that your Radiator server, or any other RADIUS server, is configured and behaving correctly, and also for checking if user's password is correct.

By default, radpwtst sends an Access-Request, waits up to 5 seconds for a reply, sends an Accounting-Request (Start), waits for a reply, then sends an Accounting-Request (Stop), and waits for a reply. You can change this behaviour with the command line flags.

Tip

When radpwtst is run with -interactive flag, it queries the password without local echo. This allows you to specify the password without the command line -password option.

Tip

If a Framed-IP-Address is received in an Access Accept, then radpwtst uses the address in subsequent Accounting Starts and Stops, unless the -framed_ip_address flag has been set. This allows simple testing of address allocation modules and such.

Tip

A fundamental requirement of the RADIUS protocol is that the RADIUS Client (in this case radpwtst) and the RADIUS Server (in this case Radiator) must use the same shared secret. If Radiator keeps rejecting your request with a “Bad Password” message, even though you are sure the password is correct, it may be because the shared secrets are not correct. Check the "Secret" line in your Radiator config file, and perhaps use the -secret command line argument to radpwtst. If you do not specify a -secret argument to radpwtst, it uses mysecret by default

The arguments to radpwtst are:

radpwtst  [-h] [-time] [-iterations n] [-iteration_delay f] [-timestamps]
          [-log_microseconds] [-trace [level]] [-notrace] [-onlyfailed] 
          [-print_stats] [-user username] [-password password]
          [-s server] [-secret secret] [-auth_port port] [-acct_port port]
          [-noauth] [-noacct] [-nostart] [-nostop] [-alive] [-status]
          [-chap] [-chap_nc] [-mschap] [-mschapv2] [-sip]
          [-eapmd5] [-eapotp] [-eapgtc] [-eapfastgtc] [-leap]
          [-motp_secret xxxxxxxxxxxxxxxx] [-eaphex xxxxxxxxxxxxx]
          [-interactive] [-code requestcode] [-accton] [-acctoff]
          [-identifier n] [-no_random] [-framed_ip_address address]
          [-state state] [-useoldascendpasswords] [-incrementuser]
          [-nas_ip_address address] [-nas_identifier string]
          [-nas_port port] [-nas_port_type type] [-service_type service]
          [-calling_station_id string] [-called_station_id string]
          [-session_id string] [-session_time n]
          [-delay_time n] [-input_octets n] [-output_octets n]
          [-timeout n] [-noreply] [-retries n] [-dictionary file,file]
          [-class string] [-message_authenticator]
          [-raw data] [-rawfile filename] [-rawfileseq filename]
          [-outport port] [-bind_address address]
          [-options optionfile] [-gui]
          [attribute=value]...

-h
This prints the usage log and exits.
-time
This is an alias for -print_stats.
-iterations n
This sends all the selected requests n times, instead of just once.
-iteration_delay f
This option makes radpwtst to wait for specified amount of time between iterations. For example, when setting iteration_delay to 0.01, radpwtst waits 0.01 seconds between iterations. This option is useful in testing purposes or when packet rate needs to be limited. Note that delay can be specified as float.
-timestamps
This includes a time stamp in announce messages. This option is automatically enabled when iterations is set to a value larger than 1.
-log_microseconds
Using this, the timestamps are logged in microseconds instead of seconds.
-trace [n]
This prints useful trace information, including the full contents of all transmitted and received requests. The default is to print limited information from the reply. Trace level 5 produces hex packet dumps of requests and replies. The trace level is optional and the default value is 1.
-notrace
The trace information is not printed. The default is to print limited information from the reply.
-onlyfailed
This shows only the failed requests.
-print_stats
Using this, radpwtst prints the the statistics of all requests and elapsed time taken to send and receives all iterations when it is finished and calculates packet rate for packets sent.
This is useful for testing purposes, since it measures how fast the RADIUS server handles requests. If Perl Time::HiRes module is available, the elapsed time is printed with sub-second resolution. This module is available in all recent Perl distributions.
To get useful values, the number of iterations must be large enough, for example, 8000.
-user username
This tags the requests with User-Name of username. The default value is mikem.
-password password
In Access-Requests, the password is password. The default value is fred.
-s server
This sends all the requests to the server, which can be either the IP address or the DNS name of the host where the destination RADIUS server runs. The default value is localhost.
-secret secret
This uses secret as the shared secret. The default value is mysecret.
-auth_port port
This is the port to use for authentication requests . The default value is 1645.
-acct_port port
This is the port to use for accounting requests. The default value is 1646.
-noauth
Access-Request is not sent.
-noacct
Accounting-Request is not sent.
-nostart
Accounting-Request Start is not sent.
-nostop
Accounting-Request Stop is not sent.
-alive
This sends an Accounting-Request with Acct-Status-Type of Alive.
-status
This sends a Server-Status. The contents of the reply are printed.

Note

The Status-Server RFC requires Message-Authenticator. In most cases you need the -message_authenticator option also.
-chap
Authentication is done with CHAP, instead of PAP.
-chap_nc
Authenticate with CHAP, instead of PAP, with the CHAP Challenge in the authenticator, and not in a separate CHAP-Challenge attribute.
-mschap
Authentication is done with MSCHAP, instead of PAP or CHAP. Requires Digest-MD4-1.0 or better from CPAN. For more information about CPAN, see Section 2.1.2. CPAN.
-mschapv2
Authentication is done with MSCHAP V2, instead of MSCHAP, PAP or CHAP. This requires Digest-MD4 version 1.1 or better and Digest-SHA version 5.0 or better from CPAN. For more information about CPAN, see Section 2.1.2. CPAN.
-sip
SIP Digest is done authentication as per draft-sterman-aaa-sip-00.txt. This requires special attributes in the additional dictionary.sip in your distribution, so it should be used with -dictionary dictionary,dictionary.sip.
-eapmd5
Authentication is done with EAP-MD5. This usually involves 2 requests being sent to the server. The first is the EAP Identity, the second is the EAP-MD5 response.
-eapotp
Authentication is done with EAP-One Time Password. This usually involves 2 requests being sent to the server. The first is the EAP Identity, the second is the EAP-One Time Password response.
-eapgtc
Authentication is done with EAP-Generic Token Card. This usually involves 2 requests being sent to the server. The first is the EAP Identity, the second is the EAP-Generic Token Card response.
-eapfastgtc
This is similar as -eapgtc argument: authentication is done with EAP-Generic Token Card. This usually involves 2 requests being sent to the server. The first is the EAP Identity, the second is the EAP-Generic Token Card response. However, this uses RFC 5421 EAP-FAST-GTC response format.
-leap
EAP-LEAP authentication is done. This usually involves 3 requests being sent to the server. The first is the EAP Identity, the second is the LEAP client response and the third is the LEAP Access Point Challenge.
-motp_secret xxxxxxxxxxxxxxxx
This makes Mobile OTP request using the password as PIN and motp_secret as the MOTP secret key.
-eaphex xxxxxxxxxxx
This adds an EAP-Message attribute to the request. Argument is the message contents in hex. The correct Message-Authenticator is automatically added.
-interactive
This displays the Reply-Message, reads a new password from STDIN, and sends a new Access-Request, automatically copying any State attribute to the new request. This flag is useful for testing methods like <AuthBy ACE> which use Access-Challenge to prompt the user during a series of steps in an authentication conversation.

This flag is also useful if password needs to be kept secret. When -interactive is set, password is read without local echo.

Requires Perl module Term::Readkey on Windows. Some Unix-based systems are supported directly but Term::ReadKey is recommended for cross platform support.
-code requestcode
This tells radpwtst to send (in addition to any other request required) a RADIUS request with the given code name. Code names such as Ascend-Access-Next-Code, Disconnect- Request and Change-Filter-Request are all supported. Note that -code Status- Server is identical in meaning to -status.
-accton
This sends Accounting-On request.
-acctoff
This sends Accounting-Off request.
-identifier n
This is the identifier number of a single RADIUS packet.
-no_random
This forces radpwtst to use fixed values for RADIUS authenticator with different CHAP methods. This allows repeating tests with known values.
-framed_ip_address address
Access requests are sent with the given Framed-IP-Address. The default value is 0.0.0.0. If the address is 0.0.0.0, it is sent in the request. By default, radpwtst takes notice of any Framed-IP-Address returned in an Access-Accept, and uses it in subsequent Accounting Stops and Starts. Setting -framed_ip_address causes the same address to be used for all Accounting Stops and Starts.
-state state
This adds the string as State attribute.
-useoldascendpasswords
This makes radpwtst to encode passwords using the old (non-RFC compliant) method that Ascend used to use for some NASs. The default is to use RFC2865-compliant algorithm.
-incrementuser
This increments the user name on each round. If the user name on the first round is mikem001, it changes automatically to mikem002 on the second round.
-nas_ip_address address
Access and Accounting requests have NAS-IP-Address of address. The default value is 203.63.154.1.
-nas_identifier identifier
Access and Accounting requests have NAS-Identifier of identifier. The default value is 203.63.154.1.
-nas_port port
Access and Accounting request have NAS-Port of port. The default value is 1234.
-nas_port_type type
Access and Accounting request have NAS-Port-Type of type. The default value is Async.
-service_type service
Access and Accounting request have Service-Type of service. The default value is Framed-User.
-called_station_id string
Access and Accounting requests have Called-Station-Id of string. The default value is 123456789. If set to an empty string, Called-Station-Id is not included in the request.
-calling_station_id string
Access and Accounting requests have Calling-Station-Id of string. The default value is 987654321. If set to an empty string, Calling-Station-Id is not included in the request.
-session_id string
Accounting request has Acct-Session-ID of string. The default value is 00001234.
-session_time n
Accounting request has Acct-Session-Time of n. The default value is 1000.
-delay_time n
Accounting request has Acct-Delay-Time of n. The default value is 0.
-input_octets n
Accounting request has Acct-Input-Octets of n. The default value is 20000.
-output_octets n
Accounting request has Acct-Output-Octets of n. The default value is 30000.
-timeout n
This specifies the time in seconds that radpwtst waits for a reply. The default value is 5 seconds. If you specify 0, it does not wait for a reply at all.
-noreply
When using this, no reply is waited before sending another request.
-retries n
If there is no reply, send up to n retries . The default value is 0 and no retries are sent.
-dictionary file,file
This uses file as the dictionary file. Multiple dictionary files can be specified as comma-separated file names. If -dictionary is not specified, radpwtst loads automatically for the first file that exists from this list ($radpwtstdir is the location where radpwtst resides):
- $radpwtstdir/dictionary
- /etc/radiator/dictionary
- /usr/local/etc/raddb/dictionary
- /usr/local/etc/radiator/dictionary
- /opt/radiator/radiator/dictionary
- C:\Program Files\Radiator\dictionary
-class string
This makes radpwtst to send string as the Class attribute in any accounting requests. Class defaults to the Class returned by any previous access-accepts.
-message_authenticator
This sends a correctly calculated Message-Authenticator attribute with the request.

Note

Some authentication methods already add Message-Authenticator automatically. For example, EAP requires Message-Authenticator.

Note

Trace 4 output shows sent Message-Authenticator before its final value is calculated.
-raw data
This sends raw data literally. An example of suitable raw data is trace 5 packet dump output. White space in the data is ignored.
-rawfile filename
This reads raw data from file called filename and send it literally. Raw data can be split to multiple lines
-rawfileseq filename
Read a sequence of raw data from file called filename and send it literally. The requests are separated with delimiter ‘NewPacket’.
-outport port
This reads radpwtst to send requests from the given port. Port can be a port number or a port service name as used in /etc/services or it equivalent on your system. The default value is 0, meaning allocate a random port.
-bind_address address
This m radpwtst to send requests through the network interface for the given IP address. Requests appear to originate from the specified IP address The default value is 0.0.0.0, which means the default address of the default network interface. If the destination address (such as the -s flag) is an IPv6 address and -bind_address is specified, bind_address must also be an IPv6 address.
-options optionfile
This reads the command line options from the file specified with optionfile. For more information, see Section 6.1.1. radpwtst option file.
-gui
This presents A GUI that allows easy interactive testing. This GUI runs on Unix, it is not yet available on Windows hosts. Requests are sent when the Send button is pressed, and the GUI stays up after the requests have been sent, so you can send more. Requires Perl Tk module.
attribute=value
You can force any number of additional attributes to be sent in each request by naming them with their values on the command line. attribute must be the name of an attribute in your dictionary, and value must be a valid value for that attribute.

6.1. radpwtst

Tip

Tip

Tip

Note

Note

Note